@bsv/wallet-toolbox 1.6.40 → 1.6.42

package/out/src/WalletPermissionsManager.js

@@ -93,8 +93,9 @@ class WalletPermissionsManager {
         this.activeRequests = new Map();
         /** Cache recently confirmed permissions to avoid repeated lookups. */
         this.permissionCache = new Map();
+        this.recentGrants = new Map();
         this.underlying = underlyingWallet;
-        this.adminOriginator = adminOriginator;
+        this.adminOriginator = this.normalizeOriginator(adminOriginator) || adminOriginator;
         // Default all config options to true unless specified
         this.config = {
             seekProtocolPermissionsForSigning: true,
@@ -212,20 +213,22 @@ class WalletPermissionsManager {
             const request = matching.request;
             if (!request.renewal) {
                 // brand-new permission token
-                await this.createPermissionOnChain(request, params.expiry || Math.floor(Date.now() / 1000) + 3600 * 24 * 30, // default 30-day expiry
+                await this.createPermissionOnChain(request, params.expiry || 0, // default: never expires
                 params.amount);
             }
             else {
                 // renewal => spend the old token, produce a new one
-                await this.renewPermissionOnChain(request.previousToken, request, params.expiry || Math.floor(Date.now() / 1000) + 3600 * 24 * 30, params.amount);
+                await this.renewPermissionOnChain(request.previousToken, request, params.expiry || 0, // default: never expires
+                params.amount);
             }
         }
         // Only cache non-ephemeral permissions
         // Ephemeral permissions should not be cached as they are one-time authorizations
         if (!params.ephemeral) {
-            const expiry = params.expiry || Math.floor(Date.now() / 1000) + 3600 * 24 * 30;
+            const expiry = params.expiry || 0; // default: never expires
             const key = this.buildRequestKey(matching.request);
             this.cachePermission(key, expiry);
+            this.markRecentGrant(matching.request);
         }
     }
     /**
@@ -259,7 +262,8 @@ class WalletPermissionsManager {
             throw new Error('Request ID not found.');
         }
         const originalRequest = matching.request;
-        const { originator, permissions: requestedPermissions } = originalRequest;
+        const { originator, permissions: requestedPermissions, displayOriginator } = originalRequest;
+        const originLookupValues = this.buildOriginatorLookupValues(displayOriginator, originator);
         // --- Validation: Ensure granted permissions are a subset of what was requested ---
         if (params.granted.spendingAuthorization &&
             !deepEqual(params.granted.spendingAuthorization, requestedPermissions.spendingAuthorization)) {
@@ -275,7 +279,7 @@ class WalletPermissionsManager {
             throw new Error('Granted certificate access permissions are not a subset of the original request.');
         }
         // --- End Validation ---
-        const expiry = params.expiry || Math.floor(Date.now() / 1000) + 3600 * 24 * 30; // 30-day default
+        const expiry = params.expiry || 0; // default: never expires
         if (params.granted.spendingAuthorization) {
             await this.createPermissionOnChain({
                 type: 'spending',
@@ -287,33 +291,39 @@ class WalletPermissionsManager {
         }
         for (const p of params.granted.protocolPermissions || []) {
             const token = await this.findProtocolToken(originator, false, // No privileged protocols allowed in groups for added security.
-            p.protocolID, p.counterparty || 'self', true);
+            p.protocolID, p.counterparty || 'self', true, originLookupValues);
             if (token) {
-                await this.renewPermissionOnChain(token, {
+                const request = {
                     type: 'protocol',
                     originator,
                     privileged: false, // No privileged protocols allowed in groups for added security.
                     protocolID: p.protocolID,
                     counterparty: p.counterparty || 'self',
                     reason: p.description
-                }, expiry);
+                };
+                await this.renewPermissionOnChain(token, request, expiry);
+                this.markRecentGrant(request);
             }
             else {
-                await this.createPermissionOnChain({
+                const request = {
                     type: 'protocol',
                     originator,
                     privileged: false, // No privileged protocols allowed in groups for added security.
                     protocolID: p.protocolID,
                     counterparty: p.counterparty || 'self',
                     reason: p.description
-                }, expiry);
+                };
+                await this.createPermissionOnChain(request, expiry);
+                this.markRecentGrant(request);
             }
         }
         for (const b of params.granted.basketAccess || []) {
-            await this.createPermissionOnChain({ type: 'basket', originator, basket: b.basket, reason: b.description }, expiry);
+            const request = { type: 'basket', originator, basket: b.basket, reason: b.description };
+            await this.createPermissionOnChain(request, expiry);
+            this.markRecentGrant(request);
         }
         for (const c of params.granted.certificateAccess || []) {
-            await this.createPermissionOnChain({
+            const request = {
                 type: 'certificate',
                 originator,
                 privileged: false, // No certificates on the privileged identity are allowed as part of groups.
