@bsv/wallet-toolbox-client 1.8.1 → 1.8.2

package/out/src/WalletPermissionsManager.js

@@ -77,8 +77,7 @@ class WalletPermissionsManager {
             onBasketAccessRequested: [],
             onCertificateAccessRequested: [],
             onSpendingAuthorizationRequested: [],
-            onGroupedPermissionRequested: [],
-            onCounterpartyPermissionRequested: []
+            onGroupedPermissionRequested: []
         };
         /**
          * We queue parallel requests for the same resource so that only one
@@ -94,9 +93,6 @@ class WalletPermissionsManager {
         /** Cache recently confirmed permissions to avoid repeated lookups. */
         this.permissionCache = new Map();
         this.recentGrants = new Map();
-        this.manifestCache = new Map();
-        this.manifestFetchInProgress = new Map();
-        this.pactEstablishedCache = new Map();
         this.underlying = underlyingWallet;
         this.adminOriginator = this.normalizeOriginator(adminOriginator) || adminOriginator;
         // Default all config options to true unless specified
@@ -163,68 +159,6 @@ class WalletPermissionsManager {
             originator
         });
     }
-    /**
-     * Adds a permission module for the given schemeID if needed, throwing if unsupported.
-     */
-    addPModuleByScheme(schemeID, kind, pModulesByScheme) {
-        var _a;
-        if (pModulesByScheme.has(schemeID))
-            return;
-        const module = (_a = this.config.permissionModules) === null || _a === void 0 ? void 0 : _a[schemeID];
-        if (!module) {
-            throw new Error(`Unsupported P-${kind} scheme: p ${schemeID}`);
-        }
-        pModulesByScheme.set(schemeID, module);
-    }
-    /**
-     * Splits labels into P and non-P lists, registering any P-modules encountered.
-     *
-     * P-labels follow BRC-111 format: `p <moduleId> <payload>`
-     * - Must start with "p " (lowercase p + space)
-     * - Module ID must be at least 1 character with no spaces
-     * - Single space separates module ID from payload
-     * - Payload must be at least 1 character
-     *
-     * @example Valid: "p btms token123", "p invoicing invoice 2026-02-02"
-     * @example Invalid: "p btms" (no payload), "p btms " (empty payload), "p  data" (empty moduleId)
-     *
-     * @param labels - Array of label strings to process
-     * @param pModulesByScheme - Map to populate with discovered p-modules
-     * @returns Array of non-P labels for normal permission checks
-     * @throws Error if p-label format is invalid or module is unsupported
-     */
-    splitLabelsByPermissionModule(labels, pModulesByScheme) {
-        const nonPLabels = [];
-        if (!labels)
-            return nonPLabels;
-        for (const label of labels) {
-            if (label.startsWith('p ')) {
-                // Remove "p " prefix to get "moduleId payload"
-                const remainder = label.slice(2);
-                // Find the space that separates moduleId from payload
-                const separatorIndex = remainder.indexOf(' ');
-                // Validate: must have a space (separatorIndex > 0) and payload after it
-                // separatorIndex <= 0 means no space found or moduleId is empty
-                // separatorIndex === remainder.length - 1 means space is last char (no payload)
-                if (separatorIndex <= 0 || separatorIndex === remainder.length - 1) {
-                    throw new Error(`Invalid P-label format: ${label}`);
-                }
-                // Reject double spaces after moduleId (payload can't start with space)
-                if (remainder[separatorIndex + 1] === ' ') {
-                    throw new Error(`Invalid P-label format: ${label}`);
-                }
-                // Extract moduleId (substring before first space)
-                const schemeID = remainder.slice(0, separatorIndex);
-                // Register the module (throws if unsupported)
-                this.addPModuleByScheme(schemeID, 'label', pModulesByScheme);
-            }
-            else {
-                // Regular label - add to list for normal permission checks
-                nonPLabels.push(label);
-            }
-        }
-        return nonPLabels;
-    }
     /**
      * Decrypts custom instructions in listOutputs results if encryption is configured.
      */
@@ -238,36 +172,6 @@ class WalletPermissionsManager {
         }
         return results;
     }
-    /**
-     * Decrypts metadata in listActions results if encryption is configured.
-     */
-    async decryptListActionsMetadata(results) {
-        if (results.actions) {
-            for (let i = 0; i < results.actions.length; i++) {
-                if (results.actions[i].description) {
-                    results.actions[i].description = await this.maybeDecryptMetadata(results.actions[i].description);
-                }
-                if (results.actions[i].inputs) {
-                    for (let j = 0; j < results.actions[i].inputs.length; j++) {
-                        if (results.actions[i].inputs[j].inputDescription) {
-                            results.actions[i].inputs[j].inputDescription = await this.maybeDecryptMetadata(results.actions[i].inputs[j].inputDescription);
-                        }
-                    }
-                }
-                if (results.actions[i].outputs) {
-                    for (let j = 0; j < results.actions[i].outputs.length; j++) {
-                        if (results.actions[i].outputs[j].outputDescription) {
-                            results.actions[i].outputs[j].outputDescription = await this.maybeDecryptMetadata(results.actions[i].outputs[j].outputDescription);
-                        }
-                        if (results.actions[i].outputs[j].customInstructions) {
-                            results.actions[i].outputs[j].customInstructions = await this.maybeDecryptMetadata(results.actions[i].outputs[j].customInstructions);
-                        }
-                    }
-                }
-            }
-        }
-        return results;
-    }
     /* ---------------------------------------------------------------------
      *  1) PUBLIC API FOR REGISTERING CALLBACKS (UI PROMPTS, LOGGING, ETC.)
