@bsv/wallet-toolbox-client 1.7.18 → 1.7.20

package/out/src/WalletPermissionsManager.js

@@ -77,7 +77,8 @@ class WalletPermissionsManager {
             onBasketAccessRequested: [],
             onCertificateAccessRequested: [],
             onSpendingAuthorizationRequested: [],
-            onGroupedPermissionRequested: []
+            onGroupedPermissionRequested: [],
+            onCounterpartyPermissionRequested: []
         };
         /**
          * We queue parallel requests for the same resource so that only one
@@ -93,6 +94,9 @@ class WalletPermissionsManager {
         /** Cache recently confirmed permissions to avoid repeated lookups. */
         this.permissionCache = new Map();
         this.recentGrants = new Map();
+        this.manifestCache = new Map();
+        this.manifestFetchInProgress = new Map();
+        this.pactEstablishedCache = new Map();
         this.underlying = underlyingWallet;
         this.adminOriginator = this.normalizeOriginator(adminOriginator) || adminOriginator;
         // Default all config options to true unless specified
@@ -316,9 +320,8 @@ class WalletPermissionsManager {
         const { originator, permissions: requestedPermissions, displayOriginator } = originalRequest;
         const originLookupValues = this.buildOriginatorLookupValues(displayOriginator, originator);
         // --- Validation: Ensure granted permissions are a subset of what was requested ---
-        if (params.granted.spendingAuthorization &&
-            !deepEqual(params.granted.spendingAuthorization, requestedPermissions.spendingAuthorization)) {
-            throw new Error('Granted spending authorization does not match the original request.');
+        if (params.granted.spendingAuthorization && !requestedPermissions.spendingAuthorization) {
+            throw new Error('Granted spending authorization was not part of the original request.');
         }
         if ((_a = params.granted.protocolPermissions) === null || _a === void 0 ? void 0 : _a.some(g => { var _a; return !((_a = requestedPermissions.protocolPermissions) === null || _a === void 0 ? void 0 : _a.find(r => deepEqual(r, g))); })) {
             throw new Error('Granted protocol permissions are not a subset of the original request.');
@@ -331,62 +334,67 @@ class WalletPermissionsManager {
         }
         // --- End Validation ---
         const expiry = params.expiry || 0; // default: never expires
+        const toCreate = [];
+        const toRenew = [];
         if (params.granted.spendingAuthorization) {
-            await this.createPermissionOnChain({
-                type: 'spending',
+            toCreate.push({
+                request: {
+                    type: 'spending',
+                    originator,
+                    spending: { satoshis: params.granted.spendingAuthorization.amount },
+                    reason: params.granted.spendingAuthorization.description
+                },
+                expiry: 0,
+                amount: params.granted.spendingAuthorization.amount
+            });
+        }
+        const grantedProtocols = params.granted.protocolPermissions || [];
+        const protocolTokens = await this.mapWithConcurrency(grantedProtocols, 8, async (p) => {
+            const token = await this.findProtocolToken(originator, false, p.protocolID, p.counterparty || 'self', true, originLookupValues);
+            return { p, token };
+        });
+        for (const { p, token } of protocolTokens) {
+            const request = {
+                type: 'protocol',
                 originator,
-                spending: { satoshis: params.granted.spendingAuthorization.amount },
-                reason: params.granted.spendingAuthorization.description
-            }, 0, // No expiry for spending tokens
-            params.granted.spendingAuthorization.amount);
-        }
-        for (const p of params.granted.protocolPermissions || []) {
-            const token = await this.findProtocolToken(originator, false, // No privileged protocols allowed in groups for added security.
-            p.protocolID, p.counterparty || 'self', true, originLookupValues);
+                privileged: false,
+                protocolID: p.protocolID,
+                counterparty: p.counterparty || 'self',
+                reason: p.description
+            };
             if (token) {
-                const request = {
-                    type: 'protocol',
-                    originator,
-                    privileged: false, // No privileged protocols allowed in groups for added security.
-                    protocolID: p.protocolID,
-                    counterparty: p.counterparty || 'self',
-                    reason: p.description
-                };
-                await this.renewPermissionOnChain(token, request, expiry);
-                this.markRecentGrant(request);
+                toRenew.push({ oldToken: token, request, expiry });
             }
             else {
-                const request = {
-                    type: 'protocol',
-                    originator,
-                    privileged: false, // No privileged protocols allowed in groups for added security.
-                    protocolID: p.protocolID,
-                    counterparty: p.counterparty || 'self',
-                    reason: p.description
-                };
-                await this.createPermissionOnChain(request, expiry);
-                this.markRecentGrant(request);
+                toCreate.push({ request, expiry });
             }
         }
         for (const b of params.granted.basketAccess || []) {
-            const request = { type: 'basket', originator, basket: b.basket, reason: b.description };
-            await this.createPermissionOnChain(request, expiry);
-            this.markRecentGrant(request);
+            toCreate.push({
+                request: { type: 'basket', originator, basket: b.basket, reason: b.description },
+                expiry
+            });
         }
         for (const c of params.granted.certificateAccess || []) {
-            const request = {
-                type: 'certificate',
-                originator,
-                privileged: false, // No certificates on the privileged identity are allowed as part of groups.