@@ -323,7 +333,9 @@ class WalletPermissionsManager {
                     fields: c.fields
                 },
                 reason: c.description
-            }, expiry);
+            };
+            await this.createPermissionOnChain(request, expiry);
+            this.markRecentGrant(request);
         }
         // Resolve all pending promises for this request
         for (const p of matching.pending) {
@@ -355,6 +367,8 @@ class WalletPermissionsManager {
      * If no valid (unexpired) permission token is found, triggers a permission request flow.
      */
     async ensureProtocolPermission({ originator, privileged, protocolID, counterparty, reason, seekPermission = true, usageType }) {
+        const { normalized: normalizedOriginator, lookupValues } = this.prepareOriginator(originator);
+        originator = normalizedOriginator;
         // 1) adminOriginator can do anything
         if (this.isAdminOriginator(originator))
             return true;
@@ -398,9 +412,12 @@ class WalletPermissionsManager {
         if (this.isPermissionCached(cacheKey)) {
             return true;
         }
+        if (this.isRecentlyGranted(cacheKey)) {
+            return true;
+        }
         // 4) Attempt to find a valid token in the internal basket
         const token = await this.findProtocolToken(originator, privileged, protocolID, counterparty, 
-        /*includeExpired=*/ true);
+        /*includeExpired=*/ true, lookupValues);
         if (token) {
             if (!this.isTokenExpired(token.expiry)) {
                 // valid and unexpired
@@ -446,6 +463,8 @@ class WalletPermissionsManager {
      * If not, triggers a permission request flow.
      */
     async ensureBasketAccess({ originator, basket, reason, seekPermission = true, usageType }) {
+        const { normalized: normalizedOriginator, lookupValues } = this.prepareOriginator(originator);
+        originator = normalizedOriginator;
         if (this.isAdminOriginator(originator))
             return true;
         if (this.isAdminBasket(basket)) {
@@ -461,7 +480,10 @@ class WalletPermissionsManager {
         if (this.isPermissionCached(cacheKey)) {
             return true;
         }
-        const token = await this.findBasketToken(originator, basket, true);
+        if (this.isRecentlyGranted(cacheKey)) {
+            return true;
+        }
+        const token = await this.findBasketToken(originator, basket, true, lookupValues);
         if (token) {
             if (!this.isTokenExpired(token.expiry)) {
                 this.cachePermission(cacheKey, token.expiry);
@@ -501,6 +523,8 @@ class WalletPermissionsManager {
      * This is relevant when revealing certificate fields in DCAP contexts.
      */
     async ensureCertificateAccess({ originator, privileged, verifier, certType, fields, reason, seekPermission = true, usageType }) {
+        const { normalized: normalizedOriginator, lookupValues } = this.prepareOriginator(originator);
+        originator = normalizedOriginator;
         if (this.isAdminOriginator(originator))
             return true;
         if (usageType === 'disclosure' && !this.config.seekCertificateDisclosurePermissions) {
@@ -518,8 +542,11 @@ class WalletPermissionsManager {
         if (this.isPermissionCached(cacheKey)) {
             return true;
         }
+        if (this.isRecentlyGranted(cacheKey)) {
+            return true;
+        }
         const token = await this.findCertificateToken(originator, privileged, verifier, certType, fields, 
-        /*includeExpired=*/ true);
+        /*includeExpired=*/ true, lookupValues);
         if (token) {
             if (!this.isTokenExpired(token.expiry)) {
                 this.cachePermission(cacheKey, token.expiry);
@@ -560,6 +587,8 @@ class WalletPermissionsManager {
      * If the existing token limit is insufficient, attempts to renew. If no token, attempts to create one.
      */
     async ensureSpendingAuthorization({ originator, satoshis, lineItems, reason, seekPermission = true }) {
+        const { normalized: normalizedOriginator, lookupValues } = this.prepareOriginator(originator);
+        originator = normalizedOriginator;
         if (this.isAdminOriginator(originator))
             return true;
         if (!this.config.seekSpendingPermissions) {
@@ -570,7 +599,7 @@ class WalletPermissionsManager {
         if (this.isPermissionCached(cacheKey)) {
             return true;
         }
-        const token = await this.findSpendingToken(originator);
+        const token = await this.findSpendingToken(originator, lookupValues);
         if (token === null || token === void 0 ? void 0 : token.authorizedAmount) {
             // Check how much has been spent so far
             const spentSoFar = await this.querySpentSince(token);
@@ -612,6 +641,8 @@ class WalletPermissionsManager {
      * If no valid (unexpired) permission token is found, triggers a permission request flow.
      */
     async ensureLabelAccess({ originator, label, reason, seekPermission = true, usageType }) {
+        const { normalized: normalizedOriginator } = this.prepareOriginator(originator);
+        originator = normalizedOriginator;
         // 1) adminOriginator can do anything
         if (this.isAdminOriginator(originator))
             return true;
@@ -654,7 +685,14 @@ class WalletPermissionsManager {
      *   and return a promise that resolves once permission is granted or rejects if denied.
