@bopen-io/wallet-toolbox 2.6.2-brc153.5 → 2.15.0-bopen.1

package/out/src/Wallet.js

@@ -2,7 +2,9 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.Wallet = void 0;
 exports.throwDummyReviewActions = throwDummyReviewActions;
+const validationHelpers_1 = require("@bsv/sdk/wallet/validationHelpers");
 const sdk_1 = require("@bsv/sdk");
+const utils_1 = require("@bsv/sdk/primitives/utils");
 const acquireDirectCertificate_1 = require("./signer/methods/acquireDirectCertificate");
 const proveCertificate_1 = require("./signer/methods/proveCertificate");
 const createAction_1 = require("./signer/methods/createAction");
@@ -11,6 +13,8 @@ const internalizeAction_1 = require("./signer/methods/internalizeAction");
 const WalletSettingsManager_1 = require("./WalletSettingsManager");
 const identityUtils_1 = require("./utility/identityUtils");
 const generateChange_1 = require("./storage/methods/generateChange");
+const brc177NoSendExpiry_1 = require("./utility/brc177NoSendExpiry");
+const createNoSendExpiryAction_1 = require("./signer/methods/createNoSendExpiryAction");
 const utilityHelpers_1 = require("./utility/utilityHelpers");
 const ScriptTemplateBRC29_1 = require("./utility/ScriptTemplateBRC29");
 const types_1 = require("./sdk/types");
@@ -19,6 +23,7 @@ const WalletError_1 = require("./sdk/WalletError");
 const utilityHelpers_noBuffer_1 = require("./utility/utilityHelpers.noBuffer");
 const resultBeef_1 = require("./signer/methods/resultBeef");
 const ActionBatchWorkspace_1 = require("./signer/actionBatch/ActionBatchWorkspace");
+const walletResultGuards_1 = require("./utility/walletResultGuards");
 function prepareKnownTxidsForCreateAction(wallet, args) {
     if (!wallet.autoKnownTxids || args.options?.knownTxids != null)
         return;
@@ -36,11 +41,23 @@ function prepareKnownTxidsForCreateAction(wallet, args) {
         return knownTxids;
     });
 }
+/**
+ * The requested page of a discovery result. BRC-100 discovery takes limit and
+ * offset, and callers reject a page longer than the limit; totalCertificates
+ * still counts every trusted match.
+ */
+function discoveryPage(result, offset, limit) {
+    return {
+        totalCertificates: result.totalCertificates,
+        certificates: result.certificates.slice(offset, offset + limit)
+    };
+}
 /**
  * Build a {@link DiscoverCertificatesResult} from contact records so {@link Wallet.discoverByIdentityKey}
  * and {@link Wallet.discoverByAttributes} can short-circuit on a local contacts hit. The synthetic
- * certificate has `trust: Infinity` by default so downstream `transformVerifiableCertificatesWithTrust`
- * style filtering treats contacts as authoritative.
+ * result has `trust: Infinity` by default so downstream trust filtering honors the user's local
+ * assertion as authoritative. Its empty serial, signature, and revocation outpoint deliberately
+ * distinguish it from an independently certified third-party attestation.
  */
 function synthesizeContactResult(contacts) {
     const certificates = contacts.map(c => ({
@@ -161,6 +178,10 @@ class Wallet {
         }
     }
     async destroy() {
+        this._identityEvidenceClosed = true;
+        this._identityEvidenceVerifier?.dispose();
+        this._overlayEvidenceCache.clear();
+        clearTimeout(this._overlayEvidenceExpiryTimer);
         await this.actionBatch.abort();
         await this.storage.destroy();
         if (this.privilegedKeyManager != null)
@@ -316,8 +337,8 @@ class Wallet {
     // List Methods
     /// ///////////////
     async listActions(args, originator) {
-        sdk_1.Validation.validateOriginator(originator);
-        const { vargs } = this.validateAuthAndArgs(args, sdk_1.Validation.validateListActionsArgs);
+        (0, validationHelpers_1.validateOriginator)(originator);
+        const { vargs } = this.validateAuthAndArgs(args, validationHelpers_1.validateListActionsArgs);
         const storageArgs = this.actionBatch.hasWorkspace ? { ...vargs, limit: 10000, offset: 0 } : vargs;
         const r = this.actionBatch.overlayListActions(await this.storage.listActions(storageArgs), vargs);
         // Implement security policy to block customInstructions from output results.
