@bopen-io/wallet-toolbox 2.1.21-parity-fix.2 → 2.6.2-brc153.2

package/out/src/WalletPermissionsManager.js

@@ -3,9 +3,10 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.WalletPermissionsManager = void 0;
 const sdk_1 = require("@bsv/sdk");
 const brc114ActionTimeLabels_1 = require("./utility/brc114ActionTimeLabels");
-////// TODO: ADD SUPPORT FOR ADMIN COUNTERPARTIES BASED ON WALLET STORAGE
-//////       PROHIBITION OF SPECIAL OPERATIONS IS ALSO CRITICAL.
-////// !!!!!!!! SECURITY-CRITICAL ADDITION — DO NOT USE UNTIL IMPLEMENTED.
+// Security invariant: only the configured admin originator bypasses permission
+// prompts. Admin-reserved protocols, baskets, and labels are rejected for all
+// other originators; counterparty bypasses require an explicit configuration
+// allowlist.
 function deepEqual(object1, object2) {
     if (object1 === null || object1 === undefined || object2 === null || object2 === undefined) {
         return object1 === object2;
@@ -61,6 +62,72 @@ const BASKET_MAP = {
  *    the old token UTXO and outputs a new one (or none, if fully revoked).
  */
 class WalletPermissionsManager {
+    /** A reference to the BRC-100 wallet instance. */
+    underlying;
+    /** The "admin" domain or FQDN that is implicitly allowed to do everything. */
+    adminOriginator;
+    /**
+     * Event callbacks that external code can subscribe to, e.g. to show a UI prompt
+     * or log events. Each event can have multiple handlers.
+     */
+    callbacks = {
+        onProtocolPermissionRequested: [],
+        onBasketAccessRequested: [],
+        onCertificateAccessRequested: [],
+        onSpendingAuthorizationRequested: [],
+        onGroupedPermissionRequested: [],
+        onCounterpartyPermissionRequested: []
+    };
+    /**
+     * We queue parallel requests for the same resource so that only one
+     * user prompt is created for a single resource. If multiple calls come
+     * in at once for the same "protocol:domain:privileged:counterparty" etc.,
+     * they get merged.
+     *
+     * The key is a string derived from the operation; the value is an object with a reference to the
+     * associated request and an array of pending promise resolve/reject pairs, one for each active
+     * operation that's waiting on the particular resource described by the key.
+     */
+    activeRequests = new Map();
+    /** Cache recently confirmed permissions to avoid repeated lookups. */
+    permissionCache = new Map();
+    recentGrants = new Map();
+    /**
+     * Token mints currently being written on-chain, keyed by permission cache
+     * key. A granted permission is only cached once its token finishes minting
+     * (network seconds); ensures arriving in that window await the in-flight
+     * mint instead of re-prompting the user for a permission they just granted.
+     * Stored promises never reject.
+     */
+    mintsInFlight = new Map();
+    manifestCache = new Map();
+    manifestFetchInProgress = new Map();
+    static MANIFEST_CACHE_TTL_MS = 5 * 60 * 1000;
+    groupedPermissionFlowTail = new Map();
+    pactEstablishedCache = new Map();
+    /**
+     * Parsed BEEF bundles keyed by the raw BEEF array of a `listOutputs`
+     * result, so token scans parse each bundle once instead of once per output.
+     * `null` records a bundle that failed to parse. WeakMap-keyed so entries
+     * are released with their results.
+     */
+    parsedBeefCache = new WeakMap();
+    /** Counts token-field decrypts so long scans can periodically yield. */
+    tokenFieldDecryptCount = 0;
+    /** How long a cached permission remains valid (5 minutes). */
+    static CACHE_TTL_MS = 5 * 60 * 1000;
+    /** Window during which freshly granted permissions are auto-allowed (except spending). */
+    static RECENT_GRANT_COVER_MS = 15 * 1000;
+    /** Default ports used when normalizing originator values. */
+    static DEFAULT_PORTS = {
+        'http:': '80',
+        'https:': '443'
+    };
+    /**
+     * Configuration that determines whether to skip or apply various checks and encryption.
+     */
+    config;
+    telemetry;
     /**
      * Constructs a new Permissions Manager instance.
      *
@@ -69,38 +136,9 @@ class WalletPermissionsManager {
      * @param config                     A set of boolean flags controlling how strictly permissions are enforced
      */
     constructor(underlyingWallet, adminOriginator, config = {}) {
-        /**
-         * Event callbacks that external code can subscribe to, e.g. to show a UI prompt
-         * or log events. Each event can have multiple handlers.
-         */
-        this.callbacks = {
-            onProtocolPermissionRequested: [],
-            onBasketAccessRequested: [],
-            onCertificateAccessRequested: [],
-            onSpendingAuthorizationRequested: [],
-            onGroupedPermissionRequested: [],
-            onCounterpartyPermissionRequested: []
-        };
-        /**
-         * We queue parallel requests for the same resource so that only one
-         * user prompt is created for a single resource. If multiple calls come
-         * in at once for the same "protocol:domain:privileged:counterparty" etc.,
-         * they get merged.
-         *
-         * The key is a string derived from the operation; the value is an object with a reference to the
-         * associated request and an array of pending promise resolve/reject pairs, one for each active
-         * operation that's waiting on the particular resource described by the key.
-         */
-        this.activeRequests = new Map();
-        /** Cache recently confirmed permissions to avoid repeated lookups. */
-        this.permissionCache = new Map();
-        this.recentGrants = new Map();
-        this.manifestCache = new Map();
-        this.manifestFetchInProgress = new Map();
-        this.groupedPermissionFlowTail = new Map();
-        this.pactEstablishedCache = new Map();
         this.underlying = underlyingWallet;
         this.adminOriginator = this.normalizeOriginator(adminOriginator) || adminOriginator;
+        this.telemetry = new sdk_1.Telemetry(config.telemetry);
         // Default all config options to true unless specified
         this.config = {
             seekProtocolPermissionsForSigning: true,
@@ -142,14 +180,13 @@ class WalletPermissionsManager {
      * @returns The transformed response, or null if not a P-basket/protocol (caller should continue normal flow)
      */
     async delegateToPModuleIfNeeded(basketOrProtocolName, method, args, originator, underlyingCall) {
-        var _a;
         // Check if this is a P-protocol/basket
         if (!basketOrProtocolName.startsWith('p ')) {
             return null; // If not, caller should continue normal flow
         }
         const schemeID = basketOrProtocolName.split(' ')[1];
-        const module = (_a = this.config.permissionModules) === null || _a === void 0 ? void 0 : _a[schemeID];
-        if (!module) {
+        const module = this.config.permissionModules?.[schemeID];
+        if (module == null) {
             throw new Error(`Unsupported P-module scheme: p ${schemeID}`);
         }
         // Transform request with module
@@ -170,11 +207,10 @@ class WalletPermissionsManager {
      * Adds a permission module for the given schemeID if needed, throwing if unsupported.
      */
     addPModuleByScheme(schemeID, kind, pModulesByScheme) {
-        var _a;
         if (pModulesByScheme.has(schemeID))
             return;
-        const module = (_a = this.config.permissionModules) === null || _a === void 0 ? void 0 : _a[schemeID];
-        if (!module) {
+        const module = this.config.permissionModules?.[schemeID];
+        if (module == null) {
             throw new Error(`Unsupported P-${kind} scheme: p ${schemeID}`);
         }
         pModulesByScheme.set(schemeID, module);
@@ -198,7 +234,7 @@ class WalletPermissionsManager {
      */
     splitLabelsByPermissionModule(labels, pModulesByScheme) {
         const nonPLabels = [];
-        if (!labels)
+        if (labels == null)
             return nonPLabels;
         for (const label of labels) {
             if (label.startsWith('p ')) {
@@ -233,9 +269,9 @@ class WalletPermissionsManager {
      */
     async decryptListOutputsMetadata(results) {
         if (results.outputs) {
-            for (let i = 0; i < results.outputs.length; i++) {
-                if (results.outputs[i].customInstructions) {
-                    results.outputs[i].customInstructions = await this.maybeDecryptMetadata(results.outputs[i].customInstructions);
+            for (const output of results.outputs) {
+                if (output.customInstructions) {
+                    output.customInstructions = await this.maybeDecryptMetadata(output.customInstructions);
                 }
             }
         }
@@ -246,31 +282,37 @@ class WalletPermissionsManager {
      */
     async decryptListActionsMetadata(results) {
         if (results.actions) {
-            for (let i = 0; i < results.actions.length; i++) {
-                if (results.actions[i].description) {
-                    results.actions[i].description = await this.maybeDecryptMetadata(results.actions[i].description);
-                }
-                if (results.actions[i].inputs) {
-                    for (let j = 0; j < results.actions[i].inputs.length; j++) {
-                        if (results.actions[i].inputs[j].inputDescription) {
-                            results.actions[i].inputs[j].inputDescription = await this.maybeDecryptMetadata(results.actions[i].inputs[j].inputDescription);
-                        }
-                    }
-                }
-                if (results.actions[i].outputs) {
-                    for (let j = 0; j < results.actions[i].outputs.length; j++) {
-                        if (results.actions[i].outputs[j].outputDescription) {
-                            results.actions[i].outputs[j].outputDescription = await this.maybeDecryptMetadata(results.actions[i].outputs[j].outputDescription);
-                        }
-                        if (results.actions[i].outputs[j].customInstructions) {
-                            results.actions[i].outputs[j].customInstructions = await this.maybeDecryptMetadata(results.actions[i].outputs[j].customInstructions);
-                        }
-                    }
-                }
+            for (const action of results.actions) {
+                await this.decryptSingleActionMetadata(action);
             }
         }
         return results;
     }
+    async decryptSingleActionMetadata(action) {
+        if (action.description) {
+            action.description = await this.maybeDecryptMetadata(action.description);
+        }
+        if (action.inputs != null) {
+            for (const input of action.inputs) {
+                if (input.inputDescription) {
+                    input.inputDescription = await this.maybeDecryptMetadata(input.inputDescription);
+                }
+            }
+        }
+        if (action.outputs != null) {
+            for (const output of action.outputs) {
+                await this.decryptActionOutputMetadata(output);
+            }
+        }
+    }
+    async decryptActionOutputMetadata(output) {
+        if (output.outputDescription) {
+            output.outputDescription = await this.maybeDecryptMetadata(output.outputDescription);
+        }
+        if (output.customInstructions) {
+            output.customInstructions = await this.maybeDecryptMetadata(output.customInstructions);
+        }
+    }
     /* ---------------------------------------------------------------------
      *  1) PUBLIC API FOR REGISTERING CALLBACKS (UI PROMPTS, LOGGING, ETC.)
      * --------------------------------------------------------------------- */
@@ -295,7 +337,7 @@ class WalletPermissionsManager {
      * @returns          True if successfully unbound, false otherwise
      */
     unbindCallback(eventName, reference) {
-        if (!this.callbacks[eventName])
+        if (this.callbacks[eventName] == null)
             return false;
         const arr = this.callbacks[eventName];
         if (typeof reference === 'number') {
@@ -324,13 +366,26 @@ class WalletPermissionsManager {
      */
     async callEvent(eventName, param) {
         const arr = this.callbacks[eventName] || [];
-        for (const cb of arr) {
+        for (const [callbackIndex, cb] of arr.entries()) {
             if (typeof cb === 'function') {
                 try {
-                    await cb(param);
+                    if (this.telemetry.enabled && typeof param === 'object' && param != null) {
+                        await this.telemetry.withSpan('wallet.permission.callback', {
+                            component: 'wallet-permissions',
+                            carrier: param,
+                            attributes: {
+                                'permission.callback': eventName,
+                                'permission.callback_index': callbackIndex
+                            }
+                        }, async () => await cb(param));
+                    }
+                    else {
+                        await cb(param);
+                    }
                 }
-                catch (e) {
-                    // Intentionally swallow errors from user-provided callbacks
+                catch {
+                    // Intentionally swallow errors from user-provided callbacks to prevent
+                    // a misbehaving callback from disrupting the event dispatch loop.
                 }
             }
         }
@@ -350,7 +405,7 @@ class WalletPermissionsManager {
     async grantPermission(params) {
         // 1) Identify the matching queued requests in `activeRequests`
         const matching = this.activeRequests.get(params.requestID);
-        if (!matching) {
+        if (matching == null) {
             throw new Error('Request ID not found.');
         }
         // 2) Mark all matching requests as resolved, deleting the entry
@@ -359,26 +414,45 @@ class WalletPermissionsManager {
         }
         this.activeRequests.delete(params.requestID);
         // 3) If `ephemeral !== true`, we create or renew an on-chain token
-        if (!params.ephemeral) {
-            const request = matching.request;
-            if (!request.renewal) {
-                // brand-new permission token
-                await this.createPermissionOnChain(request, params.expiry || 0, // default: never expires
-                params.amount);
-            }
-            else {
-                // renewal => spend the old token, produce a new one
-                await this.renewPermissionOnChain(request.previousToken, request, params.expiry || 0, // default: never expires
-                params.amount);
-            }
-        }
         // Only cache non-ephemeral permissions
         // Ephemeral permissions should not be cached as they are one-time authorizations
         if (!params.ephemeral) {
+            const request = matching.request;
             const expiry = params.expiry || 0; // default: never expires
-            const key = this.buildRequestKey(matching.request);
+            const key = this.buildRequestKey(request);
+            // Several first-contact prompts for the same permission can stack up
+            // before any token exists (e.g. one per usage type). Granting them all
+            // should yield ONE token: if an identical non-renewal grant just minted
+            // (or is minting), don't mint a duplicate. Spending authorizations are
+            // excluded — their tokens carry amounts, so every grant is honored.
+            let skipDuplicateMint = !request.renewal &&
+                request.type !== 'spending' &&
+                (this.isPermissionCached(key) || this.isRecentlyGranted(key) || this.mintsInFlight.has(key));
+            if (skipDuplicateMint) {
+                const inFlight = this.mintsInFlight.get(key);
+                if (inFlight != null) {
+                    await inFlight;
+                    // The awaited mint may have failed; only skip if it landed.
+                    skipDuplicateMint = this.isPermissionCached(key) || this.isRecentlyGranted(key);
+                }
+            }
+            if (!skipDuplicateMint) {
+                const mint = request.renewal
+                    ? this.renewPermissionOnChain(request.previousToken, request, expiry, params.amount)
+                    : this.createPermissionOnChain(request, expiry, params.amount);
+                // Publish the in-flight mint so concurrent ensures for the same
+                // permission wait for it instead of re-prompting (stored promise
+                // never rejects; failures still propagate to this caller below).
+                this.mintsInFlight.set(key, mint.then(() => { }, () => { }));
+                try {
+                    await mint;
+                }
+                finally {
+                    this.mintsInFlight.delete(key);
+                }
+            }
             this.cachePermission(key, expiry);
-            this.markRecentGrant(matching.request);
+            this.markRecentGrant(request);
         }
     }
     /**
@@ -390,12 +464,16 @@ class WalletPermissionsManager {
     async denyPermission(requestID) {
         // 1) Identify the matching requests
         const matching = this.activeRequests.get(requestID);
-        if (!matching) {
+        if (matching == null) {
             throw new Error('Request ID not found.');
         }
         // 2) Reject all matching requests, deleting the entry
+        // Denials carry the canonical machine-readable code so applications can
+        // distinguish user denial from other failures (matches denyActiveRequest).
+        const err = new Error('Permission denied.');
+        err.code = 'ERR_PERMISSION_DENIED';
         for (const x of matching.pending) {
-            x.reject(new Error('Permission denied.'));
+            x.reject(err);
         }
         this.activeRequests.delete(requestID);
     }
@@ -406,33 +484,19 @@ class WalletPermissionsManager {
      * @param params.expiry An optional expiry time (in seconds) for the new permission tokens.
      */
     async grantGroupedPermission(params) {
-        var _a, _b, _c;
         const matching = this.activeRequests.get(params.requestID);
-        if (!matching) {
+        if (matching == null) {
             throw new Error('Request ID not found.');
         }
         try {
             const originalRequest = matching.request;
             const { originator, permissions: requestedPermissions, displayOriginator } = originalRequest;
             const originLookupValues = this.buildOriginatorLookupValues(displayOriginator, originator);
-            // --- Validation: Ensure granted permissions are a subset of what was requested ---
-            if (params.granted.spendingAuthorization && !requestedPermissions.spendingAuthorization) {
-                throw new Error('Granted spending authorization was not part of the original request.');
-            }
-            if ((_a = params.granted.protocolPermissions) === null || _a === void 0 ? void 0 : _a.some(g => { var _a; return !((_a = requestedPermissions.protocolPermissions) === null || _a === void 0 ? void 0 : _a.find(r => deepEqual(r, g))); })) {
-                throw new Error('Granted protocol permissions are not a subset of the original request.');
-            }
-            if ((_b = params.granted.basketAccess) === null || _b === void 0 ? void 0 : _b.some(g => { var _a; return !((_a = requestedPermissions.basketAccess) === null || _a === void 0 ? void 0 : _a.find(r => deepEqual(r, g))); })) {
-                throw new Error('Granted basket access permissions are not a subset of the original request.');
-            }
-            if ((_c = params.granted.certificateAccess) === null || _c === void 0 ? void 0 : _c.some(g => { var _a; return !((_a = requestedPermissions.certificateAccess) === null || _a === void 0 ? void 0 : _a.find(r => deepEqual(r, g))); })) {
-                throw new Error('Granted certificate access permissions are not a subset of the original request.');
-            }
-            // --- End Validation ---
+            this.validateGrantedPermissionsSubset(params.granted, requestedPermissions);
             const expiry = params.expiry || 0; // default: never expires
             const toCreate = [];
             const toRenew = [];
-            if (params.granted.spendingAuthorization) {
+            if (params.granted.spendingAuthorization != null) {
                 toCreate.push({
                     request: {
                         type: 'spending',
@@ -446,8 +510,7 @@ class WalletPermissionsManager {
             }
             const grantedProtocols = params.granted.protocolPermissions || [];
             const protocolTokens = await this.mapWithConcurrency(grantedProtocols, 8, async (p) => {
-                var _a, _b;
-                const counterparty = ((_b = (_a = p.protocolID) === null || _a === void 0 ? void 0 : _a[0]) !== null && _b !== void 0 ? _b : 0) === 1 ? '' : p.counterparty || 'self';
+                const counterparty = (p.protocolID?.[0] ?? 0) === 1 ? '' : p.counterparty || 'self';
                 const token = await this.findProtocolToken(originator, false, p.protocolID, counterparty, true, originLookupValues);
                 return { p, token, counterparty };
             });
@@ -460,11 +523,11 @@ class WalletPermissionsManager {
                     counterparty,
                     reason: p.description
                 };
-                if (token) {
-                    toRenew.push({ oldToken: token, request, expiry });
+                if (token == null) {
+                    toCreate.push({ request, expiry });
                 }
                 else {
-                    toCreate.push({ request, expiry });
+                    toRenew.push({ oldToken: token, request, expiry });
                 }
             }
             for (const b of params.granted.basketAccess || []) {
@@ -515,9 +578,27 @@ class WalletPermissionsManager {
      * Denies a previously requested grouped permission.
      * @param requestID The ID of the request being denied.
      */
-    async denyGroupedPermission(requestID) {
+    /**
+     * Validates that every entry in `granted` was part of the original `requested` set.
+     * Throws an error on the first mismatch.
