@bsv/sdk 1.7.4 → 1.7.6

package/docs/reference/auth.md

@@ -121,23 +121,23 @@ and sending BSV payment transactions when necessary.
 ```ts
 export class AuthFetch {
     peers: Record<string, AuthPeer> = {};
-    constructor(wallet: WalletInterface, requestedCertificates?: RequestedCertificateSet, sessionManager?: SessionManager) 
+    constructor(wallet: WalletInterface, requestedCertificates?: RequestedCertificateSet, sessionManager?: SessionManager, originator?: OriginatorDomainNameStringUnder250Bytes) 
     async fetch(url: string, config: SimplifiedFetchRequestOptions = {}): Promise<Response> 
     async sendCertificateRequest(baseUrl: string, certificatesToRequest: RequestedCertificateSet): Promise<VerifiableCertificate[]> 
     public consumeReceivedCertificates(): VerifiableCertificate[] 
 }
 ```
 
-See also: [RequestedCertificateSet](./auth.md#interface-requestedcertificateset), [SessionManager](./auth.md#class-sessionmanager), [VerifiableCertificate](./auth.md#class-verifiablecertificate), [WalletInterface](./wallet.md#interface-walletinterface)
+See also: [OriginatorDomainNameStringUnder250Bytes](./wallet.md#type-originatordomainnamestringunder250bytes), [RequestedCertificateSet](./auth.md#interface-requestedcertificateset), [SessionManager](./auth.md#class-sessionmanager), [VerifiableCertificate](./auth.md#class-verifiablecertificate), [WalletInterface](./wallet.md#interface-walletinterface)
 
 #### Constructor
 
 Constructs a new AuthFetch instance.
 
 ```ts
-constructor(wallet: WalletInterface, requestedCertificates?: RequestedCertificateSet, sessionManager?: SessionManager) 
+constructor(wallet: WalletInterface, requestedCertificates?: RequestedCertificateSet, sessionManager?: SessionManager, originator?: OriginatorDomainNameStringUnder250Bytes) 
 ```
-See also: [RequestedCertificateSet](./auth.md#interface-requestedcertificateset), [SessionManager](./auth.md#class-sessionmanager), [WalletInterface](./wallet.md#interface-walletinterface)
+See also: [OriginatorDomainNameStringUnder250Bytes](./wallet.md#type-originatordomainnamestringunder250bytes), [RequestedCertificateSet](./auth.md#interface-requestedcertificateset), [SessionManager](./auth.md#class-sessionmanager), [WalletInterface](./wallet.md#interface-walletinterface)
 
 Argument Details
 
@@ -643,7 +643,7 @@ This version supports multiple concurrent sessions per peer identityKey.
 export class Peer {
     public sessionManager: SessionManager;
     certificatesToRequest: RequestedCertificateSet;
-    constructor(wallet: WalletInterface, transport: Transport, certificatesToRequest?: RequestedCertificateSet, sessionManager?: SessionManager, autoPersistLastSession?: boolean) 
+    constructor(wallet: WalletInterface, transport: Transport, certificatesToRequest?: RequestedCertificateSet, sessionManager?: SessionManager, autoPersistLastSession?: boolean, originator?: OriginatorDomainNameStringUnder250Bytes) 
     async toPeer(message: number[], identityKey?: string, maxWaitTime?: number): Promise<void> 
     async requestCertificates(certificatesToRequest: RequestedCertificateSet, identityKey?: string, maxWaitTime = 10000): Promise<void> 
     async getAuthenticatedSession(identityKey?: string, maxWaitTime?: number): Promise<PeerSession> 
@@ -657,16 +657,16 @@ export class Peer {
 }
 ```
 
-See also: [PeerSession](./auth.md#interface-peersession), [RequestedCertificateSet](./auth.md#interface-requestedcertificateset), [SessionManager](./auth.md#class-sessionmanager), [Transport](./auth.md#interface-transport), [VerifiableCertificate](./auth.md#class-verifiablecertificate), [WalletInterface](./wallet.md#interface-walletinterface)
+See also: [OriginatorDomainNameStringUnder250Bytes](./wallet.md#type-originatordomainnamestringunder250bytes), [PeerSession](./auth.md#interface-peersession), [RequestedCertificateSet](./auth.md#interface-requestedcertificateset), [SessionManager](./auth.md#class-sessionmanager), [Transport](./auth.md#interface-transport), [VerifiableCertificate](./auth.md#class-verifiablecertificate), [WalletInterface](./wallet.md#interface-walletinterface)
 
 #### Constructor
 
 Creates a new Peer instance
 
