@bsv/wallet-toolbox-client 1.7.17 → 1.7.19

package/out/src/WalletPermissionsManager.js

@@ -77,7 +77,8 @@ class WalletPermissionsManager {
             onBasketAccessRequested: [],
             onCertificateAccessRequested: [],
             onSpendingAuthorizationRequested: [],
-            onGroupedPermissionRequested: []
+            onGroupedPermissionRequested: [],
+            onCounterpartyPermissionRequested: []
         };
         /**
          * We queue parallel requests for the same resource so that only one
@@ -93,6 +94,9 @@ class WalletPermissionsManager {
         /** Cache recently confirmed permissions to avoid repeated lookups. */
         this.permissionCache = new Map();
         this.recentGrants = new Map();
+        this.manifestCache = new Map();
+        this.manifestFetchInProgress = new Map();
+        this.pactEstablishedCache = new Map();
         this.underlying = underlyingWallet;
         this.adminOriginator = this.normalizeOriginator(adminOriginator) || adminOriginator;
         // Default all config options to true unless specified
@@ -316,9 +320,8 @@ class WalletPermissionsManager {
         const { originator, permissions: requestedPermissions, displayOriginator } = originalRequest;
         const originLookupValues = this.buildOriginatorLookupValues(displayOriginator, originator);
         // --- Validation: Ensure granted permissions are a subset of what was requested ---
-        if (params.granted.spendingAuthorization &&
-            !deepEqual(params.granted.spendingAuthorization, requestedPermissions.spendingAuthorization)) {
-            throw new Error('Granted spending authorization does not match the original request.');
+        if (params.granted.spendingAuthorization && !requestedPermissions.spendingAuthorization) {
+            throw new Error('Granted spending authorization was not part of the original request.');
         }
         if ((_a = params.granted.protocolPermissions) === null || _a === void 0 ? void 0 : _a.some(g => { var _a; return !((_a = requestedPermissions.protocolPermissions) === null || _a === void 0 ? void 0 : _a.find(r => deepEqual(r, g))); })) {
             throw new Error('Granted protocol permissions are not a subset of the original request.');
@@ -410,6 +413,74 @@ class WalletPermissionsManager {
         }
         this.activeRequests.delete(requestID);
     }
+    async dismissGroupedPermission(requestID) {
+        const matching = this.activeRequests.get(requestID);
+        if (!matching) {
+            throw new Error('Request ID not found.');
+        }
+        for (const p of matching.pending) {
+            p.resolve(true);
+        }
+        this.activeRequests.delete(requestID);
+    }
+    async grantCounterpartyPermission(params) {
+        var _a;
+        const matching = this.activeRequests.get(params.requestID);
+        if (!matching) {
+            throw new Error('Request ID not found.');
+        }
+        const originalRequest = matching.request;
+        const { originator, counterparty, permissions: requestedPermissions, displayOriginator } = originalRequest;
+        const originLookupValues = this.buildOriginatorLookupValues(displayOriginator, originator);
+        if ((_a = params.granted.protocols) === null || _a === void 0 ? void 0 : _a.some(g => !requestedPermissions.protocols.find(r => deepEqual(r, g)))) {
+            throw new Error('Granted protocol permissions are not a subset of the original request.');
+        }
+        const expiry = params.expiry || 0;
+        for (const p of params.granted.protocols || []) {
+            const token = await this.findProtocolToken(originator, false, p.protocolID, counterparty, true, originLookupValues);
+            if (token) {
+                const request = {
+                    type: 'protocol',
+                    originator,
+                    privileged: false,
+                    protocolID: p.protocolID,
+                    counterparty,
+                    reason: p.description
+                };
+                await this.renewPermissionOnChain(token, request, expiry);
+                this.markRecentGrant(request);
+            }
+            else {
+                const request = {
+                    type: 'protocol',
+                    originator,
+                    privileged: false,
+                    protocolID: p.protocolID,
+                    counterparty,
+                    reason: p.description
+                };
+                await this.createPermissionOnChain(request, expiry);
+                this.markRecentGrant(request);
+            }
+        }
+        this.markPactEstablished(originator, counterparty);
+        for (const p of matching.pending) {
+            p.resolve(true);
+        }
+        this.activeRequests.delete(params.requestID);