+     */
+    validateGrantedPermissionsSubset(granted, requested) {
+        if (granted.spendingAuthorization != null && requested.spendingAuthorization == null) {
+            throw new Error('Granted spending authorization was not part of the original request.');
+        }
+        if (granted.protocolPermissions?.some(g => requested.protocolPermissions?.find(r => deepEqual(r, g)) == null)) {
+            throw new Error('Granted protocol permissions are not a subset of the original request.');
+        }
+        if (granted.basketAccess?.some(g => requested.basketAccess?.find(r => deepEqual(r, g)) == null)) {
+            throw new Error('Granted basket access permissions are not a subset of the original request.');
+        }
+        if (granted.certificateAccess?.some(g => requested.certificateAccess?.find(r => deepEqual(r, g)) == null)) {
+            throw new Error('Granted certificate access permissions are not a subset of the original request.');
+        }
+    }
+    denyActiveRequest(requestID) {
         const matching = this.activeRequests.get(requestID);
-        if (!matching) {
+        if (matching == null) {
             throw new Error('Request ID not found.');
         }
         const err = new Error('The user has denied the request for permission.');
@@ -527,9 +608,12 @@ class WalletPermissionsManager {
         }
         this.activeRequests.delete(requestID);
     }
+    async denyGroupedPermission(requestID) {
+        this.denyActiveRequest(requestID);
+    }
     async dismissGroupedPermission(requestID) {
         const matching = this.activeRequests.get(requestID);
-        if (!matching) {
+        if (matching == null) {
             throw new Error('Request ID not found.');
         }
         for (const p of matching.pending) {
@@ -538,9 +622,8 @@ class WalletPermissionsManager {
         this.activeRequests.delete(requestID);
     }
     async grantCounterpartyPermission(params) {
-        var _a;
         const matching = this.activeRequests.get(params.requestID);
-        if (!matching) {
+        if (matching == null) {
             throw new Error('Request ID not found.');
         }
         const originalRequest = matching.request;
@@ -555,7 +638,7 @@ class WalletPermissionsManager {
                 return p.protocolID[1];
             return undefined;
         };
-        if ((_a = params.granted.protocols) === null || _a === void 0 ? void 0 : _a.some(g => {
+        if (params.granted.protocols?.some(g => {
             const gName = getProtoName(g);
             if (!gName)
                 return true;
@@ -585,11 +668,11 @@ class WalletPermissionsManager {
                 counterparty,
                 reason: p.description
             };
-            if (token) {
-                toRenew.push({ oldToken: token, request, expiry });
+            if (token == null) {
+                toCreate.push({ request, expiry });
             }
             else {
-                toCreate.push({ request, expiry });
+                toRenew.push({ oldToken: token, request, expiry });
             }
         }
         const created = await this.createPermissionTokensBestEffort(toCreate);
@@ -603,16 +686,7 @@ class WalletPermissionsManager {
         this.activeRequests.delete(params.requestID);
     }
     async denyCounterpartyPermission(requestID) {
-        const matching = this.activeRequests.get(requestID);
-        if (!matching) {
-            throw new Error('Request ID not found.');
-        }
-        const err = new Error('The user has denied the request for permission.');
-        err.code = 'ERR_PERMISSION_DENIED';
-        for (const p of matching.pending) {
-            p.reject(err);
-        }
-        this.activeRequests.delete(requestID);
+        this.denyActiveRequest(requestID);
     }
     /* ---------------------------------------------------------------------
      *  3) THE "ENSURE" METHODS: CHECK IF PERMISSION EXISTS, OTHERWISE PROMPT
@@ -627,88 +701,50 @@ class WalletPermissionsManager {
         // 1) adminOriginator can do anything
         if (this.isAdminOriginator(originator))
             return true;
-        // 2) If security level=0, we consider it "open" usage
+        // 2) If security level=0, we consider it “open” usage
         const [level, protoName] = protocolID;
         if (level === 0)
             return true;
-        if (level === 1) {
+        if (level === 1)
             counterparty = '';
-        }
         // 3) If protocol is admin-reserved, block
         if (this.isAdminProtocol(protocolID)) {
             throw new Error(`Protocol “${protoName}” is admin-only.`);
         }
         // Allow the configured exceptions.
-        if (usageType === 'signing' && !this.config.seekProtocolPermissionsForSigning) {
-            return true;
-        }
-        if (usageType === 'encrypting' && !this.config.seekProtocolPermissionsForEncrypting) {
-            return true;
-        }
-        if (usageType === 'hmac' && !this.config.seekProtocolPermissionsForHMAC) {
+        if (this.isProtocolUsageTypeExempted(usageType))
             return true;
-        }
-        if (usageType === 'publicKey' && !this.config.seekPermissionsForPublicKeyRevelation) {
-            return true;
-        }
-        if (usageType === 'identityKey' && !this.config.seekPermissionsForIdentityKeyRevelation) {
-            return true;
-        }
-        if (usageType === 'linkageRevelation' && !this.config.seekPermissionsForKeyLinkageRevelation) {
-            return true;
-        }
-        if (!this.config.differentiatePrivilegedOperations) {
+        if (!this.config.differentiatePrivilegedOperations)
             privileged = false;
-        }
-        if (!privileged && this.isWhitelistedCounterpartyProtocol(counterparty, protocolID)) {
-            return true;
-        }
-        const cacheKey = this.buildRequestKey({
-            type: 'protocol',
-            originator,
-            privileged,
-            protocolID,
-            counterparty
-        });
-        if (this.isPermissionCached(cacheKey)) {
+        if (!privileged && this.isWhitelistedCounterpartyProtocol(counterparty, protocolID))
             return true;
-        }
-        if (this.isRecentlyGranted(cacheKey)) {
+        const cacheKey = this.buildRequestKey({ type: 'protocol', originator, privileged, protocolID, counterparty });
+        if (await this.hasRecentOrPendingGrant(cacheKey))
             return true;
-        }
         // 4) Attempt to find a valid token in the internal basket
         const token = await this.findProtocolToken(originator, privileged, protocolID, counterparty, 
-        /*includeExpired=*/ true, lookupValues);
-        if (token) {
-            if (!this.isTokenExpired(token.expiry)) {
-                // valid and unexpired
-                this.cachePermission(cacheKey, token.expiry);
-                return true;
-            }
-            else {
-                // has a token but expired => request renewal if allowed
-                if (!seekPermission) {
-                    throw new Error(`Protocol permission expired and no further user consent allowed (seekPermission=false).`);
-                }
-                return await this.requestPermissionFlow({
-                    type: 'protocol',
-                    originator,
-                    privileged,
-                    protocolID,
-                    counterparty,
-                    usageType,
-                    reason,
-                    renewal: true,
-                    previousToken: token
-                });
-            }
-        }
-        else {
+        /* includeExpired= */ true, lookupValues);
+        if (token == null) {
             // No token found => request a new one if allowed
+            if (!seekPermission)
+                throw new Error('No protocol permission token found (seekPermission=false).');
+            return await this.requestPermissionFlow({
+                type: 'protocol',
+                originator,
+                privileged,
+                protocolID,
+                counterparty,
+                usageType,
+                reason,
+                renewal: false
+            });
+        }
+        if (this.isTokenExpired(token.expiry)) {
+            // has a token but expired => request renewal if allowed
             if (!seekPermission) {
-                throw new Error(`No protocol permission token found (seekPermission=false).`);
+                throw new Error('Protocol permission expired and no further user consent allowed (seekPermission=false).');
             }
-            const granted = await this.requestPermissionFlow({
+            return await this.requestPermissionFlow({
                 type: 'protocol',
                 originator,
                 privileged,
@@ -716,10 +752,13 @@ class WalletPermissionsManager {
                 counterparty,
                 usageType,
                 reason,
-                renewal: false
+                renewal: true,
+                previousToken: token
             });
-            return granted;
         }
+        // valid and unexpired
+        this.cachePermission(cacheKey, token.expiry);
+        return true;
     }
     /**
      * Ensures the originator has basket usage permission for the specified basket.
@@ -730,58 +769,44 @@ class WalletPermissionsManager {
         originator = normalizedOriginator;
         if (this.isAdminOriginator(originator))
             return true;
-        if (this.isAdminBasket(basket)) {
+        if (this.isAdminBasket(basket))
             throw new Error(`Basket “${basket}” is admin-only.`);
-        }
-        if (usageType === 'insertion' && !this.config.seekBasketInsertionPermissions)
-            return true;
-        if (usageType === 'removal' && !this.config.seekBasketRemovalPermissions)
-            return true;
-        if (usageType === 'listing' && !this.config.seekBasketListingPermissions)
+        if (!this.isBasketUsageRequired(usageType))
             return true;
         const cacheKey = this.buildRequestKey({ type: 'basket', originator, basket });
-        if (this.isPermissionCached(cacheKey)) {
-            return true;
-        }
-        if (this.isRecentlyGranted(cacheKey)) {
+        if (await this.hasRecentOrPendingGrant(cacheKey))
             return true;
-        }
         const token = await this.findBasketToken(originator, basket, true, lookupValues);
-        if (token) {
-            if (!this.isTokenExpired(token.expiry)) {
-                this.cachePermission(cacheKey, token.expiry);
-                return true;
-            }
-            else {
-                if (!seekPermission) {
-                    throw new Error(`Basket permission expired (seekPermission=false).`);
-                }
-                return await this.requestPermissionFlow({
-                    type: 'basket',
-                    originator,
-                    basket,
-                    usageType,
-                    reason,
-                    renewal: true,
-                    previousToken: token
-                });
-            }
-        }
-        else {
-            // none
-            if (!seekPermission) {
-                throw new Error(`No basket permission found, and no user consent allowed (seekPermission=false).`);
-            }
-            const granted = await this.requestPermissionFlow({
+        if (token == null) {
+            if (!seekPermission)
+                throw new Error('No basket permission found, and no user consent allowed (seekPermission=false).');
+            return await this.requestPermissionFlow({ type: 'basket', originator, basket, usageType, reason, renewal: false });
+        }
+        if (this.isTokenExpired(token.expiry)) {
+            if (!seekPermission)
+                throw new Error('Basket permission expired (seekPermission=false).');
+            return await this.requestPermissionFlow({
                 type: 'basket',
                 originator,
                 basket,
                 usageType,
                 reason,
-                renewal: false
+                renewal: true,
+                previousToken: token
             });
-            return granted;
         }
+        this.cachePermission(cacheKey, token.expiry);
+        return true;
+    }
+    /** Returns false when the basket usageType does NOT need a permission check (config-gated). */
+    isBasketUsageRequired(usageType) {
+        if (usageType === 'insertion' && !this.config.seekBasketInsertionPermissions)
+            return false;
+        if (usageType === 'removal' && !this.config.seekBasketRemovalPermissions)
+            return false;
+        if (usageType === 'listing' && !this.config.seekBasketListingPermissions)
+            return false;
+        return true;
     }
     /**
      * Ensures the originator has a valid certificate permission.
@@ -804,50 +829,42 @@ class WalletPermissionsManager {
             privileged,
             certificate: { verifier, certType, fields }
         });
-        if (this.isPermissionCached(cacheKey)) {
-            return true;
-        }
-        if (this.isRecentlyGranted(cacheKey)) {
+        if (await this.hasRecentOrPendingGrant(cacheKey)) {
             return true;
         }
         const token = await this.findCertificateToken(originator, privileged, verifier, certType, fields, 
-        /*includeExpired=*/ true, lookupValues);
-        if (token) {
-            if (!this.isTokenExpired(token.expiry)) {
-                this.cachePermission(cacheKey, token.expiry);
-                return true;
-            }
-            else {
-                if (!seekPermission) {
-                    throw new Error(`Certificate permission expired (seekPermission=false).`);
-                }
-                return await this.requestPermissionFlow({
-                    type: 'certificate',
-                    originator,
-                    privileged,
-                    certificate: { verifier, certType, fields },
-                    usageType,
-                    reason,
-                    renewal: true,
-                    previousToken: token
-                });
+        /* includeExpired= */ true, lookupValues);
+        if (token == null) {
+            if (!seekPermission) {
+                throw new Error('No certificate permission found (seekPermission=false).');
             }
+            return await this.requestPermissionFlow({
+                type: 'certificate',
+                originator,
+                privileged,
+                certificate: { verifier, certType, fields },
+                usageType,
+                reason,
+                renewal: false
+            });
         }
-        else {
+        if (this.isTokenExpired(token.expiry)) {
             if (!seekPermission) {
-                throw new Error(`No certificate permission found (seekPermission=false).`);
+                throw new Error('Certificate permission expired (seekPermission=false).');
             }
-            const granted = await this.requestPermissionFlow({
+            return await this.requestPermissionFlow({
                 type: 'certificate',
                 originator,
                 privileged,
                 certificate: { verifier, certType, fields },
                 usageType,
                 reason,
-                renewal: false
+                renewal: true,
+                previousToken: token
             });
-            return granted;
         }
+        this.cachePermission(cacheKey, token.expiry);
+        return true;
     }
     /**
      * Ensures the originator has spending authorization (DSAP) for a certain satoshi amount.
@@ -863,11 +880,14 @@ class WalletPermissionsManager {
             return true;
         }
         const cacheKey = this.buildRequestKey({ type: 'spending', originator, spending: { satoshis } });
-        if (this.isPermissionCached(cacheKey)) {
+        // Spending keys are amount-scoped. The recent-grant window this adds sits
+        // inside the pre-existing permissionCache window grantPermission already
+        // wrote for spending, so accounting exposure is unchanged.
+        if (await this.hasRecentOrPendingGrant(cacheKey)) {
             return true;
         }
         const token = await this.findSpendingToken(originator, lookupValues);
-        if (token === null || token === void 0 ? void 0 : token.authorizedAmount) {
+        if (token?.authorizedAmount) {
             // Check how much has been spent so far
             const spentSoFar = await this.querySpentSince(token);
             if (spentSoFar + satoshis <= token.authorizedAmount) {
@@ -892,7 +912,7 @@ class WalletPermissionsManager {
         else {
             // no token
             if (!seekPermission) {
-                throw new Error(`No spending authorization found, (seekPermission=false).`);
+                throw new Error('No spending authorization found, (seekPermission=false).');
             }
             return await this.requestPermissionFlow({
                 type: 'spending',
@@ -944,9 +964,27 @@ class WalletPermissionsManager {
             usageType: 'generic'
         });
     }
+    /**
+     * Returns true when the given usageType is configured to skip permission checks.
+     */
+    isProtocolUsageTypeExempted(usageType) {
+        if (usageType === 'signing' && !this.config.seekProtocolPermissionsForSigning)
+            return true;
+        if (usageType === 'encrypting' && !this.config.seekProtocolPermissionsForEncrypting)
+            return true;
+        if (usageType === 'hmac' && !this.config.seekProtocolPermissionsForHMAC)
+            return true;
+        if (usageType === 'publicKey' && !this.config.seekPermissionsForPublicKeyRevelation)
+            return true;
+        if (usageType === 'identityKey' && !this.config.seekPermissionsForIdentityKeyRevelation)
+            return true;
+        if (usageType === 'linkageRevelation' && !this.config.seekPermissionsForKeyLinkageRevelation)
+            return true;
+        return false;
+    }
     isProtocolInCounterpartyPermissions(protocolID, counterpartyPermissions) {
         const [, name] = protocolID;
-        return !!counterpartyPermissions.protocols.find(p => p.protocolName === name);
+        return counterpartyPermissions.protocols.some(p => p.protocolName === name);
     }
     validateCounterpartyPermissions(raw) {
         if (!raw || !Array.isArray(raw.protocols) || raw.protocols.length === 0)
@@ -969,23 +1007,22 @@ class WalletPermissionsManager {
         };
         const validProtocols = raw.protocols
             .map((p) => {
-            var _a, _b;
             const protocolName = getCI(p, 'protocolName');
             if (typeof protocolName === 'string') {
                 return {
                     protocolName,
                     protocolID: [2, protocolName],
-                    description: typeof (p === null || p === void 0 ? void 0 : p.description) === 'string' ? p.description : undefined
+                    description: typeof p?.description === 'string' ? p.description : undefined
                 };
             }
-            const protocolIdRaw = (_b = (_a = getCI(p, 'protocolID')) !== null && _a !== void 0 ? _a : getCI(p, 'protocolId')) !== null && _b !== void 0 ? _b : getCI(p, 'protocolid');
+            const protocolIdRaw = getCI(p, 'protocolID') ?? getCI(p, 'protocolId') ?? getCI(p, 'protocolid');
             const parsed = parseProtocolId(protocolIdRaw);
             if (!parsed)
                 return null;
             return {
                 protocolName: parsed,
                 protocolID: [2, parsed],
-                description: typeof (p === null || p === void 0 ? void 0 : p.description) === 'string' ? p.description : undefined
+                description: typeof p?.description === 'string' ? p.description : undefined
             };
         })
             .filter(Boolean);
@@ -998,15 +1035,15 @@ class WalletPermissionsManager {
     }
     async fetchManifestPermissions(originator) {
         const cached = this.manifestCache.get(originator);
-        if (cached && Date.now() - cached.fetchedAt < WalletPermissionsManager.MANIFEST_CACHE_TTL_MS) {
+        if (cached != null && Date.now() - cached.fetchedAt < WalletPermissionsManager.MANIFEST_CACHE_TTL_MS) {
             return {
                 groupPermissions: cached.groupPermissions,
                 counterpartyPermissions: cached.counterpartyPermissions
             };
         }
         const inProgress = this.manifestFetchInProgress.get(originator);
-        if (inProgress) {
-            return inProgress;
+        if (inProgress != null) {
+            return await inProgress;
         }
         const fetchPromise = (async () => {
             try {
@@ -1014,9 +1051,9 @@ class WalletPermissionsManager {
                 const response = await fetch(`${proto}://${originator}/manifest.json`);
                 if (response.ok) {
                     const manifest = await response.json();
-                    const namespace = (manifest === null || manifest === void 0 ? void 0 : manifest.metanet) || (manifest === null || manifest === void 0 ? void 0 : manifest.babbage);
-                    const groupPermissions = (namespace === null || namespace === void 0 ? void 0 : namespace.groupPermissions) || null;
-                    const counterpartyPermissionsDeclared = this.validateCounterpartyPermissions(namespace === null || namespace === void 0 ? void 0 : namespace.counterpartyPermissions);
+                    const namespace = manifest?.metanet || manifest?.babbage;
+                    const groupPermissions = namespace?.groupPermissions || null;
+                    const counterpartyPermissionsDeclared = this.validateCounterpartyPermissions(namespace?.counterpartyPermissions);
                     this.manifestCache.set(originator, {
                         groupPermissions,
                         counterpartyPermissions: counterpartyPermissionsDeclared,
@@ -1025,7 +1062,9 @@ class WalletPermissionsManager {
                     return { groupPermissions, counterpartyPermissions: counterpartyPermissionsDeclared };
                 }
             }
-            catch (e) { }
+            catch {
+                // Manifest fetch or parse failed — fall through to return null/null defaults below
+            }
             const result = { groupPermissions: null, counterpartyPermissions: null };
             this.manifestCache.set(originator, { ...result, fetchedAt: Date.now() });
             return result;
@@ -1051,17 +1090,18 @@ class WalletPermissionsManager {
         };
         const [spendingAuthorization, protocolPermissions, basketAccess, certificateAccess] = await Promise.all([
             (async () => {
-                if (!groupPermissions.spendingAuthorization)
+                if (groupPermissions.spendingAuthorization == null)
                     return undefined;
-                const hasAuth = await this.hasSpendingAuthorization({
-                    originator,
-                    satoshis: groupPermissions.spendingAuthorization.amount
-                });
-                return hasAuth ? undefined : groupPermissions.spendingAuthorization;
+                // A standing authorization is a grant regardless of how much of the
+                // monthly allowance has been used — exhaustion is handled by renewal
+                // at spend time. Checking remaining headroom here re-requests (and,
+                // if approved, re-mints) spending after any monthly usage.