-                certificate: {
-                    verifier: c.verifierPublicKey,
-                    certType: c.type,
-                    fields: c.fields
+            toCreate.push({
+                request: {
+                    type: 'certificate',
+                    originator,
+                    privileged: false,
+                    certificate: {
+                        verifier: c.verifierPublicKey,
+                        certType: c.type,
+                        fields: c.fields
+                    },
+                    reason: c.description
                 },
-                reason: c.description
-            };
-            await this.createPermissionOnChain(request, expiry);
-            this.markRecentGrant(request);
+                expiry
+            });
+        }
+        const created = await this.createPermissionTokensBestEffort(toCreate);
+        const renewed = await this.renewPermissionTokensBestEffort(toRenew);
+        for (const req of [...created, ...renewed]) {
+            this.markRecentGrant(req);
         }
         // Resolve all pending promises for this request
         for (const p of matching.pending) {
@@ -410,6 +418,74 @@ class WalletPermissionsManager {
         }
         this.activeRequests.delete(requestID);
     }
+    async dismissGroupedPermission(requestID) {
+        const matching = this.activeRequests.get(requestID);
+        if (!matching) {
+            throw new Error('Request ID not found.');
+        }
+        for (const p of matching.pending) {
+            p.resolve(true);
+        }
+        this.activeRequests.delete(requestID);
+    }
+    async grantCounterpartyPermission(params) {
+        var _a;
+        const matching = this.activeRequests.get(params.requestID);
+        if (!matching) {
+            throw new Error('Request ID not found.');
+        }
+        const originalRequest = matching.request;
+        const { originator, counterparty, permissions: requestedPermissions, displayOriginator } = originalRequest;
+        const originLookupValues = this.buildOriginatorLookupValues(displayOriginator, originator);
+        if ((_a = params.granted.protocols) === null || _a === void 0 ? void 0 : _a.some(g => !requestedPermissions.protocols.find(r => deepEqual(r, g)))) {
+            throw new Error('Granted protocol permissions are not a subset of the original request.');
+        }
+        const expiry = params.expiry || 0;
+        const toCreate = [];
+        const toRenew = [];
+        const grantedProtocols = params.granted.protocols || [];
+        const protocolTokens = await this.mapWithConcurrency(grantedProtocols, 8, async (p) => {
+            const token = await this.findProtocolToken(originator, false, p.protocolID, counterparty, true, originLookupValues);
+            return { p, token };
+        });
+        for (const { p, token } of protocolTokens) {
+            const request = {
+                type: 'protocol',
+                originator,
+                privileged: false,
+                protocolID: p.protocolID,
+                counterparty,
+                reason: p.description
+            };
+            if (token) {
+                toRenew.push({ oldToken: token, request, expiry });
+            }
+            else {
+                toCreate.push({ request, expiry });
+            }
+        }
+        const created = await this.createPermissionTokensBestEffort(toCreate);
+        const renewed = await this.renewPermissionTokensBestEffort(toRenew);
+        for (const req of [...created, ...renewed]) {
+            this.markRecentGrant(req);
+        }
+        for (const p of matching.pending) {
+            p.resolve(true);
+        }
+        this.activeRequests.delete(params.requestID);
+    }
+    async denyCounterpartyPermission(requestID) {
+        const matching = this.activeRequests.get(requestID);
+        if (!matching) {
+            throw new Error('Request ID not found.');
+        }
+        const err = new Error('The user has denied the request for permission.');
+        err.code = 'ERR_PERMISSION_DENIED';
+        for (const p of matching.pending) {
+            p.reject(err);
+        }
+        this.activeRequests.delete(requestID);
+    }
     /* ---------------------------------------------------------------------
      *  3) THE "ENSURE" METHODS: CHECK IF PERMISSION EXISTS, OTHERWISE PROMPT
      * --------------------------------------------------------------------- */
@@ -728,6 +804,469 @@ class WalletPermissionsManager {
             usageType: 'generic'
         });
     }
+    validateCounterpartyPermissions(raw) {
+        if (!raw || !Array.isArray(raw.protocols) || raw.protocols.length === 0)
+            return null;
+        const validProtocols = raw.protocols.filter((p) => {
+            return (Array.isArray(p === null || p === void 0 ? void 0 : p.protocolID) &&
+                p.protocolID[0] === 2 &&
+                typeof p.protocolID[1] === 'string' &&
+                typeof (p === null || p === void 0 ? void 0 : p.description) === 'string');
+        });
+        if (validProtocols.length === 0)
+            return null;
+        return {
+            description: typeof raw.description === 'string' ? raw.description : undefined,
+            protocols: validProtocols
+        };
+    }
+    async fetchManifestPermissions(originator) {
+        const cached = this.manifestCache.get(originator);
+        if (cached && Date.now() - cached.fetchedAt < WalletPermissionsManager.MANIFEST_CACHE_TTL_MS) {
+            return {
+                groupPermissions: cached.groupPermissions,
+                counterpartyPermissions: cached.counterpartyPermissions
+            };
+        }
+        const inProgress = this.manifestFetchInProgress.get(originator);
+        if (inProgress) {
+            return inProgress;
+        }
+        const fetchPromise = (async () => {
+            var _a, _b;
+            try {
+                const proto = originator.startsWith('localhost:') ? 'http' : 'https';
+                const response = await fetch(`${proto}://${originator}/manifest.json`);
+                if (response.ok) {
+                    const manifest = await response.json();