+    }
+    async denyCounterpartyPermission(requestID) {
+        const matching = this.activeRequests.get(requestID);
+        if (!matching) {
+            throw new Error('Request ID not found.');
+        }
+        const err = new Error('The user has denied the request for permission.');
+        err.code = 'ERR_PERMISSION_DENIED';
+        for (const p of matching.pending) {
+            p.reject(err);
+        }
+        this.activeRequests.delete(requestID);
+    }
     /* ---------------------------------------------------------------------
      *  3) THE "ENSURE" METHODS: CHECK IF PERMISSION EXISTS, OTHERWISE PROMPT
      * --------------------------------------------------------------------- */
@@ -728,6 +799,469 @@ class WalletPermissionsManager {
             usageType: 'generic'
         });
     }
+    validateCounterpartyPermissions(raw) {
+        if (!raw || !Array.isArray(raw.protocols) || raw.protocols.length === 0)
+            return null;
+        const validProtocols = raw.protocols.filter((p) => {
+            return (Array.isArray(p === null || p === void 0 ? void 0 : p.protocolID) &&
+                p.protocolID[0] === 2 &&
+                typeof p.protocolID[1] === 'string' &&
+                typeof (p === null || p === void 0 ? void 0 : p.description) === 'string');
+        });
+        if (validProtocols.length === 0)
+            return null;
+        return {
+            description: typeof raw.description === 'string' ? raw.description : undefined,
+            protocols: validProtocols
+        };
+    }
+    async fetchManifestPermissions(originator) {
+        const cached = this.manifestCache.get(originator);
+        if (cached && Date.now() - cached.fetchedAt < WalletPermissionsManager.MANIFEST_CACHE_TTL_MS) {
+            return {
+                groupPermissions: cached.groupPermissions,
+                counterpartyPermissions: cached.counterpartyPermissions
+            };
+        }
+        const inProgress = this.manifestFetchInProgress.get(originator);
+        if (inProgress) {
+            return inProgress;
+        }
+        const fetchPromise = (async () => {
+            var _a, _b;
+            try {
+                const proto = originator.startsWith('localhost:') ? 'http' : 'https';
+                const response = await fetch(`${proto}://${originator}/manifest.json`);
+                if (response.ok) {
+                    const manifest = await response.json();
+                    const groupPermissions = ((_a = manifest === null || manifest === void 0 ? void 0 : manifest.babbage) === null || _a === void 0 ? void 0 : _a.groupPermissions) || null;
+                    const counterpartyPermissions = this.validateCounterpartyPermissions((_b = manifest === null || manifest === void 0 ? void 0 : manifest.babbage) === null || _b === void 0 ? void 0 : _b.counterpartyPermissions);
+                    this.manifestCache.set(originator, { groupPermissions, counterpartyPermissions, fetchedAt: Date.now() });
+                    return { groupPermissions, counterpartyPermissions };
+                }
+            }
+            catch (e) { }
+            const result = { groupPermissions: null, counterpartyPermissions: null };
+            this.manifestCache.set(originator, { ...result, fetchedAt: Date.now() });
+            return result;
+        })();
+        this.manifestFetchInProgress.set(originator, fetchPromise);
+        try {
+            return await fetchPromise;
+        }
+        finally {
+            this.manifestFetchInProgress.delete(originator);
+        }
+    }
+    async fetchManifestGroupPermissions(originator) {
+        const { groupPermissions } = await this.fetchManifestPermissions(originator);
+        return groupPermissions;
+    }
+    async filterAlreadyGrantedPermissions(originator, groupPermissions) {
+        const permissionsToRequest = {
+            description: groupPermissions.description,
+            protocolPermissions: [],
+            basketAccess: [],
+            certificateAccess: []
+        };
+        if (groupPermissions.spendingAuthorization) {
+            const hasAuth = await this.hasSpendingAuthorization({
+                originator,
+                satoshis: groupPermissions.spendingAuthorization.amount
+            });
+            if (!hasAuth) {
+                permissionsToRequest.spendingAuthorization = groupPermissions.spendingAuthorization;
+            }
+        }
+        for (const p of groupPermissions.protocolPermissions || []) {
+            const hasPerm = await this.hasProtocolPermission({
+                originator,
+                privileged: false,
+                protocolID: p.protocolID,
+                counterparty: p.counterparty || 'self'
+            });
+            if (!hasPerm) {
