@bsv/wallet-toolbox-client 2.0.5-beta.1 → 2.0.6

package/out/src/WalletPermissionsManager.js

@@ -96,6 +96,7 @@ class WalletPermissionsManager {
         this.recentGrants = new Map();
         this.manifestCache = new Map();
         this.manifestFetchInProgress = new Map();
+        this.groupedPermissionFlowTail = new Map();
         this.pactEstablishedCache = new Map();
         this.underlying = underlyingWallet;
         this.adminOriginator = this.normalizeOriginator(adminOriginator) || adminOriginator;
@@ -670,6 +671,7 @@ class WalletPermissionsManager {
                     privileged,
                     protocolID,
                     counterparty,
+                    usageType,
                     reason,
                     renewal: true,
                     previousToken: token
@@ -687,6 +689,7 @@ class WalletPermissionsManager {
                 privileged,
                 protocolID,
                 counterparty,
+                usageType,
                 reason,
                 renewal: false
             });
@@ -732,6 +735,7 @@ class WalletPermissionsManager {
                     type: 'basket',
                     originator,
                     basket,
+                    usageType,
                     reason,
                     renewal: true,
                     previousToken: token
@@ -747,6 +751,7 @@ class WalletPermissionsManager {
                 type: 'basket',
                 originator,
                 basket,
+                usageType,
                 reason,
                 renewal: false
             });
@@ -796,6 +801,7 @@ class WalletPermissionsManager {
                     originator,
                     privileged,
                     certificate: { verifier, certType, fields },
+                    usageType,
                     reason,
                     renewal: true,
                     previousToken: token
@@ -811,6 +817,7 @@ class WalletPermissionsManager {
                 originator,
                 privileged,
                 certificate: { verifier, certType, fields },
+                usageType,
                 reason,
                 renewal: false
             });
@@ -977,47 +984,58 @@ class WalletPermissionsManager {
             basketAccess: [],
             certificateAccess: []
         };
-        if (groupPermissions.spendingAuthorization) {
-            const hasAuth = await this.hasSpendingAuthorization({
-                originator,
-                satoshis: groupPermissions.spendingAuthorization.amount
-            });
-            if (!hasAuth) {
-                permissionsToRequest.spendingAuthorization = groupPermissions.spendingAuthorization;
-            }
-        }
-        for (const p of groupPermissions.protocolPermissions || []) {
-            const hasPerm = await this.hasProtocolPermission({
-                originator,
-                privileged: false,
-                protocolID: p.protocolID,
-                counterparty: p.counterparty || 'self'
-            });
-            if (!hasPerm) {
-                permissionsToRequest.protocolPermissions.push(p);
-            }
-        }
-        for (const b of groupPermissions.basketAccess || []) {
-            const hasAccess = await this.hasBasketAccess({
-                originator,
-                basket: b.basket
-            });
-            if (!hasAccess) {
-                permissionsToRequest.basketAccess.push(b);
-            }
-        }
-        for (const c of groupPermissions.certificateAccess || []) {
-            const hasAccess = await this.hasCertificateAccess({
-                originator,
-                privileged: false,
-                verifier: c.verifierPublicKey,
-                certType: c.type,
-                fields: c.fields
-            });
-            if (!hasAccess) {
-                permissionsToRequest.certificateAccess.push(c);
-            }
-        }
+        const [spendingAuthorization, protocolPermissions, basketAccess, certificateAccess] = await Promise.all([
+            (async () => {
+                if (!groupPermissions.spendingAuthorization)
+                    return undefined;
+                const hasAuth = await this.hasSpendingAuthorization({
+                    originator,
+                    satoshis: groupPermissions.spendingAuthorization.amount
+                });