 ```ts
-constructor(wallet: WalletInterface, transport: Transport, certificatesToRequest?: RequestedCertificateSet, sessionManager?: SessionManager, autoPersistLastSession?: boolean) 
+constructor(wallet: WalletInterface, transport: Transport, certificatesToRequest?: RequestedCertificateSet, sessionManager?: SessionManager, autoPersistLastSession?: boolean, originator?: OriginatorDomainNameStringUnder250Bytes) 
 ```
-See also: [RequestedCertificateSet](./auth.md#interface-requestedcertificateset), [SessionManager](./auth.md#class-sessionmanager), [Transport](./auth.md#interface-transport), [WalletInterface](./wallet.md#interface-walletinterface)
+See also: [OriginatorDomainNameStringUnder250Bytes](./wallet.md#type-originatordomainnamestringunder250bytes), [RequestedCertificateSet](./auth.md#interface-requestedcertificateset), [SessionManager](./auth.md#class-sessionmanager), [Transport](./auth.md#interface-transport), [WalletInterface](./wallet.md#interface-walletinterface)
 
 Argument Details
 
@@ -1107,20 +1107,20 @@ export class VerifiableCertificate extends Certificate {
     decryptedFields?: Record<CertificateFieldNameUnder50Bytes, Base64String>;
     constructor(type: Base64String, serialNumber: Base64String, subject: PubKeyHex, certifier: PubKeyHex, revocationOutpoint: OutpointString, fields: Record<CertificateFieldNameUnder50Bytes, string>, keyring: Record<CertificateFieldNameUnder50Bytes, string>, signature?: HexString, decryptedFields?: Record<CertificateFieldNameUnder50Bytes, Base64String>) 
     static fromCertificate(certificate: WalletCertificate, keyring: Record<CertificateFieldNameUnder50Bytes, string>): VerifiableCertificate 
-    async decryptFields(verifierWallet: ProtoWallet, privileged?: boolean, privilegedReason?: string): Promise<Record<CertificateFieldNameUnder50Bytes, string>> 
+    async decryptFields(verifierWallet: ProtoWallet, privileged?: boolean, privilegedReason?: string, originator?: OriginatorDomainNameStringUnder250Bytes): Promise<Record<CertificateFieldNameUnder50Bytes, string>> 
 }
 ```
 
-See also: [Base64String](./wallet.md#type-base64string), [Certificate](./auth.md#class-certificate), [CertificateFieldNameUnder50Bytes](./wallet.md#type-certificatefieldnameunder50bytes), [HexString](./wallet.md#type-hexstring), [OutpointString](./wallet.md#type-outpointstring), [ProtoWallet](./wallet.md#class-protowallet), [PubKeyHex](./wallet.md#type-pubkeyhex), [WalletCertificate](./wallet.md#interface-walletcertificate)
+See also: [Base64String](./wallet.md#type-base64string), [Certificate](./auth.md#class-certificate), [CertificateFieldNameUnder50Bytes](./wallet.md#type-certificatefieldnameunder50bytes), [HexString](./wallet.md#type-hexstring), [OriginatorDomainNameStringUnder250Bytes](./wallet.md#type-originatordomainnamestringunder250bytes), [OutpointString](./wallet.md#type-outpointstring), [ProtoWallet](./wallet.md#class-protowallet), [PubKeyHex](./wallet.md#type-pubkeyhex), [WalletCertificate](./wallet.md#interface-walletcertificate)
 
 #### Method decryptFields
 
 Decrypts selectively revealed certificate fields using the provided keyring and verifier wallet
 
 ```ts
-async decryptFields(verifierWallet: ProtoWallet, privileged?: boolean, privilegedReason?: string): Promise<Record<CertificateFieldNameUnder50Bytes, string>> 
+async decryptFields(verifierWallet: ProtoWallet, privileged?: boolean, privilegedReason?: string, originator?: OriginatorDomainNameStringUnder250Bytes): Promise<Record<CertificateFieldNameUnder50Bytes, string>> 
 ```
-See also: [CertificateFieldNameUnder50Bytes](./wallet.md#type-certificatefieldnameunder50bytes), [ProtoWallet](./wallet.md#class-protowallet)
+See also: [CertificateFieldNameUnder50Bytes](./wallet.md#type-certificatefieldnameunder50bytes), [OriginatorDomainNameStringUnder250Bytes](./wallet.md#type-originatordomainnamestringunder250bytes), [ProtoWallet](./wallet.md#class-protowallet)
 
 Returns
 
@@ -1177,10 +1177,10 @@ Links: [API](#api), [Interfaces](#interfaces), [Classes](#classes), [Functions](
 Creates a nonce derived from a wallet
 
 ```ts
-export async function createNonce(wallet: WalletInterface, counterparty: WalletCounterparty = "self"): Promise<Base64String> 
+export async function createNonce(wallet: WalletInterface, counterparty: WalletCounterparty = "self", originator?: OriginatorDomainNameStringUnder250Bytes): Promise<Base64String> 
 ```
 