      * --------------------------------------------------------------------- */
@@ -408,177 +312,93 @@ class WalletPermissionsManager {
         if (!matching) {
             throw new Error('Request ID not found.');
         }
-        try {
-            const originalRequest = matching.request;
-            const { originator, permissions: requestedPermissions, displayOriginator } = originalRequest;
-            const originLookupValues = this.buildOriginatorLookupValues(displayOriginator, originator);
-            // --- Validation: Ensure granted permissions are a subset of what was requested ---
-            if (params.granted.spendingAuthorization && !requestedPermissions.spendingAuthorization) {
-                throw new Error('Granted spending authorization was not part of the original request.');
-            }
-            if ((_a = params.granted.protocolPermissions) === null || _a === void 0 ? void 0 : _a.some(g => { var _a; return !((_a = requestedPermissions.protocolPermissions) === null || _a === void 0 ? void 0 : _a.find(r => deepEqual(r, g))); })) {
-                throw new Error('Granted protocol permissions are not a subset of the original request.');
-            }
-            if ((_b = params.granted.basketAccess) === null || _b === void 0 ? void 0 : _b.some(g => { var _a; return !((_a = requestedPermissions.basketAccess) === null || _a === void 0 ? void 0 : _a.find(r => deepEqual(r, g))); })) {
-                throw new Error('Granted basket access permissions are not a subset of the original request.');
-            }
-            if ((_c = params.granted.certificateAccess) === null || _c === void 0 ? void 0 : _c.some(g => { var _a; return !((_a = requestedPermissions.certificateAccess) === null || _a === void 0 ? void 0 : _a.find(r => deepEqual(r, g))); })) {
-                throw new Error('Granted certificate access permissions are not a subset of the original request.');
-            }
-            // --- End Validation ---
-            const expiry = params.expiry || 0; // default: never expires
-            const toCreate = [];
-            const toRenew = [];
-            if (params.granted.spendingAuthorization) {
-                toCreate.push({
-                    request: {
-                        type: 'spending',
-                        originator,
-                        spending: { satoshis: params.granted.spendingAuthorization.amount },
-                        reason: params.granted.spendingAuthorization.description
-                    },
-                    expiry: 0,
-                    amount: params.granted.spendingAuthorization.amount
-                });
-            }
-            const grantedProtocols = params.granted.protocolPermissions || [];
-            const protocolTokens = await this.mapWithConcurrency(grantedProtocols, 8, async (p) => {
-                const token = await this.findProtocolToken(originator, false, p.protocolID, p.counterparty || 'self', true, originLookupValues);
-                return { p, token };
-            });
-            for (const { p, token } of protocolTokens) {
+        const originalRequest = matching.request;
+        const { originator, permissions: requestedPermissions, displayOriginator } = originalRequest;
+        const originLookupValues = this.buildOriginatorLookupValues(displayOriginator, originator);
+        // --- Validation: Ensure granted permissions are a subset of what was requested ---
+        if (params.granted.spendingAuthorization &&
+            !deepEqual(params.granted.spendingAuthorization, requestedPermissions.spendingAuthorization)) {
+            throw new Error('Granted spending authorization does not match the original request.');
+        }
+        if ((_a = params.granted.protocolPermissions) === null || _a === void 0 ? void 0 : _a.some(g => { var _a; return !((_a = requestedPermissions.protocolPermissions) === null || _a === void 0 ? void 0 : _a.find(r => deepEqual(r, g))); })) {
+            throw new Error('Granted protocol permissions are not a subset of the original request.');
+        }
+        if ((_b = params.granted.basketAccess) === null || _b === void 0 ? void 0 : _b.some(g => { var _a; return !((_a = requestedPermissions.basketAccess) === null || _a === void 0 ? void 0 : _a.find(r => deepEqual(r, g))); })) {
+            throw new Error('Granted basket access permissions are not a subset of the original request.');
+        }
+        if ((_c = params.granted.certificateAccess) === null || _c === void 0 ? void 0 : _c.some(g => { var _a; return !((_a = requestedPermissions.certificateAccess) === null || _a === void 0 ? void 0 : _a.find(r => deepEqual(r, g))); })) {
+            throw new Error('Granted certificate access permissions are not a subset of the original request.');
+        }
+        // --- End Validation ---
+        const expiry = params.expiry || 0; // default: never expires
+        if (params.granted.spendingAuthorization) {
+            await this.createPermissionOnChain({
+                type: 'spending',
+                originator,
+                spending: { satoshis: params.granted.spendingAuthorization.amount },
+                reason: params.granted.spendingAuthorization.description
+            }, 0, // No expiry for spending tokens
+            params.granted.spendingAuthorization.amount);
+        }
+        for (const p of params.granted.protocolPermissions || []) {
+            const token = await this.findProtocolToken(originator, false, // No privileged protocols allowed in groups for added security.
+            p.protocolID, p.counterparty || 'self', true, originLookupValues);
+            if (token) {
                 const request = {
                     type: 'protocol',
                     originator,
-                    privileged: false,
+                    privileged: false, // No privileged protocols allowed in groups for added security.
                     protocolID: p.protocolID,
                     counterparty: p.counterparty || 'self',
                     reason: p.description
                 };
-                if (token) {
-                    toRenew.push({ oldToken: token, request, expiry });
-                }
-                else {
-                    toCreate.push({ request, expiry });
-                }
-            }
-            for (const b of params.granted.basketAccess || []) {
-                toCreate.push({
-                    request: { type: 'basket', originator, basket: b.basket, reason: b.description },
-                    expiry
-                });
-            }
-            for (const c of params.granted.certificateAccess || []) {
-                toCreate.push({
-                    request: {
-                        type: 'certificate',
-                        originator,
-                        privileged: false,
-                        certificate: {
-                            verifier: c.verifierPublicKey,
-                            certType: c.type,
-                            fields: c.fields
-                        },
-                        reason: c.description
-                    },
-                    expiry
-                });
+                await this.renewPermissionOnChain(token, request, expiry);
+                this.markRecentGrant(request);
             }
-            const created = await this.createPermissionTokensBestEffort(toCreate);
-            const renewed = await this.renewPermissionTokensBestEffort(toRenew);
-            for (const req of [...created, ...renewed]) {
-                this.markRecentGrant(req);
-            }
-            // Success - resolve all pending promises for this request
-            for (const p of matching.pending) {
-                p.resolve(true);
-            }
-        }
-        catch (error) {
-            // Failure - reject all pending promises so callers don't hang forever
-            for (const p of matching.pending) {
-                p.reject(error);
+            else {
+                const request = {
+                    type: 'protocol',
+                    originator,
+                    privileged: false, // No privileged protocols allowed in groups for added security.
+                    protocolID: p.protocolID,
+                    counterparty: p.counterparty || 'self',
+                    reason: p.description
+                };
+                await this.createPermissionOnChain(request, expiry);
+                this.markRecentGrant(request);
             }
-            throw error;
-        }
-        finally {
-            // Always clean up the request entry
-            this.activeRequests.delete(params.requestID);
-        }
-    }
-    /**
-     * Denies a previously requested grouped permission.
-     * @param requestID The ID of the request being denied.
-     */
-    async denyGroupedPermission(requestID) {
-        const matching = this.activeRequests.get(requestID);
-        if (!matching) {
-            throw new Error('Request ID not found.');
-        }
-        const err = new Error('The user has denied the request for permission.');
-        err.code = 'ERR_PERMISSION_DENIED';
-        for (const p of matching.pending) {
-            p.reject(err);
-        }
-        this.activeRequests.delete(requestID);
-    }
-    async dismissGroupedPermission(requestID) {
-        const matching = this.activeRequests.get(requestID);
-        if (!matching) {
-            throw new Error('Request ID not found.');
         }
-        for (const p of matching.pending) {
-            p.resolve(true);
+        for (const b of params.granted.basketAccess || []) {
+            const request = { type: 'basket', originator, basket: b.basket, reason: b.description };
+            await this.createPermissionOnChain(request, expiry);
+            this.markRecentGrant(request);
         }
-        this.activeRequests.delete(requestID);
-    }
-    async grantCounterpartyPermission(params) {
-        var _a;
-        const matching = this.activeRequests.get(params.requestID);
-        if (!matching) {
-            throw new Error('Request ID not found.');
-        }
-        const originalRequest = matching.request;
-        const { originator, counterparty, permissions: requestedPermissions, displayOriginator } = originalRequest;
-        const originLookupValues = this.buildOriginatorLookupValues(displayOriginator, originator);
-        if ((_a = params.granted.protocols) === null || _a === void 0 ? void 0 : _a.some(g => !requestedPermissions.protocols.find(r => deepEqual(r, g)))) {
-            throw new Error('Granted protocol permissions are not a subset of the original request.');
-        }
-        const expiry = params.expiry || 0;
-        const toCreate = [];
-        const toRenew = [];
-        const grantedProtocols = params.granted.protocols || [];
-        const protocolTokens = await this.mapWithConcurrency(grantedProtocols, 8, async (p) => {
-            const token = await this.findProtocolToken(originator, false, p.protocolID, counterparty, true, originLookupValues);
-            return { p, token };
-        });
-        for (const { p, token } of protocolTokens) {
+        for (const c of params.granted.certificateAccess || []) {
             const request = {
-                type: 'protocol',
+                type: 'certificate',
                 originator,
-                privileged: false,
-                protocolID: p.protocolID,
-                counterparty,
-                reason: p.description
+                privileged: false, // No certificates on the privileged identity are allowed as part of groups.