+                    const groupPermissions = ((_a = manifest === null || manifest === void 0 ? void 0 : manifest.babbage) === null || _a === void 0 ? void 0 : _a.groupPermissions) || null;
+                    const counterpartyPermissions = this.validateCounterpartyPermissions((_b = manifest === null || manifest === void 0 ? void 0 : manifest.babbage) === null || _b === void 0 ? void 0 : _b.counterpartyPermissions);
+                    this.manifestCache.set(originator, { groupPermissions, counterpartyPermissions, fetchedAt: Date.now() });
+                    return { groupPermissions, counterpartyPermissions };
+                }
+            }
+            catch (e) { }
+            const result = { groupPermissions: null, counterpartyPermissions: null };
+            this.manifestCache.set(originator, { ...result, fetchedAt: Date.now() });
+            return result;
+        })();
+        this.manifestFetchInProgress.set(originator, fetchPromise);
+        try {
+            return await fetchPromise;
+        }
+        finally {
+            this.manifestFetchInProgress.delete(originator);
+        }
+    }
+    async fetchManifestGroupPermissions(originator) {
+        const { groupPermissions } = await this.fetchManifestPermissions(originator);
+        return groupPermissions;
+    }
+    async filterAlreadyGrantedPermissions(originator, groupPermissions) {
+        const permissionsToRequest = {
+            description: groupPermissions.description,
+            protocolPermissions: [],
+            basketAccess: [],
+            certificateAccess: []
+        };
+        if (groupPermissions.spendingAuthorization) {
+            const hasAuth = await this.hasSpendingAuthorization({
+                originator,
+                satoshis: groupPermissions.spendingAuthorization.amount
+            });
+            if (!hasAuth) {
+                permissionsToRequest.spendingAuthorization = groupPermissions.spendingAuthorization;
+            }
+        }
+        for (const p of groupPermissions.protocolPermissions || []) {
+            const hasPerm = await this.hasProtocolPermission({
+                originator,
+                privileged: false,
+                protocolID: p.protocolID,
+                counterparty: p.counterparty || 'self'
+            });
+            if (!hasPerm) {
+                permissionsToRequest.protocolPermissions.push(p);
+            }
+        }
+        for (const b of groupPermissions.basketAccess || []) {
+            const hasAccess = await this.hasBasketAccess({
+                originator,
+                basket: b.basket
+            });
+            if (!hasAccess) {
+                permissionsToRequest.basketAccess.push(b);
+            }
+        }
+        for (const c of groupPermissions.certificateAccess || []) {
+            const hasAccess = await this.hasCertificateAccess({
+                originator,
+                privileged: false,
+                verifier: c.verifierPublicKey,
+                certType: c.type,
+                fields: c.fields
+            });
+            if (!hasAccess) {
+                permissionsToRequest.certificateAccess.push(c);
+            }
+        }
+        return permissionsToRequest;
+    }
+    hasAnyPermissionsToRequest(permissions) {
+        var _a, _b, _c, _d, _e, _f;
+        return !!(permissions.spendingAuthorization ||
+            ((_b = (_a = permissions.protocolPermissions) === null || _a === void 0 ? void 0 : _a.length) !== null && _b !== void 0 ? _b : 0) > 0 ||
+            ((_d = (_c = permissions.basketAccess) === null || _c === void 0 ? void 0 : _c.length) !== null && _d !== void 0 ? _d : 0) > 0 ||
+            ((_f = (_e = permissions.certificateAccess) === null || _e === void 0 ? void 0 : _e.length) !== null && _f !== void 0 ? _f : 0) > 0);
+    }
+    hasGroupedPermissionRequestedHandlers() {
+        const handlers = this.callbacks.onGroupedPermissionRequested || [];
+        return handlers.some(h => typeof h === 'function');
+    }
+    hasCounterpartyPermissionRequestedHandlers() {
+        const handlers = this.callbacks.onCounterpartyPermissionRequested || [];
+        return handlers.some(h => typeof h === 'function');
+    }
+    async hasPactEstablished(originator, counterparty) {
+        var _a;
+        if (counterparty === 'self' || counterparty === 'anyone') {
+            return true;
+        }
+        const cacheKey = `${originator}:${counterparty}`;
+        if (this.pactEstablishedCache.has(cacheKey)) {
+            return true;
+        }
+        const { counterpartyPermissions } = await this.fetchManifestPermissions(originator);
+        if (!((_a = counterpartyPermissions === null || counterpartyPermissions === void 0 ? void 0 : counterpartyPermissions.protocols) === null || _a === void 0 ? void 0 : _a.length)) {
+            return true;
+        }
+        const firstProtocol = counterpartyPermissions.protocols[0];
+        const hasToken = await this.hasProtocolPermission({
+            originator,
+            privileged: false,
+            protocolID: firstProtocol.protocolID,
+            counterparty
+        });
+        if (hasToken) {
+            this.pactEstablishedCache.set(cacheKey, Date.now());
+            return true;
+        }
+        return false;
+    }
+    markPactEstablished(originator, counterparty) {
+        const cacheKey = `${originator}:${counterparty}`;
+        this.pactEstablishedCache.set(cacheKey, Date.now());
+    }
+    async maybeRequestPact(currentRequest) {
+        var _a;
+        if (!this.config.seekGroupedPermission) {
+            return null;
+        }
+        if (!this.hasCounterpartyPermissionRequestedHandlers()) {
+            return null;
+        }
+        if (currentRequest.type !== 'protocol') {
+            return null;
+        }
+        if (currentRequest.privileged) {
+            return null;
+        }
+        const [level] = currentRequest.protocolID;
+        if (level !== 2) {
+            return null;
+        }
+        const originator = currentRequest.originator;
+        const counterparty = currentRequest.counterparty;
+        if (!counterparty || counterparty === 'self' || counterparty === 'anyone') {
+            return null;
+        }
+        if (!/^[0-9a-fA-F]{66}$/.test(counterparty)) {
+            return null;
+        }
+        if (await this.hasPactEstablished(originator, counterparty)) {
