@bsv/wallet-toolbox 2.1.28 → 2.2.0

package/out/src/WalletPermissionsManager.js

@@ -61,6 +61,54 @@ const BASKET_MAP = {
  *    the old token UTXO and outputs a new one (or none, if fully revoked).
  */
 class WalletPermissionsManager {
+    /** A reference to the BRC-100 wallet instance. */
+    underlying;
+    /** The "admin" domain or FQDN that is implicitly allowed to do everything. */
+    adminOriginator;
+    /**
+     * Event callbacks that external code can subscribe to, e.g. to show a UI prompt
+     * or log events. Each event can have multiple handlers.
+     */
+    callbacks = {
+        onProtocolPermissionRequested: [],
+        onBasketAccessRequested: [],
+        onCertificateAccessRequested: [],
+        onSpendingAuthorizationRequested: [],
+        onGroupedPermissionRequested: [],
+        onCounterpartyPermissionRequested: []
+    };
+    /**
+     * We queue parallel requests for the same resource so that only one
+     * user prompt is created for a single resource. If multiple calls come
+     * in at once for the same "protocol:domain:privileged:counterparty" etc.,
+     * they get merged.
+     *
+     * The key is a string derived from the operation; the value is an object with a reference to the
+     * associated request and an array of pending promise resolve/reject pairs, one for each active
+     * operation that's waiting on the particular resource described by the key.
+     */
+    activeRequests = new Map();
+    /** Cache recently confirmed permissions to avoid repeated lookups. */
+    permissionCache = new Map();
+    recentGrants = new Map();
+    manifestCache = new Map();
+    manifestFetchInProgress = new Map();
+    static MANIFEST_CACHE_TTL_MS = 5 * 60 * 1000;
+    groupedPermissionFlowTail = new Map();
+    pactEstablishedCache = new Map();
+    /** How long a cached permission remains valid (5 minutes). */
+    static CACHE_TTL_MS = 5 * 60 * 1000;
+    /** Window during which freshly granted permissions are auto-allowed (except spending). */
+    static RECENT_GRANT_COVER_MS = 15 * 1000;
+    /** Default ports used when normalizing originator values. */
+    static DEFAULT_PORTS = {
+        'http:': '80',
+        'https:': '443'
+    };
+    /**
+     * Configuration that determines whether to skip or apply various checks and encryption.
+     */
+    config;
     /**
      * Constructs a new Permissions Manager instance.
      *
@@ -69,36 +117,6 @@ class WalletPermissionsManager {
      * @param config                     A set of boolean flags controlling how strictly permissions are enforced
      */
     constructor(underlyingWallet, adminOriginator, config = {}) {
-        /**
-         * Event callbacks that external code can subscribe to, e.g. to show a UI prompt
-         * or log events. Each event can have multiple handlers.
-         */
-        this.callbacks = {
-            onProtocolPermissionRequested: [],
-            onBasketAccessRequested: [],
-            onCertificateAccessRequested: [],
-            onSpendingAuthorizationRequested: [],
-            onGroupedPermissionRequested: [],
-            onCounterpartyPermissionRequested: []
-        };
-        /**
-         * We queue parallel requests for the same resource so that only one
-         * user prompt is created for a single resource. If multiple calls come
-         * in at once for the same "protocol:domain:privileged:counterparty" etc.,
-         * they get merged.
-         *
-         * The key is a string derived from the operation; the value is an object with a reference to the
-         * associated request and an array of pending promise resolve/reject pairs, one for each active
-         * operation that's waiting on the particular resource described by the key.
-         */
-        this.activeRequests = new Map();
-        /** Cache recently confirmed permissions to avoid repeated lookups. */
-        this.permissionCache = new Map();
-        this.recentGrants = new Map();
-        this.manifestCache = new Map();
-        this.manifestFetchInProgress = new Map();
-        this.groupedPermissionFlowTail = new Map();
-        this.pactEstablishedCache = new Map();
         this.underlying = underlyingWallet;
         this.adminOriginator = this.normalizeOriginator(adminOriginator) || adminOriginator;
         // Default all config options to true unless specified
@@ -142,13 +160,12 @@ class WalletPermissionsManager {
      * @returns The transformed response, or null if not a P-basket/protocol (caller should continue normal flow)
      */
     async delegateToPModuleIfNeeded(basketOrProtocolName, method, args, originator, underlyingCall) {
-        var _a;
         // Check if this is a P-protocol/basket
         if (!basketOrProtocolName.startsWith('p ')) {
             return null; // If not, caller should continue normal flow
         }
         const schemeID = basketOrProtocolName.split(' ')[1];
-        const module = (_a = this.config.permissionModules) === null || _a === void 0 ? void 0 : _a[schemeID];
+        const module = this.config.permissionModules?.[schemeID];
         if (module == null) {
             throw new Error(`Unsupported P-module scheme: p ${schemeID}`);
         }
@@ -170,10 +187,9 @@ class WalletPermissionsManager {
      * Adds a permission module for the given schemeID if needed, throwing if unsupported.
      */
     addPModuleByScheme(schemeID, kind, pModulesByScheme) {
-        var _a;
         if (pModulesByScheme.has(schemeID))
             return;
-        const module = (_a = this.config.permissionModules) === null || _a === void 0 ? void 0 : _a[schemeID];
+        const module = this.config.permissionModules?.[schemeID];
         if (module == null) {
             throw new Error(`Unsupported P-${kind} scheme: p ${schemeID}`);
         }
@@ -439,8 +455,7 @@ class WalletPermissionsManager {
             }
             const grantedProtocols = params.granted.protocolPermissions || [];
             const protocolTokens = await this.mapWithConcurrency(grantedProtocols, 8, async (p) => {
-                var _a, _b;
-                const counterparty = ((_b = (_a = p.protocolID) === null || _a === void 0 ? void 0 : _a[0]) !== null && _b !== void 0 ? _b : 0) === 1 ? '' : p.counterparty || 'self';
+                const counterparty = (p.protocolID?.[0] ?? 0) === 1 ? '' : p.counterparty || 'self';
                 const token = await this.findProtocolToken(originator, false, p.protocolID, counterparty, true, originLookupValues);
                 return { p, token, counterparty };
             });
@@ -513,17 +528,16 @@ class WalletPermissionsManager {
      * Throws an error on the first mismatch.