      */
     async requestPermissionFlow(r) {
-        const key = this.buildRequestKey(r);
+        var _a;
+        const normalizedOriginator = this.normalizeOriginator(r.originator) || r.originator;
+        const preparedRequest = {
+            ...r,
+            originator: normalizedOriginator,
+            displayOriginator: (_a = r.displayOriginator) !== null && _a !== void 0 ? _a : r.originator
+        };
+        const key = this.buildRequestKey(preparedRequest);
         // If there's already a queue for the same resource, we piggyback on it
         const existingQueue = this.activeRequests.get(key);
         if (existingQueue && existingQueue.pending.length > 0) {
@@ -666,32 +704,32 @@ class WalletPermissionsManager {
         // Return a promise that resolves or rejects once the user grants/denies
         return new Promise(async (resolve, reject) => {
             this.activeRequests.set(key, {
-                request: r,
+                request: preparedRequest,
                 pending: [{ resolve, reject }]
             });
             // Fire the relevant onXXXRequested event (which one depends on r.type)
-            switch (r.type) {
+            switch (preparedRequest.type) {
                 case 'protocol':
                     await this.callEvent('onProtocolPermissionRequested', {
-                        ...r,
+                        ...preparedRequest,
                         requestID: key
                     });
                     break;
                 case 'basket':
                     await this.callEvent('onBasketAccessRequested', {
-                        ...r,
+                        ...preparedRequest,
                         requestID: key
                     });
                     break;
                 case 'certificate':
                     await this.callEvent('onCertificateAccessRequested', {
-                        ...r,
+                        ...preparedRequest,
                         requestID: key
                     });
                     break;
                 case 'spending':
                     await this.callEvent('onSpendingAuthorizationRequested', {
-                        ...r,
+                        ...preparedRequest,
                         requestID: key
                     });
                     break;
@@ -761,250 +799,284 @@ class WalletPermissionsManager {
         return expiry > 0 && expiry < now;
     }
     /** Looks for a DPACP permission token matching origin/domain, privileged, protocol, cpty. */
-    async findProtocolToken(originator, privileged, protocolID, counterparty, includeExpired) {
+    async findProtocolToken(originator, privileged, protocolID, counterparty, includeExpired, originatorLookupValues) {
         const [secLevel, protoName] = protocolID;
-        const tags = [
-            `originator ${originator}`,
-            `privileged ${!!privileged}`,
-            `protocolName ${protoName}`,
-            `protocolSecurityLevel ${secLevel}`
-        ];
-        if (secLevel === 2) {
-            tags.push(`counterparty ${counterparty}`);
-        }
-        const result = await this.underlying.listOutputs({
-            basket: BASKET_MAP.protocol,
-            tags,
-            tagQueryMode: 'all',
-            include: 'entire transactions'
-        }, this.adminOriginator);
-        for (const out of result.outputs) {
-            const [txid, outputIndexStr] = out.outpoint.split('.');
-            const tx = sdk_1.Transaction.fromBEEF(result.BEEF, txid);
-            const dec = sdk_1.PushDrop.decode(tx.outputs[Number(outputIndexStr)].lockingScript);
-            if (!dec || !dec.fields || dec.fields.length < 6)
-                continue;
-            const domainRaw = dec.fields[0];
-            const expiryRaw = dec.fields[1];
-            const privRaw = dec.fields[2];
-            const secLevelRaw = dec.fields[3];
-            const protoNameRaw = dec.fields[4];
-            const counterpartyRaw = dec.fields[5];
-            const domainDecoded = sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(domainRaw));
-            const expiryDecoded = parseInt(sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(expiryRaw)), 10);
-            const privDecoded = sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(privRaw)) === 'true';
-            const secLevelDecoded = parseInt(sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(secLevelRaw)), 10);
-            const protoNameDecoded = sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(protoNameRaw));
-            const cptyDecoded = sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(counterpartyRaw));
-            if (domainDecoded !== originator ||
-                privDecoded !== !!privileged ||
-                secLevelDecoded !== secLevel ||
-                protoNameDecoded !== protoName ||
-                (secLevelDecoded === 2 && cptyDecoded !== counterparty)) {
-                continue;
+        const originsToTry = (originatorLookupValues === null || originatorLookupValues === void 0 ? void 0 : originatorLookupValues.length) ? originatorLookupValues : [originator];
+        for (const originTag of originsToTry) {
+            const tags = [
+                `originator ${originTag}`,
+                `privileged ${!!privileged}`,
+                `protocolName ${protoName}`,
+                `protocolSecurityLevel ${secLevel}`
+            ];
+            if (secLevel === 2) {
+                tags.push(`counterparty ${counterparty}`);
             }
-            if (!includeExpired && this.isTokenExpired(expiryDecoded)) {
-                continue;
+            const result = await this.underlying.listOutputs({
+                basket: BASKET_MAP.protocol,
+                tags,
+                tagQueryMode: 'all',
+                include: 'entire transactions'
+            }, this.adminOriginator);
+            for (const out of result.outputs) {
+                const [txid, outputIndexStr] = out.outpoint.split('.');
+                const tx = sdk_1.Transaction.fromBEEF(result.BEEF, txid);