@@ -334,7 +355,7 @@ class Wallet {
         return `storage ${this.getStorageIdentity().storageIdentityKey}`;
     }
     async listOutputs(args, originator) {
-        sdk_1.Validation.validateOriginator(originator);
+        (0, validationHelpers_1.validateOriginator)(originator);
         const { vargs } = this.validateAuthAndArgs(args, validateListOutputsArgs);
         if (this.autoKnownTxids && !vargs.knownTxids) {
             vargs.knownTxids = this.getKnownTxids();
@@ -350,8 +371,8 @@ class Wallet {
         return r;
     }
     async listCertificates(args, originator) {
-        sdk_1.Validation.validateOriginator(originator);
-        const { vargs } = this.validateAuthAndArgs(args, sdk_1.Validation.validateListCertificatesArgs);
+        (0, validationHelpers_1.validateOriginator)(originator);
+        const { vargs } = this.validateAuthAndArgs(args, validationHelpers_1.validateListCertificatesArgs);
         const r = await this.storage.listCertificates(vargs);
         return r;
     }
@@ -359,7 +380,7 @@ class Wallet {
     // Certificates
     /// ///////////////
     async acquireDirectCertificateProtocol(args) {
-        const { auth, vargs } = this.validateAuthAndArgs(args, sdk_1.Validation.validateAcquireDirectCertificateArgs);
+        const { auth, vargs } = this.validateAuthAndArgs(args, validationHelpers_1.validateAcquireDirectCertificateArgs);
         vargs.subject = (await this.getPublicKey({
             identityKey: true,
             privileged: args.privileged,
@@ -367,7 +388,8 @@ class Wallet {
         })).publicKey;
         try {
             const certificate = new sdk_1.MasterCertificate(vargs.type, vargs.serialNumber, vargs.subject, vargs.certifier, vargs.revocationOutpoint, vargs.fields, vargs.keyringForSubject, vargs.signature);
-            await certificate.verify();
+            if (!(await certificate.verify()))
+                throw new Error('Certificate verification failed');
             await sdk_1.MasterCertificate.decryptFields(this, vargs.keyringForSubject, vargs.fields, vargs.certifier, vargs.privileged, vargs.privilegedReason);
         }
         catch (error_) {
@@ -405,11 +427,12 @@ class Wallet {
         this.validateIssuedCertificateFields(certificate, expectedFields);
     }
     async acquireIssuedCertificateProtocol(args) {
-        const { auth, vargs } = this.validateAuthAndArgs(args, sdk_1.Validation.validateAcquireIssuanceCertificateArgs);
+        const { auth, vargs } = this.validateAuthAndArgs(args, validationHelpers_1.validateAcquireIssuanceCertificateArgs);
         const clientNonce = await (0, sdk_1.createNonce)(this, vargs.certifier);
-        const authClient = new sdk_1.AuthFetch(this);
+        const endpoint = new URL('signCertificate', `${vargs.certifierUrl}/`);
+        const authClient = new sdk_1.AuthFetch(this, undefined, undefined, undefined, {}, (0, sdk_1.createPublicHTTPSFetch)(endpoint.origin));
         const { certificateFields, masterKeyring } = await sdk_1.MasterCertificate.createCertificateFields(this, vargs.certifier, vargs.fields);
-        const response = await authClient.fetch(`${vargs.certifierUrl}/signCertificate`, {
+        const response = await authClient.fetch(endpoint.toString(), {
             method: 'POST',
             headers: { 'Content-Type': 'application/json' },
             body: JSON.stringify({
@@ -431,16 +454,17 @@ class Wallet {
         const signedCertificate = new sdk_1.Certificate(certificate.type, certificate.serialNumber, certificate.subject, certificate.certifier, certificate.revocationOutpoint, certificate.fields, certificate.signature);
         await (0, sdk_1.verifyNonce)(serverNonce, this, vargs.certifier);
         const { valid } = await this.verifyHmac({
-            hmac: sdk_1.Utils.toArray(signedCertificate.serialNumber, 'base64'),
-            data: sdk_1.Utils.toArray(clientNonce + serverNonce, 'base64'),
+            hmac: (0, utils_1.toArray)(signedCertificate.serialNumber, 'base64'),
+            data: (0, utils_1.toArray)(clientNonce + serverNonce, 'base64'),
             protocolID: [2, 'certificate issuance'],
             keyID: serverNonce + clientNonce,
             counterparty: vargs.certifier
         });
-        if (!valid)
+        if (valid !== true)
             throw new Error('Invalid serialNumber');
         this.validateIssuedCertificate(signedCertificate, vargs, certificateFields);
-        await signedCertificate.verify();
+        if (!(await signedCertificate.verify()))
+            throw new Error('Certificate verification failed');
         await sdk_1.MasterCertificate.decryptFields(this, masterKeyring, certificate.fields, vargs.certifier);
         return await (0, acquireDirectCertificate_1.acquireDirectCertificate)(this, auth, {
             ...certificate,
@@ -450,7 +474,7 @@ class Wallet {
         });
     }
     async acquireCertificate(args, originator) {
-        sdk_1.Validation.validateOriginator(originator);
+        (0, validationHelpers_1.validateOriginator)(originator);
         if (args.acquisitionProtocol === 'direct') {
             return await this.acquireDirectCertificateProtocol(args);
         }
@@ -460,32 +484,117 @@ class Wallet {
         throw new WERR_errors_1.WERR_INVALID_PARAMETER('acquisitionProtocol', `valid.${args.acquisitionProtocol} is unrecognized.`);
