@bsv/wallet-toolbox-client 2.0.0-beta.1 → 2.0.2

package/out/src/WalletPermissionsManager.js

@@ -77,7 +77,8 @@ class WalletPermissionsManager {
             onBasketAccessRequested: [],
             onCertificateAccessRequested: [],
             onSpendingAuthorizationRequested: [],
-            onGroupedPermissionRequested: []
+            onGroupedPermissionRequested: [],
+            onCounterpartyPermissionRequested: []
         };
         /**
          * We queue parallel requests for the same resource so that only one
@@ -93,6 +94,9 @@ class WalletPermissionsManager {
         /** Cache recently confirmed permissions to avoid repeated lookups. */
         this.permissionCache = new Map();
         this.recentGrants = new Map();
+        this.manifestCache = new Map();
+        this.manifestFetchInProgress = new Map();
+        this.pactEstablishedCache = new Map();
         this.underlying = underlyingWallet;
         this.adminOriginator = this.normalizeOriginator(adminOriginator) || adminOriginator;
         // Default all config options to true unless specified
@@ -117,6 +121,7 @@ class WalletPermissionsManager {
             seekSpendingPermissions: true,
             seekGroupedPermission: true,
             differentiatePrivilegedOperations: true,
+            whitelistedCounterparties: {},
             ...config // override with user-specified config
         };
     }
@@ -159,6 +164,68 @@ class WalletPermissionsManager {
             originator
         });
     }
+    /**
+     * Adds a permission module for the given schemeID if needed, throwing if unsupported.
+     */
+    addPModuleByScheme(schemeID, kind, pModulesByScheme) {
+        var _a;
+        if (pModulesByScheme.has(schemeID))
+            return;
+        const module = (_a = this.config.permissionModules) === null || _a === void 0 ? void 0 : _a[schemeID];
+        if (!module) {
+            throw new Error(`Unsupported P-${kind} scheme: p ${schemeID}`);
+        }
+        pModulesByScheme.set(schemeID, module);
+    }
+    /**
+     * Splits labels into P and non-P lists, registering any P-modules encountered.
+     *
+     * P-labels follow BRC-111 format: `p <moduleId> <payload>`
+     * - Must start with "p " (lowercase p + space)
+     * - Module ID must be at least 1 character with no spaces
+     * - Single space separates module ID from payload
+     * - Payload must be at least 1 character
+     *
+     * @example Valid: "p btms token123", "p invoicing invoice 2026-02-02"
+     * @example Invalid: "p btms" (no payload), "p btms " (empty payload), "p  data" (empty moduleId)
+     *
+     * @param labels - Array of label strings to process
+     * @param pModulesByScheme - Map to populate with discovered p-modules
+     * @returns Array of non-P labels for normal permission checks
+     * @throws Error if p-label format is invalid or module is unsupported
+     */
+    splitLabelsByPermissionModule(labels, pModulesByScheme) {
+        const nonPLabels = [];
+        if (!labels)
+            return nonPLabels;
+        for (const label of labels) {
+            if (label.startsWith('p ')) {
+                // Remove "p " prefix to get "moduleId payload"
+                const remainder = label.slice(2);
+                // Find the space that separates moduleId from payload
+                const separatorIndex = remainder.indexOf(' ');
+                // Validate: must have a space (separatorIndex > 0) and payload after it
+                // separatorIndex <= 0 means no space found or moduleId is empty
+                // separatorIndex === remainder.length - 1 means space is last char (no payload)
+                if (separatorIndex <= 0 || separatorIndex === remainder.length - 1) {
+                    throw new Error(`Invalid P-label format: ${label}`);
+                }
+                // Reject double spaces after moduleId (payload can't start with space)
+                if (remainder[separatorIndex + 1] === ' ') {
+                    throw new Error(`Invalid P-label format: ${label}`);
+                }
+                // Extract moduleId (substring before first space)
+                const schemeID = remainder.slice(0, separatorIndex);
+                // Register the module (throws if unsupported)
+                this.addPModuleByScheme(schemeID, 'label', pModulesByScheme);
+            }
+            else {
+                // Regular label - add to list for normal permission checks
+                nonPLabels.push(label);
+            }
+        }
+        return nonPLabels;
+    }
     /**
      * Decrypts custom instructions in listOutputs results if encryption is configured.
      */
@@ -172,6 +239,36 @@ class WalletPermissionsManager {
         }
         return results;
     }
+    /**
+     * Decrypts metadata in listActions results if encryption is configured.
+     */
+    async decryptListActionsMetadata(results) {
+        if (results.actions) {
+            for (let i = 0; i < results.actions.length; i++) {
+                if (results.actions[i].description) {
+                    results.actions[i].description = await this.maybeDecryptMetadata(results.actions[i].description);
+                }
+                if (results.actions[i].inputs) {
+                    for (let j = 0; j < results.actions[i].inputs.length; j++) {
+                        if (results.actions[i].inputs[j].inputDescription) {
+                            results.actions[i].inputs[j].inputDescription = await this.maybeDecryptMetadata(results.actions[i].inputs[j].inputDescription);
+                        }
+                    }
+                }
+                if (results.actions[i].outputs) {
+                    for (let j = 0; j < results.actions[i].outputs.length; j++) {
+                        if (results.actions[i].outputs[j].outputDescription) {
+                            results.actions[i].outputs[j].outputDescription = await this.maybeDecryptMetadata(results.actions[i].outputs[j].outputDescription);
+                        }
+                        if (results.actions[i].outputs[j].customInstructions) {
+                            results.actions[i].outputs[j].customInstructions = await this.maybeDecryptMetadata(results.actions[i].outputs[j].customInstructions);
+                        }
+                    }
+                }
+            }
+        }
+        return results;
+    }
     /* ---------------------------------------------------------------------
      *  1) PUBLIC API FOR REGISTERING CALLBACKS (UI PROMPTS, LOGGING, ETC.)
      * --------------------------------------------------------------------- */
@@ -312,93 +409,177 @@ class WalletPermissionsManager {
         if (!matching) {
             throw new Error('Request ID not found.');
         }
-        const originalRequest = matching.request;
-        const { originator, permissions: requestedPermissions, displayOriginator } = originalRequest;
-        const originLookupValues = this.buildOriginatorLookupValues(displayOriginator, originator);
-        // --- Validation: Ensure granted permissions are a subset of what was requested ---
-        if (params.granted.spendingAuthorization &&
-            !deepEqual(params.granted.spendingAuthorization, requestedPermissions.spendingAuthorization)) {
-            throw new Error('Granted spending authorization does not match the original request.');
-        }
-        if ((_a = params.granted.protocolPermissions) === null || _a === void 0 ? void 0 : _a.some(g => { var _a; return !((_a = requestedPermissions.protocolPermissions) === null || _a === void 0 ? void 0 : _a.find(r => deepEqual(r, g))); })) {
-            throw new Error('Granted protocol permissions are not a subset of the original request.');
-        }
-        if ((_b = params.granted.basketAccess) === null || _b === void 0 ? void 0 : _b.some(g => { var _a; return !((_a = requestedPermissions.basketAccess) === null || _a === void 0 ? void 0 : _a.find(r => deepEqual(r, g))); })) {
-            throw new Error('Granted basket access permissions are not a subset of the original request.');
-        }
-        if ((_c = params.granted.certificateAccess) === null || _c === void 0 ? void 0 : _c.some(g => { var _a; return !((_a = requestedPermissions.certificateAccess) === null || _a === void 0 ? void 0 : _a.find(r => deepEqual(r, g))); })) {
-            throw new Error('Granted certificate access permissions are not a subset of the original request.');
-        }
-        // --- End Validation ---
-        const expiry = params.expiry || 0; // default: never expires
-        if (params.granted.spendingAuthorization) {
-            await this.createPermissionOnChain({
-                type: 'spending',
-                originator,
-                spending: { satoshis: params.granted.spendingAuthorization.amount },
-                reason: params.granted.spendingAuthorization.description
-            }, 0, // No expiry for spending tokens
-            params.granted.spendingAuthorization.amount);
-        }
-        for (const p of params.granted.protocolPermissions || []) {
-            const token = await this.findProtocolToken(originator, false, // No privileged protocols allowed in groups for added security.