+                const dec = sdk_1.PushDrop.decode(tx.outputs[Number(outputIndexStr)].lockingScript);
+                if (!dec || !dec.fields || dec.fields.length < 6)
+                    continue;
+                const domainRaw = dec.fields[0];
+                const expiryRaw = dec.fields[1];
+                const privRaw = dec.fields[2];
+                const secLevelRaw = dec.fields[3];
+                const protoNameRaw = dec.fields[4];
+                const counterpartyRaw = dec.fields[5];
+                const domainDecoded = sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(domainRaw));
+                const normalizedDomain = this.normalizeOriginator(domainDecoded);
+                if (normalizedDomain !== originator) {
+                    continue;
+                }
+                const expiryDecoded = parseInt(sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(expiryRaw)), 10);
+                const privDecoded = sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(privRaw)) === 'true';
+                const secLevelDecoded = parseInt(sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(secLevelRaw)), 10);
+                const protoNameDecoded = sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(protoNameRaw));
+                const cptyDecoded = sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(counterpartyRaw));
+                if (privDecoded !== !!privileged ||
+                    secLevelDecoded !== secLevel ||
+                    protoNameDecoded !== protoName ||
+                    (secLevelDecoded === 2 && cptyDecoded !== counterparty)) {
+                    continue;
+                }
+                if (!includeExpired && this.isTokenExpired(expiryDecoded)) {
+                    continue;
+                }
+                return {
+                    tx: tx.toBEEF(),
+                    txid: out.outpoint.split('.')[0],
+                    outputIndex: parseInt(out.outpoint.split('.')[1], 10),
+                    outputScript: tx.outputs[Number(outputIndexStr)].lockingScript.toHex(),
+                    satoshis: out.satoshis,
+                    originator,
+                    rawOriginator: domainDecoded,
+                    privileged,
+                    protocol: protoName,
+                    securityLevel: secLevel,
+                    expiry: expiryDecoded,
+                    counterparty: cptyDecoded
+                };
             }
-            return {
-                tx: tx.toBEEF(),
-                txid: out.outpoint.split('.')[0],
-                outputIndex: parseInt(out.outpoint.split('.')[1], 10),
-                outputScript: tx.outputs[Number(outputIndexStr)].lockingScript.toHex(),
-                satoshis: out.satoshis,
-                originator,
-                privileged,
-                protocol: protoName,
-                securityLevel: secLevel,
-                expiry: expiryDecoded,
-                counterparty: cptyDecoded
-            };
         }
         return undefined;
     }
     /** Finds ALL DPACP permission tokens matching origin/domain, privileged, protocol, cpty. Never filters by expiry. */
-    async findAllProtocolTokens(originator, privileged, protocolID, counterparty) {
+    async findAllProtocolTokens(originator, privileged, protocolID, counterparty, originatorLookupValues) {
         const [secLevel, protoName] = protocolID;
-        const tags = [
-            `originator ${originator}`,
-            `privileged ${!!privileged}`,
-            `protocolName ${protoName}`,
-            `protocolSecurityLevel ${secLevel}`
-        ];
-        if (secLevel === 2) {
-            tags.push(`counterparty ${counterparty}`);
-        }
-        const result = await this.underlying.listOutputs({
-            basket: BASKET_MAP.protocol,
-            tags,
-            tagQueryMode: 'all',
-            include: 'entire transactions'
-        }, this.adminOriginator);
+        const originsToTry = (originatorLookupValues === null || originatorLookupValues === void 0 ? void 0 : originatorLookupValues.length) ? originatorLookupValues : [originator];
         const matches = [];
-        for (const out of result.outputs) {
-            const [txid, outputIndexStr] = out.outpoint.split('.');
-            const tx = sdk_1.Transaction.fromBEEF(result.BEEF, txid);
-            const vout = Number(outputIndexStr);
-            const dec = sdk_1.PushDrop.decode(tx.outputs[vout].lockingScript);
-            if (!dec || !dec.fields || dec.fields.length < 6)
-                continue;
-            const domainRaw = dec.fields[0];
-            const expiryRaw = dec.fields[1];
-            const privRaw = dec.fields[2];
-            const secLevelRaw = dec.fields[3];
-            const protoNameRaw = dec.fields[4];
-            const counterpartyRaw = dec.fields[5];
-            // Decrypt all fields
-            const domainDecoded = sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(domainRaw));
-            const expiryDecoded = parseInt(sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(expiryRaw)), 10);
-            const privDecoded = sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(privRaw)) === 'true';
-            const secLevelDecoded = parseInt(sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(secLevelRaw)), 10);
-            const protoNameDecoded = sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(protoNameRaw));
-            const cptyDecoded = sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(counterpartyRaw));
-            // Strict attribute match; NO expiry filtering
-            if (domainDecoded !== originator ||
-                privDecoded !== !!privileged ||
-                secLevelDecoded !== secLevel ||
-                protoNameDecoded !== protoName ||
-                (secLevelDecoded === 2 && cptyDecoded !== counterparty)) {
-                continue;
+        const seen = new Set();
+        for (const originTag of originsToTry) {
+            const tags = [
+                `originator ${originTag}`,