-See also: [Base64String](./wallet.md#type-base64string), [WalletCounterparty](./wallet.md#type-walletcounterparty), [WalletInterface](./wallet.md#interface-walletinterface)
+See also: [Base64String](./wallet.md#type-base64string), [OriginatorDomainNameStringUnder250Bytes](./wallet.md#type-originatordomainnamestringunder250bytes), [WalletCounterparty](./wallet.md#type-walletcounterparty), [WalletInterface](./wallet.md#interface-walletinterface)
 
 Returns
 
@@ -1199,10 +1199,10 @@ Links: [API](#api), [Interfaces](#interfaces), [Classes](#classes), [Functions](
 Verifies a nonce derived from a wallet
 
 ```ts
-export async function verifyNonce(nonce: Base64String, wallet: WalletInterface, counterparty: WalletCounterparty = "self"): Promise<boolean> 
+export async function verifyNonce(nonce: Base64String, wallet: WalletInterface, counterparty: WalletCounterparty = "self", originator?: OriginatorDomainNameStringUnder250Bytes): Promise<boolean> 
 ```
 
-See also: [Base64String](./wallet.md#type-base64string), [WalletCounterparty](./wallet.md#type-walletcounterparty), [WalletInterface](./wallet.md#interface-walletinterface)
+See also: [Base64String](./wallet.md#type-base64string), [OriginatorDomainNameStringUnder250Bytes](./wallet.md#type-originatordomainnamestringunder250bytes), [WalletCounterparty](./wallet.md#type-walletcounterparty), [WalletInterface](./wallet.md#interface-walletinterface)
 
 Returns
 
@@ -1236,23 +1236,23 @@ Links: [API](#api), [Interfaces](#interfaces), [Classes](#classes), [Functions](
 ### Variable: getVerifiableCertificates
 
 ```ts
-getVerifiableCertificates = async (wallet: WalletInterface, requestedCertificates: RequestedCertificateSet, verifierIdentityKey: string): Promise<VerifiableCertificate[]> => {
+getVerifiableCertificates = async (wallet: WalletInterface, requestedCertificates: RequestedCertificateSet, verifierIdentityKey: string, originator?: OriginatorDomainNameStringUnder250Bytes): Promise<VerifiableCertificate[]> => {
     const matchingCertificates = await wallet.listCertificates({
         certifiers: requestedCertificates.certifiers,
         types: Object.keys(requestedCertificates.types)
-    });
+    }, originator);
     return await Promise.all(matchingCertificates.certificates.map(async (certificate) => {
         const { keyringForVerifier } = await wallet.proveCertificate({
             certificate,
             fieldsToReveal: requestedCertificates.types[certificate.type],
             verifier: verifierIdentityKey
-        });
+        }, originator);
         return new VerifiableCertificate(certificate.type, certificate.serialNumber, certificate.subject, certificate.certifier, certificate.revocationOutpoint, certificate.fields, keyringForVerifier, certificate.signature);
     }));
 }
 ```
 
-See also: [RequestedCertificateSet](./auth.md#interface-requestedcertificateset), [VerifiableCertificate](./auth.md#class-verifiablecertificate), [WalletInterface](./wallet.md#interface-walletinterface)
+See also: [OriginatorDomainNameStringUnder250Bytes](./wallet.md#type-originatordomainnamestringunder250bytes), [RequestedCertificateSet](./auth.md#interface-requestedcertificateset), [VerifiableCertificate](./auth.md#class-verifiablecertificate), [WalletInterface](./wallet.md#interface-walletinterface)
 
 Links: [API](#api), [Interfaces](#interfaces), [Classes](#classes), [Functions](#functions), [Types](#types), [Enums](#enums), [Variables](#variables)
 
@@ -1260,7 +1260,7 @@ Links: [API](#api), [Interfaces](#interfaces), [Classes](#classes), [Functions](
 ### Variable: validateCertificates
 
 ```ts
-validateCertificates = async (verifierWallet: WalletInterface, message: AuthMessage, certificatesRequested?: RequestedCertificateSet): Promise<void> => {
+validateCertificates = async (verifierWallet: WalletInterface, message: AuthMessage, certificatesRequested?: RequestedCertificateSet, originator?: OriginatorDomainNameStringUnder250Bytes): Promise<void> => {
     if ((message.certificates == null) || message.certificates.length === 0) {
         throw new Error("No certificates were provided in the AuthMessage.");
     }
@@ -1283,12 +1283,12 @@ validateCertificates = async (verifierWallet: WalletInterface, message: AuthMess
                 throw new Error(`Certificate with type ${certToVerify.type} was not requested`);
             }
         }
-        await certToVerify.decryptFields(verifierWallet);
+        await certToVerify.decryptFields(verifierWallet, undefined, undefined, originator);
     }));
 }
 ```
 