-            p.protocolID, p.counterparty || 'self', true, originLookupValues);
-            if (token) {
-                const request = {
-                    type: 'protocol',
-                    originator,
-                    privileged: false, // No privileged protocols allowed in groups for added security.
-                    protocolID: p.protocolID,
-                    counterparty: p.counterparty || 'self',
-                    reason: p.description
-                };
-                await this.renewPermissionOnChain(token, request, expiry);
-                this.markRecentGrant(request);
+        try {
+            const originalRequest = matching.request;
+            const { originator, permissions: requestedPermissions, displayOriginator } = originalRequest;
+            const originLookupValues = this.buildOriginatorLookupValues(displayOriginator, originator);
+            // --- Validation: Ensure granted permissions are a subset of what was requested ---
+            if (params.granted.spendingAuthorization && !requestedPermissions.spendingAuthorization) {
+                throw new Error('Granted spending authorization was not part of the original request.');
             }
-            else {
+            if ((_a = params.granted.protocolPermissions) === null || _a === void 0 ? void 0 : _a.some(g => { var _a; return !((_a = requestedPermissions.protocolPermissions) === null || _a === void 0 ? void 0 : _a.find(r => deepEqual(r, g))); })) {
+                throw new Error('Granted protocol permissions are not a subset of the original request.');
+            }
+            if ((_b = params.granted.basketAccess) === null || _b === void 0 ? void 0 : _b.some(g => { var _a; return !((_a = requestedPermissions.basketAccess) === null || _a === void 0 ? void 0 : _a.find(r => deepEqual(r, g))); })) {
+                throw new Error('Granted basket access permissions are not a subset of the original request.');
+            }
+            if ((_c = params.granted.certificateAccess) === null || _c === void 0 ? void 0 : _c.some(g => { var _a; return !((_a = requestedPermissions.certificateAccess) === null || _a === void 0 ? void 0 : _a.find(r => deepEqual(r, g))); })) {
+                throw new Error('Granted certificate access permissions are not a subset of the original request.');
+            }
+            // --- End Validation ---
+            const expiry = params.expiry || 0; // default: never expires
+            const toCreate = [];
+            const toRenew = [];
+            if (params.granted.spendingAuthorization) {
+                toCreate.push({
+                    request: {
+                        type: 'spending',
+                        originator,
+                        spending: { satoshis: params.granted.spendingAuthorization.amount },
+                        reason: params.granted.spendingAuthorization.description
+                    },
+                    expiry: 0,
+                    amount: params.granted.spendingAuthorization.amount
+                });
+            }
+            const grantedProtocols = params.granted.protocolPermissions || [];
+            const protocolTokens = await this.mapWithConcurrency(grantedProtocols, 8, async (p) => {
+                const token = await this.findProtocolToken(originator, false, p.protocolID, p.counterparty || 'self', true, originLookupValues);
+                return { p, token };
+            });
+            for (const { p, token } of protocolTokens) {
                 const request = {
                     type: 'protocol',
                     originator,
-                    privileged: false, // No privileged protocols allowed in groups for added security.
+                    privileged: false,
                     protocolID: p.protocolID,
                     counterparty: p.counterparty || 'self',
                     reason: p.description
                 };
-                await this.createPermissionOnChain(request, expiry);
-                this.markRecentGrant(request);
+                if (token) {
+                    toRenew.push({ oldToken: token, request, expiry });
+                }
+                else {
+                    toCreate.push({ request, expiry });
+                }
+            }
+            for (const b of params.granted.basketAccess || []) {
+                toCreate.push({
+                    request: { type: 'basket', originator, basket: b.basket, reason: b.description },
+                    expiry
+                });
+            }
+            for (const c of params.granted.certificateAccess || []) {
+                toCreate.push({
+                    request: {
+                        type: 'certificate',
+                        originator,
+                        privileged: false,
+                        certificate: {
+                            verifier: c.verifierPublicKey,
+                            certType: c.type,
+                            fields: c.fields
+                        },
+                        reason: c.description
+                    },
+                    expiry
+                });
+            }
+            const created = await this.createPermissionTokensBestEffort(toCreate);
+            const renewed = await this.renewPermissionTokensBestEffort(toRenew);
+            for (const req of [...created, ...renewed]) {
+                this.markRecentGrant(req);
+            }
+            // Success - resolve all pending promises for this request
+            for (const p of matching.pending) {
+                p.resolve(true);
             }
         }
-        for (const b of params.granted.basketAccess || []) {
-            const request = { type: 'basket', originator, basket: b.basket, reason: b.description };
-            await this.createPermissionOnChain(request, expiry);
-            this.markRecentGrant(request);
+        catch (error) {
+            // Failure - reject all pending promises so callers don't hang forever
+            for (const p of matching.pending) {
+                p.reject(error);
+            }
+            throw error;
+        }
+        finally {
+            // Always clean up the request entry
+            this.activeRequests.delete(params.requestID);
         }
-        for (const c of params.granted.certificateAccess || []) {
+    }
+    /**
+     * Denies a previously requested grouped permission.
+     * @param requestID The ID of the request being denied.
+     */
+    async denyGroupedPermission(requestID) {
+        const matching = this.activeRequests.get(requestID);
+        if (!matching) {
+            throw new Error('Request ID not found.');
+        }
+        const err = new Error('The user has denied the request for permission.');
+        err.code = 'ERR_PERMISSION_DENIED';
+        for (const p of matching.pending) {
+            p.reject(err);
+        }
+        this.activeRequests.delete(requestID);
+    }
+    async dismissGroupedPermission(requestID) {
+        const matching = this.activeRequests.get(requestID);
+        if (!matching) {
+            throw new Error('Request ID not found.');
+        }
+        for (const p of matching.pending) {
+            p.resolve(true);
+        }
+        this.activeRequests.delete(requestID);
+    }
+    async grantCounterpartyPermission(params) {
+        var _a;
+        const matching = this.activeRequests.get(params.requestID);
+        if (!matching) {
+            throw new Error('Request ID not found.');
+        }
+        const originalRequest = matching.request;
+        const { originator, counterparty, permissions: requestedPermissions, displayOriginator } = originalRequest;
+        const originLookupValues = this.buildOriginatorLookupValues(displayOriginator, originator);
+        if ((_a = params.granted.protocols) === null || _a === void 0 ? void 0 : _a.some(g => !requestedPermissions.protocols.find(r => deepEqual(r, g)))) {
+            throw new Error('Granted protocol permissions are not a subset of the original request.');
+        }
+        const expiry = params.expiry || 0;
+        const toCreate = [];
+        const toRenew = [];
+        const grantedProtocols = params.granted.protocols || [];
+        const protocolTokens = await this.mapWithConcurrency(grantedProtocols, 8, async (p) => {
+            const token = await this.findProtocolToken(originator, false, p.protocolID, counterparty, true, originLookupValues);
+            return { p, token };
+        });
+        for (const { p, token } of protocolTokens) {
             const request = {
-                type: 'certificate',
+                type: 'protocol',
                 originator,
-                privileged: false, // No certificates on the privileged identity are allowed as part of groups.
-                certificate: {
-                    verifier: c.verifierPublicKey,
-                    certType: c.type,
-                    fields: c.fields
-                },
-                reason: c.description
+                privileged: false,
+                protocolID: p.protocolID,
+                counterparty,
+                reason: p.description
             };
-            await this.createPermissionOnChain(request, expiry);
-            this.markRecentGrant(request);
+            if (token) {
+                toRenew.push({ oldToken: token, request, expiry });
+            }
+            else {
+                toCreate.push({ request, expiry });
+            }
+        }
+        const created = await this.createPermissionTokensBestEffort(toCreate);
+        const renewed = await this.renewPermissionTokensBestEffort(toRenew);
+        for (const req of [...created, ...renewed]) {
+            this.markRecentGrant(req);
         }
-        // Resolve all pending promises for this request
         for (const p of matching.pending) {
             p.resolve(true);
         }
         this.activeRequests.delete(params.requestID);
     }
-    /**
-     * Denies a previously requested grouped permission.