     }
     async relinquishCertificate(args, originator) {
-        sdk_1.Validation.validateOriginator(originator);
-        this.validateAuthAndArgs(args, sdk_1.Validation.validateRelinquishCertificateArgs);
-        await this.storage.relinquishCertificate(args);
+        (0, validationHelpers_1.validateOriginator)(originator);
+        this.validateAuthAndArgs(args, validationHelpers_1.validateRelinquishCertificateArgs);
+        const updated = await this.storage.relinquishCertificate(args);
+        (0, walletResultGuards_1.assertStorageMutationSucceeded)(updated, 'certificate relinquishment');
         return { relinquished: true };
     }
     async proveCertificate(args, originator) {
-        sdk_1.Validation.validateOriginator(originator);
-        const { auth, vargs } = this.validateAuthAndArgs(args, sdk_1.Validation.validateProveCertificateArgs);
+        (0, validationHelpers_1.validateOriginator)(originator);
+        const { auth, vargs } = this.validateAuthAndArgs(args, validationHelpers_1.validateProveCertificateArgs);
         const r = await (0, proveCertificate_1.proveCertificate)(this, auth, vargs);
         return r;
     }
     /** 2-minute cache of trust settings for identity resolution paths */
     _trustSettingsCache;
-    /** 2-minute cache of queryOverlay() results keyed by normalized query */
-    _overlayCache = new Map();
+    /** Bounded two-minute untrusted receipts. Every use rechecks canonical evidence. */
+    _overlayEvidenceCache = new Map();
+    _overlayEvidenceExpiryTimer;
+    _identityEvidenceVerifier;
+    _identityEvidenceClosed = false;
+    pruneOverlayEvidence() {
+        for (const [key, value] of this._overlayEvidenceCache) {
+            if (value.expiresAt <= Date.now())
+                this._overlayEvidenceCache.delete(key);
+        }
+    }
+    scheduleOverlayEvidenceExpiry() {
+        clearTimeout(this._overlayEvidenceExpiryTimer);
+        const expiresAt = Math.min(...[...this._overlayEvidenceCache.values()].map(value => value.expiresAt));
+        if (!Number.isFinite(expiresAt))
+            return;
+        this._overlayEvidenceExpiryTimer = setTimeout(() => {
+            this.pruneOverlayEvidence();
+            this.scheduleOverlayEvidenceExpiry();
+        }, Math.max(1, expiresAt - Date.now()));
+        this._overlayEvidenceExpiryTimer.unref?.();
+    }
+    async requireOverlayChainTracker(forceRefresh) {
+        if (this.services == null) {
+            if (forceRefresh) {
+                throw new WERR_errors_1.WERR_INVALID_PARAMETER('services', 'valid in constructor arguments to be retreived here.');
+            }
+            return undefined;
+        }
+        return await this.services.getChainTracker();
+    }
+    async discoverOverlayCertificates(query, cacheKey, forceRefresh, now) {
+        const chainTracker = await this.requireOverlayChainTracker(forceRefresh);
+        if (chainTracker == null)
+            return [];
+        if (this._identityEvidenceClosed)
+            return [];
+        const chainNamespace = `wallet:${this.chain}`;
+        if (this._identityEvidenceVerifier?.chainTracker !== chainTracker ||
+            this._identityEvidenceVerifier.chainNamespace !== chainNamespace) {
+            this._identityEvidenceVerifier?.dispose();
+            this._identityEvidenceVerifier = new identityUtils_1.IdentityEvidenceVerifier(chainTracker, chainNamespace);
+        }
+        const verifier = this._identityEvidenceVerifier;
+        this.pruneOverlayEvidence();
+        let cached = forceRefresh ? undefined : this._overlayEvidenceCache.get(cacheKey);
+        if (cached == null || cached.expiresAt <= now) {
+            const value = await (0, identityUtils_1.queryOverlayEvidence)(query, this.lookupResolver);
+            if (this._identityEvidenceClosed)
+                return [];
+            const bytes = value.type === 'output-list'
+                ? value.outputs.reduce((total, output) => total + output.beef.length + (output.context?.length ?? 0), 0)
+                : 0;
+            cached = { value, bytes, expiresAt: now + 2 * 60 * 1000 };
+            this._overlayEvidenceCache.delete(cacheKey);
+            let retained = [...this._overlayEvidenceCache.values()].reduce((total, entry) => total + entry.bytes, 0);
+            while (this._overlayEvidenceCache.size > 0 &&
+                (this._overlayEvidenceCache.size >= 32 || retained + bytes > 16 * 1024 * 1024)) {
+                const oldest = this._overlayEvidenceCache.keys().next().value;
+                retained -= this._overlayEvidenceCache.get(oldest).bytes;
+                this._overlayEvidenceCache.delete(oldest);
+            }
+            this._overlayEvidenceCache.set(cacheKey, cached);
+            this.scheduleOverlayEvidenceExpiry();
+        }
+        if (cached.value.type !== 'output-list') {
+            this._overlayEvidenceCache.delete(cacheKey);
+            return [];
+        }
+        let certificates;
+        try {
+            certificates = await (0, identityUtils_1.parseResults)(cached.value, chainTracker, verifier);
+        }
+        catch (error) {
+            this._overlayEvidenceCache.delete(cacheKey);
+            throw error;
+        }
+        // Failed evidence must allow another fetch, including after temporary chain unavailability.