+                const { normalized, lookupValues } = this.prepareOriginator(originator);
+                const token = await this.findSpendingToken(normalized, lookupValues);
+                return token != null ? undefined : groupPermissions.spendingAuthorization;
             })(),
             (async () => {
                 const protocolChecks = await Promise.all((groupPermissions.protocolPermissions || []).map(async (p) => {
-                    var _a;
                     if (p.counterparty === '')
                         return null;
                     const [level] = p.protocolID || [0];
@@ -1072,7 +1112,7 @@ class WalletPermissionsManager {
                         originator,
                         privileged: false,
                         protocolID: p.protocolID,
-                        counterparty: (_a = p.counterparty) !== null && _a !== void 0 ? _a : 'self'
+                        counterparty: p.counterparty ?? 'self'
                     });
                     return hasPerm ? null : p;
                 }));
@@ -1102,7 +1142,7 @@ class WalletPermissionsManager {
                 return certChecks.filter(Boolean);
             })()
         ]);
-        if (spendingAuthorization) {
+        if (spendingAuthorization != null) {
             permissionsToRequest.spendingAuthorization = spendingAuthorization;
         }
         permissionsToRequest.protocolPermissions = protocolPermissions;
@@ -1111,11 +1151,10 @@ class WalletPermissionsManager {
         return permissionsToRequest;
     }
     hasAnyPermissionsToRequest(permissions) {
-        var _a, _b, _c, _d, _e, _f;
         return !!(permissions.spendingAuthorization ||
-            ((_b = (_a = permissions.protocolPermissions) === null || _a === void 0 ? void 0 : _a.length) !== null && _b !== void 0 ? _b : 0) > 0 ||
-            ((_d = (_c = permissions.basketAccess) === null || _c === void 0 ? void 0 : _c.length) !== null && _d !== void 0 ? _d : 0) > 0 ||
-            ((_f = (_e = permissions.certificateAccess) === null || _e === void 0 ? void 0 : _e.length) !== null && _f !== void 0 ? _f : 0) > 0);
+            (permissions.protocolPermissions?.length ?? 0) > 0 ||
+            (permissions.basketAccess?.length ?? 0) > 0 ||
+            (permissions.certificateAccess?.length ?? 0) > 0);
     }
     hasGroupedPermissionRequestedHandlers() {
         const handlers = this.callbacks.onGroupedPermissionRequested || [];
@@ -1126,7 +1165,6 @@ class WalletPermissionsManager {
         return handlers.some(h => typeof h === 'function');
     }
     async hasPactEstablished(originator, counterparty) {
-        var _a;
         if (counterparty === 'self' || counterparty === 'anyone') {
             return true;
         }
@@ -1135,7 +1173,7 @@ class WalletPermissionsManager {
             return true;
         }
         const { counterpartyPermissions } = await this.fetchManifestPermissions(originator);
-        if (!((_a = counterpartyPermissions === null || counterpartyPermissions === void 0 ? void 0 : counterpartyPermissions.protocols) === null || _a === void 0 ? void 0 : _a.length)) {
+        if (!counterpartyPermissions?.protocols?.length) {
             return true;
         }
         const firstProtocol = counterpartyPermissions.protocols[0];
@@ -1156,7 +1194,6 @@ class WalletPermissionsManager {
         this.pactEstablishedCache.set(cacheKey, Date.now());
     }
     async maybeRequestPact(currentRequest) {
-        var _a;
         if (!this.config.seekGroupedPermission) {
             return null;
         }
@@ -1182,7 +1219,7 @@ class WalletPermissionsManager {
             return null;
         }
         const { counterpartyPermissions } = await this.fetchManifestPermissions(originator);
-        if (!((_a = counterpartyPermissions === null || counterpartyPermissions === void 0 ? void 0 : counterpartyPermissions.protocols) === null || _a === void 0 ? void 0 : _a.length)) {
+        if (!counterpartyPermissions?.protocols?.length) {
             return null;
         }
         if (!this.isProtocolInCounterpartyPermissions(currentRequest.protocolID, counterpartyPermissions)) {
@@ -1210,27 +1247,22 @@ class WalletPermissionsManager {
             protocols: protocolsToRequest
         };
         const key = `pact:${originator}:${counterparty}`;
+        await this.joinOrCreatePactRequest(key, originator, counterparty, permissionsToRequest, currentRequest.displayOriginator);
+        this.markPactEstablished(originator, counterparty);
+        const satisfied = await this.hasProtocolPermission({
+            originator,
+            privileged: false,
+            protocolID: currentRequest.protocolID,
+            counterparty
+        });
+        return satisfied ? true : null;
+    }
+    async joinOrCreatePactRequest(key, originator, counterparty, permissionsToRequest, displayOriginator) {
         const existing = this.activeRequests.get(key);
-        if (existing) {
-            const existingRequest = existing.request;
-            for (const p of permissionsToRequest.protocols) {
-                if (!existingRequest.permissions.protocols.find(x => x.protocolName === p.protocolName)) {
-                    existingRequest.permissions.protocols.push(p);
-                }
-            }
-            await new Promise((resolve, reject) => {
-                existing.pending.push({ resolve, reject });
-            });
-        }
-        else {
+        if (existing == null) {
             const counterpartyPromise = new Promise((resolve, reject) => {
                 this.activeRequests.set(key, {
-                    request: {
-                        originator,
-                        counterparty,
-                        permissions: permissionsToRequest,
-                        displayOriginator: currentRequest.displayOriginator
-                    },
+                    request: { originator, counterparty, permissions: permissionsToRequest, displayOriginator },
                     pending: [{ resolve, reject }]
                 });
             });
@@ -1242,19 +1274,21 @@ class WalletPermissionsManager {
             });
             await counterpartyPromise;
         }
-        this.markPactEstablished(originator, counterparty);
-        const satisfied = await this.hasProtocolPermission({
-            originator,
-            privileged: false,
-            protocolID: currentRequest.protocolID,
-            counterparty
-        });
-        return satisfied ? true : null;
-    }
-    async maybeRequestPeerGroupedLevel2ProtocolPermissions(currentRequest) {
-        var _a, _b;
-        if (!this.config.seekGroupedPermission) {
-            return null;
+        else {
+            const existingRequest = existing.request;
+            for (const p of permissionsToRequest.protocols) {
+                if (!existingRequest.permissions.protocols.some(x => x.protocolName === p.protocolName)) {
+                    existingRequest.permissions.protocols.push(p);
+                }
+            }
+            await new Promise((resolve, reject) => {
+                existing.pending.push({ resolve, reject });
+            });
+        }
+    }
+    async maybeRequestPeerGroupedLevel2ProtocolPermissions(currentRequest) {
+        if (!this.config.seekGroupedPermission) {
+            return null;
         }
         if (!this.hasGroupedPermissionRequestedHandlers()) {
             return null;
@@ -1267,10 +1301,10 @@ class WalletPermissionsManager {
             return null;
         }
         const originator = currentRequest.originator;
-        const privileged = (_a = currentRequest.privileged) !== null && _a !== void 0 ? _a : false;
-        const counterparty = (_b = currentRequest.counterparty) !== null && _b !== void 0 ? _b : 'self';
+        const privileged = currentRequest.privileged ?? false;
+        const counterparty = currentRequest.counterparty ?? 'self';
         const groupPermissions = await this.fetchManifestGroupPermissions(originator);
-        if (!groupPermissions) {
+        if (groupPermissions == null) {
             return null;
         }
         const normalizeManifestCounterparty = (cp) => {
@@ -1281,7 +1315,7 @@ class WalletPermissionsManager {
             return cp;
         };
         const manifestLevel2ForThisPeer = (groupPermissions.protocolPermissions || [])
-            .filter(p => { var _a, _b; return ((_b = (_a = p.protocolID) === null || _a === void 0 ? void 0 : _a[0]) !== null && _b !== void 0 ? _b : 0) === 2; })
+            .filter(p => (p.protocolID?.[0] ?? 0) === 2)
             .map(p => ({
             protocolID: p.protocolID,
             counterparty: normalizeManifestCounterparty(p.counterparty),
@@ -1316,40 +1350,7 @@ class WalletPermissionsManager {
             return null;
         }
         const key = `group-peer:${originator}:${privileged}:${counterparty}`;
-        const existing = this.activeRequests.get(key);
-        if (existing) {
-            const existingRequest = existing.request;
-            if (!existingRequest.permissions.protocolPermissions) {
-                existingRequest.permissions.protocolPermissions = [];
-            }
-            for (const p of permissionsToRequest.protocolPermissions || []) {
-                if (!existingRequest.permissions.protocolPermissions.find(x => deepEqual(x, p))) {
-                    existingRequest.permissions.protocolPermissions.push(p);
-                }
-            }
-            await new Promise((resolve, reject) => {
-                existing.pending.push({ resolve, reject });
-            });
-        }
-        else {
-            const permissions = permissionsToRequest;
-            const groupedPromise = new Promise((resolve, reject) => {
-                this.activeRequests.set(key, {
-                    request: {
-                        originator,
-                        permissions,
-                        displayOriginator: currentRequest.displayOriginator
-                    },
-                    pending: [{ resolve, reject }]
-                });
-            });
-            await this.callEvent('onGroupedPermissionRequested', {
-                requestID: key,
-                originator,
-                permissions
-            });
-            await groupedPromise;
-        }
+        await this.joinOrCreateGroupedRequest(key, originator, permissionsToRequest, currentRequest.displayOriginator);
         const satisfied = await this.checkSpecificPermissionAfterGroupFlow(currentRequest);
         return satisfied ? true : null;
     }
@@ -1360,14 +1361,14 @@ class WalletPermissionsManager {
         const gate = new Promise(resolve => {
             release = resolve;
         });
-        const currentTail = safePriorTail.then(() => gate);
+        const currentTail = safePriorTail.then(async () => await gate);
         this.groupedPermissionFlowTail.set(originator, currentTail);
         await safePriorTail;
         try {
             return await fn();
         }
         finally {
-            release === null || release === void 0 ? void 0 : release();
+            release?.();
             currentTail.finally(() => {
                 if (this.groupedPermissionFlowTail.get(originator) === currentTail) {
                     this.groupedPermissionFlowTail.delete(originator);
@@ -1376,14 +1377,13 @@ class WalletPermissionsManager {
         }
     }
     async checkSpecificPermissionAfterGroupFlow(request) {
-        var _a, _b, _c;
         switch (request.type) {
             case 'protocol':
                 return await this.hasProtocolPermission({
                     originator: request.originator,
-                    privileged: (_a = request.privileged) !== null && _a !== void 0 ? _a : false,
+                    privileged: request.privileged ?? false,
                     protocolID: request.protocolID,
-                    counterparty: (_b = request.counterparty) !== null && _b !== void 0 ? _b : 'self'
+                    counterparty: request.counterparty ?? 'self'
                 });
             case 'basket':
                 return await this.hasBasketAccess({
@@ -1393,7 +1393,7 @@ class WalletPermissionsManager {
             case 'certificate':
                 return await this.hasCertificateAccess({
                     originator: request.originator,
-                    privileged: (_c = request.privileged) !== null && _c !== void 0 ? _c : false,
+                    privileged: request.privileged ?? false,
                     verifier: request.certificate.verifier,
                     certType: request.certificate.certType,
                     fields: request.certificate.fields
@@ -1408,40 +1408,38 @@ class WalletPermissionsManager {
         }
     }
     isRequestIncludedInGroupPermissions(request, groupPermissions) {
-        var _a, _b, _c, _d;
         switch (request.type) {
             case 'protocol': {
                 if (request.privileged)
                     return false;
                 const pid = request.protocolID;
-                if (!pid)
+                if (pid == null)
                     return false;
-                const cp = (_a = request.counterparty) !== null && _a !== void 0 ? _a : 'self';
-                return !!((_b = groupPermissions.protocolPermissions) === null || _b === void 0 ? void 0 : _b.some(p => {
-                    var _a;
+                const cp = request.counterparty ?? 'self';
+                return !!groupPermissions.protocolPermissions?.some(p => {
                     if (p.counterparty === '')
                         return false;
                     const [level] = p.protocolID || [0];
                     if (level === 2 && (p.counterparty === undefined || p.counterparty === null)) {
                         return false;
                     }
-                    const manifestCp = level === 1 ? '' : ((_a = p.counterparty) !== null && _a !== void 0 ? _a : 'self');
+                    const manifestCp = level === 1 ? '' : (p.counterparty ?? 'self');
                     return deepEqual(p.protocolID, pid) && manifestCp === cp;
-                }));
+                });
             }
             case 'basket': {
                 const basket = request.basket;
                 if (!basket)
                     return false;
-                return !!((_c = groupPermissions.basketAccess) === null || _c === void 0 ? void 0 : _c.some(b => b.basket === basket));
+                return !!groupPermissions.basketAccess?.some(b => b.basket === basket);
             }
             case 'certificate': {
                 if (request.privileged)
                     return false;
                 const cert = request.certificate;
-                if (!cert)
+                if (cert == null)
                     return false;
-                return !!((_d = groupPermissions.certificateAccess) === null || _d === void 0 ? void 0 : _d.some(c => {
+                return !!groupPermissions.certificateAccess?.some(c => {
                     const fieldsA = new Set(c.fields || []);
                     const fieldsB = new Set(cert.fields || []);
                     if (fieldsA.size !== fieldsB.size)
@@ -1450,10 +1448,10 @@ class WalletPermissionsManager {
                         if (!fieldsB.has(f))
                             return false;
                     return c.type === cert.certType && c.verifierPublicKey === cert.verifier;
-                }));
+                });
             }
             case 'spending':
-                return !!groupPermissions.spendingAuthorization;
+                return groupPermissions.spendingAuthorization != null;
             default:
                 return false;
         }
@@ -1464,7 +1462,7 @@ class WalletPermissionsManager {
         }
         const originator = currentRequest.originator;
         const groupPermissions = await this.fetchManifestGroupPermissions(originator);
-        if (!groupPermissions) {
+        if (groupPermissions == null) {
             return null;
         }
         if (!this.isRequestIncludedInGroupPermissions(currentRequest, groupPermissions)) {
@@ -1475,19 +1473,20 @@ class WalletPermissionsManager {
             return null;
         }
         const key = `group:${originator}`;
-        if (this.activeRequests.has(key)) {
-            await new Promise((resolve, reject) => {
-                this.activeRequests.get(key).pending.push({ resolve, reject });
-            });
-        }
-        else {
+        await this.joinOrCreateGroupedRequest(key, originator, permissionsToRequest, currentRequest.displayOriginator);
+        const satisfied = await this.checkSpecificPermissionAfterGroupFlow(currentRequest);
+        return satisfied ? true : null;
+    }
+    /**
+     * Joins an existing grouped permission request (piggybacks on the existing promise), or creates
+     * a new one and fires the onGroupedPermissionRequested event.
+     */
+    async joinOrCreateGroupedRequest(key, originator, permissionsToRequest, displayOriginator) {
+        const existing = this.activeRequests.get(key);
+        if (existing == null) {
             const permPromise = new Promise((resolve, reject) => {
                 this.activeRequests.set(key, {
-                    request: {
-                        originator,
-                        permissions: permissionsToRequest,
-                        displayOriginator: currentRequest.displayOriginator
-                    },
+                    request: { originator, permissions: permissionsToRequest, displayOriginator },
                     pending: [{ resolve, reject }]
                 });
             });
@@ -1498,8 +1497,18 @@ class WalletPermissionsManager {
             });
             await permPromise;
         }
-        const satisfied = await this.checkSpecificPermissionAfterGroupFlow(currentRequest);
-        return satisfied ? true : null;
+        else {
+            const existingRequest = existing.request;
+            existingRequest.permissions.protocolPermissions ??= [];
+            for (const p of permissionsToRequest.protocolPermissions || []) {
+                if (!existingRequest.permissions.protocolPermissions.some(x => deepEqual(x, p))) {
+                    existingRequest.permissions.protocolPermissions.push(p);
+                }
+            }
+            await new Promise((resolve, reject) => {
+                existing.pending.push({ resolve, reject });
+            });
+        }
     }
     /**
      * A central method that triggers the permission request flow.
@@ -1509,34 +1518,74 @@ class WalletPermissionsManager {
      *   and return a promise that resolves once permission is granted or rejects if denied.
      */
     async requestPermissionFlow(r) {
-        var _a, _b, _c, _d;
+        if (!this.telemetry.enabled)
+            return await this.requestPermissionFlowCore(r);
+        return await this.telemetry.withSpan('wallet.permission.request', {
+            component: 'wallet-permissions',
+            carrier: r,
+            attributes: {
+                'permission.type': r.type,
+                'permission.renewal': r.renewal === true
+            }
+        }, async (span) => {
+            const result = await this.requestPermissionFlowCore(r, span.context);
+            span.end({
+                attributes: {
+                    'permission.granted': result
+                }
+            });
+            return result;
+        });
+    }
+    async requestPermissionFlowCore(r, context) {
+        if (context != null)
+            this.telemetry.bindContext(r, context);
         const normalizedOriginator = this.normalizeOriginator(r.originator) || r.originator;
         const preparedRequest = {
             ...r,
             originator: normalizedOriginator,
-            displayOriginator: (_c = (_a = r.displayOriginator) !== null && _a !== void 0 ? _a : (_b = r.previousToken) === null || _b === void 0 ? void 0 : _b.rawOriginator) !== null && _c !== void 0 ? _c : r.originator
+            displayOriginator: r.displayOriginator ?? r.previousToken?.rawOriginator ?? r.originator
         };
-        if (preparedRequest.type === 'protocol' && ((_d = preparedRequest.protocolID) === null || _d === void 0 ? void 0 : _d[0]) === 1) {
+        if (context != null)
+            this.telemetry.bindContext(preparedRequest, context);
+        if (preparedRequest.type === 'protocol' && preparedRequest.protocolID?.[0] === 1) {
             preparedRequest.counterparty = '';
         }
         const key = this.buildActiveRequestKey(preparedRequest);
         // If there's already a queue for the same resource, we piggyback on it
-        const existingQueue = this.activeRequests.get(key);
-        if (existingQueue && existingQueue.pending.length > 0) {
-            return new Promise((resolve, reject) => {
-                existingQueue.pending.push({ resolve, reject });
-            });
+        if (this.isPiggybacking(key)) {
+            return await this.piggybackOnExistingQueue(key);
         }
         const pactResult = await this.maybeRequestPact(preparedRequest);
-        if (pactResult !== null) {
+        if (pactResult !== null)
             return pactResult;
-        }
         const peerGroupResult = await this.maybeRequestPeerGroupedLevel2ProtocolPermissions(preparedRequest);
-        if (peerGroupResult !== null) {
+        if (peerGroupResult !== null)
             return peerGroupResult;
-        }
+        const groupResult = await this.resolveGroupedFlow(preparedRequest, key);
+        if (groupResult !== null)
+            return groupResult;
+        // Re-check after grouped flow — another waiter may have set up a queue
+        if (this.isPiggybacking(key))
+            return await this.piggybackOnExistingQueue(key);
+        return await this.enqueueAndFireEvent(preparedRequest, key);
+    }
+    /** Returns true when an active-request queue already has pending waiters for this key. */
+    isPiggybacking(key) {
+        const q = this.activeRequests.get(key);
+        return q != null && q.pending.length > 0;
+    }
+    /** Appends to an existing request queue and waits for resolution. */
+    async piggybackOnExistingQueue(key) {
+        const q = this.activeRequests.get(key);
+        return await new Promise((resolve, reject) => {
+            q.pending.push({ resolve, reject });
+        });
+    }
+    /** Runs the grouped-permission flow (with or without a lock) and checks post-group satisfaction. */
+    async resolveGroupedFlow(preparedRequest, _key) {
         const hadPendingGroupedFlowBefore = this.config.seekGroupedPermission && this.groupedPermissionFlowTail.has(preparedRequest.originator);
-        let groupResult = null;
+        let groupResult;
         if (this.config.seekGroupedPermission) {
             groupResult = await this.withGroupedPermissionFlowLock(preparedRequest.originator, async () => {
                 return await this.maybeRequestGroupedPermissions(preparedRequest);
@@ -1545,68 +1594,79 @@ class WalletPermissionsManager {
         else {
             groupResult = await this.maybeRequestGroupedPermissions(preparedRequest);
         }
-        if (groupResult !== null) {
+        if (groupResult !== null)
             return groupResult;
-        }
-        if (this.config.seekGroupedPermission && hadPendingGroupedFlowBefore) {
+        if (hadPendingGroupedFlowBefore) {
             const satisfiedAfterGroup = await this.checkSpecificPermissionAfterGroupFlow(preparedRequest);
-            if (satisfiedAfterGroup) {
+            if (satisfiedAfterGroup)
                 return true;
-            }
         }
-        const existingQueueAfterGroups = this.activeRequests.get(key);
-        if (existingQueueAfterGroups && existingQueueAfterGroups.pending.length > 0) {
-            return new Promise((resolve, reject) => {
-                existingQueueAfterGroups.pending.push({ resolve, reject });
-            });
+        return null;
+    }
+    /** Creates a new active-request queue entry, fires the event, and returns the promise. */
+    async enqueueAndFireEvent(preparedRequest, key) {
+        const requestPromise = new Promise((resolve, reject) => {
+            this.activeRequests.set(key, { request: preparedRequest, pending: [{ resolve, reject }] });
+        });
+        try {
+            await this.firePermissionRequestEvent(preparedRequest, key);
         }
-        return new Promise(async (resolve, reject) => {
-            var _a;
-            this.activeRequests.set(key, {
-                request: preparedRequest,
-                pending: [{ resolve, reject }]
-            });
-            try {
-                // Fire the relevant onXXXRequested event (which one depends on r.type)
-                switch (preparedRequest.type) {
-                    case 'protocol':
-                        await this.callEvent('onProtocolPermissionRequested', {
-                            ...preparedRequest,
-                            counterparty: ((_a = preparedRequest.protocolID) === null || _a === void 0 ? void 0 : _a[0]) === 1 ? undefined : preparedRequest.counterparty,
-                            requestID: key
-                        });
-                        break;
-                    case 'basket':
-                        await this.callEvent('onBasketAccessRequested', {
-                            ...preparedRequest,
-                            requestID: key
-                        });
-                        break;
-                    case 'certificate':
-                        await this.callEvent('onCertificateAccessRequested', {
-                            ...preparedRequest,
-                            requestID: key
-                        });
-                        break;
-                    case 'spending':
-                        await this.callEvent('onSpendingAuthorizationRequested', {
-                            ...preparedRequest,
-                            requestID: key
-                        });
-                        break;
-                }
-            }
-            catch (e) {
-                const matching = this.activeRequests.get(key);
-                if (matching) {
-                    for (const p of matching.pending) {
-                        p.reject(e);
-                    }
-                    this.activeRequests.delete(key);
-                }
+        catch (e) {
+            const matching = this.activeRequests.get(key);
+            if (matching != null) {
+                for (const p of matching.pending)
+                    p.reject(e);
+                this.activeRequests.delete(key);
             }
-        });
+        }
+        return await requestPromise;
     }
+    /** Fires the appropriate onXXXRequested event based on the request type. */
+    async firePermissionRequestEvent(request, key) {
+        switch (request.type) {
+            case 'protocol':
+                await this.callPermissionEvent(request, 'onProtocolPermissionRequested', {
+                    ...request,
+                    counterparty: request.protocolID?.[0] === 1 ? undefined : request.counterparty,
+                    requestID: key
+                });
+                break;
+            case 'basket':
+                await this.callPermissionEvent(request, 'onBasketAccessRequested', { ...request, requestID: key });
+                break;
+            case 'certificate':
+                await this.callPermissionEvent(request, 'onCertificateAccessRequested', { ...request, requestID: key });
+                break;
+            case 'spending':
+                await this.callPermissionEvent(request, 'onSpendingAuthorizationRequested', { ...request, requestID: key });
+                break;
+        }
+    }
+    async callPermissionEvent(request, eventName, param) {
+        this.telemetry.linkContext(request, param);
+        await this.callEvent(eventName, param);
+    }
+    /* ---------------------------------------------------------------------
+     *  4) SEARCH / DECODE / DECRYPT ON-CHAIN TOKENS (PushDrop Scripts)
+     * --------------------------------------------------------------------- */
+    /**
+     * We will use a administrative "permission token encryption" protocol to store fields
+     * in each permission's PushDrop script. This ensures that only the user's wallet
+     * can decrypt them. In practice, this data is not super sensitive, but we still
+     * follow the principle of least exposure.