-     * @param requestID The ID of the request being denied.
-     */
-    async denyGroupedPermission(requestID) {
+    async denyCounterpartyPermission(requestID) {
         const matching = this.activeRequests.get(requestID);
         if (!matching) {
             throw new Error('Request ID not found.');
@@ -453,6 +634,9 @@ class WalletPermissionsManager {
         if (!this.config.differentiatePrivilegedOperations) {
             privileged = false;
         }
+        if (!privileged && this.isWhitelistedCounterpartyProtocol(counterparty, protocolID)) {
+            return true;
+        }
         const cacheKey = this.buildRequestKey({
             type: 'protocol',
             originator,
@@ -728,6 +912,469 @@ class WalletPermissionsManager {
             usageType: 'generic'
         });
     }
+    validateCounterpartyPermissions(raw) {
+        if (!raw || !Array.isArray(raw.protocols) || raw.protocols.length === 0)
+            return null;
+        const validProtocols = raw.protocols.filter((p) => {
+            return (Array.isArray(p === null || p === void 0 ? void 0 : p.protocolID) &&
+                p.protocolID[0] === 2 &&
+                typeof p.protocolID[1] === 'string' &&
+                typeof (p === null || p === void 0 ? void 0 : p.description) === 'string');
+        });
+        if (validProtocols.length === 0)
+            return null;
+        return {
+            description: typeof raw.description === 'string' ? raw.description : undefined,
+            protocols: validProtocols
+        };
+    }
+    async fetchManifestPermissions(originator) {
+        const cached = this.manifestCache.get(originator);
+        if (cached && Date.now() - cached.fetchedAt < WalletPermissionsManager.MANIFEST_CACHE_TTL_MS) {
+            return {
+                groupPermissions: cached.groupPermissions,
+                counterpartyPermissions: cached.counterpartyPermissions
+            };
+        }
+        const inProgress = this.manifestFetchInProgress.get(originator);
+        if (inProgress) {
+            return inProgress;
+        }
+        const fetchPromise = (async () => {
+            var _a, _b;
+            try {
+                const proto = originator.startsWith('localhost:') ? 'http' : 'https';
+                const response = await fetch(`${proto}://${originator}/manifest.json`);
+                if (response.ok) {
+                    const manifest = await response.json();
+                    const groupPermissions = ((_a = manifest === null || manifest === void 0 ? void 0 : manifest.babbage) === null || _a === void 0 ? void 0 : _a.groupPermissions) || null;
+                    const counterpartyPermissions = this.validateCounterpartyPermissions((_b = manifest === null || manifest === void 0 ? void 0 : manifest.babbage) === null || _b === void 0 ? void 0 : _b.counterpartyPermissions);
+                    this.manifestCache.set(originator, { groupPermissions, counterpartyPermissions, fetchedAt: Date.now() });
+                    return { groupPermissions, counterpartyPermissions };
+                }
+            }
+            catch (e) { }
+            const result = { groupPermissions: null, counterpartyPermissions: null };
+            this.manifestCache.set(originator, { ...result, fetchedAt: Date.now() });
+            return result;
+        })();
+        this.manifestFetchInProgress.set(originator, fetchPromise);
+        try {
+            return await fetchPromise;
+        }
+        finally {
+            this.manifestFetchInProgress.delete(originator);
+        }
+    }
+    async fetchManifestGroupPermissions(originator) {
+        const { groupPermissions } = await this.fetchManifestPermissions(originator);
+        return groupPermissions;
+    }
+    async filterAlreadyGrantedPermissions(originator, groupPermissions) {
+        const permissionsToRequest = {
+            description: groupPermissions.description,
+            protocolPermissions: [],
+            basketAccess: [],
+            certificateAccess: []
+        };
+        if (groupPermissions.spendingAuthorization) {
+            const hasAuth = await this.hasSpendingAuthorization({
+                originator,
+                satoshis: groupPermissions.spendingAuthorization.amount
+            });
+            if (!hasAuth) {
+                permissionsToRequest.spendingAuthorization = groupPermissions.spendingAuthorization;
+            }
+        }
+        for (const p of groupPermissions.protocolPermissions || []) {
+            const hasPerm = await this.hasProtocolPermission({
+                originator,
+                privileged: false,
+                protocolID: p.protocolID,
+                counterparty: p.counterparty || 'self'
+            });
+            if (!hasPerm) {
+                permissionsToRequest.protocolPermissions.push(p);
+            }
+        }
+        for (const b of groupPermissions.basketAccess || []) {
+            const hasAccess = await this.hasBasketAccess({
+                originator,
+                basket: b.basket
+            });
+            if (!hasAccess) {
+                permissionsToRequest.basketAccess.push(b);
+            }
+        }
+        for (const c of groupPermissions.certificateAccess || []) {
+            const hasAccess = await this.hasCertificateAccess({
+                originator,
+                privileged: false,
+                verifier: c.verifierPublicKey,
+                certType: c.type,
+                fields: c.fields
+            });
+            if (!hasAccess) {
+                permissionsToRequest.certificateAccess.push(c);
+            }
+        }
+        return permissionsToRequest;
+    }
+    hasAnyPermissionsToRequest(permissions) {
+        var _a, _b, _c, _d, _e, _f;
+        return !!(permissions.spendingAuthorization ||
+            ((_b = (_a = permissions.protocolPermissions) === null || _a === void 0 ? void 0 : _a.length) !== null && _b !== void 0 ? _b : 0) > 0 ||
+            ((_d = (_c = permissions.basketAccess) === null || _c === void 0 ? void 0 : _c.length) !== null && _d !== void 0 ? _d : 0) > 0 ||
+            ((_f = (_e = permissions.certificateAccess) === null || _e === void 0 ? void 0 : _e.length) !== null && _f !== void 0 ? _f : 0) > 0);
+    }
+    hasGroupedPermissionRequestedHandlers() {
+        const handlers = this.callbacks.onGroupedPermissionRequested || [];
+        return handlers.some(h => typeof h === 'function');
+    }
+    hasCounterpartyPermissionRequestedHandlers() {
+        const handlers = this.callbacks.onCounterpartyPermissionRequested || [];
+        return handlers.some(h => typeof h === 'function');
+    }
+    async hasPactEstablished(originator, counterparty) {
+        var _a;
+        if (counterparty === 'self' || counterparty === 'anyone') {
+            return true;
+        }
+        const cacheKey = `${originator}:${counterparty}`;
+        if (this.pactEstablishedCache.has(cacheKey)) {
+            return true;
+        }
+        const { counterpartyPermissions } = await this.fetchManifestPermissions(originator);
+        if (!((_a = counterpartyPermissions === null || counterpartyPermissions === void 0 ? void 0 : counterpartyPermissions.protocols) === null || _a === void 0 ? void 0 : _a.length)) {
+            return true;
+        }
+        const firstProtocol = counterpartyPermissions.protocols[0];
+        const hasToken = await this.hasProtocolPermission({
+            originator,
+            privileged: false,
+            protocolID: firstProtocol.protocolID,
+            counterparty
+        });
+        if (hasToken) {
+            this.pactEstablishedCache.set(cacheKey, Date.now());
+            return true;
+        }
+        return false;
+    }
+    markPactEstablished(originator, counterparty) {
+        const cacheKey = `${originator}:${counterparty}`;
+        this.pactEstablishedCache.set(cacheKey, Date.now());
+    }
+    async maybeRequestPact(currentRequest) {
+        var _a;
+        if (!this.config.seekGroupedPermission) {
+            return null;
+        }
+        if (!this.hasCounterpartyPermissionRequestedHandlers()) {
+            return null;
+        }
+        if (currentRequest.type !== 'protocol') {
+            return null;
+        }
+        if (currentRequest.privileged) {
+            return null;
+        }
+        const [level] = currentRequest.protocolID;
+        if (level !== 2) {
+            return null;
+        }
+        const originator = currentRequest.originator;
+        const counterparty = currentRequest.counterparty;
+        if (!counterparty || counterparty === 'self' || counterparty === 'anyone') {
+            return null;
+        }
+        if (!/^[0-9a-fA-F]{66}$/.test(counterparty)) {
+            return null;
+        }
+        if (await this.hasPactEstablished(originator, counterparty)) {
+            return null;
+        }
+        const { counterpartyPermissions } = await this.fetchManifestPermissions(originator);
+        if (!((_a = counterpartyPermissions === null || counterpartyPermissions === void 0 ? void 0 : counterpartyPermissions.protocols) === null || _a === void 0 ? void 0 : _a.length)) {
+            return null;
+        }
+        const protocolsToRequest = [];