      */
     validateGrantedPermissionsSubset(granted, requested) {
-        var _a, _b, _c;
         if ((granted.spendingAuthorization != null) && (requested.spendingAuthorization == null)) {
             throw new Error('Granted spending authorization was not part of the original request.');
         }
-        if ((_a = granted.protocolPermissions) === null || _a === void 0 ? void 0 : _a.some(g => { var _a; return ((_a = requested.protocolPermissions) === null || _a === void 0 ? void 0 : _a.find(r => deepEqual(r, g))) == null; })) {
+        if (granted.protocolPermissions?.some(g => (requested.protocolPermissions?.find(r => deepEqual(r, g))) == null)) {
             throw new Error('Granted protocol permissions are not a subset of the original request.');
         }
-        if ((_b = granted.basketAccess) === null || _b === void 0 ? void 0 : _b.some(g => { var _a; return ((_a = requested.basketAccess) === null || _a === void 0 ? void 0 : _a.find(r => deepEqual(r, g))) == null; })) {
+        if (granted.basketAccess?.some(g => (requested.basketAccess?.find(r => deepEqual(r, g))) == null)) {
             throw new Error('Granted basket access permissions are not a subset of the original request.');
         }
-        if ((_c = granted.certificateAccess) === null || _c === void 0 ? void 0 : _c.some(g => { var _a; return ((_a = requested.certificateAccess) === null || _a === void 0 ? void 0 : _a.find(r => deepEqual(r, g))) == null; })) {
+        if (granted.certificateAccess?.some(g => (requested.certificateAccess?.find(r => deepEqual(r, g))) == null)) {
             throw new Error('Granted certificate access permissions are not a subset of the original request.');
         }
     }
@@ -553,7 +567,6 @@ class WalletPermissionsManager {
         this.activeRequests.delete(requestID);
     }
     async grantCounterpartyPermission(params) {
-        var _a;
         const matching = this.activeRequests.get(params.requestID);
         if (matching == null) {
             throw new Error('Request ID not found.');
@@ -570,7 +583,7 @@ class WalletPermissionsManager {
                 return p.protocolID[1];
             return undefined;
         };
-        if ((_a = params.granted.protocols) === null || _a === void 0 ? void 0 : _a.some(g => {
+        if (params.granted.protocols?.some(g => {
             const gName = getProtoName(g);
             if (!gName)
                 return true;
@@ -798,7 +811,7 @@ class WalletPermissionsManager {
             return true;
         }
         const token = await this.findSpendingToken(originator, lookupValues);
-        if (token === null || token === void 0 ? void 0 : token.authorizedAmount) {
+        if (token?.authorizedAmount) {
             // Check how much has been spent so far
             const spentSoFar = await this.querySpentSince(token);
             if (spentSoFar + satoshis <= token.authorizedAmount) {
@@ -918,23 +931,22 @@ class WalletPermissionsManager {
         };
         const validProtocols = raw.protocols
             .map((p) => {
-            var _a, _b;
             const protocolName = getCI(p, 'protocolName');
             if (typeof protocolName === 'string') {
                 return {
                     protocolName,
                     protocolID: [2, protocolName],
-                    description: typeof (p === null || p === void 0 ? void 0 : p.description) === 'string' ? p.description : undefined
+                    description: typeof p?.description === 'string' ? p.description : undefined
                 };
             }
-            const protocolIdRaw = (_b = (_a = getCI(p, 'protocolID')) !== null && _a !== void 0 ? _a : getCI(p, 'protocolId')) !== null && _b !== void 0 ? _b : getCI(p, 'protocolid');
+            const protocolIdRaw = getCI(p, 'protocolID') ?? getCI(p, 'protocolId') ?? getCI(p, 'protocolid');
             const parsed = parseProtocolId(protocolIdRaw);
             if (!parsed)
                 return null;
             return {
                 protocolName: parsed,
                 protocolID: [2, parsed],
-                description: typeof (p === null || p === void 0 ? void 0 : p.description) === 'string' ? p.description : undefined
+                description: typeof p?.description === 'string' ? p.description : undefined
             };
         })
             .filter(Boolean);
@@ -963,9 +975,9 @@ class WalletPermissionsManager {
                 const response = await fetch(`${proto}://${originator}/manifest.json`);
                 if (response.ok) {
                     const manifest = await response.json();
-                    const namespace = (manifest === null || manifest === void 0 ? void 0 : manifest.metanet) || (manifest === null || manifest === void 0 ? void 0 : manifest.babbage);
-                    const groupPermissions = (namespace === null || namespace === void 0 ? void 0 : namespace.groupPermissions) || null;
-                    const counterpartyPermissionsDeclared = this.validateCounterpartyPermissions(namespace === null || namespace === void 0 ? void 0 : namespace.counterpartyPermissions);
+                    const namespace = manifest?.metanet || manifest?.babbage;
+                    const groupPermissions = namespace?.groupPermissions || null;
+                    const counterpartyPermissionsDeclared = this.validateCounterpartyPermissions(namespace?.counterpartyPermissions);
                     this.manifestCache.set(originator, {
                         groupPermissions,
                         counterpartyPermissions: counterpartyPermissionsDeclared,
@@ -1012,7 +1024,6 @@ class WalletPermissionsManager {
             })(),
             (async () => {
                 const protocolChecks = await Promise.all((groupPermissions.protocolPermissions || []).map(async (p) => {
-                    var _a;
                     if (p.counterparty === '')
                         return null;
                     const [level] = p.protocolID || [0];
@@ -1023,7 +1034,7 @@ class WalletPermissionsManager {
                         originator,
                         privileged: false,
                         protocolID: p.protocolID,
-                        counterparty: (_a = p.counterparty) !== null && _a !== void 0 ? _a : 'self'
+                        counterparty: p.counterparty ?? 'self'
                     });
                     return hasPerm ? null : p;
                 }));
@@ -1062,11 +1073,10 @@ class WalletPermissionsManager {
         return permissionsToRequest;
     }
     hasAnyPermissionsToRequest(permissions) {
-        var _a, _b, _c, _d, _e, _f;
         return !!(permissions.spendingAuthorization ||
-            ((_b = (_a = permissions.protocolPermissions) === null || _a === void 0 ? void 0 : _a.length) !== null && _b !== void 0 ? _b : 0) > 0 ||
-            ((_d = (_c = permissions.basketAccess) === null || _c === void 0 ? void 0 : _c.length) !== null && _d !== void 0 ? _d : 0) > 0 ||
-            ((_f = (_e = permissions.certificateAccess) === null || _e === void 0 ? void 0 : _e.length) !== null && _f !== void 0 ? _f : 0) > 0);
+            (permissions.protocolPermissions?.length ?? 0) > 0 ||
+            (permissions.basketAccess?.length ?? 0) > 0 ||
+            (permissions.certificateAccess?.length ?? 0) > 0);
     }
     hasGroupedPermissionRequestedHandlers() {
         const handlers = this.callbacks.onGroupedPermissionRequested || [];
@@ -1077,7 +1087,6 @@ class WalletPermissionsManager {
         return handlers.some(h => typeof h === 'function');
     }
     async hasPactEstablished(originator, counterparty) {
-        var _a;
         if (counterparty === 'self' || counterparty === 'anyone') {