+     */
+    static PERM_TOKEN_ENCRYPTION_PROTOCOL = [
+        2,
+        'admin permission token encryption'
+    ];
+    /**
+     * Similarly, we will use a "metadata encryption" protocol to preserve the confidentiality
+     * of transaction descriptions and input/output descriptions from lower storage layers.
+     */
+    static METADATA_ENCRYPTION_PROTOCOL = [
+        2,
+        'admin metadata encryption'
+    ];
     /** We always use `keyID="1"` and `counterparty="self"` for these encryption ops. */
     async encryptPermissionTokenField(plaintext) {
         const data = typeof plaintext === 'string' ? sdk_1.Utils.toArray(plaintext, 'utf8') : plaintext;
@@ -1617,7 +1677,45 @@ class WalletPermissionsManager {
         }, this.adminOriginator);
         return ciphertext;
     }
+    /**
+     * Extracts a transaction from a `listOutputs` result's BEEF bundle, parsing
+     * the bundle only once per result. Calling
+     * `Transaction.fromBEEF(result.BEEF, txid)` per output re-parses the entire
+     * bundle every time — O(n²) in the number of outputs — which can block the
+     * caller's thread (in browser wallets, the UI) for seconds on large
+     * permission baskets.
+     */
+    transactionFromResultBeef(result, txid) {
+        const beef = result.BEEF;
+        if (beef != null) {
+            let parsed = this.parsedBeefCache.get(beef);
+            if (parsed === undefined) {
+                try {
+                    parsed = sdk_1.Beef.fromBinary(beef);
+                }
+                catch {
+                    parsed = null;
+                }
+                this.parsedBeefCache.set(beef, parsed);
+            }
+            // findAtomicTransaction (not findTxid().tx) matches fromBEEF exactly:
+            // it attaches merkle paths and sourceTransaction ancestry, which token
+            // consumers rely on when re-serializing via tx.toBEEF().
+            const tx = parsed?.findAtomicTransaction(txid);
+            if (tx != null)
+                return tx;
+        }
+        // Preserve the original behavior (including throwing) for bundles the
+        // fast path can't serve.
+        return sdk_1.Transaction.fromBEEF(beef ?? [], txid);
+    }
     async decryptPermissionTokenField(ciphertext) {
+        // Field decrypts run in tight loops over every token in a basket; yield a
+        // macrotask periodically so large scans don't starve the caller's event
+        // loop (in browser wallets, that means blocking rendering and input).
+        if (++this.tokenFieldDecryptCount % 8 === 0) {
+            await new Promise(resolve => setTimeout(resolve, 0));
+        }
         try {
             const { plaintext } = await this.underlying.decrypt({
                 ciphertext,
@@ -1626,7 +1724,8 @@ class WalletPermissionsManager {
             }, this.adminOriginator);
             return plaintext;
         }
-        catch (e) {
+        catch {
+            // Decryption failed (e.g. wrong key, unencrypted legacy value) — return the raw bytes unchanged
             return ciphertext;
         }
     }
@@ -1660,7 +1759,8 @@ class WalletPermissionsManager {
             }, this.adminOriginator);
             return sdk_1.Utils.toUTF8(plaintext);
         }
-        catch (e) {
+        catch {
+            // Decryption failed (e.g. wrong key, unencrypted legacy value) — return original string unchanged
             return ciphertext;
         }
     }
@@ -1669,71 +1769,200 @@ class WalletPermissionsManager {
         const now = Math.floor(Date.now() / 1000);
         return expiry > 0 && expiry < now;
     }
+    /** Decrypts the standard 6 fields from a protocol (DPACP) PushDrop script. */
+    async decryptProtocolTokenFields(fields) {
+        const domainDecoded = sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(fields[0]));
+        const expiryDecoded = Number.parseInt(sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(fields[1])), 10);
+        const privDecoded = sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(fields[2])) === 'true';
+        const secLevelDecoded = Number.parseInt(sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(fields[3])), 10);
+        const protoNameDecoded = sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(fields[4]));
+        const cptyDecoded = sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(fields[5]));
+        return { domainDecoded, expiryDecoded, privDecoded, secLevelDecoded, protoNameDecoded, cptyDecoded };
+    }
+    protocolTokenTags(originator, privileged, securityLevel, protocolName, counterparty) {
+        const tags = [
+            `originator ${originator}`,
+            `privileged ${!!privileged}`,
+            `protocolName ${protocolName}`,
+            `protocolSecurityLevel ${securityLevel}`
+        ];
+        if (securityLevel === 2)
+            tags.push(`counterparty ${counterparty}`);
+        return tags;
+    }
+    async parseProtocolTokenOutput(result, output, expected) {
+        const [txid, outputIndex] = this.parseOutpoint(output.outpoint);
+        const tx = this.transactionFromResultBeef(result, txid);
+        const decoded = sdk_1.PushDrop.decode(tx.outputs[outputIndex].lockingScript);
+        if (decoded?.fields == null || decoded.fields.length < 6)
+            return undefined;
+        const fields = await this.decryptProtocolTokenFields(decoded.fields);
+        if (this.normalizeOriginator(fields.domainDecoded) !== expected.originator)
+            return undefined;
+        const matches = fields.privDecoded === !!expected.privileged &&
+            fields.secLevelDecoded === expected.securityLevel &&
+            fields.protoNameDecoded === expected.protocolName &&
+            (fields.secLevelDecoded !== 2 || fields.cptyDecoded === expected.counterparty);
+        if (!matches)
+            return undefined;
+        return {
+            tx: tx.toBEEF(),
+            txid,
+            outputIndex,
+            outputScript: tx.outputs[outputIndex].lockingScript.toHex(),
+            satoshis: output.satoshis,
+            originator: expected.originator,
+            rawOriginator: fields.domainDecoded,
+            privileged: expected.privileged,
+            protocol: expected.protocolName,
+            securityLevel: expected.securityLevel,
+            expiry: fields.expiryDecoded,
+            counterparty: fields.cptyDecoded
+        };
+    }
+    async parseBasketTokenOutput(result, output, originator, basket) {
+        const [txid, outputIndex] = this.parseOutpoint(output.outpoint);
+        const tx = this.transactionFromResultBeef(result, txid);
+        const decoded = sdk_1.PushDrop.decode(tx.outputs[outputIndex].lockingScript);
+        if (decoded?.fields == null || decoded.fields.length < 3)
+            return undefined;
+        const domainDecoded = sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(decoded.fields[0]));
+        if (this.normalizeOriginator(domainDecoded) !== originator)
+            return undefined;
+        const expiryDecoded = Number.parseInt(sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(decoded.fields[1])), 10);
+        const basketDecoded = sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(decoded.fields[2]));
+        if (basketDecoded !== basket)
+            return undefined;
+        return {
+            tx: tx.toBEEF(),
+            txid,
+            outputIndex,
+            outputScript: tx.outputs[outputIndex].lockingScript.toHex(),
+            satoshis: output.satoshis,
+            originator,
+            rawOriginator: domainDecoded,
+            basketName: basketDecoded,
+            expiry: expiryDecoded
+        };
+    }
+    async parseCertificateTokenOutput(result, output, expected) {
+        const [txid, outputIndex] = this.parseOutpoint(output.outpoint);
+        const tx = this.transactionFromResultBeef(result, txid);
+        const decoded = sdk_1.PushDrop.decode(tx.outputs[outputIndex].lockingScript);
+        if (decoded?.fields == null || decoded.fields.length < 6)
+            return undefined;
+        const [domainRaw, expiryRaw, privRaw, typeRaw, fieldsRaw, verifierRaw] = decoded.fields;
+        const domainDecoded = sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(domainRaw));
+        if (this.normalizeOriginator(domainDecoded) !== expected.originator)
+            return undefined;
+        const expiryDecoded = Number.parseInt(sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(expiryRaw)), 10);
+        const privileged = sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(privRaw)) === 'true';
+        const certType = sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(typeRaw));
+        const verifier = sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(verifierRaw));
+        const allFields = JSON.parse(sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(fieldsRaw)));
+        const metadataMatches = privileged === !!expected.privileged && certType === expected.certType && verifier === expected.verifier;
+        if (!metadataMatches)
+            return undefined;
+        const availableFields = new Set(allFields);
+        if (expected.fields.some(field => !availableFields.has(field)))
+            return undefined;
+        return {
+            tx: tx.toBEEF(),
+            txid,
+            outputIndex,
+            outputScript: tx.outputs[outputIndex].lockingScript.toHex(),
+            satoshis: output.satoshis,
+            originator: expected.originator,
+            rawOriginator: domainDecoded,
+            privileged: expected.privileged,
+            verifier,
+            certType,
+            certFields: allFields,
+            expiry: expiryDecoded
+        };
+    }
+    /** Parses outpoint string "txid.vout" into [txid, outputIndex]. */
+    parseOutpoint(outpoint) {
+        const [txid, indexStr] = outpoint.split('.');
+        return [txid, Number.parseInt(indexStr, 10)];
+    }
+    /** Normalizes a txid string to lowercase. */
+    normalizeTxid(txid) {
+        return (txid ?? '').toLowerCase();
+    }
+    /** Reverses a 32-byte hex txid (for endian normalization). */
+    reverseHexTxid(txid) {
+        const hex = this.normalizeTxid(txid);
+        if (!/^[0-9a-f]{64}$/.test(hex))
+            return hex;
+        const bytes = hex.match(/../g);
+        return bytes != null ? bytes.reverse().join('') : hex;
+    }
+    /**
+     * Returns true when an outpoint string (e.g. "txid.vout" or "txid:vout") refers to `token`.
+     */
+    tokenMatchesOutpointString(outpoint, token) {
+        const dot = outpoint.lastIndexOf('.');
+        const colon = outpoint.lastIndexOf(':');
+        const sep = Math.max(dot, colon);
+        if (sep === -1)
+            return false;
+        const txidPart = outpoint.slice(0, sep);
+        const vout = Number(outpoint.slice(sep + 1));
+        if (!Number.isFinite(vout))
+            return false;
+        return this.normalizeTxid(txidPart) === this.normalizeTxid(token.txid) && vout === token.outputIndex;
+    }
+    /**
+     * Finds the index of the tx input that spends the given permission token.
+     * Handles multiple potential field names for TXID and vout.
+     */
+    findInputIndexForToken(tx, token) {
+        return tx.inputs.findIndex((input) => {
+            const txidCandidate = input?.sourceTXID ??
+                input?.sourceTxid ??
+                input?.sourceTxId ??
+                input?.prevTxId ??
+                input?.prevTxid ??
+                input?.prevTXID ??
+                input?.txid ??
+                input?.txID;
+            const voutCandidate = input?.sourceOutputIndex ?? input?.sourceOutput ?? input?.outputIndex ?? input?.vout ?? input?.prevOutIndex;
+            if (typeof txidCandidate === 'string' && typeof voutCandidate === 'number') {
+                const cand = this.normalizeTxid(txidCandidate);
+                if (cand === this.normalizeTxid(token.txid) && voutCandidate === token.outputIndex)
+                    return true;
+                if (cand === this.reverseHexTxid(token.txid) && voutCandidate === token.outputIndex)
+                    return true;
+            }
+            const outpointCandidate = input?.outpoint ?? input?.sourceOutpoint ?? input?.prevOutpoint;
+            return typeof outpointCandidate === 'string' && this.tokenMatchesOutpointString(outpointCandidate, token);
+        });
+    }
     /** Looks for a DPACP permission token matching origin/domain, privileged, protocol, cpty. */
     async findProtocolToken(originator, privileged, protocolID, counterparty, includeExpired, originatorLookupValues) {
         const [secLevel, protoName] = protocolID;
-        const originsToTry = (originatorLookupValues === null || originatorLookupValues === void 0 ? void 0 : originatorLookupValues.length) ? originatorLookupValues : [originator];
+        const originsToTry = originatorLookupValues?.length ? originatorLookupValues : [originator];
         for (const originTag of originsToTry) {
-            const tags = [
-                `originator ${originTag}`,
-                `privileged ${!!privileged}`,
-                `protocolName ${protoName}`,
-                `protocolSecurityLevel ${secLevel}`
-            ];
-            if (secLevel === 2) {
-                tags.push(`counterparty ${counterparty}`);
-            }
             const result = await this.underlying.listOutputs({
                 basket: BASKET_MAP.protocol,
-                tags,
+                tags: this.protocolTokenTags(originTag, privileged, secLevel, protoName, counterparty),
                 tagQueryMode: 'all',
                 include: 'entire transactions'
             }, this.adminOriginator);
             for (const out of result.outputs) {
-                const [txid, outputIndexStr] = out.outpoint.split('.');
-                const tx = sdk_1.Transaction.fromBEEF(result.BEEF, txid);
-                const dec = sdk_1.PushDrop.decode(tx.outputs[Number(outputIndexStr)].lockingScript);
-                if (!dec || !dec.fields || dec.fields.length < 6)
-                    continue;
-                const domainRaw = dec.fields[0];
-                const expiryRaw = dec.fields[1];
-                const privRaw = dec.fields[2];
-                const secLevelRaw = dec.fields[3];
-                const protoNameRaw = dec.fields[4];
-                const counterpartyRaw = dec.fields[5];
-                const domainDecoded = sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(domainRaw));
-                const normalizedDomain = this.normalizeOriginator(domainDecoded);
-                if (normalizedDomain !== originator) {
-                    continue;
-                }
-                const expiryDecoded = parseInt(sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(expiryRaw)), 10);
-                const privDecoded = sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(privRaw)) === 'true';
-                const secLevelDecoded = parseInt(sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(secLevelRaw)), 10);
-                const protoNameDecoded = sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(protoNameRaw));
-                const cptyDecoded = sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(counterpartyRaw));
-                if (privDecoded !== !!privileged ||
-                    secLevelDecoded !== secLevel ||
-                    protoNameDecoded !== protoName ||
-                    (secLevelDecoded === 2 && cptyDecoded !== counterparty)) {
-                    continue;
-                }
-                if (!includeExpired && this.isTokenExpired(expiryDecoded)) {
-                    continue;
-                }
-                return {
-                    tx: tx.toBEEF(),
-                    txid: out.outpoint.split('.')[0],
-                    outputIndex: parseInt(out.outpoint.split('.')[1], 10),
-                    outputScript: tx.outputs[Number(outputIndexStr)].lockingScript.toHex(),
-                    satoshis: out.satoshis,
+                const token = await this.parseProtocolTokenOutput(result, out, {
                     originator,
-                    rawOriginator: domainDecoded,
                     privileged,
-                    protocol: protoName,
                     securityLevel: secLevel,
-                    expiry: expiryDecoded,
-                    counterparty: cptyDecoded
-                };
+                    protocolName: protoName,
+                    counterparty
+                });
+                if (token == null)
+                    continue;
+                if (!includeExpired && this.isTokenExpired(token.expiry))
+                    continue;
+                return token;
             }
         }
         return undefined;
@@ -1741,78 +1970,37 @@ class WalletPermissionsManager {
     /** Finds ALL DPACP permission tokens matching origin/domain, privileged, protocol, cpty. Never filters by expiry. */
     async findAllProtocolTokens(originator, privileged, protocolID, counterparty, originatorLookupValues) {
         const [secLevel, protoName] = protocolID;
-        const originsToTry = (originatorLookupValues === null || originatorLookupValues === void 0 ? void 0 : originatorLookupValues.length) ? originatorLookupValues : [originator];
+        const originsToTry = originatorLookupValues?.length ? originatorLookupValues : [originator];
         const matches = [];
         const seen = new Set();
         for (const originTag of originsToTry) {
-            const tags = [
-                `originator ${originTag}`,
-                `privileged ${!!privileged}`,
-                `protocolName ${protoName}`,
-                `protocolSecurityLevel ${secLevel}`
-            ];
-            if (secLevel === 2) {
-                tags.push(`counterparty ${counterparty}`);
-            }
             const result = await this.underlying.listOutputs({
                 basket: BASKET_MAP.protocol,
-                tags,
+                tags: this.protocolTokenTags(originTag, privileged, secLevel, protoName, counterparty),
                 tagQueryMode: 'all',
                 include: 'entire transactions'
             }, this.adminOriginator);
             for (const out of result.outputs) {
                 if (seen.has(out.outpoint))
                     continue;
-                const [txid, outputIndexStr] = out.outpoint.split('.');
-                const tx = sdk_1.Transaction.fromBEEF(result.BEEF, txid);
-                const vout = Number(outputIndexStr);
-                const dec = sdk_1.PushDrop.decode(tx.outputs[vout].lockingScript);
-                if (!dec || !dec.fields || dec.fields.length < 6)
-                    continue;
-                const domainRaw = dec.fields[0];
-                const expiryRaw = dec.fields[1];
-                const privRaw = dec.fields[2];
-                const secLevelRaw = dec.fields[3];
-                const protoNameRaw = dec.fields[4];
-                const counterpartyRaw = dec.fields[5];
-                const domainDecoded = sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(domainRaw));
-                const normalizedDomain = this.normalizeOriginator(domainDecoded);
-                if (normalizedDomain !== originator) {
-                    continue;
-                }
-                const expiryDecoded = parseInt(sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(expiryRaw)), 10);
-                const privDecoded = sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(privRaw)) === 'true';
-                const secLevelDecoded = parseInt(sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(secLevelRaw)), 10);
-                const protoNameDecoded = sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(protoNameRaw));
-                const cptyDecoded = sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(counterpartyRaw));
-                if (privDecoded !== !!privileged ||
-                    secLevelDecoded !== secLevel ||
-                    protoNameDecoded !== protoName ||
-                    (secLevelDecoded === 2 && cptyDecoded !== counterparty)) {
-                    continue;
-                }
-                seen.add(out.outpoint);
-                matches.push({
-                    tx: tx.toBEEF(),
-                    txid,
-                    outputIndex: vout,
-                    outputScript: tx.outputs[vout].lockingScript.toHex(),
-                    satoshis: out.satoshis,
+                const token = await this.parseProtocolTokenOutput(result, out, {
                     originator,
-                    rawOriginator: domainDecoded,
                     privileged,
-                    protocol: protoName,
                     securityLevel: secLevel,
-                    expiry: expiryDecoded,
-                    counterparty: cptyDecoded
+                    protocolName: protoName,
+                    counterparty
                 });
+                if (token == null)
+                    continue;
+                seen.add(out.outpoint);
+                matches.push(token);
             }
         }
         return matches;
     }
     /** Looks for a DBAP token matching (originator, basket). */
     async findBasketToken(originator, basket, includeExpired, originatorLookupValues) {
-        const originsToTry = (originatorLookupValues === null || originatorLookupValues === void 0 ? void 0 : originatorLookupValues.length) ? originatorLookupValues : [originator];
+        const originsToTry = originatorLookupValues?.length ? originatorLookupValues : [originator];
         for (const originTag of originsToTry) {
             const result = await this.underlying.listOutputs({
                 basket: BASKET_MAP.basket,
@@ -1821,43 +2009,19 @@ class WalletPermissionsManager {
                 include: 'entire transactions'
             }, this.adminOriginator);
             for (const out of result.outputs) {
-                const [txid, outputIndexStr] = out.outpoint.split('.');
-                const tx = sdk_1.Transaction.fromBEEF(result.BEEF, txid);
-                const dec = sdk_1.PushDrop.decode(tx.outputs[Number(outputIndexStr)].lockingScript);
-                if (!(dec === null || dec === void 0 ? void 0 : dec.fields) || dec.fields.length < 3)