+        for (const p of counterpartyPermissions.protocols) {
+            const hasPerm = await this.hasProtocolPermission({
+                originator,
+                privileged: false,
+                protocolID: p.protocolID,
+                counterparty
+            });
+            if (!hasPerm) {
+                protocolsToRequest.push(p);
+            }
+        }
+        if (protocolsToRequest.length === 0) {
+            this.markPactEstablished(originator, counterparty);
+            return null;
+        }
+        const permissionsToRequest = {
+            description: counterpartyPermissions.description,
+            protocols: protocolsToRequest
+        };
+        const key = `pact:${originator}:${counterparty}`;
+        const existing = this.activeRequests.get(key);
+        if (existing) {
+            const existingRequest = existing.request;
+            for (const p of permissionsToRequest.protocols) {
+                if (!existingRequest.permissions.protocols.find(x => deepEqual(x, p))) {
+                    existingRequest.permissions.protocols.push(p);
+                }
+            }
+            await new Promise((resolve, reject) => {
+                existing.pending.push({ resolve, reject });
+            });
+        }
+        else {
+            await new Promise(async (resolve, reject) => {
+                this.activeRequests.set(key, {
+                    request: {
+                        originator,
+                        counterparty,
+                        permissions: permissionsToRequest,
+                        displayOriginator: currentRequest.displayOriginator
+                    },
+                    pending: [{ resolve, reject }]
+                });
+                await this.callEvent('onCounterpartyPermissionRequested', {
+                    requestID: key,
+                    originator,
+                    counterparty,
+                    permissions: permissionsToRequest
+                });
+            });
+        }
+        this.markPactEstablished(originator, counterparty);
+        const satisfied = await this.hasProtocolPermission({
+            originator,
+            privileged: false,
+            protocolID: currentRequest.protocolID,
+            counterparty
+        });
+        return satisfied ? true : null;
+    }
+    async maybeRequestPeerGroupedLevel2ProtocolPermissions(currentRequest) {
+        var _a, _b;
+        if (!this.config.seekGroupedPermission) {
+            return null;
+        }
+        if (!this.hasGroupedPermissionRequestedHandlers()) {
+            return null;
+        }
+        if (currentRequest.type !== 'protocol') {
+            return null;
+        }
+        const [level] = currentRequest.protocolID;
+        if (level !== 2) {
+            return null;
+        }
+        const originator = currentRequest.originator;
+        const privileged = (_a = currentRequest.privileged) !== null && _a !== void 0 ? _a : false;
+        const counterparty = (_b = currentRequest.counterparty) !== null && _b !== void 0 ? _b : 'self';
+        const groupPermissions = await this.fetchManifestGroupPermissions(originator);
+        if (!groupPermissions) {
+            return null;
+        }
+        const normalizeManifestCounterparty = (cp) => {
+            if (cp === '')
+                return counterparty;
+            return cp !== null && cp !== void 0 ? cp : 'self';
+        };
+        const manifestLevel2ForThisPeer = (groupPermissions.protocolPermissions || [])
+            .filter(p => { var _a, _b; return ((_b = (_a = p.protocolID) === null || _a === void 0 ? void 0 : _a[0]) !== null && _b !== void 0 ? _b : 0) === 2; })
+            .map(p => ({
+            protocolID: p.protocolID,
+            counterparty: normalizeManifestCounterparty(p.counterparty),
+            description: p.description
+        }))
+            .filter(p => p.counterparty === counterparty);
+        const isCurrentRequestInManifest = manifestLevel2ForThisPeer.some(p => deepEqual(p.protocolID, currentRequest.protocolID));
+        if (!isCurrentRequestInManifest) {
+            return null;
+        }
+        const permissionsToRequest = {
+            protocolPermissions: []
+        };
+        for (const p of manifestLevel2ForThisPeer) {
+            const hasPerm = await this.hasProtocolPermission({
+                originator,
+                privileged,
+                protocolID: p.protocolID,
+                counterparty: p.counterparty
+            });
+            if (!hasPerm) {
+                permissionsToRequest.protocolPermissions.push({
+                    protocolID: p.protocolID,
+                    counterparty: p.counterparty,
+                    description: p.description
+                });
+            }
+        }
+        if (!this.hasAnyPermissionsToRequest(permissionsToRequest)) {
+            return null;
+        }
+        const key = `group-peer:${originator}:${privileged}:${counterparty}`;
+        const existing = this.activeRequests.get(key);
+        if (existing) {
+            const existingRequest = existing.request;
+            if (!existingRequest.permissions.protocolPermissions) {
+                existingRequest.permissions.protocolPermissions = [];
+            }
+            for (const p of permissionsToRequest.protocolPermissions || []) {
+                if (!existingRequest.permissions.protocolPermissions.find(x => deepEqual(x, p))) {
+                    existingRequest.permissions.protocolPermissions.push(p);
+                }
+            }
+            await new Promise((resolve, reject) => {
+                existing.pending.push({ resolve, reject });
+            });
+        }
+        else {
+            await new Promise(async (resolve, reject) => {
+                const permissions = permissionsToRequest;
+                this.activeRequests.set(key, {
+                    request: {
+                        originator,
+                        permissions,
+                        displayOriginator: currentRequest.displayOriginator
+                    },
+                    pending: [{ resolve, reject }]
+                });
+                await this.callEvent('onGroupedPermissionRequested', {
+                    requestID: key,
+                    originator,
+                    permissions
+                });
+            });
+        }
+        const satisfied = await this.checkSpecificPermissionAfterGroupFlow(currentRequest);
+        return satisfied ? true : null;
+    }
+    async checkSpecificPermissionAfterGroupFlow(request) {
+        var _a, _b, _c;
+        switch (request.type) {
+            case 'protocol':
+                return await this.hasProtocolPermission({
+                    originator: request.originator,
+                    privileged: (_a = request.privileged) !== null && _a !== void 0 ? _a : false,
+                    protocolID: request.protocolID,
+                    counterparty: (_b = request.counterparty) !== null && _b !== void 0 ? _b : 'self'
+                });
+            case 'basket':
+                return await this.hasBasketAccess({
+                    originator: request.originator,
+                    basket: request.basket
+                });
+            case 'certificate':
+                return await this.hasCertificateAccess({
+                    originator: request.originator,
+                    privileged: (_c = request.privileged) !== null && _c !== void 0 ? _c : false,
+                    verifier: request.certificate.verifier,
+                    certType: request.certificate.certType,
+                    fields: request.certificate.fields
+                });
+            case 'spending':
+                return await this.hasSpendingAuthorization({
+                    originator: request.originator,
+                    satoshis: request.spending.satoshis
+                });
+            default:
+                return false;
+        }
+    }
+    isRequestIncludedInGroupPermissions(request, groupPermissions) {
+        var _a, _b, _c, _d;
+        switch (request.type) {
+            case 'protocol': {
+                if (request.privileged)
+                    return false;
+                const pid = request.protocolID;
+                if (!pid)
+                    return false;
+                const cp = (_a = request.counterparty) !== null && _a !== void 0 ? _a : 'self';
+                return !!((_b = groupPermissions.protocolPermissions) === null || _b === void 0 ? void 0 : _b.some(p => {
+                    var _a;
+                    const manifestCp = p.counterparty === '' ? cp : ((_a = p.counterparty) !== null && _a !== void 0 ? _a : 'self');
+                    return deepEqual(p.protocolID, pid) && manifestCp === cp;
+                }));
+            }
+            case 'basket': {
+                const basket = request.basket;
+                if (!basket)
+                    return false;
+                return !!((_c = groupPermissions.basketAccess) === null || _c === void 0 ? void 0 : _c.some(b => b.basket === basket));
+            }
+            case 'certificate': {
+                if (request.privileged)
+                    return false;