+                return hasAuth ? undefined : groupPermissions.spendingAuthorization;
+            })(),
+            (async () => {
+                const protocolChecks = await Promise.all((groupPermissions.protocolPermissions || []).map(async (p) => {
+                    const hasPerm = await this.hasProtocolPermission({
+                        originator,
+                        privileged: false,
+                        protocolID: p.protocolID,
+                        counterparty: p.counterparty || 'self'
+                    });
+                    return hasPerm ? null : p;
+                }));
+                return protocolChecks.filter(Boolean);
+            })(),
+            (async () => {
+                const basketChecks = await Promise.all((groupPermissions.basketAccess || []).map(async (b) => {
+                    const hasAccess = await this.hasBasketAccess({
+                        originator,
+                        basket: b.basket
+                    });
+                    return hasAccess ? null : b;
+                }));
+                return basketChecks.filter(Boolean);
+            })(),
+            (async () => {
+                const certChecks = await Promise.all((groupPermissions.certificateAccess || []).map(async (c) => {
+                    const hasAccess = await this.hasCertificateAccess({
+                        originator,
+                        privileged: false,
+                        verifier: c.verifierPublicKey,
+                        certType: c.type,
+                        fields: c.fields
+                    });
+                    return hasAccess ? null : c;
+                }));
+                return certChecks.filter(Boolean);
+            })()
+        ]);
+        if (spendingAuthorization) {
+            permissionsToRequest.spendingAuthorization = spendingAuthorization;
+        }
+        permissionsToRequest.protocolPermissions = protocolPermissions;
+        permissionsToRequest.basketAccess = basketAccess;
+        permissionsToRequest.certificateAccess = certificateAccess;
         return permissionsToRequest;
     }
     hasAnyPermissionsToRequest(permissions) {
@@ -1098,18 +1116,16 @@ class WalletPermissionsManager {
         if (!((_a = counterpartyPermissions === null || counterpartyPermissions === void 0 ? void 0 : counterpartyPermissions.protocols) === null || _a === void 0 ? void 0 : _a.length)) {
             return null;
         }
-        const protocolsToRequest = [];
-        for (const p of counterpartyPermissions.protocols) {
+        const protocolChecks = await Promise.all(counterpartyPermissions.protocols.map(async (p) => {
             const hasPerm = await this.hasProtocolPermission({
                 originator,
                 privileged: false,
                 protocolID: p.protocolID,
                 counterparty
             });
-            if (!hasPerm) {
-                protocolsToRequest.push(p);
-            }
-        }
+            return hasPerm ? null : p;
+        }));
+        const protocolsToRequest = protocolChecks.filter(Boolean);
         if (protocolsToRequest.length === 0) {
             this.markPactEstablished(originator, counterparty);
             return null;
@@ -1201,21 +1217,22 @@ class WalletPermissionsManager {
         const permissionsToRequest = {
             protocolPermissions: []
         };
-        for (const p of manifestLevel2ForThisPeer) {
+        const protocolChecks = await Promise.all(manifestLevel2ForThisPeer.map(async (p) => {
             const hasPerm = await this.hasProtocolPermission({
                 originator,
                 privileged,
                 protocolID: p.protocolID,
                 counterparty: p.counterparty
             });
-            if (!hasPerm) {
-                permissionsToRequest.protocolPermissions.push({
+            return hasPerm
+                ? null
+                : {
                     protocolID: p.protocolID,
                     counterparty: p.counterparty,
                     description: p.description
-                });
-            }
-        }
+                };
+        }));
+        permissionsToRequest.protocolPermissions = protocolChecks.filter(Boolean);
         if (!this.hasAnyPermissionsToRequest(permissionsToRequest)) {
             return null;
         }
