Web3User Permission Lab is an experimental, off-chain transaction authorization SDK for Node.js exploring how proposed blockchain actions can be checked against explicit, testable policies before execution. The current codebase is an in-process Node.js library supporting an ERC-20 transfer policy evaluator with cryptographic authorization binding and persistent SQLite replay protection—not a hosted API, cloud service, universal wallet, or production security product.
Deterministic IPC rendezvous barriers release competing OS processes simultaneously to attempt consuming the same V3 authorization; tests strictly enforce exactly one ALLOW and three domain-level DENY outcomes with one persistent record.
Immediate SQLite write transactions (BEGIN IMMEDIATE;) roll back partial writes and intermediate clock updates on failure. Bounded retry loops with non-spinning sleep resolve transient contention or fail closed predictably.
Rigorous boundary tests enforce strict rejection at the exact expiration second (nowSeconds >= expiresAtSeconds), clip expiry to authoritative policy/key caps, and enforce key validity windows and post-retirement forgery rejection.
Subtraction-first validity window calculation prevents integer overflow when evaluating large TTL inputs up to Number.MAX_SAFE_INTEGER, ensuring effective expiration deadlines never exceed JavaScript safe integer limits.
Durable SQLite table schemas, policy revisions, key governance states (active, retired, revoked), and monotonic clock high-water marks survive connection closes and restarts without state loss or corruption.
Abrupt child worker termination during active uncommitted write transactions confirms automatic SQLite WAL rollback upon reopen. Note: Qualified strictly as process-crash recovery testing, not physical power-loss durability.
• ERC-20 transfer(address,uint256) policy evaluator.
• Exact canonical binding digests (calldata, recipient, amount, chain ID, sender).
• Ed25519 V3 signed authorization artifacts with length-prefixed encoding.
• Monotonic policy revisions & key registry governance in SQLite.
• Persistent two-phase replay protection (issued → consumed).
• Universal wallet integration & RPC middleware adapters.
• Cumulative multi-transaction spending budgets over time windows.
• Arbitrary smart contract function call decoders.
• Multi-party threshold key signing and on-chain validator bindings.
• Formal external third-party security audits.
Evaluator logic, calldata decoding, parameter boundary checks, and test harnesses.
Deterministic length-prefixed payload binding and SQLite two-phase state storage.
Asymmetric artifact signing, authoritative policy revisions, and crash-safe schema evolution.
Multi-process race barriers, transaction rollback failure injection, safe TTL arithmetic, and process-crash recovery.
Release candidate packaging, full multi-version CI matrix passing across Node.js 22, 24, and 26 (332/332 tests), and pre-release security review.
Cumulative budgets, external wallet boundaries, and independent third-party audits before production consideration.
Language: TypeScript · Tooling: Node.js (>=22.13.0), npm, Vitest · Storage: SQLite (built-in node:sqlite, WAL mode) · Signatures: Ed25519 (node:crypto) · Version Control: Git & GitHub.
Current supported selector: 0xa9059cbb — ERC-20 transfer(address,uint256). The prototype enforces single-use persistent replay protection for bound authorizations. Cumulative multi-transaction budgets, arbitrary smart contract parsing, and universal wallet enforcement boundaries are not implemented.