             return true;
         }
@@ -1086,7 +1095,7 @@ class WalletPermissionsManager {
             return true;
         }
         const { counterpartyPermissions } = await this.fetchManifestPermissions(originator);
-        if (!((_a = counterpartyPermissions === null || counterpartyPermissions === void 0 ? void 0 : counterpartyPermissions.protocols) === null || _a === void 0 ? void 0 : _a.length)) {
+        if (!counterpartyPermissions?.protocols?.length) {
             return true;
         }
         const firstProtocol = counterpartyPermissions.protocols[0];
@@ -1107,7 +1116,6 @@ class WalletPermissionsManager {
         this.pactEstablishedCache.set(cacheKey, Date.now());
     }
     async maybeRequestPact(currentRequest) {
-        var _a;
         if (!this.config.seekGroupedPermission) {
             return null;
         }
@@ -1133,7 +1141,7 @@ class WalletPermissionsManager {
             return null;
         }
         const { counterpartyPermissions } = await this.fetchManifestPermissions(originator);
-        if (!((_a = counterpartyPermissions === null || counterpartyPermissions === void 0 ? void 0 : counterpartyPermissions.protocols) === null || _a === void 0 ? void 0 : _a.length)) {
+        if (!counterpartyPermissions?.protocols?.length) {
             return null;
         }
         if (!this.isProtocolInCounterpartyPermissions(currentRequest.protocolID, counterpartyPermissions)) {
@@ -1201,7 +1209,6 @@ class WalletPermissionsManager {
         }
     }
     async maybeRequestPeerGroupedLevel2ProtocolPermissions(currentRequest) {
-        var _a, _b;
         if (!this.config.seekGroupedPermission) {
             return null;
         }
@@ -1216,8 +1223,8 @@ class WalletPermissionsManager {
             return null;
         }
         const originator = currentRequest.originator;
-        const privileged = (_a = currentRequest.privileged) !== null && _a !== void 0 ? _a : false;
-        const counterparty = (_b = currentRequest.counterparty) !== null && _b !== void 0 ? _b : 'self';
+        const privileged = currentRequest.privileged ?? false;
+        const counterparty = currentRequest.counterparty ?? 'self';
         const groupPermissions = await this.fetchManifestGroupPermissions(originator);
         if (groupPermissions == null) {
             return null;
@@ -1230,7 +1237,7 @@ class WalletPermissionsManager {
             return cp;
         };
         const manifestLevel2ForThisPeer = (groupPermissions.protocolPermissions || [])
-            .filter(p => { var _a, _b; return ((_b = (_a = p.protocolID) === null || _a === void 0 ? void 0 : _a[0]) !== null && _b !== void 0 ? _b : 0) === 2; })
+            .filter(p => (p.protocolID?.[0] ?? 0) === 2)
             .map(p => ({
             protocolID: p.protocolID,
             counterparty: normalizeManifestCounterparty(p.counterparty),
@@ -1283,7 +1290,7 @@ class WalletPermissionsManager {
             return await fn();
         }
         finally {
-            release === null || release === void 0 ? void 0 : release();
+            release?.();
             currentTail.finally(() => {
                 if (this.groupedPermissionFlowTail.get(originator) === currentTail) {
                     this.groupedPermissionFlowTail.delete(originator);
@@ -1292,14 +1299,13 @@ class WalletPermissionsManager {
         }
     }
     async checkSpecificPermissionAfterGroupFlow(request) {
-        var _a, _b, _c;
         switch (request.type) {
             case 'protocol':
                 return await this.hasProtocolPermission({
                     originator: request.originator,
-                    privileged: (_a = request.privileged) !== null && _a !== void 0 ? _a : false,
+                    privileged: request.privileged ?? false,
                     protocolID: request.protocolID,
-                    counterparty: (_b = request.counterparty) !== null && _b !== void 0 ? _b : 'self'
+                    counterparty: request.counterparty ?? 'self'
                 });
             case 'basket':
                 return await this.hasBasketAccess({
@@ -1309,7 +1315,7 @@ class WalletPermissionsManager {
             case 'certificate':
                 return await this.hasCertificateAccess({
                     originator: request.originator,
-                    privileged: (_c = request.privileged) !== null && _c !== void 0 ? _c : false,
+                    privileged: request.privileged ?? false,
                     verifier: request.certificate.verifier,
                     certType: request.certificate.certType,
                     fields: request.certificate.fields
@@ -1324,7 +1330,6 @@ class WalletPermissionsManager {
         }
     }
     isRequestIncludedInGroupPermissions(request, groupPermissions) {
-        var _a, _b, _c, _d;
         switch (request.type) {
             case 'protocol': {
                 if (request.privileged)
@@ -1332,24 +1337,23 @@ class WalletPermissionsManager {
                 const pid = request.protocolID;
                 if (pid == null)
                     return false;
-                const cp = (_a = request.counterparty) !== null && _a !== void 0 ? _a : 'self';
-                return !!((_b = groupPermissions.protocolPermissions) === null || _b === void 0 ? void 0 : _b.some(p => {
-                    var _a;
+                const cp = request.counterparty ?? 'self';
+                return !!groupPermissions.protocolPermissions?.some(p => {
                     if (p.counterparty === '')
                         return false;
                     const [level] = p.protocolID || [0];
                     if (level === 2 && (p.counterparty === undefined || p.counterparty === null)) {
                         return false;
                     }
-                    const manifestCp = level === 1 ? '' : ((_a = p.counterparty) !== null && _a !== void 0 ? _a : 'self');
+                    const manifestCp = level === 1 ? '' : (p.counterparty ?? 'self');
                     return deepEqual(p.protocolID, pid) && manifestCp === cp;
-                }));
+                });
             }
             case 'basket': {
                 const basket = request.basket;
                 if (!basket)
                     return false;
-                return !!((_c = groupPermissions.basketAccess) === null || _c === void 0 ? void 0 : _c.some(b => b.basket === basket));
+                return !!groupPermissions.basketAccess?.some(b => b.basket === basket);
             }
             case 'certificate': {
                 if (request.privileged)
@@ -1357,7 +1361,7 @@ class WalletPermissionsManager {
                 const cert = request.certificate;
                 if (cert == null)
                     return false;
-                return !!((_d = groupPermissions.certificateAccess) === null || _d === void 0 ? void 0 : _d.some(c => {
+                return !!groupPermissions.certificateAccess?.some(c => {
                     const fieldsA = new Set(c.fields || []);
                     const fieldsB = new Set(cert.fields || []);
                     if (fieldsA.size !== fieldsB.size)
@@ -1366,7 +1370,7 @@ class WalletPermissionsManager {
                         if (!fieldsB.has(f))
                             return false;
                     return c.type === cert.certType && c.verifierPublicKey === cert.verifier;
-                }));
+                });
             }
             case 'spending':
                 return groupPermissions.spendingAuthorization != null;
@@ -1400,8 +1404,6 @@ class WalletPermissionsManager {
      * a new one and fires the onGroupedPermissionRequested event.