+                certificate: {
+                    verifier: c.verifierPublicKey,
+                    certType: c.type,
+                    fields: c.fields
+                },
+                reason: c.description
             };
-            if (token) {
-                toRenew.push({ oldToken: token, request, expiry });
-            }
-            else {
-                toCreate.push({ request, expiry });
-            }
-        }
-        const created = await this.createPermissionTokensBestEffort(toCreate);
-        const renewed = await this.renewPermissionTokensBestEffort(toRenew);
-        for (const req of [...created, ...renewed]) {
-            this.markRecentGrant(req);
+            await this.createPermissionOnChain(request, expiry);
+            this.markRecentGrant(request);
         }
+        // Resolve all pending promises for this request
         for (const p of matching.pending) {
             p.resolve(true);
         }
         this.activeRequests.delete(params.requestID);
     }
-    async denyCounterpartyPermission(requestID) {
+    /**
+     * Denies a previously requested grouped permission.
+     * @param requestID The ID of the request being denied.
+     */
+    async denyGroupedPermission(requestID) {
         const matching = this.activeRequests.get(requestID);
         if (!matching) {
             throw new Error('Request ID not found.');
@@ -908,469 +728,6 @@ class WalletPermissionsManager {
             usageType: 'generic'
         });
     }
-    validateCounterpartyPermissions(raw) {
-        if (!raw || !Array.isArray(raw.protocols) || raw.protocols.length === 0)
-            return null;
-        const validProtocols = raw.protocols.filter((p) => {
-            return (Array.isArray(p === null || p === void 0 ? void 0 : p.protocolID) &&
-                p.protocolID[0] === 2 &&
-                typeof p.protocolID[1] === 'string' &&
-                typeof (p === null || p === void 0 ? void 0 : p.description) === 'string');
-        });
-        if (validProtocols.length === 0)
-            return null;
-        return {
-            description: typeof raw.description === 'string' ? raw.description : undefined,
-            protocols: validProtocols
-        };
-    }
-    async fetchManifestPermissions(originator) {
-        const cached = this.manifestCache.get(originator);
-        if (cached && Date.now() - cached.fetchedAt < WalletPermissionsManager.MANIFEST_CACHE_TTL_MS) {
-            return {
-                groupPermissions: cached.groupPermissions,
-                counterpartyPermissions: cached.counterpartyPermissions
-            };
-        }
-        const inProgress = this.manifestFetchInProgress.get(originator);
-        if (inProgress) {
-            return inProgress;
-        }
-        const fetchPromise = (async () => {
-            var _a, _b;
-            try {
-                const proto = originator.startsWith('localhost:') ? 'http' : 'https';
-                const response = await fetch(`${proto}://${originator}/manifest.json`);
-                if (response.ok) {
-                    const manifest = await response.json();
-                    const groupPermissions = ((_a = manifest === null || manifest === void 0 ? void 0 : manifest.babbage) === null || _a === void 0 ? void 0 : _a.groupPermissions) || null;
-                    const counterpartyPermissions = this.validateCounterpartyPermissions((_b = manifest === null || manifest === void 0 ? void 0 : manifest.babbage) === null || _b === void 0 ? void 0 : _b.counterpartyPermissions);
-                    this.manifestCache.set(originator, { groupPermissions, counterpartyPermissions, fetchedAt: Date.now() });
-                    return { groupPermissions, counterpartyPermissions };
-                }
-            }
-            catch (e) { }
-            const result = { groupPermissions: null, counterpartyPermissions: null };
-            this.manifestCache.set(originator, { ...result, fetchedAt: Date.now() });
-            return result;
-        })();
-        this.manifestFetchInProgress.set(originator, fetchPromise);
-        try {
-            return await fetchPromise;
-        }
-        finally {
-            this.manifestFetchInProgress.delete(originator);
-        }
-    }
-    async fetchManifestGroupPermissions(originator) {
-        const { groupPermissions } = await this.fetchManifestPermissions(originator);
-        return groupPermissions;
-    }
-    async filterAlreadyGrantedPermissions(originator, groupPermissions) {
-        const permissionsToRequest = {
-            description: groupPermissions.description,
-            protocolPermissions: [],
-            basketAccess: [],
-            certificateAccess: []
-        };
-        if (groupPermissions.spendingAuthorization) {
-            const hasAuth = await this.hasSpendingAuthorization({
-                originator,
-                satoshis: groupPermissions.spendingAuthorization.amount
-            });
-            if (!hasAuth) {
-                permissionsToRequest.spendingAuthorization = groupPermissions.spendingAuthorization;
-            }
-        }
-        for (const p of groupPermissions.protocolPermissions || []) {
-            const hasPerm = await this.hasProtocolPermission({
-                originator,
-                privileged: false,
-                protocolID: p.protocolID,
-                counterparty: p.counterparty || 'self'
-            });
-            if (!hasPerm) {
-                permissionsToRequest.protocolPermissions.push(p);
-            }
-        }
-        for (const b of groupPermissions.basketAccess || []) {
-            const hasAccess = await this.hasBasketAccess({
-                originator,
-                basket: b.basket
-            });
-            if (!hasAccess) {
-                permissionsToRequest.basketAccess.push(b);
-            }
-        }
-        for (const c of groupPermissions.certificateAccess || []) {
-            const hasAccess = await this.hasCertificateAccess({
-                originator,
-                privileged: false,
-                verifier: c.verifierPublicKey,
-                certType: c.type,
-                fields: c.fields
-            });
-            if (!hasAccess) {
-                permissionsToRequest.certificateAccess.push(c);
-            }
-        }
-        return permissionsToRequest;
-    }
-    hasAnyPermissionsToRequest(permissions) {
-        var _a, _b, _c, _d, _e, _f;
-        return !!(permissions.spendingAuthorization ||
-            ((_b = (_a = permissions.protocolPermissions) === null || _a === void 0 ? void 0 : _a.length) !== null && _b !== void 0 ? _b : 0) > 0 ||
-            ((_d = (_c = permissions.basketAccess) === null || _c === void 0 ? void 0 : _c.length) !== null && _d !== void 0 ? _d : 0) > 0 ||
-            ((_f = (_e = permissions.certificateAccess) === null || _e === void 0 ? void 0 : _e.length) !== null && _f !== void 0 ? _f : 0) > 0);
-    }
-    hasGroupedPermissionRequestedHandlers() {
-        const handlers = this.callbacks.onGroupedPermissionRequested || [];
-        return handlers.some(h => typeof h === 'function');
-    }
-    hasCounterpartyPermissionRequestedHandlers() {
-        const handlers = this.callbacks.onCounterpartyPermissionRequested || [];
-        return handlers.some(h => typeof h === 'function');
-    }
-    async hasPactEstablished(originator, counterparty) {
-        var _a;
-        if (counterparty === 'self' || counterparty === 'anyone') {
-            return true;
-        }
-        const cacheKey = `${originator}:${counterparty}`;
-        if (this.pactEstablishedCache.has(cacheKey)) {
-            return true;
-        }
-        const { counterpartyPermissions } = await this.fetchManifestPermissions(originator);
-        if (!((_a = counterpartyPermissions === null || counterpartyPermissions === void 0 ? void 0 : counterpartyPermissions.protocols) === null || _a === void 0 ? void 0 : _a.length)) {
-            return true;
-        }
-        const firstProtocol = counterpartyPermissions.protocols[0];
-        const hasToken = await this.hasProtocolPermission({
-            originator,
-            privileged: false,
-            protocolID: firstProtocol.protocolID,
-            counterparty
-        });
-        if (hasToken) {
-            this.pactEstablishedCache.set(cacheKey, Date.now());