-See also: [AuthMessage](./auth.md#interface-authmessage), [Certificate](./auth.md#class-certificate), [RequestedCertificateSet](./auth.md#interface-requestedcertificateset), [VerifiableCertificate](./auth.md#class-verifiablecertificate), [WalletInterface](./wallet.md#interface-walletinterface), [verify](./compat.md#variable-verify)
+See also: [AuthMessage](./auth.md#interface-authmessage), [Certificate](./auth.md#class-certificate), [OriginatorDomainNameStringUnder250Bytes](./wallet.md#type-originatordomainnamestringunder250bytes), [RequestedCertificateSet](./auth.md#interface-requestedcertificateset), [VerifiableCertificate](./auth.md#class-verifiablecertificate), [WalletInterface](./wallet.md#interface-walletinterface), [verify](./compat.md#variable-verify)
 
 Links: [API](#api), [Interfaces](#interfaces), [Classes](#classes), [Functions](#functions), [Types](#types), [Enums](#enums), [Variables](#variables)
 

package/docs/reference/identity.md

@@ -62,7 +62,7 @@ Links: [API](#api), [Interfaces](#interfaces), [Classes](#classes), [Functions](
 ```ts
 export class ContactsManager {
     constructor(wallet?: WalletInterface) 
-    async getContacts(identityKey?: PubKeyHex, forceRefresh = false): Promise<Contact[]> 
+    async getContacts(identityKey?: PubKeyHex, forceRefresh = false, limit = 1000): Promise<Contact[]> 
     async saveContact(contact: DisplayableIdentity, metadata?: Record<string, any>): Promise<void> 
     async removeContact(identityKey: string): Promise<void> 
 }
@@ -75,7 +75,7 @@ See also: [Contact](./identity.md#type-contact), [DisplayableIdentity](./identit
 Load all records from the contacts basket
 
 ```ts
-async getContacts(identityKey?: PubKeyHex, forceRefresh = false): Promise<Contact[]> 
+async getContacts(identityKey?: PubKeyHex, forceRefresh = false, limit = 1000): Promise<Contact[]> 
 ```
 See also: [Contact](./identity.md#type-contact), [PubKeyHex](./wallet.md#type-pubkeyhex)
 
@@ -89,6 +89,8 @@ Argument Details
   + Optional specific identity key to fetch
 + **forceRefresh**
   + Whether to force a check for new contact data
++ **limit**
+  + Maximum number of contacts to return
 
 #### Method removeContact
 
@@ -132,7 +134,7 @@ export class IdentityClient {
     async publiclyRevealAttributes(certificate: WalletCertificate, fieldsToReveal: CertificateFieldNameUnder50Bytes[]): Promise<BroadcastResponse | BroadcastFailure> 
     async resolveByIdentityKey(args: DiscoverByIdentityKeyArgs, overrideWithContacts = true): Promise<DisplayableIdentity[]> 
     async resolveByAttributes(args: DiscoverByAttributesArgs, overrideWithContacts = true): Promise<DisplayableIdentity[]> 
-    public async getContacts(identityKey?: PubKeyHex, forceRefresh = false): Promise<Contact[]> 
+    public async getContacts(identityKey?: PubKeyHex, forceRefresh = false, limit = 1000): Promise<Contact[]> 
     public async saveContact(contact: DisplayableIdentity, metadata?: Record<string, any>): Promise<void> 
     public async removeContact(identityKey: PubKeyHex): Promise<void> 
     static parseIdentity(identityToParse: IdentityCertificate): DisplayableIdentity 
@@ -149,7 +151,7 @@ Remove public certificate revelation from overlay services by spending the ident
 Load all records from the contacts basket
 