+            return null;
+        }
+        const { counterpartyPermissions } = await this.fetchManifestPermissions(originator);
+        if (!((_a = counterpartyPermissions === null || counterpartyPermissions === void 0 ? void 0 : counterpartyPermissions.protocols) === null || _a === void 0 ? void 0 : _a.length)) {
+            return null;
+        }
+        const protocolsToRequest = [];
+        for (const p of counterpartyPermissions.protocols) {
+            const hasPerm = await this.hasProtocolPermission({
+                originator,
+                privileged: false,
+                protocolID: p.protocolID,
+                counterparty
+            });
+            if (!hasPerm) {
+                protocolsToRequest.push(p);
+            }
+        }
+        if (protocolsToRequest.length === 0) {
+            this.markPactEstablished(originator, counterparty);
+            return null;
+        }
+        const permissionsToRequest = {
+            description: counterpartyPermissions.description,
+            protocols: protocolsToRequest
+        };
+        const key = `pact:${originator}:${counterparty}`;
+        const existing = this.activeRequests.get(key);
+        if (existing) {
+            const existingRequest = existing.request;
+            for (const p of permissionsToRequest.protocols) {
+                if (!existingRequest.permissions.protocols.find(x => deepEqual(x, p))) {
+                    existingRequest.permissions.protocols.push(p);
+                }
+            }
+            await new Promise((resolve, reject) => {
+                existing.pending.push({ resolve, reject });
+            });
+        }
+        else {
+            await new Promise(async (resolve, reject) => {
+                this.activeRequests.set(key, {
+                    request: {
+                        originator,
+                        counterparty,
+                        permissions: permissionsToRequest,
+                        displayOriginator: currentRequest.displayOriginator
+                    },
+                    pending: [{ resolve, reject }]
+                });
+                await this.callEvent('onCounterpartyPermissionRequested', {
+                    requestID: key,
+                    originator,
+                    counterparty,
+                    permissions: permissionsToRequest
+                });
+            });
+        }
+        this.markPactEstablished(originator, counterparty);
+        const satisfied = await this.hasProtocolPermission({
+            originator,
+            privileged: false,
+            protocolID: currentRequest.protocolID,
+            counterparty
+        });
+        return satisfied ? true : null;
+    }
+    async maybeRequestPeerGroupedLevel2ProtocolPermissions(currentRequest) {
+        var _a, _b;
+        if (!this.config.seekGroupedPermission) {
+            return null;
+        }
+        if (!this.hasGroupedPermissionRequestedHandlers()) {
+            return null;
+        }
+        if (currentRequest.type !== 'protocol') {
+            return null;
+        }
+        const [level] = currentRequest.protocolID;
+        if (level !== 2) {
+            return null;
+        }
+        const originator = currentRequest.originator;
+        const privileged = (_a = currentRequest.privileged) !== null && _a !== void 0 ? _a : false;
+        const counterparty = (_b = currentRequest.counterparty) !== null && _b !== void 0 ? _b : 'self';
+        const groupPermissions = await this.fetchManifestGroupPermissions(originator);
+        if (!groupPermissions) {
+            return null;
+        }
+        const normalizeManifestCounterparty = (cp) => {
+            if (cp === '')
+                return counterparty;
+            return cp !== null && cp !== void 0 ? cp : 'self';
+        };
+        const manifestLevel2ForThisPeer = (groupPermissions.protocolPermissions || [])
+            .filter(p => { var _a, _b; return ((_b = (_a = p.protocolID) === null || _a === void 0 ? void 0 : _a[0]) !== null && _b !== void 0 ? _b : 0) === 2; })
+            .map(p => ({
+            protocolID: p.protocolID,
+            counterparty: normalizeManifestCounterparty(p.counterparty),
+            description: p.description
+        }))
+            .filter(p => p.counterparty === counterparty);
+        const isCurrentRequestInManifest = manifestLevel2ForThisPeer.some(p => deepEqual(p.protocolID, currentRequest.protocolID));
+        if (!isCurrentRequestInManifest) {
+            return null;
+        }
+        const permissionsToRequest = {
+            protocolPermissions: []
+        };
+        for (const p of manifestLevel2ForThisPeer) {
+            const hasPerm = await this.hasProtocolPermission({
+                originator,
+                privileged,
+                protocolID: p.protocolID,
+                counterparty: p.counterparty
+            });
+            if (!hasPerm) {
+                permissionsToRequest.protocolPermissions.push({
+                    protocolID: p.protocolID,
+                    counterparty: p.counterparty,
+                    description: p.description
+                });
+            }
+        }
+        if (!this.hasAnyPermissionsToRequest(permissionsToRequest)) {
+            return null;
+        }
+        const key = `group-peer:${originator}:${privileged}:${counterparty}`;
+        const existing = this.activeRequests.get(key);
+        if (existing) {
+            const existingRequest = existing.request;
+            if (!existingRequest.permissions.protocolPermissions) {
+                existingRequest.permissions.protocolPermissions = [];
+            }
+            for (const p of permissionsToRequest.protocolPermissions || []) {
+                if (!existingRequest.permissions.protocolPermissions.find(x => deepEqual(x, p))) {
+                    existingRequest.permissions.protocolPermissions.push(p);
+                }
+            }
+            await new Promise((resolve, reject) => {
+                existing.pending.push({ resolve, reject });
+            });
+        }
+        else {
+            await new Promise(async (resolve, reject) => {
+                const permissions = permissionsToRequest;
+                this.activeRequests.set(key, {