-                    continue;
-                const domainRaw = dec.fields[0];
-                const expiryRaw = dec.fields[1];
-                const basketRaw = dec.fields[2];
-                const domainDecoded = sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(domainRaw));
-                const normalizedDomain = this.normalizeOriginator(domainDecoded);
-                if (normalizedDomain !== originator) {
-                    continue;
-                }
-                const expiryDecoded = parseInt(sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(expiryRaw)), 10);
-                const basketDecoded = sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(basketRaw));
-                if (basketDecoded !== basket)
+                const token = await this.parseBasketTokenOutput(result, out, originator, basket);
+                if (token == null)
                     continue;
-                if (!includeExpired && this.isTokenExpired(expiryDecoded))
+                if (!includeExpired && this.isTokenExpired(token.expiry))
                     continue;
-                return {
-                    tx: tx.toBEEF(),
-                    txid: out.outpoint.split('.')[0],
-                    outputIndex: parseInt(out.outpoint.split('.')[1], 10),
-                    outputScript: tx.outputs[Number(outputIndexStr)].lockingScript.toHex(),
-                    satoshis: out.satoshis,
-                    originator,
-                    rawOriginator: domainDecoded,
-                    basketName: basketDecoded,
-                    expiry: expiryDecoded
-                };
+                return token;
             }
         }
         return undefined;
     }
     /** Looks for a DCAP token matching (origin, privileged, verifier, certType, fields subset). */
     async findCertificateToken(originator, privileged, verifier, certType, fields, includeExpired, originatorLookupValues) {
-        const originsToTry = (originatorLookupValues === null || originatorLookupValues === void 0 ? void 0 : originatorLookupValues.length) ? originatorLookupValues : [originator];
+        const originsToTry = originatorLookupValues?.length ? originatorLookupValues : [originator];
         for (const originTag of originsToTry) {
             const result = await this.underlying.listOutputs({
                 basket: BASKET_MAP.certificate,
@@ -1866,55 +2030,25 @@ class WalletPermissionsManager {
                 include: 'entire transactions'
             }, this.adminOriginator);
             for (const out of result.outputs) {
-                const [txid, outputIndexStr] = out.outpoint.split('.');
-                const tx = sdk_1.Transaction.fromBEEF(result.BEEF, txid);
-                const dec = sdk_1.PushDrop.decode(tx.outputs[Number(outputIndexStr)].lockingScript);
-                if (!(dec === null || dec === void 0 ? void 0 : dec.fields) || dec.fields.length < 6)
-                    continue;
-                const [domainRaw, expiryRaw, privRaw, typeRaw, fieldsRaw, verifierRaw] = dec.fields;
-                const domainDecoded = sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(domainRaw));
-                const normalizedDomain = this.normalizeOriginator(domainDecoded);
-                if (normalizedDomain !== originator) {
-                    continue;
-                }
-                const expiryDecoded = parseInt(sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(expiryRaw)), 10);
-                const privDecoded = sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(privRaw)) === 'true';
-                const typeDecoded = sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(typeRaw));
-                const verifierDec = sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(verifierRaw));
-                const fieldsJson = await this.decryptPermissionTokenField(fieldsRaw);
-                const allFields = JSON.parse(sdk_1.Utils.toUTF8(fieldsJson));
-                if (privDecoded !== !!privileged || typeDecoded !== certType || verifierDec !== verifier) {
-                    continue;
-                }
-                // Check if 'fields' is a subset of 'allFields'
-                const setAll = new Set(allFields);
-                if (fields.some(f => !setAll.has(f))) {
-                    continue;
-                }
-                if (!includeExpired && this.isTokenExpired(expiryDecoded)) {
-                    continue;
-                }
-                return {
-                    tx: tx.toBEEF(),
-                    txid: out.outpoint.split('.')[0],
-                    outputIndex: parseInt(out.outpoint.split('.')[1], 10),
-                    outputScript: tx.outputs[Number(outputIndexStr)].lockingScript.toHex(),
-                    satoshis: out.satoshis,
+                const token = await this.parseCertificateTokenOutput(result, out, {
                     originator,
-                    rawOriginator: domainDecoded,
                     privileged,
-                    verifier: verifierDec,
-                    certType: typeDecoded,
-                    certFields: allFields,
-                    expiry: expiryDecoded
-                };
+                    verifier,
+                    certType,
+                    fields
+                });
+                if (token == null)
+                    continue;
+                if (!includeExpired && this.isTokenExpired(token.expiry))
+                    continue;
+                return token;
             }
         }
         return undefined;
     }
     /** Looks for a DSAP token matching origin, returning the first one found. */
     async findSpendingToken(originator, originatorLookupValues) {
-        const originsToTry = (originatorLookupValues === null || originatorLookupValues === void 0 ? void 0 : originatorLookupValues.length) ? originatorLookupValues : [originator];
+        const originsToTry = originatorLookupValues?.length ? originatorLookupValues : [originator];
         for (const originTag of originsToTry) {
             const result = await this.underlying.listOutputs({
                 basket: BASKET_MAP.spending,
@@ -1924,9 +2058,9 @@ class WalletPermissionsManager {
             }, this.adminOriginator);
             for (const out of result.outputs) {
                 const [txid, outputIndexStr] = out.outpoint.split('.');
-                const tx = sdk_1.Transaction.fromBEEF(result.BEEF, txid);
+                const tx = this.transactionFromResultBeef(result, txid);
                 const dec = sdk_1.PushDrop.decode(tx.outputs[Number(outputIndexStr)].lockingScript);
-                if (!(dec === null || dec === void 0 ? void 0 : dec.fields) || dec.fields.length < 2)
+                if (!dec?.fields || dec.fields.length < 2)
                     continue;
                 const domainRaw = dec.fields[0];
                 const amtRaw = dec.fields[1];
@@ -1935,11 +2069,11 @@ class WalletPermissionsManager {
                 if (normalizedDomain !== originator)
                     continue;
                 const amtDecodedStr = sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(amtRaw));
-                const authorizedAmount = parseInt(amtDecodedStr, 10);
+                const authorizedAmount = Number.parseInt(amtDecodedStr, 10);
                 return {
                     tx: tx.toBEEF(),
                     txid: out.outpoint.split('.')[0],
-                    outputIndex: parseInt(out.outpoint.split('.')[1], 10),
+                    outputIndex: Number.parseInt(out.outpoint.split('.')[1], 10),
                     outputScript: tx.outputs[Number(outputIndexStr)].lockingScript.toHex(),
                     satoshis: out.satoshis,
                     originator,
@@ -2021,9 +2155,9 @@ class WalletPermissionsManager {
         }, this.adminOriginator);
     }
     async mapWithConcurrency(items, concurrency, fn) {
-        if (!items.length)
+        if (items.length === 0)
             return [];
-        const results = new Array(items.length);
+        const results = Array.from({ length: items.length });
         let i = 0;
         const worker = async () => {
             while (true) {
@@ -2033,11 +2167,11 @@ class WalletPermissionsManager {
                 results[idx] = await fn(items[idx]);
             }
         };
-        await Promise.all(Array.from({ length: Math.min(concurrency, items.length) }, () => worker()));
+        await Promise.all(Array.from({ length: Math.min(concurrency, items.length) }, async () => await worker()));
         return results;
     }
     async runBestEffortBatches(items, chunkSize, runChunk) {
-        if (!items.length)
+        if (items.length === 0)
             return [];
         const out = [];
         for (let i = 0; i < items.length; i += chunkSize) {
@@ -2084,8 +2218,8 @@ class WalletPermissionsManager {
     }
     async createPermissionTokensBestEffort(items) {
         const CHUNK = 25;
-        return this.runBestEffortBatches(items, CHUNK, async (chunk) => {
-            const built = await this.mapWithConcurrency(chunk, 8, c => this.buildPermissionOutput(c.request, c.expiry, c.amount));
+        return await this.runBestEffortBatches(items, CHUNK, async (chunk) => {
+            const built = await this.mapWithConcurrency(chunk, 8, async (c) => await this.buildPermissionOutput(c.request, c.expiry, c.amount));
             await this.createAction({
                 description: `Grant ${built.length} permissions`,
                 outputs: built.map(b => b.output),
@@ -2096,8 +2230,8 @@ class WalletPermissionsManager {
     }
     async renewPermissionTokensBestEffort(items) {
         const CHUNK = 15;
-        return this.runBestEffortBatches(items, CHUNK, async (chunk) => {
-            const built = await this.mapWithConcurrency(chunk, 8, c => this.buildPermissionOutput(c.request, c.expiry, c.amount));
+        return await this.runBestEffortBatches(items, CHUNK, async (chunk) => {
+            const built = await this.mapWithConcurrency(chunk, 8, async (c) => await this.buildPermissionOutput(c.request, c.expiry, c.amount));
             const inputBeef = new sdk_1.Beef();
             for (const c of chunk) {
                 inputBeef.mergeBeef(sdk_1.Beef.fromBinary(c.oldToken.tx));
@@ -2117,7 +2251,7 @@ class WalletPermissionsManager {
                     signAndProcess: false
                 }
             }, this.adminOriginator);
-            if (!(signableTransaction === null || signableTransaction === void 0 ? void 0 : signableTransaction.reference) || !signableTransaction.tx) {
+            if (!signableTransaction?.reference || !signableTransaction.tx) {
                 throw new Error('Failed to create signable transaction');
             }
             const partialTx = sdk_1.Transaction.fromAtomicBEEF(signableTransaction.tx);
@@ -2139,8 +2273,7 @@ class WalletPermissionsManager {
         });
     }
     async coalescePermissionTokens(oldTokens, newScript, opts) {
-        var _a;
-        if (!(oldTokens === null || oldTokens === void 0 ? void 0 : oldTokens.length))
+        if (!oldTokens?.length)
             throw new Error('No permission tokens to coalesce');
         if (oldTokens.length < 2)
             throw new Error('Need at least 2 tokens to coalesce');
@@ -2151,7 +2284,7 @@ class WalletPermissionsManager {
             inputBeef.mergeBeef(sdk_1.Beef.fromBinary(token.tx));
         }
         const { signableTransaction } = await this.createAction({
-            description: (_a = opts === null || opts === void 0 ? void 0 : opts.description) !== null && _a !== void 0 ? _a : `Coalesce ${oldTokens.length} permission tokens`,
+            description: opts?.description ?? `Coalesce ${oldTokens.length} permission tokens`,
             inputBEEF: inputBeef.toBinary(),
             inputs: oldTokens.map((t, i) => ({
                 outpoint: `${t.txid}.${t.outputIndex}`,
@@ -2163,8 +2296,8 @@ class WalletPermissionsManager {
                     lockingScript: newScript.toHex(),
                     satoshis: 1,
                     outputDescription: 'Renewed permission token',
-                    ...((opts === null || opts === void 0 ? void 0 : opts.basket) ? { basket: opts.basket } : {}),
-                    ...((opts === null || opts === void 0 ? void 0 : opts.tags) ? { tags: opts.tags } : {})
+                    ...(opts?.basket ? { basket: opts.basket } : {}),
+                    ...(opts?.tags == null ? {} : { tags: opts.tags })
                 }
             ],
             options: {
@@ -2173,7 +2306,7 @@ class WalletPermissionsManager {
                 signAndProcess: false
             }
         }, this.adminOriginator);
-        if (!(signableTransaction === null || signableTransaction === void 0 ? void 0 : signableTransaction.reference) || !signableTransaction.tx) {
+        if (!signableTransaction?.reference || !signableTransaction.tx) {
             throw new Error('Failed to create signable transaction');
         }
         // 2) Sign each input - each token needs its own unlocker with the correct locking script
@@ -2268,11 +2401,10 @@ class WalletPermissionsManager {
      * (protocol / basket / certificate / spending).
      */
     async buildPushdropFields(r, expiry, amount) {
-        var _a, _b;
         switch (r.type) {
             case 'protocol': {
                 const [secLevel, protoName] = r.protocolID;
-                const counterparty = secLevel === 2 ? ((_a = r.counterparty) !== null && _a !== void 0 ? _a : 'self') : '';
+                const counterparty = secLevel === 2 ? (r.counterparty ?? 'self') : '';
                 return [
                     await this.encryptPermissionTokenField(r.originator), // domain
                     await this.encryptPermissionTokenField(String(expiry)), // expiry
@@ -2302,7 +2434,7 @@ class WalletPermissionsManager {
             }
             case 'spending': {
                 // DSAP
-                const authAmt = amount !== null && amount !== void 0 ? amount : (((_b = r.spending) === null || _b === void 0 ? void 0 : _b.satoshis) || 0);
+                const authAmt = amount ?? (r.spending?.satoshis || 0);
                 return [
                     await this.encryptPermissionTokenField(r.originator),
                     await this.encryptPermissionTokenField(String(authAmt))
@@ -2315,15 +2447,12 @@ class WalletPermissionsManager {
      * origin, basket, privileged, protocol name, etc.
      */
     buildTagsForRequest(r) {
-        var _a;
         const tags = [`originator ${r.originator}`];
         switch (r.type) {
             case 'protocol': {
-                tags.push(`privileged ${!!r.privileged}`);
-                tags.push(`protocolName ${r.protocolID[1]}`);
-                tags.push(`protocolSecurityLevel ${r.protocolID[0]}`);
+                tags.push(`privileged ${!!r.privileged}`, `protocolName ${r.protocolID[1]}`, `protocolSecurityLevel ${r.protocolID[0]}`);
                 if (r.protocolID[0] === 2) {
-                    tags.push(`counterparty ${(_a = r.counterparty) !== null && _a !== void 0 ? _a : 'self'}`);
+                    tags.push(`counterparty ${r.counterparty ?? 'self'}`);
                 }
                 break;
             }
@@ -2332,9 +2461,7 @@ class WalletPermissionsManager {
                 break;
             }
             case 'certificate': {
-                tags.push(`privileged ${!!r.privileged}`);
-                tags.push(`type ${r.certificate.certType}`);
-                tags.push(`verifier ${r.certificate.verifier}`);
+                tags.push(`privileged ${!!r.privileged}`, `type ${r.certificate.certType}`, `verifier ${r.certificate.verifier}`);
                 break;
             }
             case 'spending': {
@@ -2357,74 +2484,62 @@ class WalletPermissionsManager {
      * @returns Array of permission tokens that match the filter criteria
      */
     async listProtocolPermissions({ originator, privileged, protocolName, protocolSecurityLevel, counterparty } = {}) {
-        const basketName = BASKET_MAP.protocol;
-        const baseTags = [];
-        if (privileged !== undefined) {
-            baseTags.push(`privileged ${!!privileged}`);
-        }
-        if (protocolName) {
-            baseTags.push(`protocolName ${protocolName}`);
-        }
-        if (protocolSecurityLevel !== undefined) {
-            baseTags.push(`protocolSecurityLevel ${protocolSecurityLevel}`);
-        }
-        if (counterparty) {
-            baseTags.push(`counterparty ${counterparty}`);
-        }
+        const baseTags = this.buildProtocolFilterTags({ privileged, protocolName, protocolSecurityLevel, counterparty });
         const originFilter = originator ? this.prepareOriginator(originator) : undefined;
-        const originVariants = originFilter ? originFilter.lookupValues : [undefined];
+        const originVariants = originFilter == null ? [undefined] : originFilter.lookupValues;
         const seen = new Set();
         const tokens = [];
         for (const originTag of originVariants) {
-            const tags = [...baseTags];
-            if (originTag) {
-                tags.push(`originator ${originTag}`);
-            }
-            const result = await this.underlying.listOutputs({
-                basket: basketName,
-                tags,
-                tagQueryMode: 'all',
-                include: 'entire transactions',
-                limit: 10000
-            }, this.adminOriginator);
-            for (const out of result.outputs) {
-                if (seen.has(out.outpoint))
-                    continue;
-                const [txid, outputIndexStr] = out.outpoint.split('.');
-                const tx = sdk_1.Transaction.fromBEEF(result.BEEF, txid);
-                const dec = sdk_1.PushDrop.decode(tx.outputs[Number(outputIndexStr)].lockingScript);
-                if (!(dec === null || dec === void 0 ? void 0 : dec.fields) || dec.fields.length < 6)
-                    continue;
-                const [domainRaw, expiryRaw, privRaw, secRaw, protoRaw, cptyRaw] = dec.fields;
-                const domainDec = sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(domainRaw));
-                const normalizedDomain = this.normalizeOriginator(domainDec);
-                if (originFilter && normalizedDomain !== originFilter.normalized) {
-                    continue;
-                }
-                const expiryDec = parseInt(sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(expiryRaw)), 10);
-                const privDec = sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(privRaw)) === 'true';
-                const secDec = parseInt(sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(secRaw)), 10);
-                const protoDec = sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(protoRaw));
-                const cptyDec = sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(cptyRaw));
-                seen.add(out.outpoint);
-                tokens.push({
-                    tx: tx.toBEEF(),
-                    txid: out.outpoint.split('.')[0],
-                    outputIndex: parseInt(out.outpoint.split('.')[1], 10),
-                    outputScript: tx.outputs[Number(outputIndexStr)].lockingScript.toHex(),
-                    satoshis: out.satoshis,
-                    originator: normalizedDomain,
-                    rawOriginator: domainDec,
-                    expiry: expiryDec,
-                    privileged: privDec,
-                    securityLevel: secDec,
-                    protocol: protoDec,
-                    counterparty: cptyDec
-                });
-            }
+            const tags = originTag != null ? [...baseTags, `originator ${originTag}`] : [...baseTags];
+            const result = await this.underlying.listOutputs({ basket: BASKET_MAP.protocol, tags, tagQueryMode: 'all', include: 'entire transactions', limit: 10000 }, this.adminOriginator);
+            await this.collectProtocolTokens(result, originFilter, seen, tokens);
         }
         return tokens;
     }
+    /** Builds the base tag array for protocol permission listing. */
+    buildProtocolFilterTags({ privileged, protocolName, protocolSecurityLevel, counterparty }) {
+        const tags = [];
+        if (privileged !== undefined)
+            tags.push(`privileged ${!!privileged}`);
+        if (protocolName)
+            tags.push(`protocolName ${protocolName}`);
+        if (protocolSecurityLevel !== undefined)
+            tags.push(`protocolSecurityLevel ${protocolSecurityLevel}`);
+        if (counterparty)
+            tags.push(`counterparty ${counterparty}`);
+        return tags;
+    }
+    /** Decodes and appends protocol permission tokens from a listOutputs result. */
+    async collectProtocolTokens(result, originFilter, seen, tokens) {
+        for (const out of result.outputs) {
+            if (seen.has(out.outpoint))
+                continue;
+            const [txid, outputIndex] = this.parseOutpoint(out.outpoint);
+            const tx = this.transactionFromResultBeef(result, txid);
+            const dec = sdk_1.PushDrop.decode(tx.outputs[outputIndex].lockingScript);
+            if (!dec?.fields || dec.fields.length < 6)
+                continue;
+            const f = await this.decryptProtocolTokenFields(dec.fields);
+            const normalizedDomain = this.normalizeOriginator(f.domainDecoded);
+            if (originFilter != null && normalizedDomain !== originFilter.normalized)
+                continue;
+            seen.add(out.outpoint);
+            tokens.push({
+                tx: tx.toBEEF(),
+                txid,
+                outputIndex,
+                outputScript: tx.outputs[outputIndex].lockingScript.toHex(),
+                satoshis: out.satoshis,
+                originator: normalizedDomain,
+                rawOriginator: f.domainDecoded,
+                expiry: f.expiryDecoded,
+                privileged: f.privDecoded,
+                securityLevel: f.secLevelDecoded,
+                protocol: f.protoNameDecoded,
+                counterparty: f.cptyDecoded
+            });
+        }
+    }
     /**
      * Returns true if the originator already holds a valid unexpired protocol permission.