 ```ts
-public async getContacts(identityKey?: PubKeyHex, forceRefresh = false): Promise<Contact[]> 
+public async getContacts(identityKey?: PubKeyHex, forceRefresh = false, limit = 1000): Promise<Contact[]> 
 ```
 See also: [Contact](./identity.md#type-contact), [PubKeyHex](./wallet.md#type-pubkeyhex)
 
@@ -165,6 +167,8 @@ Argument Details
   + Optional specific identity key to fetch
 + **forceRefresh**
   + Whether to force a check for new contact data
++ **limit**
+  + Optional limit on number of contacts to fetch
 
 #### Method parseIdentity
 

package/docs/reference/wallet.md

@@ -2134,7 +2134,7 @@ export class ProtoWallet {
     async revealCounterpartyKeyLinkage(args: RevealCounterpartyKeyLinkageArgs): Promise<RevealCounterpartyKeyLinkageResult> 
     async revealSpecificKeyLinkage(args: RevealSpecificKeyLinkageArgs): Promise<RevealSpecificKeyLinkageResult> 
     async encrypt(args: WalletEncryptArgs): Promise<WalletEncryptResult> 
-    async decrypt(args: WalletDecryptArgs): Promise<WalletDecryptResult> 
+    async decrypt(args: WalletDecryptArgs, originator?: string): Promise<WalletDecryptResult> 
     async createHmac(args: CreateHmacArgs): Promise<CreateHmacResult> 
     async verifyHmac(args: VerifyHmacArgs): Promise<VerifyHmacResult> 
     async createSignature(args: CreateSignatureArgs): Promise<CreateSignatureResult> 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bsv/sdk",
-  "version": "1.7.4",
+  "version": "1.7.6",
   "type": "module",
   "description": "BSV Blockchain Software Development Kit",
   "main": "dist/cjs/mod.js",

package/src/auth/Peer.ts

@@ -14,7 +14,7 @@ import {
 import { VerifiableCertificate } from './certificates/VerifiableCertificate.js'
 import Random from '../primitives/Random.js'
 import * as Utils from '../primitives/utils.js'
-import { WalletInterface } from '../wallet/Wallet.interfaces.js'
+import { OriginatorDomainNameStringUnder250Bytes, WalletInterface } from '../wallet/Wallet.interfaces.js'
 
 const AUTH_VERSION = '0.1'
 
@@ -62,6 +62,8 @@ export class Peer {
   // Last-interacted-with peer identity key (if the user calls toPeer with no identityKey)
   private lastInteractedWithPeer: string | undefined
 
+  private readonly originator?: OriginatorDomainNameStringUnder250Bytes
+
   /**
    * Creates a new Peer instance
    *
@@ -76,9 +78,11 @@ export class Peer {
     transport: Transport,
     certificatesToRequest?: RequestedCertificateSet,
     sessionManager?: SessionManager,
-    autoPersistLastSession?: boolean
+    autoPersistLastSession?: boolean,
+    originator?: OriginatorDomainNameStringUnder250Bytes
   ) {
     this.wallet = wallet
+    this.originator = originator
     this.transport = transport
     this.certificatesToRequest = certificatesToRequest ?? {
       certifiers: [],
@@ -127,12 +131,12 @@ export class Peer {
       protocolID: [2, 'auth message signature'],
       keyID: `${requestNonce} ${peerSession.peerNonce ?? ''}`,
       counterparty: peerSession.peerIdentityKey
-    })
+    }, this.originator)
 
     const generalMessage: AuthMessage = {
       version: AUTH_VERSION,
       messageType: 'general',
-      identityKey: (await this.wallet.getPublicKey({ identityKey: true }))
+      identityKey: (await this.wallet.getPublicKey({ identityKey: true }, this.originator))
         .publicKey,
       nonce: requestNonce,
       yourNonce: peerSession.peerNonce,
@@ -191,12 +195,12 @@ export class Peer {
       protocolID: [2, 'auth message signature'],
       keyID: `${requestNonce} ${peerSession.peerNonce ?? ''}`,
       counterparty: peerSession.peerIdentityKey
-    })
+    }, this.originator)
 
     const certRequestMessage: AuthMessage = {
       version: AUTH_VERSION,
       messageType: 'certificateRequest',
-      identityKey: (await this.wallet.getPublicKey({ identityKey: true }))
+      identityKey: (await this.wallet.getPublicKey({ identityKey: true }, this.originator))
         .publicKey,
       nonce: requestNonce,
       initialNonce: peerSession.sessionNonce,
@@ -342,7 +346,7 @@ export class Peer {
     identityKey?: string,
     maxWaitTime = 10000
   ): Promise<string> {
-    const sessionNonce = await createNonce(this.wallet) // Initial request nonce
+    const sessionNonce = await createNonce(this.wallet, undefined, this.originator) // Initial request nonce
 
     // Create the preliminary session (not yet authenticated)
     const now = Date.now()
@@ -356,7 +360,7 @@ export class Peer {
     const initialRequest: AuthMessage = {
       version: AUTH_VERSION,
       messageType: 'initialRequest',
-      identityKey: (await this.wallet.getPublicKey({ identityKey: true }))
+      identityKey: (await this.wallet.getPublicKey({ identityKey: true }, this.originator))
         .publicKey,
       initialNonce: sessionNonce,
       requestedCertificates: this.certificatesToRequest
@@ -473,7 +477,7 @@ export class Peer {
     }
 
     // Create a new sessionNonce for our side