+                    request: {
+                        originator,
+                        permissions,
+                        displayOriginator: currentRequest.displayOriginator
+                    },
+                    pending: [{ resolve, reject }]
+                });
+                await this.callEvent('onGroupedPermissionRequested', {
+                    requestID: key,
+                    originator,
+                    permissions
+                });
+            });
+        }
+        const satisfied = await this.checkSpecificPermissionAfterGroupFlow(currentRequest);
+        return satisfied ? true : null;
+    }
+    async checkSpecificPermissionAfterGroupFlow(request) {
+        var _a, _b, _c;
+        switch (request.type) {
+            case 'protocol':
+                return await this.hasProtocolPermission({
+                    originator: request.originator,
+                    privileged: (_a = request.privileged) !== null && _a !== void 0 ? _a : false,
+                    protocolID: request.protocolID,
+                    counterparty: (_b = request.counterparty) !== null && _b !== void 0 ? _b : 'self'
+                });
+            case 'basket':
+                return await this.hasBasketAccess({
+                    originator: request.originator,
+                    basket: request.basket
+                });
+            case 'certificate':
+                return await this.hasCertificateAccess({
+                    originator: request.originator,
+                    privileged: (_c = request.privileged) !== null && _c !== void 0 ? _c : false,
+                    verifier: request.certificate.verifier,
+                    certType: request.certificate.certType,
+                    fields: request.certificate.fields
+                });
+            case 'spending':
+                return await this.hasSpendingAuthorization({
+                    originator: request.originator,
+                    satoshis: request.spending.satoshis
+                });
+            default:
+                return false;
+        }
+    }
+    isRequestIncludedInGroupPermissions(request, groupPermissions) {
+        var _a, _b, _c, _d;
+        switch (request.type) {
+            case 'protocol': {
+                if (request.privileged)
+                    return false;
+                const pid = request.protocolID;
+                if (!pid)
+                    return false;
+                const cp = (_a = request.counterparty) !== null && _a !== void 0 ? _a : 'self';
+                return !!((_b = groupPermissions.protocolPermissions) === null || _b === void 0 ? void 0 : _b.some(p => {
+                    var _a;
+                    const manifestCp = p.counterparty === '' ? cp : ((_a = p.counterparty) !== null && _a !== void 0 ? _a : 'self');
+                    return deepEqual(p.protocolID, pid) && manifestCp === cp;
+                }));
+            }
+            case 'basket': {
+                const basket = request.basket;
+                if (!basket)
+                    return false;
+                return !!((_c = groupPermissions.basketAccess) === null || _c === void 0 ? void 0 : _c.some(b => b.basket === basket));
+            }
+            case 'certificate': {
+                if (request.privileged)
+                    return false;
+                const cert = request.certificate;
+                if (!cert)
+                    return false;
+                return !!((_d = groupPermissions.certificateAccess) === null || _d === void 0 ? void 0 : _d.some(c => {
+                    const fieldsA = new Set(c.fields || []);
+                    const fieldsB = new Set(cert.fields || []);
+                    if (fieldsA.size !== fieldsB.size)
+                        return false;
+                    for (const f of fieldsA)
+                        if (!fieldsB.has(f))
+                            return false;
+                    return c.type === cert.certType && c.verifierPublicKey === cert.verifier;
+                }));
+            }
+            case 'spending':
+                return !!groupPermissions.spendingAuthorization;
+            default:
+                return false;
+        }
+    }
+    async maybeRequestGroupedPermissions(currentRequest) {
+        if (!this.config.seekGroupedPermission) {
+            return null;
+        }
+        const originator = currentRequest.originator;
+        const groupPermissions = await this.fetchManifestGroupPermissions(originator);
+        if (!groupPermissions) {
+            return null;
+        }
+        if (!this.isRequestIncludedInGroupPermissions(currentRequest, groupPermissions)) {
+            return null;
+        }
+        const permissionsToRequest = await this.filterAlreadyGrantedPermissions(originator, groupPermissions);
+        if (!this.hasAnyPermissionsToRequest(permissionsToRequest)) {
+            return null;
+        }
+        const key = `group:${originator}`;
+        if (this.activeRequests.has(key)) {
+            await new Promise((resolve, reject) => {
+                this.activeRequests.get(key).pending.push({ resolve, reject });
+            });
+        }
+        else {
+            await new Promise(async (resolve, reject) => {
+                this.activeRequests.set(key, {
+                    request: {
+                        originator,
+                        permissions: permissionsToRequest,
+                        displayOriginator: currentRequest.displayOriginator
+                    },
+                    pending: [{ resolve, reject }]
+                });
+                await this.callEvent('onGroupedPermissionRequested', {
+                    requestID: key,
+                    originator,
+                    permissions: permissionsToRequest
+                });
+            });
+        }
+        const satisfied = await this.checkSpecificPermissionAfterGroupFlow(currentRequest);
+        return satisfied ? true : null;
+    }
     /**
      * A central method that triggers the permission request flow.
      * - It checks if there's already an active request for the same key
@@ -736,13 +1275,25 @@ class WalletPermissionsManager {
      *   and return a promise that resolves once permission is granted or rejects if denied.