      */
     async joinOrCreateGroupedRequest(key, originator, permissionsToRequest, displayOriginator) {
-        var _a;
-        var _b;
         const existing = this.activeRequests.get(key);
         if (existing == null) {
             const permPromise = new Promise((resolve, reject) => {
@@ -1419,7 +1421,7 @@ class WalletPermissionsManager {
         }
         else {
             const existingRequest = existing.request;
-            (_a = (_b = existingRequest.permissions).protocolPermissions) !== null && _a !== void 0 ? _a : (_b.protocolPermissions = []);
+            existingRequest.permissions.protocolPermissions ??= [];
             for (const p of permissionsToRequest.protocolPermissions || []) {
                 if (!existingRequest.permissions.protocolPermissions.some(x => deepEqual(x, p))) {
                     existingRequest.permissions.protocolPermissions.push(p);
@@ -1438,14 +1440,13 @@ class WalletPermissionsManager {
      *   and return a promise that resolves once permission is granted or rejects if denied.
      */
     async requestPermissionFlow(r) {
-        var _a, _b, _c, _d;
         const normalizedOriginator = this.normalizeOriginator(r.originator) || r.originator;
         const preparedRequest = {
             ...r,
             originator: normalizedOriginator,
-            displayOriginator: (_c = (_a = r.displayOriginator) !== null && _a !== void 0 ? _a : (_b = r.previousToken) === null || _b === void 0 ? void 0 : _b.rawOriginator) !== null && _c !== void 0 ? _c : r.originator
+            displayOriginator: r.displayOriginator ?? r.previousToken?.rawOriginator ?? r.originator
         };
-        if (preparedRequest.type === 'protocol' && ((_d = preparedRequest.protocolID) === null || _d === void 0 ? void 0 : _d[0]) === 1) {
+        if (preparedRequest.type === 'protocol' && preparedRequest.protocolID?.[0] === 1) {
             preparedRequest.counterparty = '';
         }
         const key = this.buildActiveRequestKey(preparedRequest);
@@ -1520,12 +1521,11 @@ class WalletPermissionsManager {
     }
     /** Fires the appropriate onXXXRequested event based on the request type. */
     async firePermissionRequestEvent(request, key) {
-        var _a;
         switch (request.type) {
             case 'protocol':
                 await this.callEvent('onProtocolPermissionRequested', {
                     ...request,
-                    counterparty: ((_a = request.protocolID) === null || _a === void 0 ? void 0 : _a[0]) === 1 ? undefined : request.counterparty,
+                    counterparty: request.protocolID?.[0] === 1 ? undefined : request.counterparty,
                     requestID: key
                 });
                 break;
@@ -1540,6 +1540,27 @@ class WalletPermissionsManager {
                 break;
         }
     }
+    /* ---------------------------------------------------------------------
+     *  4) SEARCH / DECODE / DECRYPT ON-CHAIN TOKENS (PushDrop Scripts)
+     * --------------------------------------------------------------------- */
+    /**
+     * We will use a administrative "permission token encryption" protocol to store fields
+     * in each permission's PushDrop script. This ensures that only the user's wallet
+     * can decrypt them. In practice, this data is not super sensitive, but we still
+     * follow the principle of least exposure.
+     */
+    static PERM_TOKEN_ENCRYPTION_PROTOCOL = [
+        2,
+        'admin permission token encryption'
+    ];
+    /**
+     * Similarly, we will use a "metadata encryption" protocol to preserve the confidentiality
+     * of transaction descriptions and input/output descriptions from lower storage layers.