-    const sessionNonce = await createNonce(this.wallet)
+    const sessionNonce = await createNonce(this.wallet, undefined, this.originator)
     const now = Date.now()
 
     // We'll treat this as fully authenticated from *our* perspective (the responding side).
@@ -502,7 +506,8 @@ export class Peer {
         certificatesToInclude = await getVerifiableCertificates(
           this.wallet,
           message.requestedCertificates,
-          message.identityKey
+          message.identityKey,
+          this.originator
         )
       }
     }
@@ -513,12 +518,12 @@ export class Peer {
       protocolID: [2, 'auth message signature'],
       keyID: `${message.initialNonce} ${sessionNonce}`,
       counterparty: message.identityKey
-    })
+    }, this.originator)
 
     const initialResponseMessage: AuthMessage = {
       version: AUTH_VERSION,
       messageType: 'initialResponse',
-      identityKey: (await this.wallet.getPublicKey({ identityKey: true }))
+      identityKey: (await this.wallet.getPublicKey({ identityKey: true }, this.originator))
         .publicKey,
       initialNonce: sessionNonce,
       yourNonce: message.initialNonce,
@@ -544,7 +549,7 @@ export class Peer {
    * @throws Will throw an error if nonce or signature verification fails.
    */
   private async processInitialResponse (message: AuthMessage): Promise<void> {
-    const validNonce = await verifyNonce(message.yourNonce as string, this.wallet)
+    const validNonce = await verifyNonce(message.yourNonce as string, this.wallet, undefined, this.originator)
     if (!validNonce) {
       throw new Error(
         `Initial response nonce verification failed from peer: ${message.identityKey}`
@@ -568,7 +573,7 @@ export class Peer {
       protocolID: [2, 'auth message signature'],
       keyID: `${peerSession.sessionNonce ?? ''} ${message.initialNonce ?? ''}`,
       counterparty: message.identityKey
-    })
+    }, this.originator)
     if (!valid) {
       throw new Error(
         `Unable to verify initial response signature for peer: ${message.identityKey}`
@@ -587,7 +592,7 @@ export class Peer {
       this.certificatesToRequest?.certifiers?.length > 0 &&
       message.certificates?.length as number > 0
     ) {
-      await validateCertificates(this.wallet, message, this.certificatesToRequest)
+      await validateCertificates(this.wallet, message, this.certificatesToRequest, this.originator)
 
       // Notify listeners
       this.onCertificatesReceivedCallbacks.forEach(cb =>
@@ -621,7 +626,8 @@ export class Peer {
         const verifiableCertificates = await getVerifiableCertificates(
           this.wallet,
           message.requestedCertificates,
-          message.identityKey
+          message.identityKey,
+          this.originator
         )
         await this.sendCertificateResponse(
           message.identityKey,
@@ -639,7 +645,7 @@ export class Peer {
    * @throws {Error} if nonce or signature is invalid.
    */
   private async processCertificateRequest (message: AuthMessage): Promise<void> {
-    const validNonce = await verifyNonce(message.yourNonce as string, this.wallet)
+    const validNonce = await verifyNonce(message.yourNonce as string, this.wallet, undefined, this.originator)
     if (!validNonce) {
       throw new Error(
         `Unable to verify nonce for certificate request message from: ${message.identityKey}`
@@ -656,7 +662,7 @@ export class Peer {
       protocolID: [2, 'auth message signature'],
       keyID: `${message.nonce ?? ''} ${peerSession.sessionNonce ?? ''}`,
       counterparty: peerSession.peerIdentityKey
-    })
+    }, this.originator)
     if (!valid) {
       throw new Error(
         `Invalid signature in certificate request message from ${peerSession.peerIdentityKey as string}`
@@ -682,7 +688,8 @@ export class Peer {
         const verifiableCertificates = await getVerifiableCertificates(
           this.wallet,
           message.requestedCertificates,
-          message.identityKey
+          message.identityKey,
+          this.originator
         )
         await this.sendCertificateResponse(message.identityKey, verifiableCertificates)
       }
@@ -707,12 +714,12 @@ export class Peer {
       protocolID: [2, 'auth message signature'],
       keyID: `${requestNonce} ${peerSession.peerNonce ?? ''}`,
       counterparty: peerSession.peerIdentityKey
-    })
+    }, this.originator)
 
     const certificateResponse: AuthMessage = {
       version: AUTH_VERSION,
       messageType: 'certificateResponse',
-      identityKey: (await this.wallet.getPublicKey({ identityKey: true }))
+      identityKey: (await this.wallet.getPublicKey({ identityKey: true }, this.originator))
         .publicKey,
       nonce: requestNonce,
       initialNonce: peerSession.sessionNonce,
@@ -744,7 +751,7 @@ export class Peer {
    * @throws Will throw an error if nonce verification or signature verification fails.
    */