@@ -1256,6 +1273,28 @@ class WalletPermissionsManager {
         const satisfied = await this.checkSpecificPermissionAfterGroupFlow(currentRequest);
         return satisfied ? true : null;
     }
+    async withGroupedPermissionFlowLock(originator, fn) {
+        const priorTail = this.groupedPermissionFlowTail.get(originator) || Promise.resolve();
+        const safePriorTail = priorTail.catch(() => { });
+        let release;
+        const gate = new Promise(resolve => {
+            release = resolve;
+        });
+        const currentTail = safePriorTail.then(() => gate);
+        this.groupedPermissionFlowTail.set(originator, currentTail);
+        await safePriorTail;
+        try {
+            return await fn();
+        }
+        finally {
+            release === null || release === void 0 ? void 0 : release();
+            currentTail.finally(() => {
+                if (this.groupedPermissionFlowTail.get(originator) === currentTail) {
+                    this.groupedPermissionFlowTail.delete(originator);
+                }
+            });
+        }
+    }
     async checkSpecificPermissionAfterGroupFlow(request) {
         var _a, _b, _c;
         switch (request.type) {
@@ -1390,6 +1429,14 @@ class WalletPermissionsManager {
             originator: normalizedOriginator,
             displayOriginator: (_c = (_a = r.displayOriginator) !== null && _a !== void 0 ? _a : (_b = r.previousToken) === null || _b === void 0 ? void 0 : _b.rawOriginator) !== null && _c !== void 0 ? _c : r.originator
         };
+        const key = this.buildActiveRequestKey(preparedRequest);
+        // If there's already a queue for the same resource, we piggyback on it
+        const existingQueue = this.activeRequests.get(key);
+        if (existingQueue && existingQueue.pending.length > 0) {
+            return new Promise((resolve, reject) => {
+                existingQueue.pending.push({ resolve, reject });
+            });
+        }
         const pactResult = await this.maybeRequestPact(preparedRequest);
         if (pactResult !== null) {
             return pactResult;
@@ -1398,51 +1445,73 @@ class WalletPermissionsManager {
         if (peerGroupResult !== null) {
             return peerGroupResult;
         }
-        const groupResult = await this.maybeRequestGroupedPermissions(preparedRequest);
+        const hadPendingGroupedFlowBefore = this.config.seekGroupedPermission && this.groupedPermissionFlowTail.has(preparedRequest.originator);
+        let groupResult = null;
+        if (this.config.seekGroupedPermission) {
+            groupResult = await this.withGroupedPermissionFlowLock(preparedRequest.originator, async () => {
+                return await this.maybeRequestGroupedPermissions(preparedRequest);
+            });
+        }
+        else {
+            groupResult = await this.maybeRequestGroupedPermissions(preparedRequest);
+        }
         if (groupResult !== null) {
             return groupResult;
         }
-        const key = this.buildRequestKey(preparedRequest);
-        // If there's already a queue for the same resource, we piggyback on it
-        const existingQueue = this.activeRequests.get(key);
-        if (existingQueue && existingQueue.pending.length > 0) {
+        if (this.config.seekGroupedPermission && hadPendingGroupedFlowBefore) {
+            const satisfiedAfterGroup = await this.checkSpecificPermissionAfterGroupFlow(preparedRequest);
+            if (satisfiedAfterGroup) {
+                return true;
+            }
+        }
+        const existingQueueAfterGroups = this.activeRequests.get(key);
+        if (existingQueueAfterGroups && existingQueueAfterGroups.pending.length > 0) {
             return new Promise((resolve, reject) => {
-                existingQueue.pending.push({ resolve, reject });
+                existingQueueAfterGroups.pending.push({ resolve, reject });
             });
         }
-        // Otherwise, create a new queue with a single entry
-        // Return a promise that resolves or rejects once the user grants/denies
         return new Promise(async (resolve, reject) => {
             this.activeRequests.set(key, {
                 request: preparedRequest,
                 pending: [{ resolve, reject }]
             });
-            // Fire the relevant onXXXRequested event (which one depends on r.type)
-            switch (preparedRequest.type) {