+                const cert = request.certificate;
+                if (!cert)
+                    return false;
+                return !!((_d = groupPermissions.certificateAccess) === null || _d === void 0 ? void 0 : _d.some(c => {
+                    const fieldsA = new Set(c.fields || []);
+                    const fieldsB = new Set(cert.fields || []);
+                    if (fieldsA.size !== fieldsB.size)
+                        return false;
+                    for (const f of fieldsA)
+                        if (!fieldsB.has(f))
+                            return false;
+                    return c.type === cert.certType && c.verifierPublicKey === cert.verifier;
+                }));
+            }
+            case 'spending':
+                return !!groupPermissions.spendingAuthorization;
+            default:
+                return false;
+        }
+    }
+    async maybeRequestGroupedPermissions(currentRequest) {
+        if (!this.config.seekGroupedPermission) {
+            return null;
+        }
+        const originator = currentRequest.originator;
+        const groupPermissions = await this.fetchManifestGroupPermissions(originator);
+        if (!groupPermissions) {
+            return null;
+        }
+        if (!this.isRequestIncludedInGroupPermissions(currentRequest, groupPermissions)) {
+            return null;
+        }
+        const permissionsToRequest = await this.filterAlreadyGrantedPermissions(originator, groupPermissions);
+        if (!this.hasAnyPermissionsToRequest(permissionsToRequest)) {
+            return null;
+        }
+        const key = `group:${originator}`;
+        if (this.activeRequests.has(key)) {
+            await new Promise((resolve, reject) => {
+                this.activeRequests.get(key).pending.push({ resolve, reject });
+            });
+        }
+        else {
+            await new Promise(async (resolve, reject) => {
+                this.activeRequests.set(key, {
+                    request: {
+                        originator,
+                        permissions: permissionsToRequest,
+                        displayOriginator: currentRequest.displayOriginator
+                    },
+                    pending: [{ resolve, reject }]
+                });
+                await this.callEvent('onGroupedPermissionRequested', {
+                    requestID: key,
+                    originator,
+                    permissions: permissionsToRequest
+                });
+            });
+        }
+        const satisfied = await this.checkSpecificPermissionAfterGroupFlow(currentRequest);
+        return satisfied ? true : null;
+    }
     /**
      * A central method that triggers the permission request flow.
      * - It checks if there's already an active request for the same key
@@ -736,13 +1383,25 @@ class WalletPermissionsManager {
      *   and return a promise that resolves once permission is granted or rejects if denied.
      */
     async requestPermissionFlow(r) {
-        var _a;
+        var _a, _b, _c;
         const normalizedOriginator = this.normalizeOriginator(r.originator) || r.originator;
         const preparedRequest = {
             ...r,
             originator: normalizedOriginator,
-            displayOriginator: (_a = r.displayOriginator) !== null && _a !== void 0 ? _a : r.originator
+            displayOriginator: (_c = (_a = r.displayOriginator) !== null && _a !== void 0 ? _a : (_b = r.previousToken) === null || _b === void 0 ? void 0 : _b.rawOriginator) !== null && _c !== void 0 ? _c : r.originator
         };
+        const pactResult = await this.maybeRequestPact(preparedRequest);
+        if (pactResult !== null) {
+            return pactResult;
+        }
+        const peerGroupResult = await this.maybeRequestPeerGroupedLevel2ProtocolPermissions(preparedRequest);
+        if (peerGroupResult !== null) {
+            return peerGroupResult;
+        }
+        const groupResult = await this.maybeRequestGroupedPermissions(preparedRequest);
+        if (groupResult !== null) {
+            return groupResult;
+        }
         const key = this.buildRequestKey(preparedRequest);
         // If there's already a queue for the same resource, we piggyback on it
         const existingQueue = this.activeRequests.get(key);
@@ -1196,10 +1855,128 @@ class WalletPermissionsManager {
                 }
             ],
             options: {
-                acceptDelayedBroadcast: false
+                acceptDelayedBroadcast: true
             }
         }, this.adminOriginator);
     }
+    async mapWithConcurrency(items, concurrency, fn) {
+        if (!items.length)
+            return [];
+        const results = new Array(items.length);
+        let i = 0;
+        const worker = async () => {
+            while (true) {
+                const idx = i++;
+                if (idx >= items.length)
+                    return;
+                results[idx] = await fn(items[idx]);
+            }
+        };
+        await Promise.all(Array.from({ length: Math.min(concurrency, items.length) }, () => worker()));
+        return results;
+    }
+    async runBestEffortBatches(items, chunkSize, runChunk) {
+        if (!items.length)
+            return [];
+        const out = [];
+        for (let i = 0; i < items.length; i += chunkSize) {
+            const chunk = items.slice(i, i + chunkSize);
+            out.push(...(await this.runBestEffortChunk(chunk, runChunk)));
+        }
+        return out;
+    }
+    async runBestEffortChunk(chunk, runChunk) {
+        try {
+            return await runChunk(chunk);
+        }
+        catch (e) {
+            if (chunk.length <= 1) {
+                console.error('Permission batch failed:', e);
+                return [];
+            }
+            const mid = Math.ceil(chunk.length / 2);
+            const left = await this.runBestEffortChunk(chunk.slice(0, mid), runChunk);
+            const right = await this.runBestEffortChunk(chunk.slice(mid), runChunk);
+            return [...left, ...right];
+        }
+    }
+    async buildPermissionOutput(r, expiry, amount) {
+        const normalizedOriginator = this.normalizeOriginator(r.originator) || r.originator;
+        r.originator = normalizedOriginator;
+        const basketName = BASKET_MAP[r.type];
+        if (!basketName) {
+            throw new Error(`Unsupported permission type: ${r.type}`);
+        }
+        const fields = await this.buildPushdropFields(r, expiry, amount);
+        const script = await new sdk_1.PushDrop(this.underlying).lock(fields, WalletPermissionsManager.PERM_TOKEN_ENCRYPTION_PROTOCOL, '1', 'self', true, true);
+        const tags = this.buildTagsForRequest(r);
+        return {
+            request: r,
+            output: {
+                lockingScript: script.toHex(),
+                satoshis: 1,
+                outputDescription: `${r.type} permission token`,
+                basket: basketName,
+                tags
+            }
+        };
+    }
+    async createPermissionTokensBestEffort(items) {
+        const CHUNK = 25;
+        return this.runBestEffortBatches(items, CHUNK, async (chunk) => {
+            const built = await this.mapWithConcurrency(chunk, 8, c => this.buildPermissionOutput(c.request, c.expiry, c.amount));
+            await this.createAction({
+                description: `Grant ${built.length} permissions`,
+                outputs: built.map(b => b.output),
+                options: { acceptDelayedBroadcast: true }
+            }, this.adminOriginator);
+            return built.map(b => b.request);
+        });
+    }
+    async renewPermissionTokensBestEffort(items) {
+        const CHUNK = 15;
+        return this.runBestEffortBatches(items, CHUNK, async (chunk) => {
+            const built = await this.mapWithConcurrency(chunk, 8, c => this.buildPermissionOutput(c.request, c.expiry, c.amount));
+            const inputBeef = new sdk_1.Beef();
+            for (const c of chunk) {
+                inputBeef.mergeBeef(sdk_1.Beef.fromBinary(c.oldToken.tx));
+            }
+            const { signableTransaction } = await this.createAction({
+                description: `Renew ${chunk.length} permissions`,
+                inputBEEF: inputBeef.toBinary(),
+                inputs: chunk.map((c, i) => ({
+                    outpoint: `${c.oldToken.txid}.${c.oldToken.outputIndex}`,
+                    unlockingScriptLength: 73,
+                    inputDescription: `Consume old permission token #${i + 1}`
+                })),
+                outputs: built.map(b => b.output),
+                options: {
+                    acceptDelayedBroadcast: true,
+                    randomizeOutputs: false,
+                    signAndProcess: false
+                }
+            }, this.adminOriginator);
+            if (!(signableTransaction === null || signableTransaction === void 0 ? void 0 : signableTransaction.reference) || !signableTransaction.tx) {
+                throw new Error('Failed to create signable transaction');
+            }
+            const partialTx = sdk_1.Transaction.fromAtomicBEEF(signableTransaction.tx);
+            const pushdrop = new sdk_1.PushDrop(this.underlying);
+            const spends = {};