+                permissionsToRequest.protocolPermissions.push(p);
+            }
+        }
+        for (const b of groupPermissions.basketAccess || []) {
+            const hasAccess = await this.hasBasketAccess({
+                originator,
+                basket: b.basket
+            });
+            if (!hasAccess) {
+                permissionsToRequest.basketAccess.push(b);
+            }
+        }
+        for (const c of groupPermissions.certificateAccess || []) {
+            const hasAccess = await this.hasCertificateAccess({
+                originator,
+                privileged: false,
+                verifier: c.verifierPublicKey,
+                certType: c.type,
+                fields: c.fields
+            });
+            if (!hasAccess) {
+                permissionsToRequest.certificateAccess.push(c);
+            }
+        }
+        return permissionsToRequest;
+    }
+    hasAnyPermissionsToRequest(permissions) {
+        var _a, _b, _c, _d, _e, _f;
+        return !!(permissions.spendingAuthorization ||
+            ((_b = (_a = permissions.protocolPermissions) === null || _a === void 0 ? void 0 : _a.length) !== null && _b !== void 0 ? _b : 0) > 0 ||
+            ((_d = (_c = permissions.basketAccess) === null || _c === void 0 ? void 0 : _c.length) !== null && _d !== void 0 ? _d : 0) > 0 ||
+            ((_f = (_e = permissions.certificateAccess) === null || _e === void 0 ? void 0 : _e.length) !== null && _f !== void 0 ? _f : 0) > 0);
+    }
+    hasGroupedPermissionRequestedHandlers() {
+        const handlers = this.callbacks.onGroupedPermissionRequested || [];
+        return handlers.some(h => typeof h === 'function');
+    }
+    hasCounterpartyPermissionRequestedHandlers() {
+        const handlers = this.callbacks.onCounterpartyPermissionRequested || [];
+        return handlers.some(h => typeof h === 'function');
+    }
+    async hasPactEstablished(originator, counterparty) {
+        var _a;
+        if (counterparty === 'self' || counterparty === 'anyone') {
+            return true;
+        }
+        const cacheKey = `${originator}:${counterparty}`;
+        if (this.pactEstablishedCache.has(cacheKey)) {
+            return true;
+        }
+        const { counterpartyPermissions } = await this.fetchManifestPermissions(originator);
+        if (!((_a = counterpartyPermissions === null || counterpartyPermissions === void 0 ? void 0 : counterpartyPermissions.protocols) === null || _a === void 0 ? void 0 : _a.length)) {
+            return true;
+        }
+        const firstProtocol = counterpartyPermissions.protocols[0];
+        const hasToken = await this.hasProtocolPermission({
+            originator,
+            privileged: false,
+            protocolID: firstProtocol.protocolID,
+            counterparty
+        });
+        if (hasToken) {
+            this.pactEstablishedCache.set(cacheKey, Date.now());
+            return true;
+        }
+        return false;
+    }
+    markPactEstablished(originator, counterparty) {
+        const cacheKey = `${originator}:${counterparty}`;
+        this.pactEstablishedCache.set(cacheKey, Date.now());
+    }
+    async maybeRequestPact(currentRequest) {
+        var _a;
+        if (!this.config.seekGroupedPermission) {
+            return null;
+        }
+        if (!this.hasCounterpartyPermissionRequestedHandlers()) {
+            return null;
+        }
+        if (currentRequest.type !== 'protocol') {
+            return null;
+        }
+        if (currentRequest.privileged) {
+            return null;
+        }
+        const [level] = currentRequest.protocolID;
+        if (level !== 2) {
+            return null;
+        }
+        const originator = currentRequest.originator;
+        const counterparty = currentRequest.counterparty;
+        if (!counterparty || counterparty === 'self' || counterparty === 'anyone') {
+            return null;
+        }
+        if (!/^[0-9a-fA-F]{66}$/.test(counterparty)) {
+            return null;
+        }
+        if (await this.hasPactEstablished(originator, counterparty)) {
+            return null;
+        }
+        const { counterpartyPermissions } = await this.fetchManifestPermissions(originator);
+        if (!((_a = counterpartyPermissions === null || counterpartyPermissions === void 0 ? void 0 : counterpartyPermissions.protocols) === null || _a === void 0 ? void 0 : _a.length)) {
+            return null;
+        }
+        const protocolsToRequest = [];
+        for (const p of counterpartyPermissions.protocols) {
+            const hasPerm = await this.hasProtocolPermission({
+                originator,
+                privileged: false,
+                protocolID: p.protocolID,
+                counterparty
+            });
+            if (!hasPerm) {
+                protocolsToRequest.push(p);