      */
     async requestPermissionFlow(r) {
-        var _a;
+        var _a, _b, _c;
         const normalizedOriginator = this.normalizeOriginator(r.originator) || r.originator;
         const preparedRequest = {
             ...r,
             originator: normalizedOriginator,
-            displayOriginator: (_a = r.displayOriginator) !== null && _a !== void 0 ? _a : r.originator
+            displayOriginator: (_c = (_a = r.displayOriginator) !== null && _a !== void 0 ? _a : (_b = r.previousToken) === null || _b === void 0 ? void 0 : _b.rawOriginator) !== null && _c !== void 0 ? _c : r.originator
         };
+        const pactResult = await this.maybeRequestPact(preparedRequest);
+        if (pactResult !== null) {
+            return pactResult;
+        }
+        const peerGroupResult = await this.maybeRequestPeerGroupedLevel2ProtocolPermissions(preparedRequest);
+        if (peerGroupResult !== null) {
+            return peerGroupResult;
+        }
+        const groupResult = await this.maybeRequestGroupedPermissions(preparedRequest);
+        if (groupResult !== null) {
+            return groupResult;
+        }
         const key = this.buildRequestKey(preparedRequest);
         // If there's already a queue for the same resource, we piggyback on it
         const existingQueue = this.activeRequests.get(key);
@@ -1196,10 +1747,128 @@ class WalletPermissionsManager {
                 }
             ],
             options: {
-                acceptDelayedBroadcast: false
+                acceptDelayedBroadcast: true
             }
         }, this.adminOriginator);
     }
+    async mapWithConcurrency(items, concurrency, fn) {
+        if (!items.length)
+            return [];
+        const results = new Array(items.length);
+        let i = 0;
+        const worker = async () => {
+            while (true) {
+                const idx = i++;
+                if (idx >= items.length)
+                    return;
+                results[idx] = await fn(items[idx]);
+            }
+        };
+        await Promise.all(Array.from({ length: Math.min(concurrency, items.length) }, () => worker()));
+        return results;
+    }
+    async runBestEffortBatches(items, chunkSize, runChunk) {
+        if (!items.length)
+            return [];
+        const out = [];
+        for (let i = 0; i < items.length; i += chunkSize) {
+            const chunk = items.slice(i, i + chunkSize);
+            out.push(...(await this.runBestEffortChunk(chunk, runChunk)));
+        }
+        return out;
+    }
+    async runBestEffortChunk(chunk, runChunk) {
+        try {
+            return await runChunk(chunk);
+        }
+        catch (e) {
+            if (chunk.length <= 1) {
+                console.error('Permission batch failed:', e);
+                return [];
+            }
+            const mid = Math.ceil(chunk.length / 2);
+            const left = await this.runBestEffortChunk(chunk.slice(0, mid), runChunk);
+            const right = await this.runBestEffortChunk(chunk.slice(mid), runChunk);
+            return [...left, ...right];
+        }
+    }
+    async buildPermissionOutput(r, expiry, amount) {
+        const normalizedOriginator = this.normalizeOriginator(r.originator) || r.originator;
+        r.originator = normalizedOriginator;
+        const basketName = BASKET_MAP[r.type];
+        if (!basketName) {
+            throw new Error(`Unsupported permission type: ${r.type}`);
+        }
+        const fields = await this.buildPushdropFields(r, expiry, amount);
+        const script = await new sdk_1.PushDrop(this.underlying).lock(fields, WalletPermissionsManager.PERM_TOKEN_ENCRYPTION_PROTOCOL, '1', 'self', true, true);
+        const tags = this.buildTagsForRequest(r);
+        return {
+            request: r,
+            output: {
+                lockingScript: script.toHex(),
+                satoshis: 1,
+                outputDescription: `${r.type} permission token`,
+                basket: basketName,
+                tags
+            }
+        };
+    }
+    async createPermissionTokensBestEffort(items) {
+        const CHUNK = 25;
+        return this.runBestEffortBatches(items, CHUNK, async (chunk) => {
+            const built = await this.mapWithConcurrency(chunk, 8, c => this.buildPermissionOutput(c.request, c.expiry, c.amount));
+            await this.createAction({
+                description: `Grant ${built.length} permissions`,
+                outputs: built.map(b => b.output),
+                options: { acceptDelayedBroadcast: true }
+            }, this.adminOriginator);
+            return built.map(b => b.request);
+        });
+    }
+    async renewPermissionTokensBestEffort(items) {
+        const CHUNK = 15;
+        return this.runBestEffortBatches(items, CHUNK, async (chunk) => {
+            const built = await this.mapWithConcurrency(chunk, 8, c => this.buildPermissionOutput(c.request, c.expiry, c.amount));
+            const inputBeef = new sdk_1.Beef();
+            for (const c of chunk) {
+                inputBeef.mergeBeef(sdk_1.Beef.fromBinary(c.oldToken.tx));
+            }
+            const { signableTransaction } = await this.createAction({
+                description: `Renew ${chunk.length} permissions`,
+                inputBEEF: inputBeef.toBinary(),
+                inputs: chunk.map((c, i) => ({
+                    outpoint: `${c.oldToken.txid}.${c.oldToken.outputIndex}`,
+                    unlockingScriptLength: 73,
+                    inputDescription: `Consume old permission token #${i + 1}`
+                })),
+                outputs: built.map(b => b.output),
+                options: {
+                    acceptDelayedBroadcast: true,
+                    randomizeOutputs: false,
+                    signAndProcess: false
+                }
+            }, this.adminOriginator);
+            if (!(signableTransaction === null || signableTransaction === void 0 ? void 0 : signableTransaction.reference) || !signableTransaction.tx) {