      * This calls `ensureProtocolPermission` with `seekPermission=false`, so it won't prompt.
@@ -2439,7 +2554,7 @@ class WalletPermissionsManager {
             });
             return true;
         }
-        catch (_a) {
+        catch {
             return false;
         }
     }
@@ -2456,7 +2571,7 @@ class WalletPermissionsManager {
             baseTags.push(`basket ${params.basket}`);
         }
         const originFilter = params.originator ? this.prepareOriginator(params.originator) : undefined;
-        const originVariants = originFilter ? originFilter.lookupValues : [undefined];
+        const originVariants = originFilter == null ? [undefined] : originFilter.lookupValues;
         const seen = new Set();
         const tokens = [];
         for (const originTag of originVariants) {
@@ -2471,38 +2586,41 @@ class WalletPermissionsManager {
                 include: 'entire transactions',
                 limit: 10000
             }, this.adminOriginator);
-            for (const out of result.outputs) {
-                if (seen.has(out.outpoint))
-                    continue;
-                const [txid, outputIndexStr] = out.outpoint.split('.');
-                const tx = sdk_1.Transaction.fromBEEF(result.BEEF, txid);
-                const dec = sdk_1.PushDrop.decode(tx.outputs[Number(outputIndexStr)].lockingScript);
-                if (!(dec === null || dec === void 0 ? void 0 : dec.fields) || dec.fields.length < 3)
-                    continue;
-                const [domainRaw, expiryRaw, basketRaw] = dec.fields;
-                const domainDecoded = sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(domainRaw));
-                const normalizedDomain = this.normalizeOriginator(domainDecoded);
-                if (originFilter && normalizedDomain !== originFilter.normalized) {
-                    continue;
-                }
-                const expiryDecoded = parseInt(sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(expiryRaw)), 10);
-                const basketDecoded = sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(basketRaw));
-                seen.add(out.outpoint);
-                tokens.push({
-                    tx: tx.toBEEF(),
-                    txid: out.outpoint.split('.')[0],
-                    outputIndex: parseInt(out.outpoint.split('.')[1], 10),
-                    satoshis: out.satoshis,
-                    outputScript: tx.outputs[Number(outputIndexStr)].lockingScript.toHex(),
-                    originator: normalizedDomain,
-                    rawOriginator: domainDecoded,
-                    basketName: basketDecoded,
-                    expiry: expiryDecoded
-                });
-            }
+            await this.collectBasketTokens(result, originFilter, seen, tokens);
         }
         return tokens;
     }
+    /** Decodes and appends basket permission tokens from a listOutputs result. */
+    async collectBasketTokens(result, originFilter, seen, tokens) {
+        for (const out of result.outputs) {
+            if (seen.has(out.outpoint))
+                continue;
+            const [txid, outputIndex] = this.parseOutpoint(out.outpoint);
+            const tx = this.transactionFromResultBeef(result, txid);
+            const dec = sdk_1.PushDrop.decode(tx.outputs[outputIndex].lockingScript);
+            if (!dec?.fields || dec.fields.length < 3)
+                continue;
+            const [domainRaw, expiryRaw, basketRaw] = dec.fields;
+            const domainDecoded = sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(domainRaw));
+            const normalizedDomain = this.normalizeOriginator(domainDecoded);
+            if (originFilter != null && normalizedDomain !== originFilter.normalized)
+                continue;
+            const expiryDecoded = Number.parseInt(sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(expiryRaw)), 10);
+            const basketDecoded = sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(basketRaw));
+            seen.add(out.outpoint);
+            tokens.push({
+                tx: tx.toBEEF(),
+                txid,
+                outputIndex,
+                satoshis: out.satoshis,
+                outputScript: tx.outputs[outputIndex].lockingScript.toHex(),
+                originator: normalizedDomain,
+                rawOriginator: domainDecoded,
+                basketName: basketDecoded,
+                expiry: expiryDecoded
+            });
+        }
+    }
     /**
      * Returns `true` if the originator already holds a valid unexpired basket permission for `basket`.
      */
@@ -2512,11 +2630,11 @@ class WalletPermissionsManager {
                 originator: params.originator,
                 basket: params.basket,
                 seekPermission: false,
-                usageType: 'insertion' // TODO: Consider a generic case for "has"
+                usageType: 'insertion'
             });
             return true;
         }
-        catch (_a) {
+        catch {
             return false;
         }
     }
@@ -2539,18 +2657,18 @@ class WalletPermissionsManager {
         const tokens = [];
         for (const out of result.outputs) {
             const [txid, outputIndexStr] = out.outpoint.split('.');
-            const tx = sdk_1.Transaction.fromBEEF(result.BEEF, txid);
+            const tx = this.transactionFromResultBeef(result, txid);
             const dec = sdk_1.PushDrop.decode(tx.outputs[Number(outputIndexStr)].lockingScript);
-            if (!(dec === null || dec === void 0 ? void 0 : dec.fields) || dec.fields.length < 2)
+            if (!dec?.fields || dec.fields.length < 2)
                 continue;
             const [domainRaw, amtRaw] = dec.fields;
             const domainDecoded = sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(domainRaw));
             const amtDecodedStr = sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(amtRaw));
-            const authorizedAmount = parseInt(amtDecodedStr, 10);
+            const authorizedAmount = Number.parseInt(amtDecodedStr, 10);
             tokens.push({
                 tx: tx.toBEEF(),
                 txid: out.outpoint.split('.')[0],
-                outputIndex: parseInt(out.outpoint.split('.')[1], 10),
+                outputIndex: Number.parseInt(out.outpoint.split('.')[1], 10),
                 satoshis: out.satoshis,
                 outputScript: tx.outputs[Number(outputIndexStr)].lockingScript.toHex(),
                 originator: domainDecoded,
@@ -2573,7 +2691,7 @@ class WalletPermissionsManager {
             });
             return true;
         }
-        catch (_a) {
+        catch {
             return false;
         }
     }
@@ -2586,72 +2704,61 @@ class WalletPermissionsManager {
      * @returns Array of permission tokens that match the filter criteria
      */
     async listCertificateAccess(params = {}) {
-        const basketName = BASKET_MAP.certificate;
         const baseTags = [];
-        if (params.privileged !== undefined) {
+        if (params.privileged !== undefined)
             baseTags.push(`privileged ${!!params.privileged}`);
-        }
-        if (params.certType) {
+        if (params.certType)
             baseTags.push(`type ${params.certType}`);
-        }
-        if (params.verifier) {
+        if (params.verifier)
             baseTags.push(`verifier ${params.verifier}`);
-        }
         const originFilter = params.originator ? this.prepareOriginator(params.originator) : undefined;
-        const originVariants = originFilter ? originFilter.lookupValues : [undefined];
+        const originVariants = originFilter == null ? [undefined] : originFilter.lookupValues;
         const seen = new Set();
         const tokens = [];
         for (const originTag of originVariants) {
-            const tags = [...baseTags];
-            if (originTag) {
-                tags.push(`originator ${originTag}`);
-            }
-            const result = await this.underlying.listOutputs({
-                basket: basketName,
-                tags,
-                tagQueryMode: 'all',
-                include: 'entire transactions',
-                limit: 10000
-            }, this.adminOriginator);
-            for (const out of result.outputs) {
-                if (seen.has(out.outpoint))
-                    continue;
-                const [txid, outputIndexStr] = out.outpoint.split('.');
-                const tx = sdk_1.Transaction.fromBEEF(result.BEEF, txid);
-                const dec = sdk_1.PushDrop.decode(tx.outputs[Number(outputIndexStr)].lockingScript);
-                if (!(dec === null || dec === void 0 ? void 0 : dec.fields) || dec.fields.length < 6)
-                    continue;
-                const [domainRaw, expiryRaw, privRaw, typeRaw, fieldsRaw, verifierRaw] = dec.fields;
-                const domainDecoded = sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(domainRaw));
-                const normalizedDomain = this.normalizeOriginator(domainDecoded);
-                if (originFilter && normalizedDomain !== originFilter.normalized) {
-                    continue;
-                }
-                const expiryDecoded = parseInt(sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(expiryRaw)), 10);
-                const privDecoded = sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(privRaw)) === 'true';
-                const typeDecoded = sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(typeRaw));
-                const verifierDec = sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(verifierRaw));
-                const fieldsJson = await this.decryptPermissionTokenField(fieldsRaw);
-                const allFields = JSON.parse(sdk_1.Utils.toUTF8(fieldsJson));
-                seen.add(out.outpoint);
-                tokens.push({
-                    tx: tx.toBEEF(),
-                    txid: out.outpoint.split('.')[0],
-                    outputIndex: parseInt(out.outpoint.split('.')[1], 10),
-                    satoshis: out.satoshis,
-                    outputScript: tx.outputs[Number(outputIndexStr)].lockingScript.toHex(),
-                    originator: normalizedDomain,
-                    rawOriginator: domainDecoded,
-                    privileged: privDecoded,
-                    certType: typeDecoded,
-                    certFields: allFields,
-                    verifier: verifierDec,
-                    expiry: expiryDecoded
-                });
-            }
+            const tags = originTag != null ? [...baseTags, `originator ${originTag}`] : [...baseTags];
+            const result = await this.underlying.listOutputs({ basket: BASKET_MAP.certificate, tags, tagQueryMode: 'all', include: 'entire transactions', limit: 10000 }, this.adminOriginator);
+            await this.collectCertificateTokens(result, originFilter, seen, tokens);
         }
         return tokens;
     }
+    /** Decodes and appends certificate permission tokens from a listOutputs result. */
+    async collectCertificateTokens(result, originFilter, seen, tokens) {
+        for (const out of result.outputs) {
+            if (seen.has(out.outpoint))
+                continue;
+            const [txid, outputIndex] = this.parseOutpoint(out.outpoint);
+            const tx = this.transactionFromResultBeef(result, txid);
+            const dec = sdk_1.PushDrop.decode(tx.outputs[outputIndex].lockingScript);
+            if (!dec?.fields || dec.fields.length < 6)
+                continue;
+            const [domainRaw, expiryRaw, privRaw, typeRaw, fieldsRaw, verifierRaw] = dec.fields;
+            const domainDecoded = sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(domainRaw));
+            const normalizedDomain = this.normalizeOriginator(domainDecoded);
+            if (originFilter != null && normalizedDomain !== originFilter.normalized)
+                continue;
+            const expiryDecoded = Number.parseInt(sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(expiryRaw)), 10);
+            const privDecoded = sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(privRaw)) === 'true';
+            const typeDecoded = sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(typeRaw));
+            const verifierDec = sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(verifierRaw));
+            const allFields = JSON.parse(sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(fieldsRaw)));
+            seen.add(out.outpoint);
+            tokens.push({
+                tx: tx.toBEEF(),
+                txid,
+                outputIndex,
+                satoshis: out.satoshis,
+                outputScript: tx.outputs[outputIndex].lockingScript.toHex(),
+                originator: normalizedDomain,
+                rawOriginator: domainDecoded,
+                privileged: privDecoded,
+                certType: typeDecoded,
+                certFields: allFields,
+                verifier: verifierDec,
+                expiry: expiryDecoded
+            });
+        }
+    }
     /**
      * Returns `true` if the originator already holds a valid unexpired certificate access
      * for the given certType/fields. Does not prompt the user.
@@ -2669,7 +2776,7 @@ class WalletPermissionsManager {
             });
             return true;
         }
-        catch (_a) {
+        catch {
             return false;
         }
     }
@@ -2683,7 +2790,7 @@ class WalletPermissionsManager {
             basket: true,
             certificate: true,
             spending: true,
-            ...(opts || {})
+            ...opts
         };
         const [protocolTokens, basketTokens, certificateTokens, spendingTokens] = await Promise.all([
             include.protocol ? this.listProtocolPermissions({ originator }) : Promise.resolve([]),
@@ -2693,7 +2800,7 @@ class WalletPermissionsManager {
                 ? this.listSpendingAuthorizations({ originator: preparedOriginator.normalized })
                 : Promise.resolve([])
         ]);
-        const spendingTokenList = spendingTokens.length ? [spendingTokens[0]] : [];
+        const spendingTokenList = spendingTokens.length > 0 ? [spendingTokens[0]] : [];
         const allTokens = [...protocolTokens, ...basketTokens, ...certificateTokens, ...spendingTokenList];
         const seen = new Set();
         const deduped = allTokens.filter(t => {
@@ -2707,13 +2814,13 @@ class WalletPermissionsManager {
     }
     async revokePermissionTokensBestEffort(items) {
         const CHUNK = 15;
-        return this.runBestEffortBatches(items, CHUNK, async (chunk) => {
+        return await this.runBestEffortBatches(items, CHUNK, async (chunk) => {
             await this.revokePermissionTokensChunk(chunk);
             return chunk;
         });
     }
     async revokePermissionTokensChunk(oldTokens) {
-        if (!oldTokens.length)
+        if (oldTokens.length === 0)
             return;
         const inputBeef = new sdk_1.Beef();
         for (const token of oldTokens) {
@@ -2733,52 +2840,12 @@ class WalletPermissionsManager {
                 signAndProcess: false
             }
         }, this.adminOriginator);
-        if (!(signableTransaction === null || signableTransaction === void 0 ? void 0 : signableTransaction.reference) || !signableTransaction.tx) {
+        if (!signableTransaction?.reference || !signableTransaction.tx) {
             throw new Error('Failed to create signable transaction');
         }
         const tx = sdk_1.Transaction.fromAtomicBEEF(signableTransaction.tx);
-        const normalizeTxid = (txid) => (txid !== null && txid !== void 0 ? txid : '').toLowerCase();
-        const reverseHexTxid = (txid) => {
-            const hex = normalizeTxid(txid);
-            if (!/^[0-9a-f]{64}$/.test(hex))
-                return hex;
-            const bytes = hex.match(/../g);
-            return bytes ? bytes.reverse().join('') : hex;
-        };
-        const matchesOutpointString = (outpoint, token) => {
-            const dot = outpoint.lastIndexOf('.');
-            const colon = outpoint.lastIndexOf(':');
-            const sep = dot > colon ? dot : colon;
-            if (sep === -1)
-                return false;
-            const txidPart = outpoint.slice(0, sep);
-            const indexPart = outpoint.slice(sep + 1);
-            const vout = Number(indexPart);
-            if (!Number.isFinite(vout))
-                return false;
-            return normalizeTxid(txidPart) === normalizeTxid(token.txid) && vout === token.outputIndex;
-        };
-        const findInputIndexForToken = (token) => {
-            return tx.inputs.findIndex((input) => {
-                var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l, _m, _o;
-                const txidCandidate = (_g = (_f = (_e = (_d = (_c = (_b = (_a = input === null || input === void 0 ? void 0 : input.sourceTXID) !== null && _a !== void 0 ? _a : input === null || input === void 0 ? void 0 : input.sourceTxid) !== null && _b !== void 0 ? _b : input === null || input === void 0 ? void 0 : input.sourceTxId) !== null && _c !== void 0 ? _c : input === null || input === void 0 ? void 0 : input.prevTxId) !== null && _d !== void 0 ? _d : input === null || input === void 0 ? void 0 : input.prevTxid) !== null && _e !== void 0 ? _e : input === null || input === void 0 ? void 0 : input.prevTXID) !== null && _f !== void 0 ? _f : input === null || input === void 0 ? void 0 : input.txid) !== null && _g !== void 0 ? _g : input === null || input === void 0 ? void 0 : input.txID;
-                const voutCandidate = (_l = (_k = (_j = (_h = input === null || input === void 0 ? void 0 : input.sourceOutputIndex) !== null && _h !== void 0 ? _h : input === null || input === void 0 ? void 0 : input.sourceOutput) !== null && _j !== void 0 ? _j : input === null || input === void 0 ? void 0 : input.outputIndex) !== null && _k !== void 0 ? _k : input === null || input === void 0 ? void 0 : input.vout) !== null && _l !== void 0 ? _l : input === null || input === void 0 ? void 0 : input.prevOutIndex;
-                if (typeof txidCandidate === 'string' && typeof voutCandidate === 'number') {
-                    const cand = normalizeTxid(txidCandidate);
-                    const target = normalizeTxid(token.txid);
-                    if (cand === target && voutCandidate === token.outputIndex)
-                        return true;
-                    if (cand === reverseHexTxid(token.txid) && voutCandidate === token.outputIndex)
-                        return true;
-                }
-                const outpointCandidate = (_o = (_m = input === null || input === void 0 ? void 0 : input.outpoint) !== null && _m !== void 0 ? _m : input === null || input === void 0 ? void 0 : input.sourceOutpoint) !== null && _o !== void 0 ? _o : input === null || input === void 0 ? void 0 : input.prevOutpoint;
-                if (typeof outpointCandidate === 'string' && matchesOutpointString(outpointCandidate, token))
-                    return true;
-                return false;
-            });
-        };
         const inputsToSign = oldTokens.map(token => {
-            let permInputIndex = findInputIndexForToken(token);
+            let permInputIndex = this.findInputIndexForToken(tx, token);
             if (permInputIndex === -1 && tx.inputs.length === 1) {
                 permInputIndex = 0;
             }
@@ -2811,13 +2878,13 @@ class WalletPermissionsManager {
     async revokePermission(oldToken) {
         const oldOutpoint = `${oldToken.txid}.${oldToken.outputIndex}`;
         const { signableTransaction } = await this.createAction({
-            description: `Revoke permission`,
+            description: 'Revoke permission',
             inputBEEF: oldToken.tx,
             inputs: [
                 {
                     outpoint: oldOutpoint,
                     unlockingScriptLength: 73, // length of signature
-                    inputDescription: `Consume old permission token`
+                    inputDescription: 'Consume old permission token'
                 }
             ],
             options: {
@@ -2825,44 +2892,7 @@ class WalletPermissionsManager {
             }
         }, this.adminOriginator);
         const tx = sdk_1.Transaction.fromBEEF(signableTransaction.tx);
-        const normalizeTxid = (txid) => (txid !== null && txid !== void 0 ? txid : '').toLowerCase();
-        const reverseHexTxid = (txid) => {
-            const hex = normalizeTxid(txid);
-            if (!/^[0-9a-f]{64}$/.test(hex))
-                return hex;
-            const bytes = hex.match(/../g);
-            return bytes ? bytes.reverse().join('') : hex;
-        };
-        const matchesOutpointString = (outpoint) => {
-            const dot = outpoint.lastIndexOf('.');
-            const colon = outpoint.lastIndexOf(':');
-            const sep = dot > colon ? dot : colon;
-            if (sep === -1)
-                return false;
-            const txidPart = outpoint.slice(0, sep);
-            const indexPart = outpoint.slice(sep + 1);
-            const vout = Number(indexPart);
-            if (!Number.isFinite(vout))
-                return false;
-            return normalizeTxid(txidPart) === normalizeTxid(oldToken.txid) && vout === oldToken.outputIndex;
-        };
-        let permInputIndex = tx.inputs.findIndex((input) => {
-            var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l, _m, _o;
-            const txidCandidate = (_g = (_f = (_e = (_d = (_c = (_b = (_a = input === null || input === void 0 ? void 0 : input.sourceTXID) !== null && _a !== void 0 ? _a : input === null || input === void 0 ? void 0 : input.sourceTxid) !== null && _b !== void 0 ? _b : input === null || input === void 0 ? void 0 : input.sourceTxId) !== null && _c !== void 0 ? _c : input === null || input === void 0 ? void 0 : input.prevTxId) !== null && _d !== void 0 ? _d : input === null || input === void 0 ? void 0 : input.prevTxid) !== null && _e !== void 0 ? _e : input === null || input === void 0 ? void 0 : input.prevTXID) !== null && _f !== void 0 ? _f : input === null || input === void 0 ? void 0 : input.txid) !== null && _g !== void 0 ? _g : input === null || input === void 0 ? void 0 : input.txID;
-            const voutCandidate = (_l = (_k = (_j = (_h = input === null || input === void 0 ? void 0 : input.sourceOutputIndex) !== null && _h !== void 0 ? _h : input === null || input === void 0 ? void 0 : input.sourceOutput) !== null && _j !== void 0 ? _j : input === null || input === void 0 ? void 0 : input.outputIndex) !== null && _k !== void 0 ? _k : input === null || input === void 0 ? void 0 : input.vout) !== null && _l !== void 0 ? _l : input === null || input === void 0 ? void 0 : input.prevOutIndex;
-            if (typeof txidCandidate === 'string' && typeof voutCandidate === 'number') {
-                const cand = normalizeTxid(txidCandidate);
-                const target = normalizeTxid(oldToken.txid);
-                if (cand === target && voutCandidate === oldToken.outputIndex)
-                    return true;
-                if (cand === reverseHexTxid(oldToken.txid) && voutCandidate === oldToken.outputIndex)
-                    return true;
-            }
-            const outpointCandidate = (_o = (_m = input === null || input === void 0 ? void 0 : input.outpoint) !== null && _m !== void 0 ? _m : input === null || input === void 0 ? void 0 : input.sourceOutpoint) !== null && _o !== void 0 ? _o : input === null || input === void 0 ? void 0 : input.prevOutpoint;
-            if (typeof outpointCandidate === 'string' && matchesOutpointString(outpointCandidate))
-                return true;
-            return false;
-        });
+        let permInputIndex = this.findInputIndexForToken(tx, oldToken);
         if (permInputIndex === -1 && tx.inputs.length === 1) {
             permInputIndex = 0;
         }
@@ -2886,23 +2916,7 @@ class WalletPermissionsManager {
     async createAction(args, originator) {
         // 1) Identify unique P-modules involved (one per schemeID) from both baskets and labels
         const pModulesByScheme = new Map();
-        const nonPBaskets = [];
-        // Check baskets for p modules
-        if (args.outputs) {
-            for (const out of args.outputs) {
-                if (out.basket) {
-                    if (out.basket.startsWith('p ')) {
-                        const schemeID = out.basket.split(' ')[1];
-                        this.addPModuleByScheme(schemeID, 'basket', pModulesByScheme);
-                    }
-                    else {
-                        // Track non-P baskets for normal permission checks
-                        nonPBaskets.push(out.basket);
-                    }
-                }
-            }
-        }
-        // Check labels for p modules
+        const nonPBaskets = this.collectNonPBaskets(args.outputs, pModulesByScheme);
         const nonPLabels = this.splitLabelsByPermissionModule(args.labels, pModulesByScheme);
         // 2) Check permissions for non-P baskets
         for (const basket of nonPBaskets) {
@@ -2922,20 +2936,91 @@ class WalletPermissionsManager {
                 usageType: 'apply'
             });
         }
-        /**
-         * 4) Force signAndProcess=false unless the originator is admin and explicitly sets it to true.