+        if (certificates.length !== cached.value.outputs.length)
+            this._overlayEvidenceCache.delete(cacheKey);
+        return certificates;
+    }
+    /**
+     * Resolves an identity from a caller-installed local contact source first, then the certificate
+     * overlay. A local hit expresses the user's own authoritative trust decision and carries empty
+     * third-party certificate proof fields; use `forceRefresh` to bypass it and query the overlay.
+     */
     async discoverByIdentityKey(args, originator) {
-        sdk_1.Validation.validateOriginator(originator);
-        this.validateAuthAndArgs(args, sdk_1.Validation.validateDiscoverByIdentityKeyArgs);
-        const TTL_MS = 2 * 60 * 1000;
+        (0, validationHelpers_1.validateOriginator)(originator);
+        const { vargs } = this.validateAuthAndArgs(args, validationHelpers_1.validateDiscoverByIdentityKeyArgs);
         const now = Date.now();
         const forceRefresh = args.forceRefresh === true;
-        // --- Contacts short-circuit (sub-10 ms typical, no network) ---
+        // Local contacts are explicit user trust anchors, not third-party certifier attestations.
         if (!forceRefresh && this.contactSource != null) {
             try {
-                const contact = await this.contactSource.findByIdentityKey(args.identityKey);
-                if (contact != null) {
+                const contact = await this.contactSource.findByIdentityKey(vargs.identityKey);
+                if (contact != null && contact.identityKey === vargs.identityKey && vargs.offset === 0) {
                     return synthesizeContactResult([contact]);
                 }
             }
@@ -493,84 +602,64 @@ class Wallet {
                 // Contact source failures must never block the network path.
             }
         }
-        // --- trustSettings cache (2 minutes) ---
-        let trustSettings = this._trustSettingsCache != null && this._trustSettingsCache.expiresAt > now
-            ? this._trustSettingsCache.trustSettings
-            : undefined;
-        if (trustSettings == null) {
-            const settings = await this.settingsManager.get();
-            trustSettings = settings.trustSettings;
-            this._trustSettingsCache = { trustSettings, expiresAt: now + TTL_MS };
-        }
+        // Authorization policy is read fresh on every call. A removed certifier or
+        // raised threshold must take effect immediately rather than after a cache TTL.
+        const trustSettings = (await this.settingsManager.get()).trustSettings;
         const certifiers = trustSettings.trustedCertifiers.map(c => c.identityKey).sort((a, b) => a.localeCompare(b));
-        // --- queryOverlay cache (2 minutes, client-side, bounded staleness) ---
+        // --- Untrusted overlay response cache; verify again before use. ---
         const cacheKey = JSON.stringify({
             fn: 'discoverByIdentityKey',
-            identityKey: args.identityKey,
-            certifiers
+            identityKey: vargs.identityKey,
+            certifiers,
+            limit: vargs.limit,
+            offset: vargs.offset
         });
-        let cached = forceRefresh ? undefined : this._overlayCache.get(cacheKey);
-        if (cached == null || cached.expiresAt <= now) {
-            const value = await (0, identityUtils_1.queryOverlay)({ identityKey: args.identityKey, certifiers }, this.lookupResolver);
-            cached = { value, expiresAt: now + TTL_MS };
-            this._overlayCache.set(cacheKey, cached);
-        }
-        if (!cached.value) {
-            return { totalCertificates: 0, certificates: [] };
-        }
-        return (0, identityUtils_1.transformVerifiableCertificatesWithTrust)(trustSettings, cached.value);
+        const certificates = await this.discoverOverlayCertificates({ identityKey: args.identityKey, certifiers }, cacheKey, forceRefresh, now);
+        return discoveryPage((0, identityUtils_1.transformVerifiableCertificatesWithTrust)(trustSettings, (0, identityUtils_1.filterCertificatesByIdentityKey)(certificates, vargs.identityKey)), vargs.offset, vargs.limit);
     }
+    /**
+     * Resolves matching identities from a caller-installed local contact source first, then the
+     * certificate overlay. Local hits are authoritative personal assertions with empty third-party
+     * certificate proof fields; use `forceRefresh` to bypass them and query the overlay.