+                `privileged ${!!privileged}`,
+                `protocolName ${protoName}`,
+                `protocolSecurityLevel ${secLevel}`
+            ];
+            if (secLevel === 2) {
+                tags.push(`counterparty ${counterparty}`);
+            }
+            const result = await this.underlying.listOutputs({
+                basket: BASKET_MAP.protocol,
+                tags,
+                tagQueryMode: 'all',
+                include: 'entire transactions'
+            }, this.adminOriginator);
+            for (const out of result.outputs) {
+                if (seen.has(out.outpoint))
+                    continue;
+                const [txid, outputIndexStr] = out.outpoint.split('.');
+                const tx = sdk_1.Transaction.fromBEEF(result.BEEF, txid);
+                const vout = Number(outputIndexStr);
+                const dec = sdk_1.PushDrop.decode(tx.outputs[vout].lockingScript);
+                if (!dec || !dec.fields || dec.fields.length < 6)
+                    continue;
+                const domainRaw = dec.fields[0];
+                const expiryRaw = dec.fields[1];
+                const privRaw = dec.fields[2];
+                const secLevelRaw = dec.fields[3];
+                const protoNameRaw = dec.fields[4];
+                const counterpartyRaw = dec.fields[5];
+                const domainDecoded = sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(domainRaw));
+                const normalizedDomain = this.normalizeOriginator(domainDecoded);
+                if (normalizedDomain !== originator) {
+                    continue;
+                }
+                const expiryDecoded = parseInt(sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(expiryRaw)), 10);
+                const privDecoded = sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(privRaw)) === 'true';
+                const secLevelDecoded = parseInt(sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(secLevelRaw)), 10);
+                const protoNameDecoded = sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(protoNameRaw));
+                const cptyDecoded = sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(counterpartyRaw));
+                if (privDecoded !== !!privileged ||
+                    secLevelDecoded !== secLevel ||
+                    protoNameDecoded !== protoName ||
+                    (secLevelDecoded === 2 && cptyDecoded !== counterparty)) {
+                    continue;
+                }
+                seen.add(out.outpoint);
+                matches.push({
+                    tx: tx.toBEEF(),
+                    txid,
+                    outputIndex: vout,
+                    outputScript: tx.outputs[vout].lockingScript.toHex(),
+                    satoshis: out.satoshis,
+                    originator,
+                    rawOriginator: domainDecoded,
+                    privileged,
+                    protocol: protoName,
+                    securityLevel: secLevel,
+                    expiry: expiryDecoded,
+                    counterparty: cptyDecoded
+                });
             }
-            matches.push({
-                tx: tx.toBEEF(),
-                txid,
-                outputIndex: vout,
-                outputScript: tx.outputs[vout].lockingScript.toHex(),
-                satoshis: out.satoshis,
-                originator,
-                privileged,
-                protocol: protoName,
-                securityLevel: secLevel,
-                expiry: expiryDecoded,
-                counterparty: cptyDecoded
-            });
         }
         return matches;
     }
     /** Looks for a DBAP token matching (originator, basket). */
-    async findBasketToken(originator, basket, includeExpired) {
-        const result = await this.underlying.listOutputs({
-            basket: BASKET_MAP.basket,
-            tags: [`originator ${originator}`, `basket ${basket}`],
-            tagQueryMode: 'all',
-            include: 'entire transactions'
-        }, this.adminOriginator);
-        for (const out of result.outputs) {
-            const [txid, outputIndexStr] = out.outpoint.split('.');
-            const tx = sdk_1.Transaction.fromBEEF(result.BEEF, txid);
-            const dec = sdk_1.PushDrop.decode(tx.outputs[Number(outputIndexStr)].lockingScript);
-            if (!(dec === null || dec === void 0 ? void 0 : dec.fields) || dec.fields.length < 3)
-                continue;
-            const domainRaw = dec.fields[0];
-            const expiryRaw = dec.fields[1];
-            const basketRaw = dec.fields[2];
-            const domainDecoded = sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(domainRaw));
-            const expiryDecoded = parseInt(sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(expiryRaw)), 10);
-            const basketDecoded = sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(basketRaw));
-            if (domainDecoded !== originator || basketDecoded !== basket)
-                continue;
-            if (!includeExpired && this.isTokenExpired(expiryDecoded))
-                continue;
-            return {
-                tx: tx.toBEEF(),
-                txid: out.outpoint.split('.')[0],
-                outputIndex: parseInt(out.outpoint.split('.')[1], 10),
-                outputScript: tx.outputs[Number(outputIndexStr)].lockingScript.toHex(),
-                satoshis: out.satoshis,
-                originator,
-                basketName: basketDecoded,
-                expiry: expiryDecoded
-            };
+    async findBasketToken(originator, basket, includeExpired, originatorLookupValues) {
+        const originsToTry = (originatorLookupValues === null || originatorLookupValues === void 0 ? void 0 : originatorLookupValues.length) ? originatorLookupValues : [originator];
+        for (const originTag of originsToTry) {
+            const result = await this.underlying.listOutputs({
+                basket: BASKET_MAP.basket,
+                tags: [`originator ${originTag}`, `basket ${basket}`],