-                case 'protocol':
-                    await this.callEvent('onProtocolPermissionRequested', {
-                        ...preparedRequest,
-                        requestID: key
-                    });
-                    break;
-                case 'basket':
-                    await this.callEvent('onBasketAccessRequested', {
-                        ...preparedRequest,
-                        requestID: key
-                    });
-                    break;
-                case 'certificate':
-                    await this.callEvent('onCertificateAccessRequested', {
-                        ...preparedRequest,
-                        requestID: key
-                    });
-                    break;
-                case 'spending':
-                    await this.callEvent('onSpendingAuthorizationRequested', {
-                        ...preparedRequest,
-                        requestID: key
-                    });
-                    break;
+            try {
+                // Fire the relevant onXXXRequested event (which one depends on r.type)
+                switch (preparedRequest.type) {
+                    case 'protocol':
+                        await this.callEvent('onProtocolPermissionRequested', {
+                            ...preparedRequest,
+                            requestID: key
+                        });
+                        break;
+                    case 'basket':
+                        await this.callEvent('onBasketAccessRequested', {
+                            ...preparedRequest,
+                            requestID: key
+                        });
+                        break;
+                    case 'certificate':
+                        await this.callEvent('onCertificateAccessRequested', {
+                            ...preparedRequest,
+                            requestID: key
+                        });
+                        break;
+                    case 'spending':
+                        await this.callEvent('onSpendingAuthorizationRequested', {
+                            ...preparedRequest,
+                            requestID: key
+                        });
+                        break;
+                }
+            }
+            catch (e) {
+                const matching = this.activeRequests.get(key);
+                if (matching) {
+                    for (const p of matching.pending) {
+                        p.reject(e);
+                    }
+                    this.activeRequests.delete(key);
+                }
             }
         });
     }
@@ -2510,6 +2579,137 @@ class WalletPermissionsManager {
             return false;
         }
     }
+    async revokePermissions(oldTokens) {
+        return await this.revokePermissionTokensBestEffort(oldTokens);
+    }
+    async revokeAllForOriginator(originator, opts) {
+        const preparedOriginator = this.prepareOriginator(originator);
+        const include = {
+            protocol: true,
+            basket: true,
+            certificate: true,
+            spending: true,
+            ...(opts || {})
+        };
+        const [protocolTokens, basketTokens, certificateTokens, spendingTokens] = await Promise.all([
+            include.protocol ? this.listProtocolPermissions({ originator }) : Promise.resolve([]),
+            include.basket ? this.listBasketAccess({ originator }) : Promise.resolve([]),
+            include.certificate ? this.listCertificateAccess({ originator }) : Promise.resolve([]),
+            include.spending
+                ? this.listSpendingAuthorizations({ originator: preparedOriginator.normalized })
+                : Promise.resolve([])
+        ]);
+        const spendingTokenList = spendingTokens.length ? [spendingTokens[0]] : [];
+        const allTokens = [...protocolTokens, ...basketTokens, ...certificateTokens, ...spendingTokenList];
+        const seen = new Set();
+        const deduped = allTokens.filter(t => {
+            const key = `${t.txid}.${t.outputIndex}`;
+            if (seen.has(key))
+                return false;
+            seen.add(key);
+            return true;
+        });
+        return await this.revokePermissions(deduped);
+    }
+    async revokePermissionTokensBestEffort(items) {
+        const CHUNK = 15;
+        return this.runBestEffortBatches(items, CHUNK, async (chunk) => {