-         *    This ensures the underlying wallet returns a signableTransaction, letting us parse the transaction
-         *    to determine net spending and request authorization if needed.
-         */
-        const modifiedOptions = { ...(args.options || {}) };
+        // 4) Force signAndProcess=false unless the originator is admin and explicitly sets it to true.
+        const modifiedOptions = this.enforceSignAndProcess(args.options, originator);
+        // 5) Encrypt transaction metadata, saving originals for spending auth and line items.
+        const originalDescription = args.description;
+        const { originalInputDescriptions, originalOutputDescriptions } = await this.encryptActionMetadata(args);
+        // 6) Call the underlying wallet's createAction with P-module chaining as needed.
+        const finalArgs = {
+            ...args,
+            options: modifiedOptions,
+            labels: [...(args.labels || []), `admin originator ${originator}`, `admin month ${this.getCurrentMonthYearUTC()}`]
+        };
+        let createResult = await this.callCreateActionWithPModules(finalArgs, pModulesByScheme, originator);
+        if (createResult.signableTransaction == null)
+            return createResult;
+        // 7) Parse the signable tx to determine net spend, then gate on spending authorization.
+        const tx = sdk_1.Transaction.fromAtomicBEEF(createResult.signableTransaction.tx);
+        const reference = createResult.signableTransaction.reference;
+        // 7a) SECURITY (GHSA-36f9-7rg5-cpf8) defense-in-depth: confirm every
+        // caller-requested output actually appears in the transaction we are about to
+        // authorize and sign. The locking scripts in the signable transaction
+        // originate from storage; a malicious or compromised remote storage provider
+        // could substitute a recipient script, which would then be signed and
+        // broadcast while this manager's caller/UI still shows the requested
+        // recipient. The signer (buildSignableTransaction) rejects this at the
+        // source; this is an independent check at the permissions layer.
+        try {
+            this.verifyRequestedOutputsPresent(tx, args);
+        }
+        catch (err) {
+            await this.underlying.abortAction({ reference });
+            throw err;
+        }
+        const { netSpent, lineItems } = this.computeNetSpend(tx, args, originalInputDescriptions, originalOutputDescriptions);
+        // 8) If netSpent > 0, require spending authorization. Abort if denied.
+        if (netSpent > 0) {
+            try {
+                await this.ensureSpendingAuthorization({
+                    originator: originator,
+                    satoshis: netSpent,
+                    lineItems,
+                    reason: originalDescription
+                });
+            }
+            catch (err) {
+                await this.underlying.abortAction({ reference });
+                throw err;
+            }
+        }
+        // 9) Finalize or return the signable transaction based on whether more signatures are needed.
+        const vargs = sdk_1.Validation.validateCreateActionArgs(args);
+        if (vargs.isSignAction)
+            return createResult;
+        const signResult = await this.underlying.signAction({ reference, spends: {}, options: args.options }, originator);
+        return { ...createResult, ...signResult, signableTransaction: undefined };
+    }
+    /** Scans outputs to split P-scheme baskets from regular baskets; registers P-modules as a side effect. */
+    collectNonPBaskets(outputs, pModulesByScheme) {
+        const nonPBaskets = [];
+        if (outputs == null)
+            return nonPBaskets;
+        for (const out of outputs) {
+            if (!out.basket)
+                continue;
+            if (out.basket.startsWith('p ')) {
+                this.addPModuleByScheme(out.basket.split(' ')[1], 'basket', pModulesByScheme);
+            }
+            else {
+                nonPBaskets.push(out.basket);
+            }
+        }
+        return nonPBaskets;
+    }
+    /** Enforces signAndProcess=false for non-admin originators; throws if admin override is missing. */
+    enforceSignAndProcess(options, originator) {
+        const modifiedOptions = { ...options };
         if (modifiedOptions.signAndProcess !== true) {
             modifiedOptions.signAndProcess = false;
         }
         else if (!this.isAdminOriginator(originator)) {
             throw new Error('Only the admin originator can set signAndProcess=true explicitly.');
         }
-        // 5) Encrypt transaction metadata, saving originals for use in permissions and line items.
-        const originalDescription = args.description;
+        return modifiedOptions;
+    }
+    /** Encrypts all description/instruction fields in args in-place; returns original (plaintext) copies. */
+    async encryptActionMetadata(args) {
         const originalInputDescriptions = {};
         const originalOutputDescriptions = {};
         const inputEncryptionTasks = (args.inputs || []).map(async (input, i) => {
@@ -2960,58 +3045,74 @@ class WalletPermissionsManager {
             ...inputEncryptionTasks,
             ...outputEncryptionTasks
         ]);
-        /**
-         * 6) Call the underlying wallet's createAction.
-         *    - If P-modules are involved, chain request transformations through them first
-         *    - Add two "admin" labels for tracking: "admin originator <domain>" and "admin month YYYY-MM"
-         *    - If P-modules are involved, chain response transformations back through them
-         */
-        const finalArgs = {
-            ...args,
-            options: modifiedOptions,
-            labels: [...(args.labels || []), `admin originator ${originator}`, `admin month ${this.getCurrentMonthYearUTC()}`]
-        };
-        let createResult;
-        if (pModulesByScheme.size > 0) {
-            // P-modules are involved - chain transformations
-            const pModules = Array.from(pModulesByScheme.values());
-            // Chain onRequest calls through all modules
-            let transformedArgs = finalArgs;
-            for (const module of pModules) {
-                const transformed = await module.onRequest({
-                    method: 'createAction',
-                    args: transformedArgs,
-                    originator: originator
-                });
-                transformedArgs = transformed.args;
-            }
-            // Call underlying wallet with transformed args
-            createResult = await this.underlying.createAction(transformedArgs, originator);
-            // Chain onResponse calls in reverse order
-            for (let i = pModules.length - 1; i >= 0; i--) {
-                createResult = await pModules[i].onResponse(createResult, {
-                    method: 'createAction',
-                    originator: originator
-                });
-            }
+        return { originalInputDescriptions, originalOutputDescriptions };
+    }
+    /** Calls underlying createAction, chaining P-module request/response transforms when needed. */
+    async callCreateActionWithPModules(finalArgs, pModulesByScheme, originator) {
+        if (pModulesByScheme.size === 0)
+            return await this.underlying.createAction(finalArgs, originator);
+        const pModules = Array.from(pModulesByScheme.values());
+        let transformedArgs = finalArgs;
+        for (const module of pModules) {
+            const transformed = await module.onRequest({
+                method: 'createAction',
+                args: transformedArgs,
+                originator: originator
+            });
+            transformedArgs = transformed.args;
         }
-        else {
-            // No P-modules - call underlying wallet directly
-            createResult = await this.underlying.createAction(finalArgs, originator);
+        let createResult = await this.underlying.createAction(transformedArgs, originator);
+        for (let i = pModules.length - 1; i >= 0; i--) {
+            createResult = await pModules[i].onResponse(createResult, { method: 'createAction', originator: originator });
         }
-        // If there's no signableTransaction, the underlying wallet must have fully finalized it. Return as is.
-        if (!createResult.signableTransaction) {
-            return createResult;
+        return createResult;
+    }
+    /**
+     * Computes the net satoshis the originator is spending in a createAction call,
+     * accounting for foreign (originator-provided) inputs and outputs plus the fee.
+     * Also builds the line items list for the spending authorization request.
+     */
+    /**
+     * Defense-in-depth verification that each caller-requested output (locking
+     * script + amount) is present in the transaction returned for signing.
+     *
+     * The scripts in the signable transaction originate from storage. A malicious
+     * or compromised remote storage provider could substitute a different
+     * recipient script for a caller-specified output. The signer
+     * (buildSignableTransaction) rejects this at the source; this is an
+     * independent check at the permissions layer so the substitution is caught
+     * regardless of how the signable transaction was produced.
+     *
+     * Outputs are matched as a multiset on (lockingScript, satoshis): the
+     * transaction also contains change/commission outputs and the output order is
+     * randomized by default, and a caller may legitimately request the same
+     * script+amount more than once.
+     *
+     * @throws Error if any caller-requested output is absent from the transaction.
+     */
+    verifyRequestedOutputsPresent(tx, args) {
+        const requested = args.outputs || [];
+        if (requested.length === 0)
+            return;
+        // All transaction outputs as (script hex, satoshis); each may satisfy at
+        // most one requested output.
+        const available = tx.outputs.map(o => ({
+            script: o.lockingScript.toHex().toLowerCase(),
+            satoshis: o.satoshis,
+            used: false
+        }));
+        for (let i = 0; i < requested.length; i++) {
+            const wantScript = (requested[i].lockingScript ?? '').toLowerCase();
+            const wantSats = requested[i].satoshis;
+            const match = available.find(a => !a.used && a.script === wantScript && a.satoshis === wantSats);
+            if (match == null) {
+                throw new Error(`The transaction returned for signing does not contain caller-requested output ${i} ` +
+                    `(locking script and amount). The recipient may have been substituted by storage.`);
+            }
+            match.used = true;
         }
-        /**
-         * 7) We have a signable transaction. Parse it to determine how much the originator is actually spending.
-         *    We only consider inputs the originator explicitly listed in args.inputs.
-         *    netSpent = (sum of originator-requested outputs) - (sum of matching originator inputs).
-         *    If netSpent > 0, we need spending authorization.
-         */
-        const tx = sdk_1.Transaction.fromAtomicBEEF(createResult.signableTransaction.tx);
-        const reference = createResult.signableTransaction.reference;
-        let netSpent = 0;
+    }
+    computeNetSpend(tx, args, originalInputDescriptions, originalOutputDescriptions) {
         const lineItems = [];
         // Sum originator-provided inputs:
         let totalInputSatoshis = 0;
@@ -3024,7 +3125,7 @@ class WalletPermissionsManager {
                 lineItems.push({
                     type: 'input',
                     description: originalInputDescriptions[matchingIndex] || 'No input description provided',
-                    satoshis: satoshis
+                    satoshis
                 });
             }
         }
@@ -3039,68 +3140,20 @@ class WalletPermissionsManager {
             });
         }
         // Add an entry for the transaction fee:
-        lineItems.push({
-            type: 'fee',
-            satoshis: tx.getFee(),
-            description: 'Network fee'
-        });
-        /**
-         * When it comes to spending authorizations, and the computation of net spend, there are
-         * two types of inputs and two types of outputs:
-         *
-         * There are foreign (originator-requested) ones, and domestic (internally-provided) ones.
-         * The net spend is always calculated from the domestic, internal perspective. Therefore, the
-         * cost of funding the foreign outputs is the base cost to the domestic user, unless this is
-         * somehow offset.
-         *
-         * The only way to offset this cost is when the foreign inputs help carry some of the burden.
-         * This is why we can subtract the sum of the foreign inputs from the sum of foreign outputs,
-         * to gague how much of that cost needs to be born domestically by the user.
-         *
-         * The logic does not need to account for whatever domestic inputs are provided, or whatever
-         * domestic outputs are re-captured by the wallet back as change. The wallet could conceivably
-         * provide 21e8 satoshis as input and re-capture the same amount as change, but the net effect
-         * on actual spending would be zero. Therefore, we base net spend on total foreign outflows
-         * minus total foreign inflows. Fees are also considered.
-         */
-        netSpent = totalOutputSatoshis + tx.getFee() - totalInputSatoshis;
-        // 8) If netSpent > 0, require spending authorization. Abort if denied.
-        if (netSpent > 0) {
-            try {
-                await this.ensureSpendingAuthorization({
-                    originator: originator,
-                    satoshis: netSpent,
-                    lineItems,
-                    reason: originalDescription
-                });
-            }
-            catch (err) {
-                await this.underlying.abortAction({ reference });
-                throw err;
-            }
-        }
+        const fee = tx.getFee();
+        lineItems.push({ type: 'fee', satoshis: fee, description: 'Network fee' });
         /**
-         * 9) Decide whether to finalize the transaction automatically or return the signableTransaction:
-         *    - If the user originally wanted signAndProcess (the default when undefined), we forcibly set it to false earlier, so check if we should now finalize it.
-         *    - If the transaction still needs more signatures, we must return the signableTransaction.
+         * Net spend = total foreign outflows minus total foreign inflows plus fee.
+         * Domestic wallet inputs/change outputs are not counted — they are internal.
          */
-        const vargs = sdk_1.Validation.validateCreateActionArgs(args);
-        if (vargs.isSignAction) {
-            return createResult;
-        }
-        const signResult = await this.underlying.signAction({ reference, spends: {}, options: args.options }, originator);
-        // Merge signResult into createResult and remove signableTransaction:
-        return {
-            ...createResult,
-            ...signResult,
-            signableTransaction: undefined
-        };
+        const netSpent = totalOutputSatoshis + fee - totalInputSatoshis;
+        return { netSpent, lineItems };
     }
     async signAction(...args) {
-        return this.underlying.signAction(...args);
+        return await this.underlying.signAction(...args);
     }
     async abortAction(...args) {
-        return this.underlying.abortAction(...args);
+        return await this.underlying.abortAction(...args);
     }
     async listActions(...args) {
         const [requestArgs, originator] = args;
@@ -3149,89 +3202,89 @@ class WalletPermissionsManager {
         // 4) Transparently decrypt transaction metadata, if configured to do so.