+     */
+    static METADATA_ENCRYPTION_PROTOCOL = [
+        2,
+        'admin metadata encryption'
+    ];
     /** We always use `keyID="1"` and `counterparty="self"` for these encryption ops. */
     async encryptPermissionTokenField(plaintext) {
         const data = typeof plaintext === 'string' ? sdk_1.Utils.toArray(plaintext, 'utf8') : plaintext;
@@ -1621,7 +1642,7 @@ class WalletPermissionsManager {
     }
     /** Normalizes a txid string to lowercase. */
     normalizeTxid(txid) {
-        return (txid !== null && txid !== void 0 ? txid : '').toLowerCase();
+        return (txid ?? '').toLowerCase();
     }
     /** Reverses a 32-byte hex txid (for endian normalization). */
     reverseHexTxid(txid) {
@@ -1652,9 +1673,15 @@ class WalletPermissionsManager {
      */
     findInputIndexForToken(tx, token) {
         return tx.inputs.findIndex((input) => {
-            var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l, _m, _o;
-            const txidCandidate = (_g = (_f = (_e = (_d = (_c = (_b = (_a = input === null || input === void 0 ? void 0 : input.sourceTXID) !== null && _a !== void 0 ? _a : input === null || input === void 0 ? void 0 : input.sourceTxid) !== null && _b !== void 0 ? _b : input === null || input === void 0 ? void 0 : input.sourceTxId) !== null && _c !== void 0 ? _c : input === null || input === void 0 ? void 0 : input.prevTxId) !== null && _d !== void 0 ? _d : input === null || input === void 0 ? void 0 : input.prevTxid) !== null && _e !== void 0 ? _e : input === null || input === void 0 ? void 0 : input.prevTXID) !== null && _f !== void 0 ? _f : input === null || input === void 0 ? void 0 : input.txid) !== null && _g !== void 0 ? _g : input === null || input === void 0 ? void 0 : input.txID;
-            const voutCandidate = (_l = (_k = (_j = (_h = input === null || input === void 0 ? void 0 : input.sourceOutputIndex) !== null && _h !== void 0 ? _h : input === null || input === void 0 ? void 0 : input.sourceOutput) !== null && _j !== void 0 ? _j : input === null || input === void 0 ? void 0 : input.outputIndex) !== null && _k !== void 0 ? _k : input === null || input === void 0 ? void 0 : input.vout) !== null && _l !== void 0 ? _l : input === null || input === void 0 ? void 0 : input.prevOutIndex;
+            const txidCandidate = input?.sourceTXID ??
+                input?.sourceTxid ??
+                input?.sourceTxId ??
+                input?.prevTxId ??
+                input?.prevTxid ??
+                input?.prevTXID ??
+                input?.txid ??
+                input?.txID;
+            const voutCandidate = input?.sourceOutputIndex ?? input?.sourceOutput ?? input?.outputIndex ?? input?.vout ?? input?.prevOutIndex;
             if (typeof txidCandidate === 'string' && typeof voutCandidate === 'number') {
                 const cand = this.normalizeTxid(txidCandidate);
                 if (cand === this.normalizeTxid(token.txid) && voutCandidate === token.outputIndex)
@@ -1662,14 +1689,14 @@ class WalletPermissionsManager {
                 if (cand === this.reverseHexTxid(token.txid) && voutCandidate === token.outputIndex)
                     return true;
             }
-            const outpointCandidate = (_o = (_m = input === null || input === void 0 ? void 0 : input.outpoint) !== null && _m !== void 0 ? _m : input === null || input === void 0 ? void 0 : input.sourceOutpoint) !== null && _o !== void 0 ? _o : input === null || input === void 0 ? void 0 : input.prevOutpoint;
+            const outpointCandidate = input?.outpoint ?? input?.sourceOutpoint ?? input?.prevOutpoint;
             return typeof outpointCandidate === 'string' && this.tokenMatchesOutpointString(outpointCandidate, token);
         });
     }
     /** Looks for a DPACP permission token matching origin/domain, privileged, protocol, cpty. */
     async findProtocolToken(originator, privileged, protocolID, counterparty, includeExpired, originatorLookupValues) {
         const [secLevel, protoName] = protocolID;
-        const originsToTry = (originatorLookupValues === null || originatorLookupValues === void 0 ? void 0 : originatorLookupValues.length) ? originatorLookupValues : [originator];
+        const originsToTry = originatorLookupValues?.length ? originatorLookupValues : [originator];
         for (const originTag of originsToTry) {
             const tags = [
                 `originator ${originTag}`,
@@ -1690,7 +1717,7 @@ class WalletPermissionsManager {
                 const [txid, outputIndex] = this.parseOutpoint(out.outpoint);
                 const tx = sdk_1.Transaction.fromBEEF(result.BEEF, txid);
                 const dec = sdk_1.PushDrop.decode(tx.outputs[outputIndex].lockingScript);
-                if ((dec === null || dec === void 0 ? void 0 : dec.fields) == null || dec.fields.length < 6)
+                if (dec?.fields == null || dec.fields.length < 6)
                     continue;
                 const f = await this.decryptProtocolTokenFields(dec.fields);
                 if (this.normalizeOriginator(f.domainDecoded) !== originator)
@@ -1724,7 +1751,7 @@ class WalletPermissionsManager {
     /** Finds ALL DPACP permission tokens matching origin/domain, privileged, protocol, cpty. Never filters by expiry. */
     async findAllProtocolTokens(originator, privileged, protocolID, counterparty, originatorLookupValues) {
         const [secLevel, protoName] = protocolID;
-        const originsToTry = (originatorLookupValues === null || originatorLookupValues === void 0 ? void 0 : originatorLookupValues.length) ? originatorLookupValues : [originator];
+        const originsToTry = originatorLookupValues?.length ? originatorLookupValues : [originator];
         const matches = [];
         const seen = new Set();
         for (const originTag of originsToTry) {
@@ -1749,7 +1776,7 @@ class WalletPermissionsManager {
                 const [txid, vout] = this.parseOutpoint(out.outpoint);
                 const tx = sdk_1.Transaction.fromBEEF(result.BEEF, txid);
                 const dec = sdk_1.PushDrop.decode(tx.outputs[vout].lockingScript);
-                if ((dec === null || dec === void 0 ? void 0 : dec.fields) == null || dec.fields.length < 6)
+                if (dec?.fields == null || dec.fields.length < 6)
                     continue;
                 const f = await this.decryptProtocolTokenFields(dec.fields);
                 if (this.normalizeOriginator(f.domainDecoded) !== originator)
@@ -1781,7 +1808,7 @@ class WalletPermissionsManager {
     }
     /** Looks for a DBAP token matching (originator, basket). */
     async findBasketToken(originator, basket, includeExpired, originatorLookupValues) {