-            return true;
-        }
-        return false;
-    }
-    markPactEstablished(originator, counterparty) {
-        const cacheKey = `${originator}:${counterparty}`;
-        this.pactEstablishedCache.set(cacheKey, Date.now());
-    }
-    async maybeRequestPact(currentRequest) {
-        var _a;
-        if (!this.config.seekGroupedPermission) {
-            return null;
-        }
-        if (!this.hasCounterpartyPermissionRequestedHandlers()) {
-            return null;
-        }
-        if (currentRequest.type !== 'protocol') {
-            return null;
-        }
-        if (currentRequest.privileged) {
-            return null;
-        }
-        const [level] = currentRequest.protocolID;
-        if (level !== 2) {
-            return null;
-        }
-        const originator = currentRequest.originator;
-        const counterparty = currentRequest.counterparty;
-        if (!counterparty || counterparty === 'self' || counterparty === 'anyone') {
-            return null;
-        }
-        if (!/^[0-9a-fA-F]{66}$/.test(counterparty)) {
-            return null;
-        }
-        if (await this.hasPactEstablished(originator, counterparty)) {
-            return null;
-        }
-        const { counterpartyPermissions } = await this.fetchManifestPermissions(originator);
-        if (!((_a = counterpartyPermissions === null || counterpartyPermissions === void 0 ? void 0 : counterpartyPermissions.protocols) === null || _a === void 0 ? void 0 : _a.length)) {
-            return null;
-        }
-        const protocolsToRequest = [];
-        for (const p of counterpartyPermissions.protocols) {
-            const hasPerm = await this.hasProtocolPermission({
-                originator,
-                privileged: false,
-                protocolID: p.protocolID,
-                counterparty
-            });
-            if (!hasPerm) {
-                protocolsToRequest.push(p);
-            }
-        }
-        if (protocolsToRequest.length === 0) {
-            this.markPactEstablished(originator, counterparty);
-            return null;
-        }
-        const permissionsToRequest = {
-            description: counterpartyPermissions.description,
-            protocols: protocolsToRequest
-        };
-        const key = `pact:${originator}:${counterparty}`;
-        const existing = this.activeRequests.get(key);
-        if (existing) {
-            const existingRequest = existing.request;
-            for (const p of permissionsToRequest.protocols) {
-                if (!existingRequest.permissions.protocols.find(x => deepEqual(x, p))) {
-                    existingRequest.permissions.protocols.push(p);
-                }
-            }
-            await new Promise((resolve, reject) => {
-                existing.pending.push({ resolve, reject });
-            });
-        }
-        else {
-            await new Promise(async (resolve, reject) => {
-                this.activeRequests.set(key, {
-                    request: {
-                        originator,
-                        counterparty,
-                        permissions: permissionsToRequest,
-                        displayOriginator: currentRequest.displayOriginator
-                    },
-                    pending: [{ resolve, reject }]
-                });
-                await this.callEvent('onCounterpartyPermissionRequested', {
-                    requestID: key,
-                    originator,
-                    counterparty,
-                    permissions: permissionsToRequest
-                });
-            });
-        }
-        this.markPactEstablished(originator, counterparty);
-        const satisfied = await this.hasProtocolPermission({
-            originator,
-            privileged: false,
-            protocolID: currentRequest.protocolID,
-            counterparty
-        });
-        return satisfied ? true : null;
-    }
-    async maybeRequestPeerGroupedLevel2ProtocolPermissions(currentRequest) {
-        var _a, _b;
-        if (!this.config.seekGroupedPermission) {
-            return null;
-        }
-        if (!this.hasGroupedPermissionRequestedHandlers()) {
-            return null;
-        }
-        if (currentRequest.type !== 'protocol') {
-            return null;
-        }
-        const [level] = currentRequest.protocolID;
-        if (level !== 2) {
-            return null;
-        }
-        const originator = currentRequest.originator;
-        const privileged = (_a = currentRequest.privileged) !== null && _a !== void 0 ? _a : false;
-        const counterparty = (_b = currentRequest.counterparty) !== null && _b !== void 0 ? _b : 'self';
-        const groupPermissions = await this.fetchManifestGroupPermissions(originator);
-        if (!groupPermissions) {
-            return null;
-        }
-        const normalizeManifestCounterparty = (cp) => {
-            if (cp === '')
-                return counterparty;
-            return cp !== null && cp !== void 0 ? cp : 'self';
-        };
-        const manifestLevel2ForThisPeer = (groupPermissions.protocolPermissions || [])
-            .filter(p => { var _a, _b; return ((_b = (_a = p.protocolID) === null || _a === void 0 ? void 0 : _a[0]) !== null && _b !== void 0 ? _b : 0) === 2; })
-            .map(p => ({
-            protocolID: p.protocolID,
-            counterparty: normalizeManifestCounterparty(p.counterparty),
-            description: p.description
-        }))
-            .filter(p => p.counterparty === counterparty);
-        const isCurrentRequestInManifest = manifestLevel2ForThisPeer.some(p => deepEqual(p.protocolID, currentRequest.protocolID));
-        if (!isCurrentRequestInManifest) {
-            return null;
-        }
-        const permissionsToRequest = {
-            protocolPermissions: []
-        };
-        for (const p of manifestLevel2ForThisPeer) {
-            const hasPerm = await this.hasProtocolPermission({
-                originator,
-                privileged,
-                protocolID: p.protocolID,
-                counterparty: p.counterparty
-            });
-            if (!hasPerm) {
-                permissionsToRequest.protocolPermissions.push({
-                    protocolID: p.protocolID,
-                    counterparty: p.counterparty,
-                    description: p.description
-                });
-            }
-        }
-        if (!this.hasAnyPermissionsToRequest(permissionsToRequest)) {
-            return null;
-        }
-        const key = `group-peer:${originator}:${privileged}:${counterparty}`;
-        const existing = this.activeRequests.get(key);
-        if (existing) {
-            const existingRequest = existing.request;
-            if (!existingRequest.permissions.protocolPermissions) {
-                existingRequest.permissions.protocolPermissions = [];
-            }
-            for (const p of permissionsToRequest.protocolPermissions || []) {
-                if (!existingRequest.permissions.protocolPermissions.find(x => deepEqual(x, p))) {
-                    existingRequest.permissions.protocolPermissions.push(p);
-                }
-            }
-            await new Promise((resolve, reject) => {
-                existing.pending.push({ resolve, reject });
-            });
-        }
-        else {
-            await new Promise(async (resolve, reject) => {
-                const permissions = permissionsToRequest;
-                this.activeRequests.set(key, {
-                    request: {
-                        originator,
-                        permissions,
-                        displayOriginator: currentRequest.displayOriginator
-                    },
-                    pending: [{ resolve, reject }]
-                });
-                await this.callEvent('onGroupedPermissionRequested', {
-                    requestID: key,
-                    originator,
-                    permissions
-                });
-            });
-        }
-        const satisfied = await this.checkSpecificPermissionAfterGroupFlow(currentRequest);
-        return satisfied ? true : null;
-    }
-    async checkSpecificPermissionAfterGroupFlow(request) {
-        var _a, _b, _c;
-        switch (request.type) {
-            case 'protocol':
-                return await this.hasProtocolPermission({