   private async processCertificateResponse (message: AuthMessage): Promise<void> {
-    const validNonce = await verifyNonce(message.yourNonce as string, this.wallet)
+    const validNonce = await verifyNonce(message.yourNonce as string, this.wallet, undefined, this.originator)
     if (!validNonce) {
       throw new Error(
         `Unable to verify nonce for certificate response from: ${message.identityKey}`
@@ -763,7 +770,7 @@ export class Peer {
       protocolID: [2, 'auth message signature'],
       keyID: `${message.nonce ?? ''} ${peerSession.sessionNonce ?? ''}`,
       counterparty: message.identityKey
-    })
+    }, this.originator)
     if (!valid) {
       throw new Error(
         `Unable to verify certificate response signature for peer: ${message.identityKey}`
@@ -774,7 +781,8 @@ export class Peer {
     await validateCertificates(
       this.wallet,
       message,
-      message.requestedCertificates
+      message.requestedCertificates,
+      this.originator
     )
 
     // Notify any listeners
@@ -794,7 +802,7 @@ export class Peer {
    * @throws Will throw an error if nonce or signature verification fails.
    */
   private async processGeneralMessage (message: AuthMessage): Promise<void> {
-    const validNonce = await verifyNonce(message.yourNonce as string, this.wallet)
+    const validNonce = await verifyNonce(message.yourNonce as string, this.wallet, undefined, this.originator)
     if (!validNonce) {
       throw new Error(
         `Unable to verify nonce for general message from: ${message.identityKey}`
@@ -812,7 +820,7 @@ export class Peer {
       protocolID: [2, 'auth message signature'],
       keyID: `${message.nonce ?? ''} ${peerSession.sessionNonce ?? ''}`,
       counterparty: peerSession.peerIdentityKey
-    })
+    }, this.originator)
     if (!valid) {
       throw new Error(
         `Invalid signature in generalMessage from ${peerSession.peerIdentityKey as string}`

package/src/auth/certificates/VerifiableCertificate.ts

@@ -5,6 +5,7 @@ import type {
   HexString,
   OutpointString,
   WalletCertificate,
+  OriginatorDomainNameStringUnder250Bytes,
 } from '../../wallet/Wallet.interfaces.js'
 import SymmetricKey from '../../primitives/SymmetricKey.js'
 import * as Utils from '../../primitives/utils.js'
@@ -85,9 +86,10 @@ export class VerifiableCertificate extends Certificate {
   async decryptFields(
     verifierWallet: ProtoWallet,
     privileged?: boolean,
-    privilegedReason?: string
+    privilegedReason?: string,
+    originator?: OriginatorDomainNameStringUnder250Bytes
   ): Promise<Record<CertificateFieldNameUnder50Bytes, string>> {
-    if (this.keyring == null || Object.keys(this.keyring).length === 0) { // ✅ Explicitly check null and empty object
+    if (this.keyring == null || Object.keys(this.keyring).length === 0) {
       throw new Error(
         'A keyring is required to decrypt certificate fields for the verifier.'
       )
@@ -106,7 +108,7 @@ export class VerifiableCertificate extends Certificate {
           counterparty: this.subject,
           privileged,
           privilegedReason
-        })
+        }, originator)
 
         const fieldValue = new SymmetricKey(fieldRevelationKey).decrypt(
           Utils.toArray(this.fields[fieldName], 'base64')
@@ -117,7 +119,6 @@ export class VerifiableCertificate extends Certificate {
     } catch (error) {
       throw new Error(
         `Failed to decrypt selectively revealed certificate fields using keyring: ${String(error instanceof Error ? error.message : error)}`
-
       )
     }
   }

package/src/auth/clients/AuthFetch.ts

@@ -3,7 +3,7 @@ import * as Utils from '../../primitives/utils.js'
 import Random from '../../primitives/Random.js'
 import P2PKH from '../../script/templates/P2PKH.js'
 import PublicKey from '../../primitives/PublicKey.js'
-import { WalletInterface } from '../../wallet/Wallet.interfaces.js'
+import { OriginatorDomainNameStringUnder250Bytes, WalletInterface } from '../../wallet/Wallet.interfaces.js'
 import { createNonce } from '../utils/createNonce.js'
 import { Peer } from '../Peer.js'
 import { SimplifiedFetchTransport } from '../transports/SimplifiedFetchTransport.js'
@@ -43,6 +43,7 @@ export class AuthFetch {
   private callbacks: Record<string, { resolve: Function, reject: Function }> = {}
   private readonly certificatesReceived: VerifiableCertificate[] = []
   private readonly requestedCertificates?: RequestedCertificateSet
+  private readonly originator?: OriginatorDomainNameStringUnder250Bytes
   peers: Record<string, AuthPeer> = {}
 
   /**
@@ -50,10 +51,11 @@ export class AuthFetch {
   * @param wallet - The wallet instance for signing and authentication.
   * @param requestedCertificates - Optional set of certificates to request from peers.
   */
-  constructor(wallet: WalletInterface, requestedCertificates?: RequestedCertificateSet, sessionManager?: SessionManager) {