-        const originsToTry = (originatorLookupValues === null || originatorLookupValues === void 0 ? void 0 : originatorLookupValues.length) ? originatorLookupValues : [originator];
+        const originsToTry = originatorLookupValues?.length ? originatorLookupValues : [originator];
         for (const originTag of originsToTry) {
             const result = await this.underlying.listOutputs({
                 basket: BASKET_MAP.basket,
@@ -1793,7 +1820,7 @@ class WalletPermissionsManager {
                 const [txid, outputIndex] = this.parseOutpoint(out.outpoint);
                 const tx = sdk_1.Transaction.fromBEEF(result.BEEF, txid);
                 const dec = sdk_1.PushDrop.decode(tx.outputs[outputIndex].lockingScript);
-                if (!(dec === null || dec === void 0 ? void 0 : dec.fields) || dec.fields.length < 3)
+                if (!dec?.fields || dec.fields.length < 3)
                     continue;
                 const domainDecoded = sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(dec.fields[0]));
                 if (this.normalizeOriginator(domainDecoded) !== originator)
@@ -1821,7 +1848,7 @@ class WalletPermissionsManager {
     }
     /** Looks for a DCAP token matching (origin, privileged, verifier, certType, fields subset). */
     async findCertificateToken(originator, privileged, verifier, certType, fields, includeExpired, originatorLookupValues) {
-        const originsToTry = (originatorLookupValues === null || originatorLookupValues === void 0 ? void 0 : originatorLookupValues.length) ? originatorLookupValues : [originator];
+        const originsToTry = originatorLookupValues?.length ? originatorLookupValues : [originator];
         for (const originTag of originsToTry) {
             const result = await this.underlying.listOutputs({
                 basket: BASKET_MAP.certificate,
@@ -1833,7 +1860,7 @@ class WalletPermissionsManager {
                 const [txid, outputIndex] = this.parseOutpoint(out.outpoint);
                 const tx = sdk_1.Transaction.fromBEEF(result.BEEF, txid);
                 const dec = sdk_1.PushDrop.decode(tx.outputs[outputIndex].lockingScript);
-                if (!(dec === null || dec === void 0 ? void 0 : dec.fields) || dec.fields.length < 6)
+                if (!dec?.fields || dec.fields.length < 6)
                     continue;
                 const [domainRaw, expiryRaw, privRaw, typeRaw, fieldsRaw, verifierRaw] = dec.fields;
                 const domainDecoded = sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(domainRaw));
@@ -1872,7 +1899,7 @@ class WalletPermissionsManager {
     }
     /** Looks for a DSAP token matching origin, returning the first one found. */
     async findSpendingToken(originator, originatorLookupValues) {
-        const originsToTry = (originatorLookupValues === null || originatorLookupValues === void 0 ? void 0 : originatorLookupValues.length) ? originatorLookupValues : [originator];
+        const originsToTry = originatorLookupValues?.length ? originatorLookupValues : [originator];
         for (const originTag of originsToTry) {
             const result = await this.underlying.listOutputs({
                 basket: BASKET_MAP.spending,
@@ -1884,7 +1911,7 @@ class WalletPermissionsManager {
                 const [txid, outputIndexStr] = out.outpoint.split('.');
                 const tx = sdk_1.Transaction.fromBEEF(result.BEEF, txid);
                 const dec = sdk_1.PushDrop.decode(tx.outputs[Number(outputIndexStr)].lockingScript);
-                if (!(dec === null || dec === void 0 ? void 0 : dec.fields) || dec.fields.length < 2)
+                if (!dec?.fields || dec.fields.length < 2)
                     continue;
                 const domainRaw = dec.fields[0];
                 const amtRaw = dec.fields[1];
@@ -2075,7 +2102,7 @@ class WalletPermissionsManager {
                     signAndProcess: false
                 }
             }, this.adminOriginator);
-            if (!(signableTransaction === null || signableTransaction === void 0 ? void 0 : signableTransaction.reference) || !signableTransaction.tx) {
+            if (!signableTransaction?.reference || !signableTransaction.tx) {
                 throw new Error('Failed to create signable transaction');
             }
             const partialTx = sdk_1.Transaction.fromAtomicBEEF(signableTransaction.tx);
@@ -2097,8 +2124,7 @@ class WalletPermissionsManager {
         });
     }
     async coalescePermissionTokens(oldTokens, newScript, opts) {
-        var _a;
-        if (!(oldTokens === null || oldTokens === void 0 ? void 0 : oldTokens.length))
+        if (!oldTokens?.length)
             throw new Error('No permission tokens to coalesce');
         if (oldTokens.length < 2)
             throw new Error('Need at least 2 tokens to coalesce');
@@ -2109,7 +2135,7 @@ class WalletPermissionsManager {
             inputBeef.mergeBeef(sdk_1.Beef.fromBinary(token.tx));
         }
         const { signableTransaction } = await this.createAction({
-            description: (_a = opts === null || opts === void 0 ? void 0 : opts.description) !== null && _a !== void 0 ? _a : `Coalesce ${oldTokens.length} permission tokens`,
+            description: opts?.description ?? `Coalesce ${oldTokens.length} permission tokens`,
             inputBEEF: inputBeef.toBinary(),
             inputs: oldTokens.map((t, i) => ({
                 outpoint: `${t.txid}.${t.outputIndex}`,
@@ -2121,8 +2147,8 @@ class WalletPermissionsManager {
                     lockingScript: newScript.toHex(),
                     satoshis: 1,
                     outputDescription: 'Renewed permission token',
-                    ...((opts === null || opts === void 0 ? void 0 : opts.basket) ? { basket: opts.basket } : {}),
-                    ...(((opts === null || opts === void 0 ? void 0 : opts.tags) == null) ? {} : { tags: opts.tags })
+                    ...(opts?.basket ? { basket: opts.basket } : {}),
+                    ...((opts?.tags == null) ? {} : { tags: opts.tags })
                 }
             ],
             options: {
@@ -2131,7 +2157,7 @@ class WalletPermissionsManager {
                 signAndProcess: false
             }
         }, this.adminOriginator);
-        if (!(signableTransaction === null || signableTransaction === void 0 ? void 0 : signableTransaction.reference) || !signableTransaction.tx) {
+        if (!signableTransaction?.reference || !signableTransaction.tx) {
             throw new Error('Failed to create signable transaction');
         }
         // 2) Sign each input - each token needs its own unlocker with the correct locking script
@@ -2226,11 +2252,10 @@ class WalletPermissionsManager {
      * (protocol / basket / certificate / spending).