+     */
     async discoverByAttributes(args, originator) {
-        sdk_1.Validation.validateOriginator(originator);
-        this.validateAuthAndArgs(args, sdk_1.Validation.validateDiscoverByAttributesArgs);
-        const TTL_MS = 2 * 60 * 1000;
+        (0, validationHelpers_1.validateOriginator)(originator);
+        const { vargs } = this.validateAuthAndArgs(args, validationHelpers_1.validateDiscoverByAttributesArgs);
         const now = Date.now();
         const forceRefresh = args.forceRefresh === true;
-        // --- Contacts short-circuit (optional, only when source supports attribute search) ---
-        if (!forceRefresh && this.contactSource?.findByAttributes != null && args.attributes != null) {
+        // Local contacts are explicit user trust anchors, not third-party certifier attestations.
+        if (!forceRefresh && this.contactSource?.findByAttributes != null && vargs.attributes != null) {
             try {
-                const matches = await this.contactSource.findByAttributes(args.attributes);
+                const matches = await this.contactSource.findByAttributes(vargs.attributes);
                 if (Array.isArray(matches) && matches.length > 0) {
-                    return synthesizeContactResult(matches);
+                    return synthesizeContactResult(matches.slice(vargs.offset, vargs.offset + vargs.limit));
                 }
             }
             catch {
                 // Fall through to network path on contact-source failure.
             }
         }
-        // --- trustSettings cache (2 minutes) ---
-        let trustSettings = this._trustSettingsCache != null && this._trustSettingsCache.expiresAt > now
-            ? this._trustSettingsCache.trustSettings
-            : undefined;
-        if (trustSettings == null) {
-            const settings = await this.settingsManager.get();
-            trustSettings = settings.trustSettings;
-            this._trustSettingsCache = { trustSettings, expiresAt: now + TTL_MS };
-        }
+        // Authorization policy is read fresh on every call. A removed certifier or
+        // raised threshold must take effect immediately rather than after a cache TTL.
+        const trustSettings = (await this.settingsManager.get()).trustSettings;
         const certifiers = trustSettings.trustedCertifiers.map(c => c.identityKey).sort((a, b) => a.localeCompare(b));
         // Normalize attributes for a stable cache key.
         // If attributes is an object, sort its top-level keys; if it's an array, sort a shallow copy.
-        let attributesKey = args.attributes;
-        if (args.attributes && typeof args.attributes === 'object') {
-            const keys = Object.keys(args.attributes).sort((a, b) => a.localeCompare(b));
-            attributesKey = JSON.stringify(args.attributes, keys);
+        let attributesKey = vargs.attributes;
+        if (vargs.attributes != null && typeof vargs.attributes === 'object') {
+            const keys = Object.keys(vargs.attributes).sort((a, b) => a.localeCompare(b));
+            attributesKey = JSON.stringify(vargs.attributes, keys);
         }
-        // --- queryOverlay cache (2 minutes, client-side, bounded staleness) ---
+        // --- Untrusted overlay response cache; verify again before use. ---
         const cacheKey = JSON.stringify({
             fn: 'discoverByAttributes',
             attributes: attributesKey,
-            certifiers
+            certifiers,
+            limit: vargs.limit,
+            offset: vargs.offset
         });
-        let cached = forceRefresh ? undefined : this._overlayCache.get(cacheKey);
-        if (cached == null || cached.expiresAt <= now) {
-            const value = await (0, identityUtils_1.queryOverlay)({ attributes: args.attributes, certifiers }, this.lookupResolver);
-            cached = { value, expiresAt: now + TTL_MS };
-            this._overlayCache.set(cacheKey, cached);
-        }
-        if (!cached.value) {
-            return { totalCertificates: 0, certificates: [] };
-        }
-        return (0, identityUtils_1.transformVerifiableCertificatesWithTrust)(trustSettings, cached.value);
+        const certificates = await this.discoverOverlayCertificates({ attributes: args.attributes, certifiers }, cacheKey, forceRefresh, now);
+        return discoveryPage((0, identityUtils_1.transformVerifiableCertificatesWithTrust)(trustSettings, (0, identityUtils_1.filterCertificatesByAttributes)(certificates, vargs.attributes)), vargs.offset, vargs.limit);
     }
     verifyReturnedTxidOnly(beef, knownTxids) {
         if (this.returnTxidOnly)
@@ -595,7 +684,7 @@ class Wallet {
     verifyReturnedTxidOnlyAtomicBEEF(beef, knownTxids, parsedBeef) {