+  constructor(wallet: WalletInterface, requestedCertificates?: RequestedCertificateSet, sessionManager?: SessionManager, originator?: OriginatorDomainNameStringUnder250Bytes) {
     this.wallet = wallet
     this.requestedCertificates = requestedCertificates
-    this.sessionManager = sessionManager || new SessionManager()
+    this.sessionManager = sessionManager ?? new SessionManager()
+    this.originator = originator
   }
 
   /**
@@ -91,7 +93,7 @@ export class AuthFetch {
           // Create a peer for the request
           const newTransport = new SimplifiedFetchTransport(baseURL)
           peerToUse = {
-            peer: new Peer(this.wallet, newTransport, this.requestedCertificates, this.sessionManager),
+            peer: new Peer(this.wallet, newTransport, this.requestedCertificates, this.sessionManager, undefined, this.originator),
             pendingCertificateRequests: []
           }
           this.peers[baseURL] = peerToUse
@@ -104,7 +106,8 @@ export class AuthFetch {
               const certificatesToInclude = await getVerifiableCertificates(
                 this.wallet,
                 requestedCertificates,
-                verifier
+                verifier,
+                this.originator
               )
               await this.peers[baseURL].peer.sendCertificateResponse(verifier, certificatesToInclude)
             } finally {
@@ -268,7 +271,8 @@ export class AuthFetch {
           this.wallet,
           newTransport,
           this.requestedCertificates,
-          this.sessionManager
+          this.sessionManager,
+          this.originator
         )
       }
       this.peers[baseURL] = peerToUse
@@ -460,7 +464,7 @@ export class AuthFetch {
     }
 
     const serverIdentityKey = originalResponse.headers.get('x-bsv-auth-identity-key')
-    if (!serverIdentityKey) {
+    if (typeof serverIdentityKey !== 'string') {
       throw new Error('Missing x-bsv-auth-identity-key response header.')
     }
 
@@ -470,14 +474,14 @@ export class AuthFetch {
     }
 
     // Create a random suffix for the derivation path
-    const derivationSuffix = await createNonce(this.wallet)
+    const derivationSuffix = await createNonce(this.wallet, undefined, this.originator)
 
     // Derive the script hex from the server identity key
     const { publicKey: derivedPublicKey } = await this.wallet.getPublicKey({
       protocolID: [2, '3241645161d8'], // wallet payment protocol
       keyID: `${derivationPrefix} ${derivationSuffix}`,
       counterparty: serverIdentityKey
-    })
+    }, this.originator)
     const lockingScript = new P2PKH().lock(PublicKey.fromString(derivedPublicKey).toAddress()).toHex()
 
     // Create the payment transaction using createAction
@@ -492,7 +496,7 @@ export class AuthFetch {
       options: {
         randomizeOutputs: false
       }
-    })
+    }, this.originator)
 
 
 

package/src/auth/utils/__tests/getVerifiableCertificates.test.ts

@@ -52,13 +52,13 @@ describe('getVerifiableCertificates', () => {
     expect(mockWallet.listCertificates).toHaveBeenCalledWith({
       certifiers: requestedCertificates.certifiers,
       types: Object.keys(requestedCertificates.types)
-    })
+    }, undefined)
 
     expect(mockWallet.proveCertificate).toHaveBeenCalledWith({
       certificate: mockCertificate,
       fieldsToReveal: requestedCertificates.types[mockCertificate.type],
       verifier: verifierIdentityKey
-    })
+    }, undefined)
 
     expect(result).toHaveLength(1)
     expect(result[0]).toBeInstanceOf(VerifiableCertificate)
@@ -147,6 +147,6 @@ describe('getVerifiableCertificates', () => {
     expect(mockWallet.listCertificates).toHaveBeenCalledWith({
       certifiers: [],
       types: []
-    })
+    }, undefined)
   })
 })

package/src/auth/utils/__tests/validateCertificates.test.ts

@@ -79,7 +79,7 @@ describe('validateCertificates', () => {
       message.certificates.length
     )
     expect(mockVerify).toHaveBeenCalledTimes(message.certificates.length)
-    expect(mockDecryptFields).toHaveBeenCalledWith(verifierWallet)
+    expect(mockDecryptFields).toHaveBeenCalledWith(verifierWallet, undefined, undefined, undefined)
   })
 
   it('throws an error for mismatched identity key', async () => {
@@ -127,7 +127,7 @@ describe('validateCertificates', () => {
       validateCertificates(verifierWallet, message)
     ).resolves.not.toThrow()
     for (const instance of mockInstances) {
-      expect(instance.decryptFields).toHaveBeenCalledWith(verifierWallet)
+      expect(instance.decryptFields).toHaveBeenCalledWith(verifierWallet, undefined, undefined, undefined)
     }
   })
 
@@ -158,7 +158,7 @@ describe('validateCertificates', () => {
     expect(VerifiableCertificate).toHaveBeenCalledTimes(2)
     expect(mockVerify).toHaveBeenCalledTimes(2)
     for (const instance of mockInstances) {
-      expect(instance.decryptFields).toHaveBeenCalledWith(verifierWallet)
+      expect(instance.decryptFields).toHaveBeenCalledWith(verifierWallet, undefined, undefined, undefined)
     }
   })
 })