+            await this.revokePermissionTokensChunk(chunk);
+            return chunk;
+        });
+    }
+    async revokePermissionTokensChunk(oldTokens) {
+        if (!oldTokens.length)
+            return;
+        const inputBeef = new sdk_1.Beef();
+        for (const token of oldTokens) {
+            inputBeef.mergeBeef(sdk_1.Beef.fromBinary(token.tx));
+        }
+        const { signableTransaction } = await this.createAction({
+            description: `Revoke ${oldTokens.length} permissions`,
+            inputBEEF: inputBeef.toBinary(),
+            inputs: oldTokens.map((t, i) => ({
+                outpoint: `${t.txid}.${t.outputIndex}`,
+                unlockingScriptLength: 73,
+                inputDescription: `Consume old permission token #${i + 1}`
+            })),
+            options: {
+                acceptDelayedBroadcast: true,
+                randomizeOutputs: false,
+                signAndProcess: false
+            }
+        }, this.adminOriginator);
+        if (!(signableTransaction === null || signableTransaction === void 0 ? void 0 : signableTransaction.reference) || !signableTransaction.tx) {
+            throw new Error('Failed to create signable transaction');
+        }
+        const tx = sdk_1.Transaction.fromAtomicBEEF(signableTransaction.tx);
+        const normalizeTxid = (txid) => (txid !== null && txid !== void 0 ? txid : '').toLowerCase();
+        const reverseHexTxid = (txid) => {
+            const hex = normalizeTxid(txid);
+            if (!/^[0-9a-f]{64}$/.test(hex))
+                return hex;
+            const bytes = hex.match(/../g);
+            return bytes ? bytes.reverse().join('') : hex;
+        };
+        const matchesOutpointString = (outpoint, token) => {
+            const dot = outpoint.lastIndexOf('.');
+            const colon = outpoint.lastIndexOf(':');
+            const sep = dot > colon ? dot : colon;
+            if (sep === -1)
+                return false;
+            const txidPart = outpoint.slice(0, sep);
+            const indexPart = outpoint.slice(sep + 1);
+            const vout = Number(indexPart);
+            if (!Number.isFinite(vout))
+                return false;
+            return normalizeTxid(txidPart) === normalizeTxid(token.txid) && vout === token.outputIndex;
+        };
+        const findInputIndexForToken = (token) => {
+            return tx.inputs.findIndex((input) => {
+                var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l, _m, _o;
+                const txidCandidate = (_g = (_f = (_e = (_d = (_c = (_b = (_a = input === null || input === void 0 ? void 0 : input.sourceTXID) !== null && _a !== void 0 ? _a : input === null || input === void 0 ? void 0 : input.sourceTxid) !== null && _b !== void 0 ? _b : input === null || input === void 0 ? void 0 : input.sourceTxId) !== null && _c !== void 0 ? _c : input === null || input === void 0 ? void 0 : input.prevTxId) !== null && _d !== void 0 ? _d : input === null || input === void 0 ? void 0 : input.prevTxid) !== null && _e !== void 0 ? _e : input === null || input === void 0 ? void 0 : input.prevTXID) !== null && _f !== void 0 ? _f : input === null || input === void 0 ? void 0 : input.txid) !== null && _g !== void 0 ? _g : input === null || input === void 0 ? void 0 : input.txID;
+                const voutCandidate = (_l = (_k = (_j = (_h = input === null || input === void 0 ? void 0 : input.sourceOutputIndex) !== null && _h !== void 0 ? _h : input === null || input === void 0 ? void 0 : input.sourceOutput) !== null && _j !== void 0 ? _j : input === null || input === void 0 ? void 0 : input.outputIndex) !== null && _k !== void 0 ? _k : input === null || input === void 0 ? void 0 : input.vout) !== null && _l !== void 0 ? _l : input === null || input === void 0 ? void 0 : input.prevOutIndex;
+                if (typeof txidCandidate === 'string' && typeof voutCandidate === 'number') {
+                    const cand = normalizeTxid(txidCandidate);
+                    const target = normalizeTxid(token.txid);
+                    if (cand === target && voutCandidate === token.outputIndex)
+                        return true;
+                    if (cand === reverseHexTxid(token.txid) && voutCandidate === token.outputIndex)
+                        return true;
+                }