         if (this.returnTxidOnly)
             return beef;
-        const b = parsedBeef ?? sdk_1.Beef.fromBinary(beef);
+        const b = parsedBeef ?? sdk_1.Beef.fromBinaryStrict(beef);
         if (!b.atomicTxid)
             throw new WERR_errors_1.WERR_INTERNAL();
         const hasUnknownTxidOnly = b.txs.some(btx => btx.isTxidOnly && !knownTxids?.includes(btx.txid));
@@ -606,7 +695,7 @@ class Wallet {
     verifyReturnedTxidOnlyBEEF(beef) {
         if (this.returnTxidOnly)
             return beef;
-        const b = sdk_1.Beef.fromBinary(beef);
+        const b = sdk_1.Beef.fromBinaryStrict(beef);
         return this.verifyReturnedTxidOnly(b).toBinary();
     }
     logMakeLogger(method, args) {
@@ -635,17 +724,22 @@ class Wallet {
     async createAction(args, originator) {
         const logger = this.logMakeLogger('createAction', args);
         try {
-            sdk_1.Validation.validateOriginator(originator);
+            (0, validationHelpers_1.validateOriginator)(originator);
             args.options ??= {};
             args.options.trustSelf ||= this.trustSelf;
             prepareKnownTxidsForCreateAction(this, args);
-            const { auth, vargs } = this.validateAuthAndArgs(args, sdk_1.Validation.validateCreateActionArgs, logger);
+            const { auth, vargs } = this.validateAuthAndArgs(args, validationHelpers_1.validateCreateActionArgs, logger);
             logger?.log('validated args');
             vargs.includeAllSourceTransactions = this.includeAllSourceTransactions;
             if (this.randomVals != null && this.randomVals.length > 1) {
                 vargs.randomVals = [...this.randomVals];
             }
-            const r = await (0, createAction_1.createAction)(this, auth, vargs);
+            const brc177Requested = (0, brc177NoSendExpiry_1.hasBrc177NoSendExpiryLabel)(vargs.labels);
+            if (brc177Requested)
+                (0, brc177NoSendExpiry_1.parseBrc177NoSendExpiryLabels)(vargs.labels);
+            const r = brc177Requested
+                ? await (0, createNoSendExpiryAction_1.createNoSendExpiryAction)(this, auth, vargs)
+                : await (0, createAction_1.createAction)(this, auth, vargs);
             logger?.log('action created');
             const resultBeef = (0, resultBeef_1.getResultBeef)(r);
             if (r.tx != null) {
@@ -686,8 +780,8 @@ class Wallet {
         }
     }
     async signAction(args, originator) {
-        sdk_1.Validation.validateOriginator(originator);
-        const { auth, vargs } = this.validateAuthAndArgs(args, sdk_1.Validation.validateSignActionArgs);
+        (0, validationHelpers_1.validateOriginator)(originator);
+        const { auth, vargs } = this.validateAuthAndArgs(args, validationHelpers_1.validateSignActionArgs);
         const prior = this.pendingSignActions[args.reference];
         if (!prior) {
             throw new WERR_errors_1.WERR_NOT_IMPLEMENTED('recovery of out-of-session signAction reference data is not yet implemented.');
@@ -702,56 +796,61 @@ class Wallet {
         return r;
     }
     async internalizeAction(args, originator) {
-        sdk_1.Validation.validateOriginator(originator);
-        const { auth, vargs } = this.validateAuthAndArgs(args, sdk_1.Validation.validateInternalizeActionArgs);
+        (0, validationHelpers_1.validateOriginator)(originator);
+        const { auth, vargs } = this.validateAuthAndArgs(args, validationHelpers_1.validateInternalizeActionArgs);
         if (vargs.labels.includes(types_1.specOpThrowReviewActions))
             throwDummyReviewActions();
+        if ((0, brc177NoSendExpiry_1.hasBrc177NoSendExpiryLabel)(vargs.labels)) {
+            throw new WERR_errors_1.WERR_INVALID_PARAMETER('labels', 'BRC-177 noSend expiry labels only on outgoing createAction requests');
+        }
         const r = await (0, internalizeAction_1.internalizeAction)(this, auth, args);
         throwIfUnsuccessfulInternalizeAction(r);
         return r;
     }
     async abortAction(args, originator) {
-        sdk_1.Validation.validateOriginator(originator);
-        this.validateAuthAndArgs(args, sdk_1.Validation.validateAbortActionArgs);
+        (0, validationHelpers_1.validateOriginator)(originator);
+        this.validateAuthAndArgs(args, validationHelpers_1.validateAbortActionArgs);
         if (this.actionBatch.ownsReference(args.reference)) {
             return { aborted: await this.actionBatch.abortAction(args.reference) };
         }
         const r = await this.storage.abortAction(args);
+        (0, walletResultGuards_1.assertAbortResult)(r);
         return r;
     }
     async relinquishOutput(args, originator) {
-        sdk_1.Validation.validateOriginator(originator);