-                    originator: request.originator,
-                    privileged: (_a = request.privileged) !== null && _a !== void 0 ? _a : false,
-                    protocolID: request.protocolID,
-                    counterparty: (_b = request.counterparty) !== null && _b !== void 0 ? _b : 'self'
-                });
-            case 'basket':
-                return await this.hasBasketAccess({
-                    originator: request.originator,
-                    basket: request.basket
-                });
-            case 'certificate':
-                return await this.hasCertificateAccess({
-                    originator: request.originator,
-                    privileged: (_c = request.privileged) !== null && _c !== void 0 ? _c : false,
-                    verifier: request.certificate.verifier,
-                    certType: request.certificate.certType,
-                    fields: request.certificate.fields
-                });
-            case 'spending':
-                return await this.hasSpendingAuthorization({
-                    originator: request.originator,
-                    satoshis: request.spending.satoshis
-                });
-            default:
-                return false;
-        }
-    }
-    isRequestIncludedInGroupPermissions(request, groupPermissions) {
-        var _a, _b, _c, _d;
-        switch (request.type) {
-            case 'protocol': {
-                if (request.privileged)
-                    return false;
-                const pid = request.protocolID;
-                if (!pid)
-                    return false;
-                const cp = (_a = request.counterparty) !== null && _a !== void 0 ? _a : 'self';
-                return !!((_b = groupPermissions.protocolPermissions) === null || _b === void 0 ? void 0 : _b.some(p => {
-                    var _a;
-                    const manifestCp = p.counterparty === '' ? cp : ((_a = p.counterparty) !== null && _a !== void 0 ? _a : 'self');
-                    return deepEqual(p.protocolID, pid) && manifestCp === cp;
-                }));
-            }
-            case 'basket': {
-                const basket = request.basket;
-                if (!basket)
-                    return false;
-                return !!((_c = groupPermissions.basketAccess) === null || _c === void 0 ? void 0 : _c.some(b => b.basket === basket));
-            }
-            case 'certificate': {
-                if (request.privileged)
-                    return false;
-                const cert = request.certificate;
-                if (!cert)
-                    return false;
-                return !!((_d = groupPermissions.certificateAccess) === null || _d === void 0 ? void 0 : _d.some(c => {
-                    const fieldsA = new Set(c.fields || []);
-                    const fieldsB = new Set(cert.fields || []);
-                    if (fieldsA.size !== fieldsB.size)
-                        return false;
-                    for (const f of fieldsA)
-                        if (!fieldsB.has(f))
-                            return false;
-                    return c.type === cert.certType && c.verifierPublicKey === cert.verifier;
-                }));
-            }
-            case 'spending':
-                return !!groupPermissions.spendingAuthorization;
-            default:
-                return false;
-        }
-    }
-    async maybeRequestGroupedPermissions(currentRequest) {
-        if (!this.config.seekGroupedPermission) {
-            return null;
-        }
-        const originator = currentRequest.originator;
-        const groupPermissions = await this.fetchManifestGroupPermissions(originator);
-        if (!groupPermissions) {
-            return null;
-        }
-        if (!this.isRequestIncludedInGroupPermissions(currentRequest, groupPermissions)) {
-            return null;
-        }
-        const permissionsToRequest = await this.filterAlreadyGrantedPermissions(originator, groupPermissions);
-        if (!this.hasAnyPermissionsToRequest(permissionsToRequest)) {
-            return null;
-        }
-        const key = `group:${originator}`;
-        if (this.activeRequests.has(key)) {
-            await new Promise((resolve, reject) => {
-                this.activeRequests.get(key).pending.push({ resolve, reject });
-            });
-        }
-        else {
-            await new Promise(async (resolve, reject) => {
-                this.activeRequests.set(key, {
-                    request: {
-                        originator,
-                        permissions: permissionsToRequest,
-                        displayOriginator: currentRequest.displayOriginator
-                    },
-                    pending: [{ resolve, reject }]
-                });
-                await this.callEvent('onGroupedPermissionRequested', {
-                    requestID: key,
-                    originator,
-                    permissions: permissionsToRequest
-                });
-            });
-        }
-        const satisfied = await this.checkSpecificPermissionAfterGroupFlow(currentRequest);
-        return satisfied ? true : null;
-    }
     /**
      * A central method that triggers the permission request flow.
      * - It checks if there's already an active request for the same key
@@ -1379,25 +736,13 @@ class WalletPermissionsManager {
      *   and return a promise that resolves once permission is granted or rejects if denied.
      */
     async requestPermissionFlow(r) {
-        var _a, _b, _c;
+        var _a;
         const normalizedOriginator = this.normalizeOriginator(r.originator) || r.originator;
         const preparedRequest = {
             ...r,
             originator: normalizedOriginator,
-            displayOriginator: (_c = (_a = r.displayOriginator) !== null && _a !== void 0 ? _a : (_b = r.previousToken) === null || _b === void 0 ? void 0 : _b.rawOriginator) !== null && _c !== void 0 ? _c : r.originator
+            displayOriginator: (_a = r.displayOriginator) !== null && _a !== void 0 ? _a : r.originator
         };
-        const pactResult = await this.maybeRequestPact(preparedRequest);
-        if (pactResult !== null) {
-            return pactResult;
-        }
-        const peerGroupResult = await this.maybeRequestPeerGroupedLevel2ProtocolPermissions(preparedRequest);
-        if (peerGroupResult !== null) {
-            return peerGroupResult;
-        }
-        const groupResult = await this.maybeRequestGroupedPermissions(preparedRequest);
-        if (groupResult !== null) {
-            return groupResult;
-        }
         const key = this.buildRequestKey(preparedRequest);
         // If there's already a queue for the same resource, we piggyback on it
         const existingQueue = this.activeRequests.get(key);
@@ -1851,128 +1196,10 @@ class WalletPermissionsManager {
                 }
             ],
             options: {
-                acceptDelayedBroadcast: true
+                acceptDelayedBroadcast: false
             }
         }, this.adminOriginator);
     }
-    async mapWithConcurrency(items, concurrency, fn) {
-        if (!items.length)
-            return [];
-        const results = new Array(items.length);
-        let i = 0;
-        const worker = async () => {
-            while (true) {
-                const idx = i++;
-                if (idx >= items.length)
-                    return;
-                results[idx] = await fn(items[idx]);
-            }
-        };
-        await Promise.all(Array.from({ length: Math.min(concurrency, items.length) }, () => worker()));
-        return results;
-    }
-    async runBestEffortBatches(items, chunkSize, runChunk) {
-        if (!items.length)
-            return [];
-        const out = [];
-        for (let i = 0; i < items.length; i += chunkSize) {
-            const chunk = items.slice(i, i + chunkSize);
-            out.push(...(await this.runBestEffortChunk(chunk, runChunk)));
-        }
-        return out;
-    }
-    async runBestEffortChunk(chunk, runChunk) {
-        try {
-            return await runChunk(chunk);
-        }
-        catch (e) {
-            if (chunk.length <= 1) {
-                console.error('Permission batch failed:', e);
-                return [];
-            }
-            const mid = Math.ceil(chunk.length / 2);