+                tagQueryMode: 'all',
+                include: 'entire transactions'
+            }, this.adminOriginator);
+            for (const out of result.outputs) {
+                const [txid, outputIndexStr] = out.outpoint.split('.');
+                const tx = sdk_1.Transaction.fromBEEF(result.BEEF, txid);
+                const dec = sdk_1.PushDrop.decode(tx.outputs[Number(outputIndexStr)].lockingScript);
+                if (!(dec === null || dec === void 0 ? void 0 : dec.fields) || dec.fields.length < 3)
+                    continue;
+                const domainRaw = dec.fields[0];
+                const expiryRaw = dec.fields[1];
+                const basketRaw = dec.fields[2];
+                const domainDecoded = sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(domainRaw));
+                const normalizedDomain = this.normalizeOriginator(domainDecoded);
+                if (normalizedDomain !== originator) {
+                    continue;
+                }
+                const expiryDecoded = parseInt(sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(expiryRaw)), 10);
+                const basketDecoded = sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(basketRaw));
+                if (basketDecoded !== basket)
+                    continue;
+                if (!includeExpired && this.isTokenExpired(expiryDecoded))
+                    continue;
+                return {
+                    tx: tx.toBEEF(),
+                    txid: out.outpoint.split('.')[0],
+                    outputIndex: parseInt(out.outpoint.split('.')[1], 10),
+                    outputScript: tx.outputs[Number(outputIndexStr)].lockingScript.toHex(),
+                    satoshis: out.satoshis,
+                    originator,
+                    rawOriginator: domainDecoded,
+                    basketName: basketDecoded,
+                    expiry: expiryDecoded
+                };
+            }
         }
         return undefined;
     }
     /** Looks for a DCAP token matching (origin, privileged, verifier, certType, fields subset). */
-    async findCertificateToken(originator, privileged, verifier, certType, fields, includeExpired) {
-        const result = await this.underlying.listOutputs({
-            basket: BASKET_MAP.certificate,
-            tags: [`originator ${originator}`, `privileged ${!!privileged}`, `type ${certType}`, `verifier ${verifier}`],
-            tagQueryMode: 'all',
-            include: 'entire transactions'
-        }, this.adminOriginator);
-        for (const out of result.outputs) {
-            const [txid, outputIndexStr] = out.outpoint.split('.');
-            const tx = sdk_1.Transaction.fromBEEF(result.BEEF, txid);
-            const dec = sdk_1.PushDrop.decode(tx.outputs[Number(outputIndexStr)].lockingScript);
-            if (!(dec === null || dec === void 0 ? void 0 : dec.fields) || dec.fields.length < 6)
-                continue;
-            const [domainRaw, expiryRaw, privRaw, typeRaw, fieldsRaw, verifierRaw] = dec.fields;
-            const domainDecoded = sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(domainRaw));
-            const expiryDecoded = parseInt(sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(expiryRaw)), 10);
-            const privDecoded = sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(privRaw)) === 'true';
-            const typeDecoded = sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(typeRaw));
-            const verifierDec = sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(verifierRaw));
-            const fieldsJson = await this.decryptPermissionTokenField(fieldsRaw);
-            const allFields = JSON.parse(sdk_1.Utils.toUTF8(fieldsJson));
-            if (domainDecoded !== originator ||
-                privDecoded !== !!privileged ||
-                typeDecoded !== certType ||
-                verifierDec !== verifier) {
-                continue;
-            }
-            // Check if 'fields' is a subset of 'allFields'
-            const setAll = new Set(allFields);
-            if (fields.some(f => !setAll.has(f))) {
-                continue;
-            }
-            if (!includeExpired && this.isTokenExpired(expiryDecoded)) {
-                continue;
+    async findCertificateToken(originator, privileged, verifier, certType, fields, includeExpired, originatorLookupValues) {
+        const originsToTry = (originatorLookupValues === null || originatorLookupValues === void 0 ? void 0 : originatorLookupValues.length) ? originatorLookupValues : [originator];
+        for (const originTag of originsToTry) {
+            const result = await this.underlying.listOutputs({
+                basket: BASKET_MAP.certificate,
+                tags: [`originator ${originTag}`, `privileged ${!!privileged}`, `type ${certType}`, `verifier ${verifier}`],
+                tagQueryMode: 'all',
+                include: 'entire transactions'
+            }, this.adminOriginator);
+            for (const out of result.outputs) {
+                const [txid, outputIndexStr] = out.outpoint.split('.');
+                const tx = sdk_1.Transaction.fromBEEF(result.BEEF, txid);
+                const dec = sdk_1.PushDrop.decode(tx.outputs[Number(outputIndexStr)].lockingScript);
+                if (!(dec === null || dec === void 0 ? void 0 : dec.fields) || dec.fields.length < 6)
+                    continue;
+                const [domainRaw, expiryRaw, privRaw, typeRaw, fieldsRaw, verifierRaw] = dec.fields;
+                const domainDecoded = sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(domainRaw));
+                const normalizedDomain = this.normalizeOriginator(domainDecoded);
+                if (normalizedDomain !== originator) {
+                    continue;
+                }
+                const expiryDecoded = parseInt(sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(expiryRaw)), 10);
+                const privDecoded = sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(privRaw)) === 'true';
