Module audit 

PERMISSION AUDIT — record what a REAL wallet would have prompted the user for.

This daemon grants everything silently, which is what makes it usable headlessly — and also what makes it blind. A BRC-100 wallet with a human behind it prompts on two axes:

• PROTOCOL (BRC-43): security level 1 asks once per protocol, level 2 once per protocol AND counterparty. Level 0 never asks. An app can pre-grant these in its manifest.json (BRC-73 groupPermissions.protocolPermissions) — but only for a level-2 counterparty it can name in advance. • SPENDING: every action that moves satoshis, unless the app declared a spendingAuthorization budget.

An app can therefore be correct, fast, fully tested — and still interrupt a player a dozen times a hand, with nothing in any test suite noticing. Worse, a dismissed prompt fails SILENTLY at the call site, so a missing manifest entry looks like a mysteriously absent marker rather than a permission bug (bsv-low #386 was found exactly that way).

So: record the raw facts here and let the CALLER judge them. This module deliberately does NOT know what a manifest is or which protocols are pre-granted — that belongs with the app being tested, which owns its own manifest. Here we only answer “what was asked for, in what order, at what level, against which counterparty, for how many satoshis”.

Process-global on purpose: this daemon serves exactly one wallet (bsv-wallet serve --db … --port N), and threading a sink through every handler signature would be a large diff for no extra fidelity.

Structs

AuditEntry

One permissioned request, as the wallet received it.

Functions

protocol_entry

Build an entry for a protocol-bearing call.

record

Record one permissioned request. Never panics and never fails a request — an audit that can break the wallet it observes is worse than no audit.

reset

Clear the log — a test calls this immediately before the flow it measures.

snapshot

Everything recorded since start or the last reset.

spend_entry

Build an entry for a spending call.