+            for (let i = 0; i < chunk.length; i++) {
+                const token = chunk[i].oldToken;
+                const unlocker = pushdrop.unlock(WalletPermissionsManager.PERM_TOKEN_ENCRYPTION_PROTOCOL, '1', 'self', 'all', false, 1, sdk_1.LockingScript.fromHex(token.outputScript));
+                const unlockingScript = await unlocker.sign(partialTx, i);
+                spends[i] = { unlockingScript: unlockingScript.toHex() };
+            }
+            const { txid } = await this.underlying.signAction({
+                reference: signableTransaction.reference,
+                spends
+            });
+            if (!txid)
+                throw new Error('Failed to finalize renewal transaction');
+            return built.map(b => b.request);
+        });
+    }
     async coalescePermissionTokens(oldTokens, newScript, opts) {
         var _a;
         if (!(oldTokens === null || oldTokens === void 0 ? void 0 : oldTokens.length))
@@ -1230,7 +2007,7 @@ class WalletPermissionsManager {
                 }
             ],
             options: {
-                acceptDelayedBroadcast: false,
+                acceptDelayedBroadcast: true,
                 randomizeOutputs: false,
                 signAndProcess: false
             }
@@ -1309,7 +2086,7 @@ class WalletPermissionsManager {
                     }
                 ],
                 options: {
-                    acceptDelayedBroadcast: false
+                    acceptDelayedBroadcast: true
                 }
             }, this.adminOriginator);
             const tx = sdk_1.Transaction.fromBEEF(signableTransaction.tx);
@@ -1445,7 +2222,7 @@ class WalletPermissionsManager {
                 tags,
                 tagQueryMode: 'all',
                 include: 'entire transactions',
-                limit: 100
+                limit: 10000
             }, this.adminOriginator);
             for (const out of result.outputs) {
                 if (seen.has(out.outpoint))
@@ -1750,16 +2527,60 @@ class WalletPermissionsManager {
                 }
             ],
             options: {
-                acceptDelayedBroadcast: false
+                acceptDelayedBroadcast: true
             }
         }, this.adminOriginator);
         const tx = sdk_1.Transaction.fromBEEF(signableTransaction.tx);
+        const normalizeTxid = (txid) => (txid !== null && txid !== void 0 ? txid : '').toLowerCase();
+        const reverseHexTxid = (txid) => {
+            const hex = normalizeTxid(txid);
+            if (!/^[0-9a-f]{64}$/.test(hex))
+                return hex;
+            const bytes = hex.match(/../g);
+            return bytes ? bytes.reverse().join('') : hex;
+        };
+        const matchesOutpointString = (outpoint) => {
+            const dot = outpoint.lastIndexOf('.');
+            const colon = outpoint.lastIndexOf(':');
+            const sep = dot > colon ? dot : colon;
+            if (sep === -1)
+                return false;
+            const txidPart = outpoint.slice(0, sep);
+            const indexPart = outpoint.slice(sep + 1);
+            const vout = Number(indexPart);
+            if (!Number.isFinite(vout))
+                return false;
+            return normalizeTxid(txidPart) === normalizeTxid(oldToken.txid) && vout === oldToken.outputIndex;
+        };
+        let permInputIndex = tx.inputs.findIndex((input) => {
+            var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l, _m, _o;
+            const txidCandidate = (_g = (_f = (_e = (_d = (_c = (_b = (_a = input === null || input === void 0 ? void 0 : input.sourceTXID) !== null && _a !== void 0 ? _a : input === null || input === void 0 ? void 0 : input.sourceTxid) !== null && _b !== void 0 ? _b : input === null || input === void 0 ? void 0 : input.sourceTxId) !== null && _c !== void 0 ? _c : input === null || input === void 0 ? void 0 : input.prevTxId) !== null && _d !== void 0 ? _d : input === null || input === void 0 ? void 0 : input.prevTxid) !== null && _e !== void 0 ? _e : input === null || input === void 0 ? void 0 : input.prevTXID) !== null && _f !== void 0 ? _f : input === null || input === void 0 ? void 0 : input.txid) !== null && _g !== void 0 ? _g : input === null || input === void 0 ? void 0 : input.txID;
+            const voutCandidate = (_l = (_k = (_j = (_h = input === null || input === void 0 ? void 0 : input.sourceOutputIndex) !== null && _h !== void 0 ? _h : input === null || input === void 0 ? void 0 : input.sourceOutput) !== null && _j !== void 0 ? _j : input === null || input === void 0 ? void 0 : input.outputIndex) !== null && _k !== void 0 ? _k : input === null || input === void 0 ? void 0 : input.vout) !== null && _l !== void 0 ? _l : input === null || input === void 0 ? void 0 : input.prevOutIndex;
+            if (typeof txidCandidate === 'string' && typeof voutCandidate === 'number') {
+                const cand = normalizeTxid(txidCandidate);
+                const target = normalizeTxid(oldToken.txid);
+                if (cand === target && voutCandidate === oldToken.outputIndex)
+                    return true;
+                if (cand === reverseHexTxid(oldToken.txid) && voutCandidate === oldToken.outputIndex)
+                    return true;
+            }
+            const outpointCandidate = (_o = (_m = input === null || input === void 0 ? void 0 : input.outpoint) !== null && _m !== void 0 ? _m : input === null || input === void 0 ? void 0 : input.sourceOutpoint) !== null && _o !== void 0 ? _o : input === null || input === void 0 ? void 0 : input.prevOutpoint;
+            if (typeof outpointCandidate === 'string' && matchesOutpointString(outpointCandidate))
+                return true;
+            return false;
+        });
+        if (permInputIndex === -1 && tx.inputs.length === 1) {
+            permInputIndex = 0;
+        }
+        if (permInputIndex === -1) {
+            throw new Error('Unable to locate permission token input for revocation.');
+        }
         const unlocker = new sdk_1.PushDrop(this.underlying).unlock(WalletPermissionsManager.PERM_TOKEN_ENCRYPTION_PROTOCOL, '1', 'self', 'all', false, 1, sdk_1.LockingScript.fromHex(oldToken.outputScript));
-        const unlockingScript = await unlocker.sign(tx, 0);
+        const unlockingScript = await unlocker.sign(tx, permInputIndex);
         await this.underlying.signAction({
             reference: signableTransaction.reference,
             spends: {
-                0: {
+                [permInputIndex]: {
                     unlockingScript: unlockingScript.toHex()
                 }
             }
@@ -1769,22 +2590,16 @@ class WalletPermissionsManager {
      *  7) BRC-100 WALLET INTERFACE FORWARDING WITH PERMISSION CHECKS
      * --------------------------------------------------------------------- */
     async createAction(args, originator) {
-        var _a;
-        // 1) Identify unique P-modules involved (one per schemeID)
+        // 1) Identify unique P-modules involved (one per schemeID) from both baskets and labels
         const pModulesByScheme = new Map();
         const nonPBaskets = [];
+        // Check baskets for p modules
         if (args.outputs) {
             for (const out of args.outputs) {
                 if (out.basket) {
                     if (out.basket.startsWith('p ')) {
                         const schemeID = out.basket.split(' ')[1];
-                        if (!pModulesByScheme.has(schemeID)) {
-                            const module = (_a = this.config.permissionModules) === null || _a === void 0 ? void 0 : _a[schemeID];
-                            if (!module) {
-                                throw new Error(`Unsupported P-basket scheme: p ${schemeID}`);
-                            }
-                            pModulesByScheme.set(schemeID, module);
-                        }
+                        this.addPModuleByScheme(schemeID, 'basket', pModulesByScheme);
                     }
                     else {
                         // Track non-P baskets for normal permission checks
@@ -1793,6 +2608,8 @@ class WalletPermissionsManager {
                 }
             }
         }
+        // Check labels for p modules
+        const nonPLabels = this.splitLabelsByPermissionModule(args.labels, pModulesByScheme);
         // 2) Check permissions for non-P baskets
         for (const basket of nonPBaskets) {
             await this.ensureBasketAccess({
@@ -1802,15 +2619,14 @@ class WalletPermissionsManager {
                 usageType: 'insertion'
             });
         }
-        if (args.labels) {
-            for (const lbl of args.labels) {
-                await this.ensureLabelAccess({
-                    originator: originator,
-                    label: lbl,
-                    reason: args.description,
-                    usageType: 'apply'
-                });
-            }
+        // 3) Check permissions for non-P labels
+        for (const lbl of nonPLabels) {
+            await this.ensureLabelAccess({
+                originator: originator,
+                label: lbl,
+                reason: args.description,
+                usageType: 'apply'
+            });
         }
         /**
          * 4) Force signAndProcess=false unless the originator is admin and explicitly sets it to true.