+                const typeDecoded = sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(typeRaw));
+                const verifierDec = sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(verifierRaw));
+                const fieldsJson = await this.decryptPermissionTokenField(fieldsRaw);
+                const allFields = JSON.parse(sdk_1.Utils.toUTF8(fieldsJson));
+                if (privDecoded !== !!privileged || typeDecoded !== certType || verifierDec !== verifier) {
+                    continue;
+                }
+                // Check if 'fields' is a subset of 'allFields'
+                const setAll = new Set(allFields);
+                if (fields.some(f => !setAll.has(f))) {
+                    continue;
+                }
+                if (!includeExpired && this.isTokenExpired(expiryDecoded)) {
+                    continue;
+                }
+                return {
+                    tx: tx.toBEEF(),
+                    txid: out.outpoint.split('.')[0],
+                    outputIndex: parseInt(out.outpoint.split('.')[1], 10),
+                    outputScript: tx.outputs[Number(outputIndexStr)].lockingScript.toHex(),
+                    satoshis: out.satoshis,
+                    originator,
+                    rawOriginator: domainDecoded,
+                    privileged,
+                    verifier: verifierDec,
+                    certType: typeDecoded,
+                    certFields: allFields,
+                    expiry: expiryDecoded
+                };
             }
-            return {
-                tx: tx.toBEEF(),
-                txid: out.outpoint.split('.')[0],
-                outputIndex: parseInt(out.outpoint.split('.')[1], 10),
-                outputScript: tx.outputs[Number(outputIndexStr)].lockingScript.toHex(),
-                satoshis: out.satoshis,
-                originator,
-                privileged,
-                verifier: verifierDec,
-                certType: typeDecoded,
-                certFields: allFields,
-                expiry: expiryDecoded
-            };
         }
         return undefined;
     }
     /** Looks for a DSAP token matching origin, returning the first one found. */
-    async findSpendingToken(originator) {
-        const result = await this.underlying.listOutputs({
-            basket: BASKET_MAP.spending,
-            tags: [`originator ${originator}`],
-            tagQueryMode: 'all',
-            include: 'entire transactions'
-        }, this.adminOriginator);
-        for (const out of result.outputs) {
-            const [txid, outputIndexStr] = out.outpoint.split('.');
-            const tx = sdk_1.Transaction.fromBEEF(result.BEEF, txid);
-            const dec = sdk_1.PushDrop.decode(tx.outputs[Number(outputIndexStr)].lockingScript);
-            if (!(dec === null || dec === void 0 ? void 0 : dec.fields) || dec.fields.length < 2)
-                continue;
-            const domainRaw = dec.fields[0];
-            const amtRaw = dec.fields[1];
-            const domainDecoded = sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(domainRaw));
-            if (domainDecoded !== originator)
-                continue;
-            const amtDecodedStr = sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(amtRaw));
-            const authorizedAmount = parseInt(amtDecodedStr, 10);
-            return {
-                tx: tx.toBEEF(),
-                txid: out.outpoint.split('.')[0],
-                outputIndex: parseInt(out.outpoint.split('.')[1], 10),
-                outputScript: tx.outputs[Number(outputIndexStr)].lockingScript.toHex(),
-                satoshis: out.satoshis,
-                originator,
-                authorizedAmount,
-                expiry: 0 // Not time-limited, monthly authorization
-            };
+    async findSpendingToken(originator, originatorLookupValues) {
+        const originsToTry = (originatorLookupValues === null || originatorLookupValues === void 0 ? void 0 : originatorLookupValues.length) ? originatorLookupValues : [originator];
+        for (const originTag of originsToTry) {
+            const result = await this.underlying.listOutputs({
+                basket: BASKET_MAP.spending,
+                tags: [`originator ${originTag}`],
+                tagQueryMode: 'all',
+                include: 'entire transactions'
+            }, this.adminOriginator);
+            for (const out of result.outputs) {
+                const [txid, outputIndexStr] = out.outpoint.split('.');
+                const tx = sdk_1.Transaction.fromBEEF(result.BEEF, txid);
+                const dec = sdk_1.PushDrop.decode(tx.outputs[Number(outputIndexStr)].lockingScript);
+                if (!(dec === null || dec === void 0 ? void 0 : dec.fields) || dec.fields.length < 2)
+                    continue;
+                const domainRaw = dec.fields[0];
+                const amtRaw = dec.fields[1];
+                const domainDecoded = sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(domainRaw));
+                const normalizedDomain = this.normalizeOriginator(domainDecoded);
+                if (normalizedDomain !== originator)
+                    continue;
+                const amtDecodedStr = sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(amtRaw));
+                const authorizedAmount = parseInt(amtDecodedStr, 10);
+                return {
+                    tx: tx.toBEEF(),
+                    txid: out.outpoint.split('.')[0],
+                    outputIndex: parseInt(out.outpoint.split('.')[1], 10),
+                    outputScript: tx.outputs[Number(outputIndexStr)].lockingScript.toHex(),
+                    satoshis: out.satoshis,
+                    originator,
+                    rawOriginator: domainDecoded,
+                    authorizedAmount,
+                    expiry: 0 // Not time-limited, monthly authorization
+                };
+            }
         }
         return undefined;
     }
@@ -1023,11 +1095,16 @@ class WalletPermissionsManager {
      * Returns spending for an originator in the current calendar month.