+                const outpointCandidate = (_o = (_m = input === null || input === void 0 ? void 0 : input.outpoint) !== null && _m !== void 0 ? _m : input === null || input === void 0 ? void 0 : input.sourceOutpoint) !== null && _o !== void 0 ? _o : input === null || input === void 0 ? void 0 : input.prevOutpoint;
+                if (typeof outpointCandidate === 'string' && matchesOutpointString(outpointCandidate, token))
+                    return true;
+                return false;
+            });
+        };
+        const inputsToSign = oldTokens.map(token => {
+            let permInputIndex = findInputIndexForToken(token);
+            if (permInputIndex === -1 && tx.inputs.length === 1) {
+                permInputIndex = 0;
+            }
+            if (permInputIndex === -1) {
+                throw new Error('Unable to locate permission token input for revocation.');
+            }
+            return { token, permInputIndex };
+        });
+        const pushdrop = new sdk_1.PushDrop(this.underlying);
+        const spends = {};
+        const signed = await this.mapWithConcurrency(inputsToSign, 8, async ({ token, permInputIndex }) => {
+            const unlocker = pushdrop.unlock(WalletPermissionsManager.PERM_TOKEN_ENCRYPTION_PROTOCOL, '1', 'self', 'all', false, 1, sdk_1.LockingScript.fromHex(token.outputScript));
+            const unlockingScript = await unlocker.sign(tx, permInputIndex);
+            return { permInputIndex, unlockingScriptHex: unlockingScript.toHex() };
+        });
+        for (const s of signed) {
+            spends[s.permInputIndex] = { unlockingScript: s.unlockingScriptHex };
+        }
+        const { txid } = await this.underlying.signAction({
+            reference: signableTransaction.reference,
+            spends
+        });
+        if (!txid)
+            throw new Error('Failed to finalize revoke transaction');
+    }
     /**
      * Revokes a permission token by spending it with no replacement output.
      * The manager builds a BRC-100 transaction that consumes the token, effectively invalidating it.
@@ -2644,22 +2844,28 @@ class WalletPermissionsManager {
         const originalDescription = args.description;
         const originalInputDescriptions = {};
         const originalOutputDescriptions = {};
-        args.description = await this.maybeEncryptMetadata(args.description);
-        for (let i = 0; i < (args.inputs || []).length; i++) {
-            if (args.inputs[i].inputDescription) {
-                originalInputDescriptions[i] = args.inputs[i].inputDescription;
-                args.inputs[i].inputDescription = await this.maybeEncryptMetadata(args.inputs[i].inputDescription);
-            }
-        }
-        for (let i = 0; i < (args.outputs || []).length; i++) {
-            if (args.outputs[i].outputDescription) {
-                originalOutputDescriptions[i] = args.outputs[i].outputDescription;
-                args.outputs[i].outputDescription = await this.maybeEncryptMetadata(args.outputs[i].outputDescription);
+        const inputEncryptionTasks = (args.inputs || []).map(async (input, i) => {
+            if (!input.inputDescription)
+                return;
+            originalInputDescriptions[i] = input.inputDescription;
+            input.inputDescription = await this.maybeEncryptMetadata(input.inputDescription);
+        });
+        const outputEncryptionTasks = (args.outputs || []).map(async (output, i) => {
+            if (output.outputDescription) {
+                originalOutputDescriptions[i] = output.outputDescription;
+                output.outputDescription = await this.maybeEncryptMetadata(output.outputDescription);
             }
-            if (args.outputs[i].customInstructions) {
-                args.outputs[i].customInstructions = await this.maybeEncryptMetadata(args.outputs[i].customInstructions);
+            if (output.customInstructions) {
+                output.customInstructions = await this.maybeEncryptMetadata(output.customInstructions);
             }
-        }
+        });
+        await Promise.all([
+            (async () => {
+                args.description = await this.maybeEncryptMetadata(args.description);
+            })(),
+            ...inputEncryptionTasks,
+            ...outputEncryptionTasks
+        ]);
         /**
          * 6) Call the underlying wallet's createAction.