+                throw new Error('Failed to create signable transaction');
+            }
+            const partialTx = sdk_1.Transaction.fromAtomicBEEF(signableTransaction.tx);
+            const pushdrop = new sdk_1.PushDrop(this.underlying);
+            const spends = {};
+            for (let i = 0; i < chunk.length; i++) {
+                const token = chunk[i].oldToken;
+                const unlocker = pushdrop.unlock(WalletPermissionsManager.PERM_TOKEN_ENCRYPTION_PROTOCOL, '1', 'self', 'all', false, 1, sdk_1.LockingScript.fromHex(token.outputScript));
+                const unlockingScript = await unlocker.sign(partialTx, i);
+                spends[i] = { unlockingScript: unlockingScript.toHex() };
+            }
+            const { txid } = await this.underlying.signAction({
+                reference: signableTransaction.reference,
+                spends
+            });
+            if (!txid)
+                throw new Error('Failed to finalize renewal transaction');
+            return built.map(b => b.request);
+        });
+    }
     async coalescePermissionTokens(oldTokens, newScript, opts) {
         var _a;
         if (!(oldTokens === null || oldTokens === void 0 ? void 0 : oldTokens.length))
@@ -1230,7 +1899,7 @@ class WalletPermissionsManager {
                 }
             ],
             options: {
-                acceptDelayedBroadcast: false,
+                acceptDelayedBroadcast: true,
                 randomizeOutputs: false,
                 signAndProcess: false
             }
@@ -1309,7 +1978,7 @@ class WalletPermissionsManager {
                     }
                 ],
                 options: {
-                    acceptDelayedBroadcast: false
+                    acceptDelayedBroadcast: true
                 }
             }, this.adminOriginator);
             const tx = sdk_1.Transaction.fromBEEF(signableTransaction.tx);
@@ -1445,7 +2114,7 @@ class WalletPermissionsManager {
                 tags,
                 tagQueryMode: 'all',
                 include: 'entire transactions',
-                limit: 100
+                limit: 10000
             }, this.adminOriginator);
             for (const out of result.outputs) {
                 if (seen.has(out.outpoint))
@@ -1750,16 +2419,60 @@ class WalletPermissionsManager {
                 }
             ],
             options: {
-                acceptDelayedBroadcast: false
+                acceptDelayedBroadcast: true
             }
         }, this.adminOriginator);
         const tx = sdk_1.Transaction.fromBEEF(signableTransaction.tx);
+        const normalizeTxid = (txid) => (txid !== null && txid !== void 0 ? txid : '').toLowerCase();
+        const reverseHexTxid = (txid) => {
+            const hex = normalizeTxid(txid);
+            if (!/^[0-9a-f]{64}$/.test(hex))
+                return hex;
+            const bytes = hex.match(/../g);
+            return bytes ? bytes.reverse().join('') : hex;
+        };
+        const matchesOutpointString = (outpoint) => {
+            const dot = outpoint.lastIndexOf('.');
+            const colon = outpoint.lastIndexOf(':');
+            const sep = dot > colon ? dot : colon;
+            if (sep === -1)
+                return false;
+            const txidPart = outpoint.slice(0, sep);
+            const indexPart = outpoint.slice(sep + 1);
+            const vout = Number(indexPart);
+            if (!Number.isFinite(vout))
+                return false;
+            return normalizeTxid(txidPart) === normalizeTxid(oldToken.txid) && vout === oldToken.outputIndex;
+        };
+        let permInputIndex = tx.inputs.findIndex((input) => {
+            var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l, _m, _o;
+            const txidCandidate = (_g = (_f = (_e = (_d = (_c = (_b = (_a = input === null || input === void 0 ? void 0 : input.sourceTXID) !== null && _a !== void 0 ? _a : input === null || input === void 0 ? void 0 : input.sourceTxid) !== null && _b !== void 0 ? _b : input === null || input === void 0 ? void 0 : input.sourceTxId) !== null && _c !== void 0 ? _c : input === null || input === void 0 ? void 0 : input.prevTxId) !== null && _d !== void 0 ? _d : input === null || input === void 0 ? void 0 : input.prevTxid) !== null && _e !== void 0 ? _e : input === null || input === void 0 ? void 0 : input.prevTXID) !== null && _f !== void 0 ? _f : input === null || input === void 0 ? void 0 : input.txid) !== null && _g !== void 0 ? _g : input === null || input === void 0 ? void 0 : input.txID;
+            const voutCandidate = (_l = (_k = (_j = (_h = input === null || input === void 0 ? void 0 : input.sourceOutputIndex) !== null && _h !== void 0 ? _h : input === null || input === void 0 ? void 0 : input.sourceOutput) !== null && _j !== void 0 ? _j : input === null || input === void 0 ? void 0 : input.outputIndex) !== null && _k !== void 0 ? _k : input === null || input === void 0 ? void 0 : input.vout) !== null && _l !== void 0 ? _l : input === null || input === void 0 ? void 0 : input.prevOutIndex;
+            if (typeof txidCandidate === 'string' && typeof voutCandidate === 'number') {
+                const cand = normalizeTxid(txidCandidate);
+                const target = normalizeTxid(oldToken.txid);
+                if (cand === target && voutCandidate === oldToken.outputIndex)
+                    return true;
+                if (cand === reverseHexTxid(oldToken.txid) && voutCandidate === oldToken.outputIndex)
+                    return true;
+            }
+            const outpointCandidate = (_o = (_m = input === null || input === void 0 ? void 0 : input.outpoint) !== null && _m !== void 0 ? _m : input === null || input === void 0 ? void 0 : input.sourceOutpoint) !== null && _o !== void 0 ? _o : input === null || input === void 0 ? void 0 : input.prevOutpoint;
+            if (typeof outpointCandidate === 'string' && matchesOutpointString(outpointCandidate))
+                return true;
+            return false;