@@ -1988,74 +2804,132 @@ class WalletPermissionsManager {
     }
     async listActions(...args) {
         const [requestArgs, originator] = args;
-        // for each label, ensure label access
-        if (requestArgs.labels) {
-            for (const lbl of requestArgs.labels) {
-                await this.ensureLabelAccess({
-                    originator: originator,
-                    label: lbl,
-                    reason: 'listActions',
-                    usageType: 'list'
+        // 1) Identify unique P-modules involved (one per schemeID, preserving label order)
+        const pModulesByScheme = new Map();
+        const nonPLabels = this.splitLabelsByPermissionModule(requestArgs.labels, pModulesByScheme);
+        // 2) Check permissions for non-P labels
+        for (const lbl of nonPLabels) {
+            await this.ensureLabelAccess({
+                originator: originator,
+                label: lbl,
+                reason: 'listActions',
+                usageType: 'list'
+            });
+        }
+        // 3) Call underlying wallet, with P-module transformations if needed
+        let results;
+        if (pModulesByScheme.size > 0) {
+            // P-modules are involved - chain transformations
+            const pModules = Array.from(pModulesByScheme.values());
+            // Chain onRequest calls through all modules in order
+            let transformedArgs = requestArgs;
+            for (const module of pModules) {
+                const transformed = await module.onRequest({
+                    method: 'listActions',
+                    args: transformedArgs,
+                    originator: originator
                 });
+                transformedArgs = transformed.args;
             }
-        }
-        const results = await this.underlying.listActions(...args);
-        // Transparently decrypt transaction metadata, if configured to do so.
-        if (results.actions) {
-            for (let i = 0; i < results.actions.length; i++) {
-                if (results.actions[i].description) {
-                    results.actions[i].description = await this.maybeDecryptMetadata(results.actions[i].description);
-                }
-                if (results.actions[i].inputs) {
-                    for (let j = 0; j < results.actions[i].inputs.length; j++) {
-                        if (results.actions[i].inputs[j].inputDescription) {
-                            results.actions[i].inputs[j].inputDescription = await this.maybeDecryptMetadata(results.actions[i].inputs[j].inputDescription);
-                        }
-                    }
-                }
-                if (results.actions[i].outputs) {
-                    for (let j = 0; j < results.actions[i].outputs.length; j++) {
-                        if (results.actions[i].outputs[j].outputDescription) {
-                            results.actions[i].outputs[j].outputDescription = await this.maybeDecryptMetadata(results.actions[i].outputs[j].outputDescription);
-                        }
-                        if (results.actions[i].outputs[j].customInstructions) {
-                            results.actions[i].outputs[j].customInstructions = await this.maybeDecryptMetadata(results.actions[i].outputs[j].customInstructions);
-                        }
-                    }
-                }
+            // Call underlying wallet with transformed args
+            results = await this.underlying.listActions(transformedArgs, originator);
+            // Chain onResponse calls in reverse order
+            for (let i = pModules.length - 1; i >= 0; i--) {
+                results = await pModules[i].onResponse(results, {
+                    method: 'listActions',
+                    originator: originator
+                });
             }
         }
-        return results;
+        else {
+            // No P-modules - call underlying wallet directly
+            results = await this.underlying.listActions(...args);
+        }
+        // 4) Transparently decrypt transaction metadata, if configured to do so.
+        return await this.decryptListActionsMetadata(results);
     }
     async internalizeAction(...args) {
+        var _a;
         const [requestArgs, originator] = args;
-        // If the transaction is inserting outputs into baskets, we also ensure basket permission
+        // 1) Identify unique P-modules involved (one per schemeID) from both baskets and labels
+        const pModulesByScheme = new Map();
+        const nonPBaskets = [];
+        // Check baskets for p modules
         for (const outIndex in requestArgs.outputs) {
             const out = requestArgs.outputs[outIndex];
             if (out.protocol === 'basket insertion') {
-                // Delegate to permission module if needed
-                const pModuleResult = await this.delegateToPModuleIfNeeded(out.insertionRemittance.basket, 'internalizeAction', requestArgs, originator, async (transformedArgs) => {
-                    if (out.insertionRemittance.customInstructions) {
-                        ;
-                        transformedArgs.outputs[outIndex].insertionRemittance.customInstructions =
-                            await this.maybeEncryptMetadata(out.insertionRemittance.customInstructions);
-                    }
-                    return await this.underlying.internalizeAction(transformedArgs, originator);
-                });
-                if (pModuleResult !== null) {
-                    return pModuleResult;
+                const basket = out.insertionRemittance.basket;
+                if (basket.startsWith('p ')) {
+                    const schemeID = basket.split(' ')[1];
+                    this.addPModuleByScheme(schemeID, 'basket', pModulesByScheme);
                 }
-                await this.ensureBasketAccess({
-                    originator: originator,
-                    basket: out.insertionRemittance.basket,
-                    reason: requestArgs.description,
-                    usageType: 'insertion'
+                else {
+                    // Track non-P baskets for normal permission checks
+                    nonPBaskets.push({
+                        outIndex,
+                        basket,
+                        customInstructions: out.insertionRemittance.customInstructions
+                    });
+                }
+            }
+        }
+        // Check labels for p modules
+        const nonPLabels = this.splitLabelsByPermissionModule(requestArgs.labels, pModulesByScheme);
+        // 2) Check permissions for non-P baskets
+        for (const { outIndex, basket, customInstructions } of nonPBaskets) {
+            await this.ensureBasketAccess({
+                originator: originator,
+                basket,
+                reason: requestArgs.description,
+                usageType: 'insertion'
+            });
+            if (customInstructions) {
+                requestArgs.outputs[outIndex].insertionRemittance.customInstructions =
+                    await this.maybeEncryptMetadata(customInstructions);
+            }
+        }
+        // 3) Check permissions for non-P labels
+        for (const lbl of nonPLabels) {
+            await this.ensureLabelAccess({
+                originator: originator,
+                label: lbl,
+                reason: requestArgs.description,
+                usageType: 'apply'
+            });
+        }
+        // 4) Call underlying wallet, with P-module transformations if needed
+        if (pModulesByScheme.size > 0) {
+            // P-modules are involved - chain transformations
+            const pModules = Array.from(pModulesByScheme.values());
+            // Chain onRequest calls through all modules in order
+            let transformedArgs = requestArgs;
+            for (const module of pModules) {
+                const transformed = await module.onRequest({
+                    method: 'internalizeAction',
+                    args: transformedArgs,
+                    originator: originator
                 });
-                if (out.insertionRemittance.customInstructions) {
-                    requestArgs.outputs[outIndex].insertionRemittance.customInstructions = await this.maybeEncryptMetadata(out.insertionRemittance.customInstructions);