-        this.validateAuthAndArgs(args, sdk_1.Validation.validateRelinquishOutputArgs);
-        await this.storage.relinquishOutput(args);
+        (0, validationHelpers_1.validateOriginator)(originator);
+        this.validateAuthAndArgs(args, validationHelpers_1.validateRelinquishOutputArgs);
+        const updated = await this.storage.relinquishOutput(args);
+        (0, walletResultGuards_1.assertStorageMutationSucceeded)(updated, 'output relinquishment');
         return { relinquished: true };
     }
     async isAuthenticated(args, originator) {
-        sdk_1.Validation.validateOriginator(originator);
+        (0, validationHelpers_1.validateOriginator)(originator);
         const r = {
             authenticated: true
         };
         return r;
     }
     async waitForAuthentication(args, originator) {
-        sdk_1.Validation.validateOriginator(originator);
+        (0, validationHelpers_1.validateOriginator)(originator);
         return { authenticated: true };
     }
     async getHeight(args, originator) {
-        sdk_1.Validation.validateOriginator(originator);
+        (0, validationHelpers_1.validateOriginator)(originator);
         const height = await this.getServices().getHeight();
         return { height };
     }
     async getHeaderForHeight(args, originator) {
-        sdk_1.Validation.validateOriginator(originator);
+        (0, validationHelpers_1.validateOriginator)(originator);
         const serializedHeader = await this.getServices().getHeaderForHeight(args.height);
-        return { header: sdk_1.Utils.toHex(serializedHeader) };
+        return { header: (0, utils_1.toHex)(serializedHeader) };
     }
     async getNetwork(args, originator) {
-        sdk_1.Validation.validateOriginator(originator);
+        (0, validationHelpers_1.validateOriginator)(originator);
         return { network: (0, utilityHelpers_1.toWalletNetwork)(this.chain) };
     }
     async getVersion(args, originator) {
-        sdk_1.Validation.validateOriginator(originator);
+        (0, validationHelpers_1.validateOriginator)(originator);
         return { version: 'wallet-brc100-1.0.0' };
     }
     /**
@@ -829,13 +928,15 @@ class Wallet {
                 limit: 1000,
                 offset
             });
-            if (change.totalOutputs === 0)
+            if (change.outputs.length === 0)
                 break;
             for (const o of change.outputs) {
                 r.total += o.satoshis;
                 r.utxos.push({ satoshis: o.satoshis, outpoint: o.outpoint });
             }
             offset += change.outputs.length;
+            if (offset >= change.totalOutputs)
+                break;
         }
         return r;
     }
@@ -855,14 +956,15 @@ class Wallet {
     }
     /**
      * Uses `listOutputs` special operation to review the spendability via `Services` of
-     * outputs currently considered spendable. Returns the outputs that fail to verify.
+     * outputs currently considered spendable. Returns only outputs conclusively
+     * confirmed spent. Rejects the review if any provider result is inconclusive.
      *
      * Ignores the `limit` and `offset` properties.
      *
      * @param all Defaults to false. If false, only change outputs ('default' basket) are reviewed. If true, all spendable outputs are reviewed.
-     * @param release Defaults to false. If true, sets outputs that fail to verify to un-spendable (spendable: false)
+     * @param release Defaults to false. If true, atomically sets conclusively spent outputs to un-spendable (spendable: false). No outputs change if any candidate is inconclusive.
      * @param optionalArgs Optional. Additional tags will constrain the outputs processed.
-     * @returns outputs which are/where considered spendable but currently fail to verify as spendable.
+     * @returns outputs previously considered spendable but conclusively confirmed spent.
      */
     async reviewSpendableOutputs(all = false, release = false, optionalArgs) {
         const args = {
@@ -898,7 +1000,7 @@ class Wallet {
      * @returns {ListActionsResult} start `listActions` result restricted to 'nosend' (or 'failed' if aborted) actions.
      */
     async listNoSendActions(args, abort = false) {
-        const { vargs } = this.validateAuthAndArgs(args, sdk_1.Validation.validateListActionsArgs);
+        const { vargs } = this.validateAuthAndArgs(args, validationHelpers_1.validateListActionsArgs);
         vargs.labels.push(types_1.specOpNoSendActions);
         if (abort) {
             await this.actionBatch.abort();
@@ -913,7 +1015,7 @@ class Wallet {
      * @returns {ListActionsResult} start `listActions` result restricted to 'failed' status actions.