          *    - If P-modules are involved, chain request transformations through them first
@@ -3235,43 +3441,45 @@ class WalletPermissionsManager {
         let [_, originator] = args;
         if (this.config.seekGroupedPermission && originator) {
             const { normalized: normalizedOriginator } = this.prepareOriginator(originator);
-            originator = normalizedOriginator;
-            // 1. Fetch manifest.json from the originator
-            const groupPermissions = await this.fetchManifestGroupPermissions(originator);
-            if (groupPermissions) {
-                // 2. Filter out already-granted permissions
-                const permissionsToRequest = await this.filterAlreadyGrantedPermissions(originator, groupPermissions);
-                // 3. If any permissions are left to request, start the flow
-                if (this.hasAnyPermissionsToRequest(permissionsToRequest)) {
-                    const key = `group:${originator}`;
-                    if (this.activeRequests.has(key)) {
-                        // Another call is already waiting, piggyback on it
-                        await new Promise((resolve, reject) => {
-                            this.activeRequests.get(key).pending.push({ resolve, reject });
-                        });
-                    }
-                    else {
-                        // This is the first call, create a new request
-                        try {
-                            await new Promise(async (resolve, reject) => {
-                                this.activeRequests.set(key, {
-                                    request: { originator: originator, permissions: permissionsToRequest },
-                                    pending: [{ resolve, reject }]
-                                });
-                                await this.callEvent('onGroupedPermissionRequested', {
-                                    requestID: key,
-                                    originator,
-                                    permissions: permissionsToRequest
-                                });
+            const normalized = normalizedOriginator;
+            await this.withGroupedPermissionFlowLock(normalized, async () => {
+                // 1. Fetch manifest.json from the originator
+                const groupPermissions = await this.fetchManifestGroupPermissions(normalized);
+                if (groupPermissions) {
+                    // 2. Filter out already-granted permissions
+                    const permissionsToRequest = await this.filterAlreadyGrantedPermissions(normalized, groupPermissions);
+                    // 3. If any permissions are left to request, start the flow
+                    if (this.hasAnyPermissionsToRequest(permissionsToRequest)) {
+                        const key = `group:${normalized}`;
+                        if (this.activeRequests.has(key)) {
+                            // Another call is already waiting, piggyback on it
+                            await new Promise((resolve, reject) => {
+                                this.activeRequests.get(key).pending.push({ resolve, reject });
                             });
                         }
-                        catch (e) {
-                            // Permission was denied, re-throw to stop execution
-                            throw e;
+                        else {
+                            // This is the first call, create a new request
+                            try {
+                                await new Promise(async (resolve, reject) => {
+                                    this.activeRequests.set(key, {
+                                        request: { originator: normalized, permissions: permissionsToRequest },
+                                        pending: [{ resolve, reject }]
+                                    });
+                                    await this.callEvent('onGroupedPermissionRequested', {
+                                        requestID: key,
+                                        originator: normalized,
+                                        permissions: permissionsToRequest
+                                    });
+                                });
+                            }
+                            catch (e) {
+                                // Permission was denied, re-throw to stop execution
+                                throw e;
+                            }
                         }
                     }
                 }
-            }
+            });
         }
         // Finally, after handling grouped permissions, call the underlying method.
         return this.underlying.waitForAuthentication(...args);
@@ -3474,6 +3682,14 @@ class WalletPermissionsManager {
                 return `spend:${normalizedOriginator}:${(_e = r.spending) === null || _e === void 0 ? void 0 : _e.satoshis}`;
         }
     }
+    buildActiveRequestKey(r) {
+        var _a;
+        const base = this.buildRequestKey(r);
+        if (r.type === 'protocol' || r.type === 'basket' || r.type === 'certificate') {
+            return `${base}:${(_a = r.usageType) !== null && _a !== void 0 ? _a : ''}`;
+        }
+        return base;
+    }
 }
 exports.WalletPermissionsManager = WalletPermissionsManager;
 WalletPermissionsManager.MANIFEST_CACHE_TTL_MS = 5 * 60 * 1000;