+                transformedArgs = transformed.args;
+            }
+            // Encrypt custom instructions for p basket outputs
+            for (const outIndex in transformedArgs.outputs) {
+                const out = transformedArgs.outputs[outIndex];
+                if (out.protocol === 'basket insertion' && ((_a = out.insertionRemittance) === null || _a === void 0 ? void 0 : _a.customInstructions)) {
+                    out.insertionRemittance.customInstructions = await this.maybeEncryptMetadata(out.insertionRemittance.customInstructions);
                 }
             }
+            // Call underlying wallet with transformed args
+            let results = await this.underlying.internalizeAction(transformedArgs, originator);
+            // Chain onResponse calls in reverse order
+            for (let i = pModules.length - 1; i >= 0; i--) {
+                results = await pModules[i].onResponse(results, {
+                    method: 'internalizeAction',
+                    originator: originator
+                });
+            }
+            return results;
         }
+        // No P-modules - call underlying wallet directly
         return this.underlying.internalizeAction(...args);
     }
     async listOutputs(...args) {
@@ -2358,80 +3232,17 @@ class WalletPermissionsManager {
         return this.underlying.isAuthenticated(...args);
     }
     async waitForAuthentication(...args) {
-        var _a, _b, _c, _d, _e, _f, _g;
         let [_, originator] = args;
         if (this.config.seekGroupedPermission && originator) {
             const { normalized: normalizedOriginator } = this.prepareOriginator(originator);
             originator = normalizedOriginator;
             // 1. Fetch manifest.json from the originator
-            let groupPermissions;
-            try {
-                const proto = originator.startsWith('localhost:') ? 'http' : 'https';
-                const response = await fetch(`${proto}://${originator}/manifest.json`);
-                if (response.ok) {
-                    const manifest = await response.json();
-                    if ((_a = manifest === null || manifest === void 0 ? void 0 : manifest.babbage) === null || _a === void 0 ? void 0 : _a.groupPermissions) {
-                        groupPermissions = manifest.babbage.groupPermissions;
-                    }
-                }
-            }
-            catch (e) {
-                // Ignore fetch/parse errors, just proceed without group permissions.
-            }
+            const groupPermissions = await this.fetchManifestGroupPermissions(originator);
             if (groupPermissions) {
                 // 2. Filter out already-granted permissions
-                const permissionsToRequest = {
-                    protocolPermissions: [],
-                    basketAccess: [],
-                    certificateAccess: []
-                };
-                if (groupPermissions.spendingAuthorization) {
-                    const hasAuth = await this.hasSpendingAuthorization({
-                        originator,
-                        satoshis: groupPermissions.spendingAuthorization.amount
-                    });
-                    if (!hasAuth) {
-                        permissionsToRequest.spendingAuthorization = groupPermissions.spendingAuthorization;
-                    }
-                }
-                for (const p of groupPermissions.protocolPermissions || []) {
-                    const hasPerm = await this.hasProtocolPermission({
-                        originator,
-                        privileged: false, // Privilege is never allowed here
-                        protocolID: p.protocolID,
-                        counterparty: p.counterparty || 'self'
-                    });
-                    if (!hasPerm) {
-                        permissionsToRequest.protocolPermissions.push(p);
-                    }
-                }
-                for (const b of groupPermissions.basketAccess || []) {
-                    const hasAccess = await this.hasBasketAccess({
-                        originator,
-                        basket: b.basket
-                    });
-                    if (!hasAccess) {
-                        permissionsToRequest.basketAccess.push(b);
-                    }
-                }
-                for (const c of groupPermissions.certificateAccess || []) {
-                    const hasAccess = await this.hasCertificateAccess({
-                        originator,
-                        privileged: false, // Privilege is never allowed here for security
-                        verifier: c.verifierPublicKey,
-                        certType: c.type,
-                        fields: c.fields
-                    });
-                    if (!hasAccess) {
-                        permissionsToRequest.certificateAccess.push(c);
-                    }
-                }
+                const permissionsToRequest = await this.filterAlreadyGrantedPermissions(originator, groupPermissions);
                 // 3. If any permissions are left to request, start the flow
-                const hasRequests = permissionsToRequest.spendingAuthorization ||
-                    ((_c = (_b = permissionsToRequest.protocolPermissions) === null || _b === void 0 ? void 0 : _b.length) !== null && _c !== void 0 ? _c : 0) > 0 ||
-                    ((_e = (_d = permissionsToRequest.basketAccess) === null || _d === void 0 ? void 0 : _d.length) !== null && _e !== void 0 ? _e : 0) > 0 ||
-                    ((_g = (_f = permissionsToRequest.certificateAccess) === null || _f === void 0 ? void 0 : _f.length) !== null && _g !== void 0 ? _g : 0) > 0;
-                if (hasRequests) {
+                if (this.hasAnyPermissionsToRequest(permissionsToRequest)) {
                     const key = `group:${originator}`;
                     if (this.activeRequests.has(key)) {
                         // Another call is already waiting, piggyback on it
@@ -2503,6 +3314,7 @@ class WalletPermissionsManager {
      * Checks if the given label is admin-reserved per BRC-100 rules:
      *
      *  - Must not start with `admin` (admin-reserved)
+     *  - Must not start with `p ` (permissioned labels requiring a permission module)
      *
      * If it violates these rules and the caller is not admin, we consider it "admin-only."
      */
@@ -2510,6 +3322,9 @@ class WalletPermissionsManager {
         if (label.startsWith('admin')) {
             return true;
         }
+        if (label.startsWith('p ')) {
+            return true;
+        }
         return false;
     }
     /**
@@ -2598,6 +3413,21 @@ class WalletPermissionsManager {
             return trimmed.toLowerCase();
         }
     }
+    isWhitelistedCounterpartyProtocol(counterparty, protocolID) {
+        var _a;
+        const whitelist = this.config.whitelistedCounterparties;
+        if (!whitelist)
+            return false;
+        if (!counterparty || counterparty === 'self' || counterparty === 'anyone')
+            return false;
+        const protocols = whitelist[counterparty] || whitelist[counterparty.toLowerCase()] || whitelist[counterparty.toUpperCase()];
+        if (!protocols || protocols.length === 0)
+            return false;
+        const protoName = ((_a = protocolID === null || protocolID === void 0 ? void 0 : protocolID[1]) !== null && _a !== void 0 ? _a : '').toString().toLowerCase();
+        if (!protoName)
+            return false;
+        return protocols.some(p => (p !== null && p !== void 0 ? p : '').toString().toLowerCase() === protoName);
+    }
     /**
      * Produces a normalized originator value along with the set of legacy
      * representations that should be considered when searching for existing
@@ -2646,6 +3476,7 @@ class WalletPermissionsManager {
     }
 }
 exports.WalletPermissionsManager = WalletPermissionsManager;
+WalletPermissionsManager.MANIFEST_CACHE_TTL_MS = 5 * 60 * 1000;
 /** How long a cached permission remains valid (5 minutes). */
 WalletPermissionsManager.CACHE_TTL_MS = 5 * 60 * 1000;
 /** Window during which freshly granted permissions are auto-allowed (except spending). */