+            }
+        }
+        if (protocolsToRequest.length === 0) {
+            this.markPactEstablished(originator, counterparty);
+            return null;
+        }
+        const permissionsToRequest = {
+            description: counterpartyPermissions.description,
+            protocols: protocolsToRequest
+        };
+        const key = `pact:${originator}:${counterparty}`;
+        const existing = this.activeRequests.get(key);
+        if (existing) {
+            const existingRequest = existing.request;
+            for (const p of permissionsToRequest.protocols) {
+                if (!existingRequest.permissions.protocols.find(x => deepEqual(x, p))) {
+                    existingRequest.permissions.protocols.push(p);
+                }
+            }
+            await new Promise((resolve, reject) => {
+                existing.pending.push({ resolve, reject });
+            });
+        }
+        else {
+            await new Promise(async (resolve, reject) => {
+                this.activeRequests.set(key, {
+                    request: {
+                        originator,
+                        counterparty,
+                        permissions: permissionsToRequest,
+                        displayOriginator: currentRequest.displayOriginator
+                    },
+                    pending: [{ resolve, reject }]
+                });
+                await this.callEvent('onCounterpartyPermissionRequested', {
+                    requestID: key,
+                    originator,
+                    counterparty,
+                    permissions: permissionsToRequest
+                });
+            });
+        }
+        this.markPactEstablished(originator, counterparty);
+        const satisfied = await this.hasProtocolPermission({
+            originator,
+            privileged: false,
+            protocolID: currentRequest.protocolID,
+            counterparty
+        });
+        return satisfied ? true : null;
+    }
+    async maybeRequestPeerGroupedLevel2ProtocolPermissions(currentRequest) {
+        var _a, _b;
+        if (!this.config.seekGroupedPermission) {
+            return null;
+        }
+        if (!this.hasGroupedPermissionRequestedHandlers()) {
+            return null;
+        }
+        if (currentRequest.type !== 'protocol') {
+            return null;
+        }
+        const [level] = currentRequest.protocolID;
+        if (level !== 2) {
+            return null;
+        }
+        const originator = currentRequest.originator;
+        const privileged = (_a = currentRequest.privileged) !== null && _a !== void 0 ? _a : false;
+        const counterparty = (_b = currentRequest.counterparty) !== null && _b !== void 0 ? _b : 'self';
+        const groupPermissions = await this.fetchManifestGroupPermissions(originator);
+        if (!groupPermissions) {
+            return null;
+        }
+        const normalizeManifestCounterparty = (cp) => {
+            if (cp === '')
+                return counterparty;
+            return cp !== null && cp !== void 0 ? cp : 'self';
+        };
+        const manifestLevel2ForThisPeer = (groupPermissions.protocolPermissions || [])
+            .filter(p => { var _a, _b; return ((_b = (_a = p.protocolID) === null || _a === void 0 ? void 0 : _a[0]) !== null && _b !== void 0 ? _b : 0) === 2; })
+            .map(p => ({
+            protocolID: p.protocolID,
+            counterparty: normalizeManifestCounterparty(p.counterparty),
+            description: p.description
+        }))
+            .filter(p => p.counterparty === counterparty);
+        const isCurrentRequestInManifest = manifestLevel2ForThisPeer.some(p => deepEqual(p.protocolID, currentRequest.protocolID));
+        if (!isCurrentRequestInManifest) {
+            return null;
+        }
+        const permissionsToRequest = {
+            protocolPermissions: []
+        };
+        for (const p of manifestLevel2ForThisPeer) {
+            const hasPerm = await this.hasProtocolPermission({
+                originator,
+                privileged,
+                protocolID: p.protocolID,
+                counterparty: p.counterparty
+            });
+            if (!hasPerm) {
+                permissionsToRequest.protocolPermissions.push({
+                    protocolID: p.protocolID,
+                    counterparty: p.counterparty,
+                    description: p.description
+                });
+            }
+        }
+        if (!this.hasAnyPermissionsToRequest(permissionsToRequest)) {
+            return null;
+        }
+        const key = `group-peer:${originator}:${privileged}:${counterparty}`;
+        const existing = this.activeRequests.get(key);
+        if (existing) {
+            const existingRequest = existing.request;