      */
     async listFailedActions(args, unfail = false) {
-        const { vargs } = this.validateAuthAndArgs(args, sdk_1.Validation.validateListActionsArgs);
+        const { vargs } = this.validateAuthAndArgs(args, validationHelpers_1.validateListActionsArgs);
         vargs.labels.push(types_1.specOpFailedActions);
         if (unfail)
             vargs.labels.push('unfail');
@@ -937,6 +1039,7 @@ function throwIfAnyUnsuccessfulSignActions(r) {
     throw new WERR_errors_1.WERR_REVIEW_ACTIONS(ndrs, swrs, r.txid, r.tx);
 }
 function throwIfUnsuccessfulInternalizeAction(r) {
+    (0, walletResultGuards_1.assertInternalizeAccepted)(r);
     const ndrs = r.notDelayedResults;
     const swrs = r.sendWithResults;
     if (ndrs == null || swrs == null || swrs.every(r => r.status === 'unproven'))
@@ -948,10 +1051,9 @@ function throwIfUnsuccessfulInternalizeAction(r) {
  */
 function throwDummyReviewActions() {
     const b58Beef = 'gno9MC7VXii1KoCkc2nsVyYJpqzN3dhBzYATETJcys62emMKfpBof4R7GozwYEaSapUtnNvqQ57aaYYjm3U2dv9eUJ1sV46boHkQgppYmAz9YH8FdZduV8aJayPViaKcyPmbDhEw6UW8TM5iFZLXNs7HBnJHUKCeTdNK4FUEL7vAugxAV9WUUZ43BZjJk2SmSeps9TCXjt1Ci9fKWp3d9QSoYvTpxwzyUFHjRKtbUgwq55ZfkBp5bV2Bpz9qSuKywKewW7Hh4S1nCUScwwzpKDozb3zic1V9p2k8rQxoPsRxjUJ8bjhNDdsN8d7KukFuc3n47fXzdWttvnxwsujLJRGnQbgJuknQqx3KLf5kJXHzwjG6TzigZk2t24qeB6d3hbYiaDr2fFkUJBL3tukTHhfNkQYRXuz3kucVDzvejHyqJaF51mXG8BjMN5aQj91ZJXCaPVqkMWCzmvyaqmXMdRiJdSAynhXbQK91xf6RwdNhz1tg5f9B6oJJMhsi9UYSVymmax8VLKD9AKzBCBDcfyD83m3jyS1VgKGZn3SkQmr6bsoWq88L3GsMnnmYUGogvdAYarTqg3pzkjCMxHzmJBMN6ofnUk8c1sRTXQue7BbyUaN5uZu3KW6CmFsEfpuqVvnqFW93TU1jrPP2S8yz8AexAnARPCKE8Yz7RfVaT6RCavwQKL3u5iookwRWEZXW1QWmM37yJWHD87SjVynyg327a1CLwcBxmE2CB48QeNVGyQki4CTQMqw2o8TMhDPJej1g68oniAjBcxBLSCs7KGvK3k7AfrHbCMULX9CTibYhCjdFjbsbBoocqJpxxcvkMo1fEEiAzZuiBVZQDYktDdTVbhKHvYkW25HcYX75NJrpNAhm7AjFeKLzEVxqAQkMfvTufpESNRZF4kQqg2Rg8h2ajcKTd5cpEPwXCrZLHm4EaZEmZVbg3QNfGhn7BJu1bHMtLqPD4y8eJxm2uGrW6saf6qKYmmu64F8A667NbD4yskPRQ1S863VzwGpxxmgLc1Ta3R46jEqsAoRDoZVUaCgBBZG3Yg1CTgi1EVBMXU7qvY4n3h8o2FLCEMWY4KadnV3iD4FbcdCmg4yxBosNAZgbPjhgGjCimjh4YsLd9zymGLmivmz2ZBg5m3xaiXT9NN81X9C1JUujd';
-    const beef = sdk_1.Beef.fromBinary(sdk_1.Utils.fromBase58(b58Beef));
+    const beef = sdk_1.Beef.fromBinaryStrict((0, utils_1.fromBase58)(b58Beef));
     const btx = beef.txs.at(-1);
     const txid = btx.txid;
-    console.log('Throwing dummy WERR_REVIEW_ACTIONS');
     throw new WERR_errors_1.WERR_REVIEW_ACTIONS([
         {
             txid, // only care that it is syntactically a txid
@@ -972,7 +1074,7 @@ function throwDummyReviewActions() {
  * @returns
  */
 function validateListOutputsArgs(args) {
-    const vargs = sdk_1.Validation.validateListOutputsArgs(args);
+    const vargs = (0, validationHelpers_1.validateListOutputsArgs)(args);
     const balancePrefix = 'balance ';
     if (vargs.basket.startsWith(balancePrefix)) {
         vargs.basket = vargs.basket.slice(balancePrefix.length);