+        });
+        if (permInputIndex === -1 && tx.inputs.length === 1) {
+            permInputIndex = 0;
+        }
+        if (permInputIndex === -1) {
+            throw new Error('Unable to locate permission token input for revocation.');
+        }
         const unlocker = new sdk_1.PushDrop(this.underlying).unlock(WalletPermissionsManager.PERM_TOKEN_ENCRYPTION_PROTOCOL, '1', 'self', 'all', false, 1, sdk_1.LockingScript.fromHex(oldToken.outputScript));
-        const unlockingScript = await unlocker.sign(tx, 0);
+        const unlockingScript = await unlocker.sign(tx, permInputIndex);
         await this.underlying.signAction({
             reference: signableTransaction.reference,
             spends: {
-                0: {
+                [permInputIndex]: {
                     unlockingScript: unlockingScript.toHex()
                 }
             }
@@ -2358,80 +3071,17 @@ class WalletPermissionsManager {
         return this.underlying.isAuthenticated(...args);
     }
     async waitForAuthentication(...args) {
-        var _a, _b, _c, _d, _e, _f, _g;
         let [_, originator] = args;
         if (this.config.seekGroupedPermission && originator) {
             const { normalized: normalizedOriginator } = this.prepareOriginator(originator);
             originator = normalizedOriginator;
             // 1. Fetch manifest.json from the originator
-            let groupPermissions;
-            try {
-                const proto = originator.startsWith('localhost:') ? 'http' : 'https';
-                const response = await fetch(`${proto}://${originator}/manifest.json`);
-                if (response.ok) {
-                    const manifest = await response.json();
-                    if ((_a = manifest === null || manifest === void 0 ? void 0 : manifest.babbage) === null || _a === void 0 ? void 0 : _a.groupPermissions) {
-                        groupPermissions = manifest.babbage.groupPermissions;
-                    }
-                }
-            }
-            catch (e) {
-                // Ignore fetch/parse errors, just proceed without group permissions.
-            }
+            const groupPermissions = await this.fetchManifestGroupPermissions(originator);
             if (groupPermissions) {
                 // 2. Filter out already-granted permissions
-                const permissionsToRequest = {
-                    protocolPermissions: [],
-                    basketAccess: [],
-                    certificateAccess: []
-                };
-                if (groupPermissions.spendingAuthorization) {
-                    const hasAuth = await this.hasSpendingAuthorization({
-                        originator,
-                        satoshis: groupPermissions.spendingAuthorization.amount
-                    });
-                    if (!hasAuth) {
-                        permissionsToRequest.spendingAuthorization = groupPermissions.spendingAuthorization;
-                    }
-                }
-                for (const p of groupPermissions.protocolPermissions || []) {
-                    const hasPerm = await this.hasProtocolPermission({
-                        originator,
-                        privileged: false, // Privilege is never allowed here
-                        protocolID: p.protocolID,
-                        counterparty: p.counterparty || 'self'
-                    });
-                    if (!hasPerm) {
-                        permissionsToRequest.protocolPermissions.push(p);
-                    }
-                }
-                for (const b of groupPermissions.basketAccess || []) {
-                    const hasAccess = await this.hasBasketAccess({
-                        originator,
-                        basket: b.basket
-                    });
-                    if (!hasAccess) {
-                        permissionsToRequest.basketAccess.push(b);
-                    }
-                }
-                for (const c of groupPermissions.certificateAccess || []) {
-                    const hasAccess = await this.hasCertificateAccess({
-                        originator,
-                        privileged: false, // Privilege is never allowed here for security
-                        verifier: c.verifierPublicKey,
-                        certType: c.type,
-                        fields: c.fields
-                    });
-                    if (!hasAccess) {
-                        permissionsToRequest.certificateAccess.push(c);
-                    }
-                }
+                const permissionsToRequest = await this.filterAlreadyGrantedPermissions(originator, groupPermissions);
                 // 3. If any permissions are left to request, start the flow
-                const hasRequests = permissionsToRequest.spendingAuthorization ||
-                    ((_c = (_b = permissionsToRequest.protocolPermissions) === null || _b === void 0 ? void 0 : _b.length) !== null && _c !== void 0 ? _c : 0) > 0 ||
-                    ((_e = (_d = permissionsToRequest.basketAccess) === null || _d === void 0 ? void 0 : _d.length) !== null && _e !== void 0 ? _e : 0) > 0 ||
-                    ((_g = (_f = permissionsToRequest.certificateAccess) === null || _f === void 0 ? void 0 : _f.length) !== null && _g !== void 0 ? _g : 0) > 0;
-                if (hasRequests) {
+                if (this.hasAnyPermissionsToRequest(permissionsToRequest)) {
                     const key = `group:${originator}`;
                     if (this.activeRequests.has(key)) {
                         // Another call is already waiting, piggyback on it
@@ -2646,6 +3296,7 @@ class WalletPermissionsManager {
     }
 }
 exports.WalletPermissionsManager = WalletPermissionsManager;
+WalletPermissionsManager.MANIFEST_CACHE_TTL_MS = 5 * 60 * 1000;
 /** How long a cached permission remains valid (5 minutes). */
 WalletPermissionsManager.CACHE_TTL_MS = 5 * 60 * 1000;
 /** Window during which freshly granted permissions are auto-allowed (except spending). */