+            if (!existingRequest.permissions.protocolPermissions) {
+                existingRequest.permissions.protocolPermissions = [];
+            }
+            for (const p of permissionsToRequest.protocolPermissions || []) {
+                if (!existingRequest.permissions.protocolPermissions.find(x => deepEqual(x, p))) {
+                    existingRequest.permissions.protocolPermissions.push(p);
+                }
+            }
+            await new Promise((resolve, reject) => {
+                existing.pending.push({ resolve, reject });
+            });
+        }
+        else {
+            await new Promise(async (resolve, reject) => {
+                const permissions = permissionsToRequest;
+                this.activeRequests.set(key, {
+                    request: {
+                        originator,
+                        permissions,
+                        displayOriginator: currentRequest.displayOriginator
+                    },
+                    pending: [{ resolve, reject }]
+                });
+                await this.callEvent('onGroupedPermissionRequested', {
+                    requestID: key,
+                    originator,
+                    permissions
+                });
+            });
+        }
+        const satisfied = await this.checkSpecificPermissionAfterGroupFlow(currentRequest);
+        return satisfied ? true : null;
+    }
+    async checkSpecificPermissionAfterGroupFlow(request) {
+        var _a, _b, _c;
+        switch (request.type) {
+            case 'protocol':
+                return await this.hasProtocolPermission({
+                    originator: request.originator,
+                    privileged: (_a = request.privileged) !== null && _a !== void 0 ? _a : false,
+                    protocolID: request.protocolID,
+                    counterparty: (_b = request.counterparty) !== null && _b !== void 0 ? _b : 'self'
+                });
+            case 'basket':
+                return await this.hasBasketAccess({
+                    originator: request.originator,
+                    basket: request.basket
+                });
+            case 'certificate':
+                return await this.hasCertificateAccess({
+                    originator: request.originator,
+                    privileged: (_c = request.privileged) !== null && _c !== void 0 ? _c : false,
+                    verifier: request.certificate.verifier,
+                    certType: request.certificate.certType,
+                    fields: request.certificate.fields
+                });
+            case 'spending':
+                return await this.hasSpendingAuthorization({
+                    originator: request.originator,
+                    satoshis: request.spending.satoshis
+                });
+            default:
+                return false;
+        }
+    }
+    isRequestIncludedInGroupPermissions(request, groupPermissions) {
+        var _a, _b, _c, _d;
+        switch (request.type) {
+            case 'protocol': {
+                if (request.privileged)
+                    return false;
+                const pid = request.protocolID;
+                if (!pid)
+                    return false;
+                const cp = (_a = request.counterparty) !== null && _a !== void 0 ? _a : 'self';
+                return !!((_b = groupPermissions.protocolPermissions) === null || _b === void 0 ? void 0 : _b.some(p => {
+                    var _a;
+                    const manifestCp = p.counterparty === '' ? cp : ((_a = p.counterparty) !== null && _a !== void 0 ? _a : 'self');
+                    return deepEqual(p.protocolID, pid) && manifestCp === cp;
+                }));
+            }
+            case 'basket': {
+                const basket = request.basket;
+                if (!basket)
+                    return false;
+                return !!((_c = groupPermissions.basketAccess) === null || _c === void 0 ? void 0 : _c.some(b => b.basket === basket));
+            }
+            case 'certificate': {
+                if (request.privileged)
+                    return false;
+                const cert = request.certificate;
+                if (!cert)
+                    return false;
+                return !!((_d = groupPermissions.certificateAccess) === null || _d === void 0 ? void 0 : _d.some(c => {
+                    const fieldsA = new Set(c.fields || []);
+                    const fieldsB = new Set(cert.fields || []);
+                    if (fieldsA.size !== fieldsB.size)
+                        return false;
+                    for (const f of fieldsA)
+                        if (!fieldsB.has(f))
+                            return false;
+                    return c.type === cert.certType && c.verifierPublicKey === cert.verifier;
+                }));
+            }