         return await this.decryptListActionsMetadata(results);
     }
-    async internalizeAction(...args) {
-        var _a;
-        const [requestArgs, originator] = args;
-        // 1) Identify unique P-modules involved (one per schemeID) from both baskets and labels
-        const pModulesByScheme = new Map();
-        const nonPBaskets = [];
-        // Check baskets for p modules
+    collectInternalizeActionBaskets(requestArgs, pModulesByScheme) {
+        const nonPModuleBaskets = [];
         for (const outIndex in requestArgs.outputs) {
-            const out = requestArgs.outputs[outIndex];
-            if (out.protocol === 'basket insertion') {
-                const basket = out.insertionRemittance.basket;
-                if (basket.startsWith('p ')) {
-                    const schemeID = basket.split(' ')[1];
-                    this.addPModuleByScheme(schemeID, 'basket', pModulesByScheme);
-                }
-                else {
-                    // Track non-P baskets for normal permission checks
-                    nonPBaskets.push({
-                        outIndex,
-                        basket,
-                        customInstructions: out.insertionRemittance.customInstructions
-                    });
-                }
+            const output = requestArgs.outputs[outIndex];
+            if (output.protocol !== 'basket insertion')
+                continue;
+            const { basket, customInstructions } = output.insertionRemittance;
+            if (basket.startsWith('p ')) {
+                this.addPModuleByScheme(basket.split(' ')[1], 'basket', pModulesByScheme);
+            }
+            else {
+                nonPModuleBaskets.push({ outIndex, basket, customInstructions });
             }
         }
-        // Check labels for p modules
-        const nonPLabels = this.splitLabelsByPermissionModule(requestArgs.labels, pModulesByScheme);
-        // 2) Check permissions for non-P baskets
-        for (const { outIndex, basket, customInstructions } of nonPBaskets) {
+        return nonPModuleBaskets;
+    }
+    async authorizeInternalizeActionBaskets(requestArgs, originator, baskets) {
+        for (const { outIndex, basket, customInstructions } of baskets) {
             await this.ensureBasketAccess({
-                originator: originator,
+                originator,
                 basket,
                 reason: requestArgs.description,
                 usageType: 'insertion'
             });
-            if (customInstructions) {
-                requestArgs.outputs[outIndex].insertionRemittance.customInstructions =
-                    await this.maybeEncryptMetadata(customInstructions);
-            }
+            if (customInstructions == null || customInstructions === '')
+                continue;
+            requestArgs.outputs[outIndex].insertionRemittance.customInstructions =
+                await this.maybeEncryptMetadata(customInstructions);
         }
-        // 3) Check permissions for non-P labels
-        for (const lbl of nonPLabels) {
+    }
+    async authorizeInternalizeActionLabels(requestArgs, originator, labels) {
+        for (const label of labels) {
             await this.ensureLabelAccess({
-                originator: originator,
-                label: lbl,
+                originator,
+                label,
                 reason: requestArgs.description,
                 usageType: 'apply'
             });
         }
+    }
+    async encryptInternalizeActionModuleMetadata(requestArgs) {
+        for (const outIndex in requestArgs.outputs) {
+            const output = requestArgs.outputs[outIndex];
+            const customInstructions = output.insertionRemittance?.customInstructions;
+            if (output.protocol !== 'basket insertion' || !customInstructions)
+                continue;
+            output.insertionRemittance.customInstructions = await this.maybeEncryptMetadata(customInstructions);
+        }
+    }
+    async runInternalizeActionModules(requestArgs, originator, modules) {
+        let transformedArgs = requestArgs;
+        for (const module of modules) {
+            const transformed = await module.onRequest({
+                method: 'internalizeAction',
+                args: transformedArgs,
+                originator
+            });
+            transformedArgs = transformed.args;
+        }
+        await this.encryptInternalizeActionModuleMetadata(transformedArgs);
+        let result = await this.underlying.internalizeAction(transformedArgs, originator);
+        for (let index = modules.length - 1; index >= 0; index--) {
+            result = await modules[index].onResponse(result, {
+                method: 'internalizeAction',
+                originator
+            });
+        }
+        return result;
+    }
+    async internalizeAction(...args) {
+        const [requestArgs, originator] = args;
+        // 1) Identify unique P-modules involved (one per schemeID) from both baskets and labels
+        const pModulesByScheme = new Map();
+        const nonPBaskets = this.collectInternalizeActionBaskets(requestArgs, pModulesByScheme);
+        const nonPLabels = this.splitLabelsByPermissionModule(requestArgs.labels, pModulesByScheme);
+        await this.authorizeInternalizeActionBaskets(requestArgs, originator, nonPBaskets);
+        await this.authorizeInternalizeActionLabels(requestArgs, originator, nonPLabels);
         // 4) Call underlying wallet, with P-module transformations if needed
         if (pModulesByScheme.size > 0) {
-            // P-modules are involved - chain transformations
-            const pModules = Array.from(pModulesByScheme.values());
-            // Chain onRequest calls through all modules in order
-            let transformedArgs = requestArgs;
-            for (const module of pModules) {
-                const transformed = await module.onRequest({
-                    method: 'internalizeAction',
-                    args: transformedArgs,
-                    originator: originator
-                });
-                transformedArgs = transformed.args;
-            }
-            // Encrypt custom instructions for p basket outputs
-            for (const outIndex in transformedArgs.outputs) {
-                const out = transformedArgs.outputs[outIndex];
-                if (out.protocol === 'basket insertion' && ((_a = out.insertionRemittance) === null || _a === void 0 ? void 0 : _a.customInstructions)) {
-                    out.insertionRemittance.customInstructions = await this.maybeEncryptMetadata(out.insertionRemittance.customInstructions);
-                }
-            }
-            // Call underlying wallet with transformed args
-            let results = await this.underlying.internalizeAction(transformedArgs, originator);
-            // Chain onResponse calls in reverse order
-            for (let i = pModules.length - 1; i >= 0; i--) {
-                results = await pModules[i].onResponse(results, {
-                    method: 'internalizeAction',
-                    originator: originator
-                });
-            }
-            return results;
+            return await this.runInternalizeActionModules(requestArgs, originator, Array.from(pModulesByScheme.values()));
         }
         // No P-modules - call underlying wallet directly
-        return this.underlying.internalizeAction(...args);
+        return await this.underlying.internalizeAction(...args);
     }
     async listOutputs(...args) {
         const [requestArgs, originator] = args;
@@ -3270,11 +3323,11 @@ class WalletPermissionsManager {
             reason: 'relinquishOutput',
             usageType: 'removal'
         });
-        return this.underlying.relinquishOutput(...args);
+        return await this.underlying.relinquishOutput(...args);
     }
     async getPublicKey(...args) {
         const [requestArgs, originator] = args;
-        if (requestArgs.protocolID) {
+        if (requestArgs.protocolID != null) {
             // Delegate to permission module if needed
             const pModuleResult = await this.delegateToPModuleIfNeeded(requestArgs.protocolID[1], 'getPublicKey', requestArgs, originator, async (transformedArgs) => {
                 return await this.underlying.getPublicKey(transformedArgs, originator);
@@ -3289,6 +3342,7 @@ class WalletPermissionsManager {
                 protocolID: requestArgs.protocolID,
                 counterparty: requestArgs.counterparty || 'self',
                 reason: requestArgs.privilegedReason,
+                seekPermission: requestArgs.seekPermission,
                 usageType: 'publicKey'
             });
         }
@@ -3300,10 +3354,11 @@ class WalletPermissionsManager {
                 protocolID: [1, 'identity key retrieval'],
                 counterparty: 'self',
                 reason: requestArgs.privilegedReason,
+                seekPermission: requestArgs.seekPermission,
                 usageType: 'identityKey'
             });
         }
-        return this.underlying.getPublicKey(...args);
+        return await this.underlying.getPublicKey(...args);
     }
     async revealCounterpartyKeyLinkage(...args) {
         const [requestArgs, originator] = args;
@@ -3315,7 +3370,7 @@ class WalletPermissionsManager {
             reason: requestArgs.privilegedReason,
             usageType: 'linkageRevelation'
         });
-        return this.underlying.revealCounterpartyKeyLinkage(...args);
+        return await this.underlying.revealCounterpartyKeyLinkage(...args);
     }
     async revealSpecificKeyLinkage(...args) {
         const [requestArgs, originator] = args;
@@ -3330,7 +3385,7 @@ class WalletPermissionsManager {
             reason: requestArgs.privilegedReason,
             usageType: 'linkageRevelation'
         });
-        return this.underlying.revealSpecificKeyLinkage(...args);
+        return await this.underlying.revealSpecificKeyLinkage(...args);
     }
     async encrypt(...args) {
         const [requestArgs, originator] = args;
@@ -3349,7 +3404,7 @@ class WalletPermissionsManager {
             reason: requestArgs.privilegedReason,
             usageType: 'encrypting'
         });
-        return this.underlying.encrypt(...args);
+        return await this.underlying.encrypt(...args);
     }
     async decrypt(...args) {
         const [requestArgs, originator] = args;
@@ -3368,7 +3423,7 @@ class WalletPermissionsManager {
             reason: requestArgs.privilegedReason,
             usageType: 'encrypting'
         });
-        return this.underlying.decrypt(...args);
+        return await this.underlying.decrypt(...args);
     }
     async createHmac(...args) {
         const [requestArgs, originator] = args;
@@ -3387,7 +3442,7 @@ class WalletPermissionsManager {
             reason: requestArgs.privilegedReason,
             usageType: 'hmac'
         });
-        return this.underlying.createHmac(...args);
+        return await this.underlying.createHmac(...args);
     }
     async verifyHmac(...args) {
         const [requestArgs, originator] = args;
@@ -3406,7 +3461,7 @@ class WalletPermissionsManager {
             reason: requestArgs.privilegedReason,
             usageType: 'hmac'
         });
-        return this.underlying.verifyHmac(...args);
+        return await this.underlying.verifyHmac(...args);
     }
     async createSignature(...args) {
         const [requestArgs, originator] = args;
@@ -3425,7 +3480,7 @@ class WalletPermissionsManager {
             reason: requestArgs.privilegedReason,
             usageType: 'signing'
         });
-        return this.underlying.createSignature(...args);
+        return await this.underlying.createSignature(...args);
     }
     async verifySignature(...args) {
         const [requestArgs, originator] = args;
@@ -3444,7 +3499,7 @@ class WalletPermissionsManager {
             reason: requestArgs.privilegedReason,
             usageType: 'signing'
         });
-        return this.underlying.verifySignature(...args);
+        return await this.underlying.verifySignature(...args);
     }
     async acquireCertificate(...args) {
         const [requestArgs, originator] = args;
@@ -3458,7 +3513,7 @@ class WalletPermissionsManager {
                 usageType: 'generic'
             });
         }
-        return this.underlying.acquireCertificate(...args);
+        return await this.underlying.acquireCertificate(...args);
     }
     async listCertificates(...args) {
         const [requestArgs, originator] = args;
@@ -3466,13 +3521,13 @@ class WalletPermissionsManager {
             await this.ensureProtocolPermission({
                 originator: originator,
                 privileged: requestArgs.privileged,
-                protocolID: [1, `certificate list`],
+                protocolID: [1, 'certificate list'],
                 counterparty: 'self',
                 reason: requestArgs.privilegedReason,
                 usageType: 'generic'
             });
         }
-        return this.underlying.listCertificates(...args);
+        return await this.underlying.listCertificates(...args);
     }
     async proveCertificate(...args) {
         const [requestArgs, originator] = args;
@@ -3485,21 +3540,21 @@ class WalletPermissionsManager {
             reason: 'proveCertificate',
             usageType: 'disclosure'
         });
-        return this.underlying.proveCertificate(...args);
+        return await this.underlying.proveCertificate(...args);
     }
     async relinquishCertificate(...args) {
         const [requestArgs, originator] = args;
         if (this.config.seekCertificateRelinquishmentPermissions) {
             await this.ensureProtocolPermission({
                 originator: originator,
-                privileged: requestArgs.privileged ? true : false,
+                privileged: !!requestArgs.privileged,
                 protocolID: [1, `certificate relinquishment ${requestArgs.type}`],
                 counterparty: 'self',
                 reason: requestArgs.privilegedReason || 'relinquishCertificate',
                 usageType: 'generic'
             });
         }
-        return this.underlying.relinquishCertificate(...args);
+        return await this.underlying.relinquishCertificate(...args);
     }
     async discoverByIdentityKey(...args) {
         const [_, originator] = args;
@@ -3507,13 +3562,13 @@ class WalletPermissionsManager {
             await this.ensureProtocolPermission({
                 originator: originator,
                 privileged: false,
-                protocolID: [1, `identity resolution`],
+                protocolID: [1, 'identity resolution'],
                 counterparty: 'self',
                 reason: 'discoverByIdentityKey',
                 usageType: 'generic'
             });
         }
-        return this.underlying.discoverByIdentityKey(...args);
+        return await this.underlying.discoverByIdentityKey(...args);
     }
     async discoverByAttributes(...args) {
         const [_, originator] = args;
@@ -3521,26 +3576,26 @@ class WalletPermissionsManager {
             await this.ensureProtocolPermission({
                 originator: originator,
                 privileged: false,
-                protocolID: [1, `identity resolution`],
+                protocolID: [1, 'identity resolution'],
                 counterparty: 'self',
                 reason: 'discoverByAttributes',
                 usageType: 'generic'
             });
         }
-        return this.underlying.discoverByAttributes(...args);
+        return await this.underlying.discoverByAttributes(...args);
     }
     async isAuthenticated(...args) {
-        return this.underlying.isAuthenticated(...args);
+        return await this.underlying.isAuthenticated(...args);
     }
     async waitForAuthentication(...args) {
-        let [_, originator] = args;
+        const [_, originator] = args;
         if (this.config.seekGroupedPermission && originator) {
             const { normalized: normalizedOriginator } = this.prepareOriginator(originator);
             const normalized = normalizedOriginator;
             await this.withGroupedPermissionFlowLock(normalized, async () => {
                 // 1. Fetch manifest.json from the originator
                 const groupPermissions = await this.fetchManifestGroupPermissions(normalized);
-                if (groupPermissions) {
+                if (groupPermissions != null) {
                     // 2. Filter out already-granted permissions
                     const permissionsToRequest = await this.filterAlreadyGrantedPermissions(normalized, groupPermissions);
                     // 3. If any permissions are left to request, start the flow
@@ -3573,19 +3628,19 @@ class WalletPermissionsManager {
             });
         }
         // Finally, after handling grouped permissions, call the underlying method.
-        return this.underlying.waitForAuthentication(...args);
+        return await this.underlying.waitForAuthentication(...args);
     }
     async getHeight(...args) {
-        return this.underlying.getHeight(...args);
+        return await this.underlying.getHeight(...args);
     }
     async getHeaderForHeight(...args) {
-        return this.underlying.getHeaderForHeight(...args);
+        return await this.underlying.getHeaderForHeight(...args);
     }
     async getNetwork(...args) {
-        return this.underlying.getNetwork(...args);
+        return await this.underlying.getNetwork(...args);
     }
     async getVersion(...args) {
-        return this.underlying.getVersion(...args);
+        return await this.underlying.getVersion(...args);
     }
     /* ---------------------------------------------------------------------
      *  8) INTERNAL HELPER UTILITIES
@@ -3640,13 +3695,44 @@ class WalletPermissionsManager {
             return true;
         return false;
     }
+    /**
+     * Whether the permission is satisfied without consulting on-chain tokens:
+     * cached, recently granted, or — when the user just granted it and its
+     * token is still minting — after the in-flight mint settles. Spares the
+     * user a duplicate prompt for a grant they already made moments ago.
+     */
+    async hasRecentOrPendingGrant(cacheKey) {
+        if (!this.telemetry.enabled)
+            return await this.hasRecentOrPendingGrantCore(cacheKey);
+        return await this.telemetry.withSpan('wallet.permission.cache_check', {
+            component: 'wallet-permissions'
+        }, async (span) => {
+            const result = await this.hasRecentOrPendingGrantCore(cacheKey);
+            span.end({
+                attributes: {
+                    'permission.cache_hit': result,
+                    'permission.mint_in_flight': this.mintsInFlight.has(cacheKey)
+                }
+            });
+            return result;
+        });
+    }
+    async hasRecentOrPendingGrantCore(cacheKey) {
+        if (this.isPermissionCached(cacheKey) || this.isRecentlyGranted(cacheKey))
+            return true;
+        const inFlight = this.mintsInFlight.get(cacheKey);
+        if (inFlight == null)
+            return false;
+        await inFlight;
+        return this.isPermissionCached(cacheKey) || this.isRecentlyGranted(cacheKey);
+    }
     /**
      * Returns true if we have a cached record that the permission identified by
      * `key` is valid and unexpired.
      */
     isPermissionCached(key) {
         const entry = this.permissionCache.get(key);
-        if (!entry)
+        if (entry == null)
             return false;
         if (Date.now() - entry.cachedAt > WalletPermissionsManager.CACHE_TTL_MS) {
             this.permissionCache.delete(key);
@@ -3707,25 +3793,24 @@ class WalletPermissionsManager {
             }
             return port ? `${baseHost}:${port}` : baseHost;
         }
-        catch (_a) {
+        catch {
             // Fall back to a conservative lowercase trim if URL parsing fails.
             return trimmed.toLowerCase();
         }
     }
     isWhitelistedCounterpartyProtocol(counterparty, protocolID) {
-        var _a;
         const whitelist = this.config.whitelistedCounterparties;
-        if (!whitelist)
+        if (whitelist == null)
             return false;
         if (!counterparty || counterparty === 'self' || counterparty === 'anyone')
             return false;
         const protocols = whitelist[counterparty] || whitelist[counterparty.toLowerCase()] || whitelist[counterparty.toUpperCase()];
         if (!protocols || protocols.length === 0)
             return false;
-        const protoName = ((_a = protocolID === null || protocolID === void 0 ? void 0 : protocolID[1]) !== null && _a !== void 0 ? _a : '').toString().toLowerCase();
+        const protoName = (protocolID?.[1] ?? '').toString().toLowerCase();
         if (!protoName)
             return false;
-        return protocols.some(p => (p !== null && p !== void 0 ? p : '').toString().toLowerCase() === protoName);
+        return protocols.some(p => (p ?? '').toString().toLowerCase() === protoName);
     }
     /**
      * Produces a normalized originator value along with the set of legacy
@@ -3733,7 +3818,7 @@ class WalletPermissionsManager {
      * permission tokens (for backwards compatibility).
      */
     prepareOriginator(originator) {
-        const trimmed = originator === null || originator === void 0 ? void 0 : originator.trim();
+        const trimmed = originator?.trim();
         if (!trimmed) {
             throw new Error('Originator is required for permission checks.');
         }
@@ -3748,7 +3833,7 @@ class WalletPermissionsManager {
     buildOriginatorLookupValues(...origins) {
         const variants = new Set();
         for (const origin of origins) {
-            const trimmed = origin === null || origin === void 0 ? void 0 : origin.trim();
+            const trimmed = origin?.trim();
             if (trimmed) {
                 variants.add(trimmed);
             }
@@ -3760,58 +3845,25 @@ class WalletPermissionsManager {
      * do not produce multiple user prompts.
      */
     buildRequestKey(r) {
-        var _a, _b, _c, _d, _e;
         const normalizedOriginator = this.normalizeOriginator(r.originator);
         switch (r.type) {
             case 'protocol':
-                return `proto:${normalizedOriginator}:${!!r.privileged}:${(_a = r.protocolID) === null || _a === void 0 ? void 0 : _a.join(',')}:${r.counterparty}`;
+                return `proto:${normalizedOriginator}:${!!r.privileged}:${r.protocolID?.join(',')}:${r.counterparty}`;
             case 'basket':
                 return `basket:${normalizedOriginator}:${r.basket}`;
             case 'certificate':
-                return `cert:${normalizedOriginator}:${!!r.privileged}:${(_b = r.certificate) === null || _b === void 0 ? void 0 : _b.verifier}:${(_c = r.certificate) === null || _c === void 0 ? void 0 : _c.certType}:${(_d = r.certificate) === null || _d === void 0 ? void 0 : _d.fields.join('|')}`;
+                return `cert:${normalizedOriginator}:${!!r.privileged}:${r.certificate?.verifier}:${r.certificate?.certType}:${r.certificate?.fields.join('|')}`;
             case 'spending':
-                return `spend:${normalizedOriginator}:${(_e = r.spending) === null || _e === void 0 ? void 0 : _e.satoshis}`;
+                return `spend:${normalizedOriginator}:${r.spending?.satoshis}`;
         }
     }
     buildActiveRequestKey(r) {
-        var _a;
         const base = this.buildRequestKey(r);
         if (r.type === 'protocol' || r.type === 'basket' || r.type === 'certificate') {
-            return `${base}:${(_a = r.usageType) !== null && _a !== void 0 ? _a : ''}`;
+            return `${base}:${r.usageType ?? ''}`;
         }
         return base;
     }
 }
 exports.WalletPermissionsManager = WalletPermissionsManager;
-WalletPermissionsManager.MANIFEST_CACHE_TTL_MS = 5 * 60 * 1000;
-/** How long a cached permission remains valid (5 minutes). */
-WalletPermissionsManager.CACHE_TTL_MS = 5 * 60 * 1000;
-/** Window during which freshly granted permissions are auto-allowed (except spending). */
-WalletPermissionsManager.RECENT_GRANT_COVER_MS = 15 * 1000;
-/** Default ports used when normalizing originator values. */
-WalletPermissionsManager.DEFAULT_PORTS = {
-    'http:': '80',
-    'https:': '443'
-};
-/* ---------------------------------------------------------------------
- *  4) SEARCH / DECODE / DECRYPT ON-CHAIN TOKENS (PushDrop Scripts)
- * --------------------------------------------------------------------- */
-/**
- * We will use a administrative "permission token encryption" protocol to store fields
- * in each permission's PushDrop script. This ensures that only the user's wallet
- * can decrypt them. In practice, this data is not super sensitive, but we still
- * follow the principle of least exposure.
- */
-WalletPermissionsManager.PERM_TOKEN_ENCRYPTION_PROTOCOL = [
-    2,
-    'admin permission token encryption'
-];
-/**
- * Similarly, we will use a "metadata encryption" protocol to preserve the confidentiality
- * of transaction descriptions and input/output descriptions from lower storage layers.
- */
-WalletPermissionsManager.METADATA_ENCRYPTION_PROTOCOL = [
-    2,
-    'admin metadata encryption'
-];
 //# sourceMappingURL=WalletPermissionsManager.js.map