      */
     async buildPushdropFields(r, expiry, amount) {
-        var _a, _b;
         switch (r.type) {
             case 'protocol': {
                 const [secLevel, protoName] = r.protocolID;
-                const counterparty = secLevel === 2 ? ((_a = r.counterparty) !== null && _a !== void 0 ? _a : 'self') : '';
+                const counterparty = secLevel === 2 ? (r.counterparty ?? 'self') : '';
                 return [
                     await this.encryptPermissionTokenField(r.originator), // domain
                     await this.encryptPermissionTokenField(String(expiry)), // expiry
@@ -2260,7 +2285,7 @@ class WalletPermissionsManager {
             }
             case 'spending': {
                 // DSAP
-                const authAmt = amount !== null && amount !== void 0 ? amount : (((_b = r.spending) === null || _b === void 0 ? void 0 : _b.satoshis) || 0);
+                const authAmt = amount ?? (r.spending?.satoshis || 0);
                 return [
                     await this.encryptPermissionTokenField(r.originator),
                     await this.encryptPermissionTokenField(String(authAmt))
@@ -2273,13 +2298,12 @@ class WalletPermissionsManager {
      * origin, basket, privileged, protocol name, etc.
      */
     buildTagsForRequest(r) {
-        var _a;
         const tags = [`originator ${r.originator}`];
         switch (r.type) {
             case 'protocol': {
                 tags.push(`privileged ${!!r.privileged}`, `protocolName ${r.protocolID[1]}`, `protocolSecurityLevel ${r.protocolID[0]}`);
                 if (r.protocolID[0] === 2) {
-                    tags.push(`counterparty ${(_a = r.counterparty) !== null && _a !== void 0 ? _a : 'self'}`);
+                    tags.push(`counterparty ${r.counterparty ?? 'self'}`);
                 }
                 break;
             }
@@ -2344,7 +2368,7 @@ class WalletPermissionsManager {
             const [txid, outputIndex] = this.parseOutpoint(out.outpoint);
             const tx = sdk_1.Transaction.fromBEEF(result.BEEF, txid);
             const dec = sdk_1.PushDrop.decode(tx.outputs[outputIndex].lockingScript);
-            if (!(dec === null || dec === void 0 ? void 0 : dec.fields) || dec.fields.length < 6)
+            if (!dec?.fields || dec.fields.length < 6)
                 continue;
             const f = await this.decryptProtocolTokenFields(dec.fields);
             const normalizedDomain = this.normalizeOriginator(f.domainDecoded);
@@ -2374,7 +2398,7 @@ class WalletPermissionsManager {
             });
             return true;
         }
-        catch (_a) {
+        catch {
             return false;
         }
     }
@@ -2412,7 +2436,7 @@ class WalletPermissionsManager {
                 const [txid, outputIndex] = this.parseOutpoint(out.outpoint);
                 const tx = sdk_1.Transaction.fromBEEF(result.BEEF, txid);
                 const dec = sdk_1.PushDrop.decode(tx.outputs[outputIndex].lockingScript);
-                if (!(dec === null || dec === void 0 ? void 0 : dec.fields) || dec.fields.length < 3)
+                if (!dec?.fields || dec.fields.length < 3)
                     continue;
                 const [domainRaw, expiryRaw, basketRaw] = dec.fields;
                 const domainDecoded = sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(domainRaw));
@@ -2450,7 +2474,7 @@ class WalletPermissionsManager {
             });
             return true;
         }
-        catch (_a) {
+        catch {
             return false;
         }
     }
@@ -2475,7 +2499,7 @@ class WalletPermissionsManager {
             const [txid, outputIndexStr] = out.outpoint.split('.');
             const tx = sdk_1.Transaction.fromBEEF(result.BEEF, txid);
             const dec = sdk_1.PushDrop.decode(tx.outputs[Number(outputIndexStr)].lockingScript);
-            if (!(dec === null || dec === void 0 ? void 0 : dec.fields) || dec.fields.length < 2)
+            if (!dec?.fields || dec.fields.length < 2)
                 continue;
             const [domainRaw, amtRaw] = dec.fields;
             const domainDecoded = sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(domainRaw));
@@ -2507,7 +2531,7 @@ class WalletPermissionsManager {
             });
             return true;
         }
-        catch (_a) {
+        catch {
             return false;
         }
     }
@@ -2546,7 +2570,7 @@ class WalletPermissionsManager {
             const [txid, outputIndex] = this.parseOutpoint(out.outpoint);
             const tx = sdk_1.Transaction.fromBEEF(result.BEEF, txid);
             const dec = sdk_1.PushDrop.decode(tx.outputs[outputIndex].lockingScript);
-            if (!(dec === null || dec === void 0 ? void 0 : dec.fields) || dec.fields.length < 6)
+            if (!dec?.fields || dec.fields.length < 6)
                 continue;
             const [domainRaw, expiryRaw, privRaw, typeRaw, fieldsRaw, verifierRaw] = dec.fields;
             const domainDecoded = sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(domainRaw));
@@ -2585,7 +2609,7 @@ class WalletPermissionsManager {
             });
             return true;
         }
-        catch (_a) {
+        catch {
             return false;
         }
     }
@@ -2649,7 +2673,7 @@ class WalletPermissionsManager {
                 signAndProcess: false
             }
         }, this.adminOriginator);
-        if (!(signableTransaction === null || signableTransaction === void 0 ? void 0 : signableTransaction.reference) || !signableTransaction.tx) {
+        if (!signableTransaction?.reference || !signableTransaction.tx) {
             throw new Error('Failed to create signable transaction');
         }
         const tx = sdk_1.Transaction.fromAtomicBEEF(signableTransaction.tx);
@@ -2936,7 +2960,6 @@ class WalletPermissionsManager {
         return await this.decryptListActionsMetadata(results);
     }
     async internalizeAction(...args) {
-        var _a;
         const [requestArgs, originator] = args;
         // 1) Identify unique P-modules involved (one per schemeID) from both baskets and labels
         const pModulesByScheme = new Map();
@@ -3001,7 +3024,7 @@ class WalletPermissionsManager {
             // Encrypt custom instructions for p basket outputs
             for (const outIndex in transformedArgs.outputs) {
                 const out = transformedArgs.outputs[outIndex];
-                if (out.protocol === 'basket insertion' && ((_a = out.insertionRemittance) === null || _a === void 0 ? void 0 : _a.customInstructions)) {
+                if (out.protocol === 'basket insertion' && out.insertionRemittance?.customInstructions) {
                     out.insertionRemittance.customInstructions = await this.maybeEncryptMetadata(out.insertionRemittance.customInstructions);
                 }
             }
@@ -3075,6 +3098,7 @@ class WalletPermissionsManager {
                 protocolID: requestArgs.protocolID,
                 counterparty: requestArgs.counterparty || 'self',
                 reason: requestArgs.privilegedReason,
+                seekPermission: requestArgs.seekPermission,
                 usageType: 'publicKey'
             });
         }
@@ -3086,6 +3110,7 @@ class WalletPermissionsManager {
                 protocolID: [1, 'identity key retrieval'],
                 counterparty: 'self',
                 reason: requestArgs.privilegedReason,
+                seekPermission: requestArgs.seekPermission,
                 usageType: 'identityKey'
             });
         }
@@ -3493,13 +3518,12 @@ class WalletPermissionsManager {
             }
             return port ? `${baseHost}:${port}` : baseHost;
         }
-        catch (_a) {
+        catch {
             // Fall back to a conservative lowercase trim if URL parsing fails.