-            const left = await this.runBestEffortChunk(chunk.slice(0, mid), runChunk);
-            const right = await this.runBestEffortChunk(chunk.slice(mid), runChunk);
-            return [...left, ...right];
-        }
-    }
-    async buildPermissionOutput(r, expiry, amount) {
-        const normalizedOriginator = this.normalizeOriginator(r.originator) || r.originator;
-        r.originator = normalizedOriginator;
-        const basketName = BASKET_MAP[r.type];
-        if (!basketName) {
-            throw new Error(`Unsupported permission type: ${r.type}`);
-        }
-        const fields = await this.buildPushdropFields(r, expiry, amount);
-        const script = await new sdk_1.PushDrop(this.underlying).lock(fields, WalletPermissionsManager.PERM_TOKEN_ENCRYPTION_PROTOCOL, '1', 'self', true, true);
-        const tags = this.buildTagsForRequest(r);
-        return {
-            request: r,
-            output: {
-                lockingScript: script.toHex(),
-                satoshis: 1,
-                outputDescription: `${r.type} permission token`,
-                basket: basketName,
-                tags
-            }
-        };
-    }
-    async createPermissionTokensBestEffort(items) {
-        const CHUNK = 25;
-        return this.runBestEffortBatches(items, CHUNK, async (chunk) => {
-            const built = await this.mapWithConcurrency(chunk, 8, c => this.buildPermissionOutput(c.request, c.expiry, c.amount));
-            await this.createAction({
-                description: `Grant ${built.length} permissions`,
-                outputs: built.map(b => b.output),
-                options: { acceptDelayedBroadcast: true }
-            }, this.adminOriginator);
-            return built.map(b => b.request);
-        });
-    }
-    async renewPermissionTokensBestEffort(items) {
-        const CHUNK = 15;
-        return this.runBestEffortBatches(items, CHUNK, async (chunk) => {
-            const built = await this.mapWithConcurrency(chunk, 8, c => this.buildPermissionOutput(c.request, c.expiry, c.amount));
-            const inputBeef = new sdk_1.Beef();
-            for (const c of chunk) {
-                inputBeef.mergeBeef(sdk_1.Beef.fromBinary(c.oldToken.tx));
-            }
-            const { signableTransaction } = await this.createAction({
-                description: `Renew ${chunk.length} permissions`,
-                inputBEEF: inputBeef.toBinary(),
-                inputs: chunk.map((c, i) => ({
-                    outpoint: `${c.oldToken.txid}.${c.oldToken.outputIndex}`,
-                    unlockingScriptLength: 73,
-                    inputDescription: `Consume old permission token #${i + 1}`
-                })),
-                outputs: built.map(b => b.output),
-                options: {
-                    acceptDelayedBroadcast: true,
-                    randomizeOutputs: false,
-                    signAndProcess: false
-                }
-            }, this.adminOriginator);
-            if (!(signableTransaction === null || signableTransaction === void 0 ? void 0 : signableTransaction.reference) || !signableTransaction.tx) {
-                throw new Error('Failed to create signable transaction');
-            }
-            const partialTx = sdk_1.Transaction.fromAtomicBEEF(signableTransaction.tx);
-            const pushdrop = new sdk_1.PushDrop(this.underlying);
-            const spends = {};
-            for (let i = 0; i < chunk.length; i++) {
-                const token = chunk[i].oldToken;
-                const unlocker = pushdrop.unlock(WalletPermissionsManager.PERM_TOKEN_ENCRYPTION_PROTOCOL, '1', 'self', 'all', false, 1, sdk_1.LockingScript.fromHex(token.outputScript));
-                const unlockingScript = await unlocker.sign(partialTx, i);
-                spends[i] = { unlockingScript: unlockingScript.toHex() };
-            }
-            const { txid } = await this.underlying.signAction({
-                reference: signableTransaction.reference,
-                spends
-            });
-            if (!txid)
-                throw new Error('Failed to finalize renewal transaction');
-            return built.map(b => b.request);
-        });
-    }
     async coalescePermissionTokens(oldTokens, newScript, opts) {
         var _a;
         if (!(oldTokens === null || oldTokens === void 0 ? void 0 : oldTokens.length))
@@ -2003,7 +1230,7 @@ class WalletPermissionsManager {
                 }
             ],
             options: {
-                acceptDelayedBroadcast: true,
+                acceptDelayedBroadcast: false,
                 randomizeOutputs: false,
                 signAndProcess: false
             }
@@ -2082,7 +1309,7 @@ class WalletPermissionsManager {
                     }
                 ],
                 options: {
-                    acceptDelayedBroadcast: true
+                    acceptDelayedBroadcast: false
                 }
             }, this.adminOriginator);
             const tx = sdk_1.Transaction.fromBEEF(signableTransaction.tx);
@@ -2218,7 +1445,7 @@ class WalletPermissionsManager {
                 tags,
                 tagQueryMode: 'all',
                 include: 'entire transactions',
-                limit: 10000
+                limit: 100
             }, this.adminOriginator);
             for (const out of result.outputs) {
                 if (seen.has(out.outpoint))
@@ -2523,60 +1750,16 @@ class WalletPermissionsManager {
                 }
             ],
             options: {
-                acceptDelayedBroadcast: true
+                acceptDelayedBroadcast: false
             }
         }, this.adminOriginator);
         const tx = sdk_1.Transaction.fromBEEF(signableTransaction.tx);
-        const normalizeTxid = (txid) => (txid !== null && txid !== void 0 ? txid : '').toLowerCase();
-        const reverseHexTxid = (txid) => {
-            const hex = normalizeTxid(txid);
-            if (!/^[0-9a-f]{64}$/.test(hex))
-                return hex;
-            const bytes = hex.match(/../g);
-            return bytes ? bytes.reverse().join('') : hex;
-        };
-        const matchesOutpointString = (outpoint) => {
-            const dot = outpoint.lastIndexOf('.');
-            const colon = outpoint.lastIndexOf(':');
-            const sep = dot > colon ? dot : colon;
-            if (sep === -1)
-                return false;
-            const txidPart = outpoint.slice(0, sep);
-            const indexPart = outpoint.slice(sep + 1);
-            const vout = Number(indexPart);
-            if (!Number.isFinite(vout))
-                return false;
-            return normalizeTxid(txidPart) === normalizeTxid(oldToken.txid) && vout === oldToken.outputIndex;
-        };
-        let permInputIndex = tx.inputs.findIndex((input) => {
-            var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l, _m, _o;
-            const txidCandidate = (_g = (_f = (_e = (_d = (_c = (_b = (_a = input === null || input === void 0 ? void 0 : input.sourceTXID) !== null && _a !== void 0 ? _a : input === null || input === void 0 ? void 0 : input.sourceTxid) !== null && _b !== void 0 ? _b : input === null || input === void 0 ? void 0 : input.sourceTxId) !== null && _c !== void 0 ? _c : input === null || input === void 0 ? void 0 : input.prevTxId) !== null && _d !== void 0 ? _d : input === null || input === void 0 ? void 0 : input.prevTxid) !== null && _e !== void 0 ? _e : input === null || input === void 0 ? void 0 : input.prevTXID) !== null && _f !== void 0 ? _f : input === null || input === void 0 ? void 0 : input.txid) !== null && _g !== void 0 ? _g : input === null || input === void 0 ? void 0 : input.txID;
-            const voutCandidate = (_l = (_k = (_j = (_h = input === null || input === void 0 ? void 0 : input.sourceOutputIndex) !== null && _h !== void 0 ? _h : input === null || input === void 0 ? void 0 : input.sourceOutput) !== null && _j !== void 0 ? _j : input === null || input === void 0 ? void 0 : input.outputIndex) !== null && _k !== void 0 ? _k : input === null || input === void 0 ? void 0 : input.vout) !== null && _l !== void 0 ? _l : input === null || input === void 0 ? void 0 : input.prevOutIndex;
-            if (typeof txidCandidate === 'string' && typeof voutCandidate === 'number') {
-                const cand = normalizeTxid(txidCandidate);
-                const target = normalizeTxid(oldToken.txid);