+            case 'spending':
+                return !!groupPermissions.spendingAuthorization;
+            default:
+                return false;
+        }
+    }
+    async maybeRequestGroupedPermissions(currentRequest) {
+        if (!this.config.seekGroupedPermission) {
+            return null;
+        }
+        const originator = currentRequest.originator;
+        const groupPermissions = await this.fetchManifestGroupPermissions(originator);
+        if (!groupPermissions) {
+            return null;
+        }
+        if (!this.isRequestIncludedInGroupPermissions(currentRequest, groupPermissions)) {
+            return null;
+        }
+        const permissionsToRequest = await this.filterAlreadyGrantedPermissions(originator, groupPermissions);
+        if (!this.hasAnyPermissionsToRequest(permissionsToRequest)) {
+            return null;
+        }
+        const key = `group:${originator}`;
+        if (this.activeRequests.has(key)) {
+            await new Promise((resolve, reject) => {
+                this.activeRequests.get(key).pending.push({ resolve, reject });
+            });
+        }
+        else {
+            await new Promise(async (resolve, reject) => {
+                this.activeRequests.set(key, {
+                    request: {
+                        originator,
+                        permissions: permissionsToRequest,
+                        displayOriginator: currentRequest.displayOriginator
+                    },
+                    pending: [{ resolve, reject }]
+                });
+                await this.callEvent('onGroupedPermissionRequested', {
+                    requestID: key,
+                    originator,
+                    permissions: permissionsToRequest
+                });
+            });
+        }
+        const satisfied = await this.checkSpecificPermissionAfterGroupFlow(currentRequest);
+        return satisfied ? true : null;
+    }
     /**
      * A central method that triggers the permission request flow.
      * - It checks if there's already an active request for the same key
@@ -736,13 +1270,25 @@ class WalletPermissionsManager {
      *   and return a promise that resolves once permission is granted or rejects if denied.
      */
     async requestPermissionFlow(r) {
-        var _a;
+        var _a, _b, _c;
         const normalizedOriginator = this.normalizeOriginator(r.originator) || r.originator;
         const preparedRequest = {
             ...r,
             originator: normalizedOriginator,
-            displayOriginator: (_a = r.displayOriginator) !== null && _a !== void 0 ? _a : r.originator
+            displayOriginator: (_c = (_a = r.displayOriginator) !== null && _a !== void 0 ? _a : (_b = r.previousToken) === null || _b === void 0 ? void 0 : _b.rawOriginator) !== null && _c !== void 0 ? _c : r.originator
         };
+        const pactResult = await this.maybeRequestPact(preparedRequest);
+        if (pactResult !== null) {
+            return pactResult;
+        }
+        const peerGroupResult = await this.maybeRequestPeerGroupedLevel2ProtocolPermissions(preparedRequest);
+        if (peerGroupResult !== null) {
+            return peerGroupResult;
+        }
+        const groupResult = await this.maybeRequestGroupedPermissions(preparedRequest);
+        if (groupResult !== null) {
+            return groupResult;
+        }
         const key = this.buildRequestKey(preparedRequest);
         // If there's already a queue for the same resource, we piggyback on it
         const existingQueue = this.activeRequests.get(key);
@@ -2358,80 +2904,17 @@ class WalletPermissionsManager {
         return this.underlying.isAuthenticated(...args);
     }
     async waitForAuthentication(...args) {
-        var _a, _b, _c, _d, _e, _f, _g;
         let [_, originator] = args;
         if (this.config.seekGroupedPermission && originator) {
             const { normalized: normalizedOriginator } = this.prepareOriginator(originator);
             originator = normalizedOriginator;
             // 1. Fetch manifest.json from the originator
-            let groupPermissions;
-            try {
-                const proto = originator.startsWith('localhost:') ? 'http' : 'https';
-                const response = await fetch(`${proto}://${originator}/manifest.json`);
-                if (response.ok) {
-                    const manifest = await response.json();
-                    if ((_a = manifest === null || manifest === void 0 ? void 0 : manifest.babbage) === null || _a === void 0 ? void 0 : _a.groupPermissions) {
-                        groupPermissions = manifest.babbage.groupPermissions;
-                    }
-                }
-            }
-            catch (e) {
-                // Ignore fetch/parse errors, just proceed without group permissions.