             return trimmed.toLowerCase();
         }
     }
     isWhitelistedCounterpartyProtocol(counterparty, protocolID) {
-        var _a;
         const whitelist = this.config.whitelistedCounterparties;
         if (whitelist == null)
             return false;
@@ -3508,10 +3532,10 @@ class WalletPermissionsManager {
         const protocols = whitelist[counterparty] || whitelist[counterparty.toLowerCase()] || whitelist[counterparty.toUpperCase()];
         if (!protocols || protocols.length === 0)
             return false;
-        const protoName = ((_a = protocolID === null || protocolID === void 0 ? void 0 : protocolID[1]) !== null && _a !== void 0 ? _a : '').toString().toLowerCase();
+        const protoName = (protocolID?.[1] ?? '').toString().toLowerCase();
         if (!protoName)
             return false;
-        return protocols.some(p => (p !== null && p !== void 0 ? p : '').toString().toLowerCase() === protoName);
+        return protocols.some(p => (p ?? '').toString().toLowerCase() === protoName);
     }
     /**
      * Produces a normalized originator value along with the set of legacy
@@ -3519,7 +3543,7 @@ class WalletPermissionsManager {
      * permission tokens (for backwards compatibility).
      */
     prepareOriginator(originator) {
-        const trimmed = originator === null || originator === void 0 ? void 0 : originator.trim();
+        const trimmed = originator?.trim();
         if (!trimmed) {
             throw new Error('Originator is required for permission checks.');
         }
@@ -3534,7 +3558,7 @@ class WalletPermissionsManager {
     buildOriginatorLookupValues(...origins) {
         const variants = new Set();
         for (const origin of origins) {
-            const trimmed = origin === null || origin === void 0 ? void 0 : origin.trim();
+            const trimmed = origin?.trim();
             if (trimmed) {
                 variants.add(trimmed);
             }
@@ -3546,58 +3570,25 @@ class WalletPermissionsManager {
      * do not produce multiple user prompts.
      */
     buildRequestKey(r) {
-        var _a, _b, _c, _d, _e;
         const normalizedOriginator = this.normalizeOriginator(r.originator);
         switch (r.type) {
             case 'protocol':
-                return `proto:${normalizedOriginator}:${!!r.privileged}:${(_a = r.protocolID) === null || _a === void 0 ? void 0 : _a.join(',')}:${r.counterparty}`;
+                return `proto:${normalizedOriginator}:${!!r.privileged}:${r.protocolID?.join(',')}:${r.counterparty}`;
             case 'basket':
                 return `basket:${normalizedOriginator}:${r.basket}`;
             case 'certificate':
-                return `cert:${normalizedOriginator}:${!!r.privileged}:${(_b = r.certificate) === null || _b === void 0 ? void 0 : _b.verifier}:${(_c = r.certificate) === null || _c === void 0 ? void 0 : _c.certType}:${(_d = r.certificate) === null || _d === void 0 ? void 0 : _d.fields.join('|')}`;
+                return `cert:${normalizedOriginator}:${!!r.privileged}:${r.certificate?.verifier}:${r.certificate?.certType}:${r.certificate?.fields.join('|')}`;
             case 'spending':
-                return `spend:${normalizedOriginator}:${(_e = r.spending) === null || _e === void 0 ? void 0 : _e.satoshis}`;
+                return `spend:${normalizedOriginator}:${r.spending?.satoshis}`;
         }
     }
     buildActiveRequestKey(r) {
-        var _a;
         const base = this.buildRequestKey(r);
         if (r.type === 'protocol' || r.type === 'basket' || r.type === 'certificate') {
-            return `${base}:${(_a = r.usageType) !== null && _a !== void 0 ? _a : ''}`;
+            return `${base}:${r.usageType ?? ''}`;
         }
         return base;
     }
 }
 exports.WalletPermissionsManager = WalletPermissionsManager;
-WalletPermissionsManager.MANIFEST_CACHE_TTL_MS = 5 * 60 * 1000;
-/** How long a cached permission remains valid (5 minutes). */
-WalletPermissionsManager.CACHE_TTL_MS = 5 * 60 * 1000;
-/** Window during which freshly granted permissions are auto-allowed (except spending). */
-WalletPermissionsManager.RECENT_GRANT_COVER_MS = 15 * 1000;
-/** Default ports used when normalizing originator values. */
-WalletPermissionsManager.DEFAULT_PORTS = {
-    'http:': '80',
-    'https:': '443'
-};
-/* ---------------------------------------------------------------------
- *  4) SEARCH / DECODE / DECRYPT ON-CHAIN TOKENS (PushDrop Scripts)
- * --------------------------------------------------------------------- */
-/**
- * We will use a administrative "permission token encryption" protocol to store fields
- * in each permission's PushDrop script. This ensures that only the user's wallet
- * can decrypt them. In practice, this data is not super sensitive, but we still
- * follow the principle of least exposure.
- */
-WalletPermissionsManager.PERM_TOKEN_ENCRYPTION_PROTOCOL = [
-    2,
-    'admin permission token encryption'
-];
-/**
- * Similarly, we will use a "metadata encryption" protocol to preserve the confidentiality
- * of transaction descriptions and input/output descriptions from lower storage layers.
- */
-WalletPermissionsManager.METADATA_ENCRYPTION_PROTOCOL = [
-    2,
-    'admin metadata encryption'
-];
 //# sourceMappingURL=WalletPermissionsManager.js.map