-                if (cand === target && voutCandidate === oldToken.outputIndex)
-                    return true;
-                if (cand === reverseHexTxid(oldToken.txid) && voutCandidate === oldToken.outputIndex)
-                    return true;
-            }
-            const outpointCandidate = (_o = (_m = input === null || input === void 0 ? void 0 : input.outpoint) !== null && _m !== void 0 ? _m : input === null || input === void 0 ? void 0 : input.sourceOutpoint) !== null && _o !== void 0 ? _o : input === null || input === void 0 ? void 0 : input.prevOutpoint;
-            if (typeof outpointCandidate === 'string' && matchesOutpointString(outpointCandidate))
-                return true;
-            return false;
-        });
-        if (permInputIndex === -1 && tx.inputs.length === 1) {
-            permInputIndex = 0;
-        }
-        if (permInputIndex === -1) {
-            throw new Error('Unable to locate permission token input for revocation.');
-        }
         const unlocker = new sdk_1.PushDrop(this.underlying).unlock(WalletPermissionsManager.PERM_TOKEN_ENCRYPTION_PROTOCOL, '1', 'self', 'all', false, 1, sdk_1.LockingScript.fromHex(oldToken.outputScript));
-        const unlockingScript = await unlocker.sign(tx, permInputIndex);
+        const unlockingScript = await unlocker.sign(tx, 0);
         await this.underlying.signAction({
             reference: signableTransaction.reference,
             spends: {
-                [permInputIndex]: {
+                0: {
                     unlockingScript: unlockingScript.toHex()
                 }
             }
@@ -2586,16 +1769,22 @@ class WalletPermissionsManager {
      *  7) BRC-100 WALLET INTERFACE FORWARDING WITH PERMISSION CHECKS
      * --------------------------------------------------------------------- */
     async createAction(args, originator) {
-        // 1) Identify unique P-modules involved (one per schemeID) from both baskets and labels
+        var _a;
+        // 1) Identify unique P-modules involved (one per schemeID)
         const pModulesByScheme = new Map();
         const nonPBaskets = [];
-        // Check baskets for p modules
         if (args.outputs) {
             for (const out of args.outputs) {
                 if (out.basket) {
                     if (out.basket.startsWith('p ')) {
                         const schemeID = out.basket.split(' ')[1];
-                        this.addPModuleByScheme(schemeID, 'basket', pModulesByScheme);
+                        if (!pModulesByScheme.has(schemeID)) {
+                            const module = (_a = this.config.permissionModules) === null || _a === void 0 ? void 0 : _a[schemeID];
+                            if (!module) {
+                                throw new Error(`Unsupported P-basket scheme: p ${schemeID}`);
+                            }
+                            pModulesByScheme.set(schemeID, module);
+                        }
                     }
                     else {
                         // Track non-P baskets for normal permission checks
@@ -2604,8 +1793,6 @@ class WalletPermissionsManager {
                 }
             }
         }
-        // Check labels for p modules
-        const nonPLabels = this.splitLabelsByPermissionModule(args.labels, pModulesByScheme);
         // 2) Check permissions for non-P baskets
         for (const basket of nonPBaskets) {
             await this.ensureBasketAccess({
@@ -2615,14 +1802,15 @@ class WalletPermissionsManager {
                 usageType: 'insertion'
             });
         }
-        // 3) Check permissions for non-P labels
-        for (const lbl of nonPLabels) {
-            await this.ensureLabelAccess({
-                originator: originator,
-                label: lbl,
-                reason: args.description,
-                usageType: 'apply'
-            });
+        if (args.labels) {
+            for (const lbl of args.labels) {
+                await this.ensureLabelAccess({
+                    originator: originator,
+                    label: lbl,
+                    reason: args.description,
+                    usageType: 'apply'
+                });
+            }
         }
         /**
          * 4) Force signAndProcess=false unless the originator is admin and explicitly sets it to true.
@@ -2800,132 +1988,74 @@ class WalletPermissionsManager {
     }
     async listActions(...args) {
         const [requestArgs, originator] = args;
-        // 1) Identify unique P-modules involved (one per schemeID, preserving label order)
-        const pModulesByScheme = new Map();
-        const nonPLabels = this.splitLabelsByPermissionModule(requestArgs.labels, pModulesByScheme);
-        // 2) Check permissions for non-P labels
-        for (const lbl of nonPLabels) {
-            await this.ensureLabelAccess({
-                originator: originator,
-                label: lbl,
-                reason: 'listActions',
-                usageType: 'list'
-            });
-        }
-        // 3) Call underlying wallet, with P-module transformations if needed
-        let results;
-        if (pModulesByScheme.size > 0) {
-            // P-modules are involved - chain transformations
-            const pModules = Array.from(pModulesByScheme.values());
-            // Chain onRequest calls through all modules in order
-            let transformedArgs = requestArgs;
-            for (const module of pModules) {
-                const transformed = await module.onRequest({
-                    method: 'listActions',
-                    args: transformedArgs,
-                    originator: originator
-                });
-                transformedArgs = transformed.args;
-            }
-            // Call underlying wallet with transformed args
-            results = await this.underlying.listActions(transformedArgs, originator);
-            // Chain onResponse calls in reverse order
-            for (let i = pModules.length - 1; i >= 0; i--) {
-                results = await pModules[i].onResponse(results, {
-                    method: 'listActions',
-                    originator: originator
+        // for each label, ensure label access
+        if (requestArgs.labels) {
+            for (const lbl of requestArgs.labels) {
+                await this.ensureLabelAccess({
+                    originator: originator,
+                    label: lbl,
+                    reason: 'listActions',
+                    usageType: 'list'
                 });
             }
         }
-        else {
-            // No P-modules - call underlying wallet directly
-            results = await this.underlying.listActions(...args);
+        const results = await this.underlying.listActions(...args);
+        // Transparently decrypt transaction metadata, if configured to do so.
+        if (results.actions) {
+            for (let i = 0; i < results.actions.length; i++) {
+                if (results.actions[i].description) {
+                    results.actions[i].description = await this.maybeDecryptMetadata(results.actions[i].description);
+                }
+                if (results.actions[i].inputs) {
+                    for (let j = 0; j < results.actions[i].inputs.length; j++) {
+                        if (results.actions[i].inputs[j].inputDescription) {
+                            results.actions[i].inputs[j].inputDescription = await this.maybeDecryptMetadata(results.actions[i].inputs[j].inputDescription);
+                        }
+                    }
+                }
+                if (results.actions[i].outputs) {
+                    for (let j = 0; j < results.actions[i].outputs.length; j++) {
+                        if (results.actions[i].outputs[j].outputDescription) {
+                            results.actions[i].outputs[j].outputDescription = await this.maybeDecryptMetadata(results.actions[i].outputs[j].outputDescription);
+                        }
+                        if (results.actions[i].outputs[j].customInstructions) {
+                            results.actions[i].outputs[j].customInstructions = await this.maybeDecryptMetadata(results.actions[i].outputs[j].customInstructions);
+                        }
+                    }
+                }
+            }
         }
-        // 4) Transparently decrypt transaction metadata, if configured to do so.