-            }
+            const groupPermissions = await this.fetchManifestGroupPermissions(originator);
             if (groupPermissions) {
                 // 2. Filter out already-granted permissions
-                const permissionsToRequest = {
-                    protocolPermissions: [],
-                    basketAccess: [],
-                    certificateAccess: []
-                };
-                if (groupPermissions.spendingAuthorization) {
-                    const hasAuth = await this.hasSpendingAuthorization({
-                        originator,
-                        satoshis: groupPermissions.spendingAuthorization.amount
-                    });
-                    if (!hasAuth) {
-                        permissionsToRequest.spendingAuthorization = groupPermissions.spendingAuthorization;
-                    }
-                }
-                for (const p of groupPermissions.protocolPermissions || []) {
-                    const hasPerm = await this.hasProtocolPermission({
-                        originator,
-                        privileged: false, // Privilege is never allowed here
-                        protocolID: p.protocolID,
-                        counterparty: p.counterparty || 'self'
-                    });
-                    if (!hasPerm) {
-                        permissionsToRequest.protocolPermissions.push(p);
-                    }
-                }
-                for (const b of groupPermissions.basketAccess || []) {
-                    const hasAccess = await this.hasBasketAccess({
-                        originator,
-                        basket: b.basket
-                    });
-                    if (!hasAccess) {
-                        permissionsToRequest.basketAccess.push(b);
-                    }
-                }
-                for (const c of groupPermissions.certificateAccess || []) {
-                    const hasAccess = await this.hasCertificateAccess({
-                        originator,
-                        privileged: false, // Privilege is never allowed here for security
-                        verifier: c.verifierPublicKey,
-                        certType: c.type,
-                        fields: c.fields
-                    });
-                    if (!hasAccess) {
-                        permissionsToRequest.certificateAccess.push(c);
-                    }
-                }
+                const permissionsToRequest = await this.filterAlreadyGrantedPermissions(originator, groupPermissions);
                 // 3. If any permissions are left to request, start the flow
-                const hasRequests = permissionsToRequest.spendingAuthorization ||
-                    ((_c = (_b = permissionsToRequest.protocolPermissions) === null || _b === void 0 ? void 0 : _b.length) !== null && _c !== void 0 ? _c : 0) > 0 ||
-                    ((_e = (_d = permissionsToRequest.basketAccess) === null || _d === void 0 ? void 0 : _d.length) !== null && _e !== void 0 ? _e : 0) > 0 ||
-                    ((_g = (_f = permissionsToRequest.certificateAccess) === null || _f === void 0 ? void 0 : _f.length) !== null && _g !== void 0 ? _g : 0) > 0;
-                if (hasRequests) {
+                if (this.hasAnyPermissionsToRequest(permissionsToRequest)) {
                     const key = `group:${originator}`;
                     if (this.activeRequests.has(key)) {
                         // Another call is already waiting, piggyback on it
@@ -2646,6 +3129,7 @@ class WalletPermissionsManager {
     }
 }
 exports.WalletPermissionsManager = WalletPermissionsManager;
+WalletPermissionsManager.MANIFEST_CACHE_TTL_MS = 5 * 60 * 1000;
 /** How long a cached permission remains valid (5 minutes). */
 WalletPermissionsManager.CACHE_TTL_MS = 5 * 60 * 1000;
 /** Window during which freshly granted permissions are auto-allowed (except spending). */