-        return await this.decryptListActionsMetadata(results);
+        return results;
     }
     async internalizeAction(...args) {
-        var _a;
         const [requestArgs, originator] = args;
-        // 1) Identify unique P-modules involved (one per schemeID) from both baskets and labels
-        const pModulesByScheme = new Map();
-        const nonPBaskets = [];
-        // Check baskets for p modules
+        // If the transaction is inserting outputs into baskets, we also ensure basket permission
         for (const outIndex in requestArgs.outputs) {
             const out = requestArgs.outputs[outIndex];
             if (out.protocol === 'basket insertion') {
-                const basket = out.insertionRemittance.basket;
-                if (basket.startsWith('p ')) {
-                    const schemeID = basket.split(' ')[1];
-                    this.addPModuleByScheme(schemeID, 'basket', pModulesByScheme);
-                }
-                else {
-                    // Track non-P baskets for normal permission checks
-                    nonPBaskets.push({
-                        outIndex,
-                        basket,
-                        customInstructions: out.insertionRemittance.customInstructions
-                    });
-                }
-            }
-        }
-        // Check labels for p modules
-        const nonPLabels = this.splitLabelsByPermissionModule(requestArgs.labels, pModulesByScheme);
-        // 2) Check permissions for non-P baskets
-        for (const { outIndex, basket, customInstructions } of nonPBaskets) {
-            await this.ensureBasketAccess({
-                originator: originator,
-                basket,
-                reason: requestArgs.description,
-                usageType: 'insertion'
-            });
-            if (customInstructions) {
-                requestArgs.outputs[outIndex].insertionRemittance.customInstructions =
-                    await this.maybeEncryptMetadata(customInstructions);
-            }
-        }
-        // 3) Check permissions for non-P labels
-        for (const lbl of nonPLabels) {
-            await this.ensureLabelAccess({
-                originator: originator,
-                label: lbl,
-                reason: requestArgs.description,
-                usageType: 'apply'
-            });
-        }
-        // 4) Call underlying wallet, with P-module transformations if needed
-        if (pModulesByScheme.size > 0) {
-            // P-modules are involved - chain transformations
-            const pModules = Array.from(pModulesByScheme.values());
-            // Chain onRequest calls through all modules in order
-            let transformedArgs = requestArgs;
-            for (const module of pModules) {
-                const transformed = await module.onRequest({
-                    method: 'internalizeAction',
-                    args: transformedArgs,
-                    originator: originator
+                // Delegate to permission module if needed
+                const pModuleResult = await this.delegateToPModuleIfNeeded(out.insertionRemittance.basket, 'internalizeAction', requestArgs, originator, async (transformedArgs) => {
+                    if (out.insertionRemittance.customInstructions) {
+                        ;
+                        transformedArgs.outputs[outIndex].insertionRemittance.customInstructions =
+                            await this.maybeEncryptMetadata(out.insertionRemittance.customInstructions);
+                    }
+                    return await this.underlying.internalizeAction(transformedArgs, originator);
                 });
-                transformedArgs = transformed.args;
-            }
-            // Encrypt custom instructions for p basket outputs
-            for (const outIndex in transformedArgs.outputs) {
-                const out = transformedArgs.outputs[outIndex];
-                if (out.protocol === 'basket insertion' && ((_a = out.insertionRemittance) === null || _a === void 0 ? void 0 : _a.customInstructions)) {
-                    out.insertionRemittance.customInstructions = await this.maybeEncryptMetadata(out.insertionRemittance.customInstructions);
+                if (pModuleResult !== null) {
+                    return pModuleResult;
                 }
-            }
-            // Call underlying wallet with transformed args
-            let results = await this.underlying.internalizeAction(transformedArgs, originator);
-            // Chain onResponse calls in reverse order
-            for (let i = pModules.length - 1; i >= 0; i--) {
-                results = await pModules[i].onResponse(results, {
-                    method: 'internalizeAction',
-                    originator: originator
+                await this.ensureBasketAccess({
+                    originator: originator,
+                    basket: out.insertionRemittance.basket,
+                    reason: requestArgs.description,
+                    usageType: 'insertion'
                 });
+                if (out.insertionRemittance.customInstructions) {
+                    requestArgs.outputs[outIndex].insertionRemittance.customInstructions = await this.maybeEncryptMetadata(out.insertionRemittance.customInstructions);
+                }
             }
-            return results;
         }
-        // No P-modules - call underlying wallet directly
         return this.underlying.internalizeAction(...args);
     }
     async listOutputs(...args) {
@@ -3228,17 +2358,80 @@ class WalletPermissionsManager {
         return this.underlying.isAuthenticated(...args);
     }
     async waitForAuthentication(...args) {
+        var _a, _b, _c, _d, _e, _f, _g;
         let [_, originator] = args;
         if (this.config.seekGroupedPermission && originator) {
             const { normalized: normalizedOriginator } = this.prepareOriginator(originator);
             originator = normalizedOriginator;
             // 1. Fetch manifest.json from the originator
-            const groupPermissions = await this.fetchManifestGroupPermissions(originator);
+            let groupPermissions;
+            try {
+                const proto = originator.startsWith('localhost:') ? 'http' : 'https';
+                const response = await fetch(`${proto}://${originator}/manifest.json`);
+                if (response.ok) {
+                    const manifest = await response.json();
+                    if ((_a = manifest === null || manifest === void 0 ? void 0 : manifest.babbage) === null || _a === void 0 ? void 0 : _a.groupPermissions) {
+                        groupPermissions = manifest.babbage.groupPermissions;
+                    }
+                }
+            }
+            catch (e) {
+                // Ignore fetch/parse errors, just proceed without group permissions.
+            }
             if (groupPermissions) {
                 // 2. Filter out already-granted permissions
-                const permissionsToRequest = await this.filterAlreadyGrantedPermissions(originator, groupPermissions);
+                const permissionsToRequest = {
+                    protocolPermissions: [],
+                    basketAccess: [],
+                    certificateAccess: []
+                };
+                if (groupPermissions.spendingAuthorization) {
+                    const hasAuth = await this.hasSpendingAuthorization({
+                        originator,
+                        satoshis: groupPermissions.spendingAuthorization.amount
+                    });
+                    if (!hasAuth) {
+                        permissionsToRequest.spendingAuthorization = groupPermissions.spendingAuthorization;
+                    }
+                }
+                for (const p of groupPermissions.protocolPermissions || []) {
+                    const hasPerm = await this.hasProtocolPermission({
+                        originator,
+                        privileged: false, // Privilege is never allowed here
+                        protocolID: p.protocolID,
+                        counterparty: p.counterparty || 'self'
+                    });
+                    if (!hasPerm) {
+                        permissionsToRequest.protocolPermissions.push(p);
+                    }
+                }
+                for (const b of groupPermissions.basketAccess || []) {
+                    const hasAccess = await this.hasBasketAccess({
+                        originator,
+                        basket: b.basket
+                    });
+                    if (!hasAccess) {
+                        permissionsToRequest.basketAccess.push(b);
+                    }
+                }
+                for (const c of groupPermissions.certificateAccess || []) {
+                    const hasAccess = await this.hasCertificateAccess({
+                        originator,
+                        privileged: false, // Privilege is never allowed here for security
+                        verifier: c.verifierPublicKey,
+                        certType: c.type,
+                        fields: c.fields
+                    });
+                    if (!hasAccess) {
+                        permissionsToRequest.certificateAccess.push(c);
+                    }
+                }
                 // 3. If any permissions are left to request, start the flow
-                if (this.hasAnyPermissionsToRequest(permissionsToRequest)) {
+                const hasRequests = permissionsToRequest.spendingAuthorization ||
+                    ((_c = (_b = permissionsToRequest.protocolPermissions) === null || _b === void 0 ? void 0 : _b.length) !== null && _c !== void 0 ? _c : 0) > 0 ||
+                    ((_e = (_d = permissionsToRequest.basketAccess) === null || _d === void 0 ? void 0 : _d.length) !== null && _e !== void 0 ? _e : 0) > 0 ||
+                    ((_g = (_f = permissionsToRequest.certificateAccess) === null || _f === void 0 ? void 0 : _f.length) !== null && _g !== void 0 ? _g : 0) > 0;
+                if (hasRequests) {
                     const key = `group:${originator}`;
                     if (this.activeRequests.has(key)) {
                         // Another call is already waiting, piggyback on it
@@ -3310,7 +2503,6 @@ class WalletPermissionsManager {
      * Checks if the given label is admin-reserved per BRC-100 rules:
      *
      *  - Must not start with `admin` (admin-reserved)
-     *  - Must not start with `p ` (permissioned labels requiring a permission module)
      *
      * If it violates these rules and the caller is not admin, we consider it "admin-only."
      */
@@ -3318,9 +2510,6 @@ class WalletPermissionsManager {
         if (label.startsWith('admin')) {
             return true;
         }
-        if (label.startsWith('p ')) {
-            return true;
-        }
         return false;
     }
     /**
@@ -3457,7 +2646,6 @@ class WalletPermissionsManager {
     }
 }
 exports.WalletPermissionsManager = WalletPermissionsManager;
-WalletPermissionsManager.MANIFEST_CACHE_TTL_MS = 5 * 60 * 1000;
 /** How long a cached permission remains valid (5 minutes). */
 WalletPermissionsManager.CACHE_TTL_MS = 5 * 60 * 1000;
 /** Window during which freshly granted permissions are auto-allowed (except spending). */