      */
     async querySpentSince(token) {
-        const { actions } = await this.underlying.listActions({
-            labels: [`admin originator ${token.originator}`, `admin month ${this.getCurrentMonthYearUTC()}`],
-            labelQueryMode: 'all'
-        }, this.adminOriginator);
-        return actions.reduce((a, e) => a + e.satoshis, 0);
+        const labelOrigins = this.buildOriginatorLookupValues(token.rawOriginator, token.originator);
+        let total = 0;
+        for (const labelOrigin of labelOrigins) {
+            const { actions } = await this.underlying.listActions({
+                labels: [`admin originator ${labelOrigin}`, `admin month ${this.getCurrentMonthYearUTC()}`],
+                labelQueryMode: 'all'
+            }, this.adminOriginator);
+            total += actions.reduce((a, e) => a + e.satoshis, 0);
+        }
+        return total;
     }
     /* ---------------------------------------------------------------------
      *  5) CREATE / RENEW / REVOKE PERMISSION TOKENS ON CHAIN
@@ -1042,6 +1119,8 @@ class WalletPermissionsManager {
      * @param amount   For DSAP, the authorized spending limit
      */
     async createPermissionOnChain(r, expiry, amount) {
+        const normalizedOriginator = this.normalizeOriginator(r.originator) || r.originator;
+        r.originator = normalizedOriginator;
         const basketName = BASKET_MAP[r.type];
         if (!basketName)
             return;
@@ -1077,8 +1156,14 @@ class WalletPermissionsManager {
         if (oldTokens.length < 2)
             throw new Error('Need at least 2 tokens to coalesce');
         // 1) Create a signable action with N inputs and a single renewed output
+        // Merge all input token BEEFs into a single BEEF structure
+        const inputBeef = new sdk_1.Beef();
+        for (const token of oldTokens) {
+            inputBeef.mergeBeef(sdk_1.Beef.fromBinary(token.tx));
+        }
         const { signableTransaction } = await this.createAction({
             description: (_a = opts === null || opts === void 0 ? void 0 : opts.description) !== null && _a !== void 0 ? _a : `Coalesce ${oldTokens.length} permission tokens`,
+            inputBEEF: inputBeef.toBinary(),
             inputs: oldTokens.map((t, i) => ({
                 outpoint: `${t.txid}.${t.outputIndex}`,
                 unlockingScriptLength: 74,
@@ -1102,13 +1187,14 @@ class WalletPermissionsManager {
         if (!(signableTransaction === null || signableTransaction === void 0 ? void 0 : signableTransaction.reference) || !signableTransaction.tx) {
             throw new Error('Failed to create signable transaction');
         }
-        // 2) Sign each input
+        // 2) Sign each input - each token needs its own unlocker with the correct locking script
         const partialTx = sdk_1.Transaction.fromAtomicBEEF(signableTransaction.tx);
         const pushdrop = new sdk_1.PushDrop(this.underlying);
-        const unlocker = pushdrop.unlock(WalletPermissionsManager.PERM_TOKEN_ENCRYPTION_PROTOCOL, '1', 'self');
         const spends = {};
         for (let i = 0; i < oldTokens.length; i++) {
-            // The signable transaction already contains the necessary prevout context
+            const token = oldTokens[i];
+            // Each token requires its own unlocker with the specific locking script
+            const unlocker = pushdrop.unlock(WalletPermissionsManager.PERM_TOKEN_ENCRYPTION_PROTOCOL, '1', 'self', 'all', false, 1, sdk_1.LockingScript.fromHex(token.outputScript));
             const unlockingScript = await unlocker.sign(partialTx, i);
             spends[i] = { unlockingScript: unlockingScript.toHex() };
         }
@@ -1131,21 +1217,21 @@ class WalletPermissionsManager {
      * @param newAmount For DSAP, the new authorized amount
      */
     async renewPermissionOnChain(oldToken, r, newExpiry, newAmount) {
+        r.originator = this.normalizeOriginator(r.originator) || r.originator;
         // 1) build new fields
         const newFields = await this.buildPushdropFields(r, newExpiry, newAmount);
         // 2) new script
         const newScript = await new sdk_1.PushDrop(this.underlying).lock(newFields, WalletPermissionsManager.PERM_TOKEN_ENCRYPTION_PROTOCOL, '1', 'self', true, true);
         const tags = this.buildTagsForRequest(r);
         // Check if there are multiple old tokens for the same parameters (shouldn't usually happen)
-        const oldTokens = await this.findAllProtocolTokens(oldToken.originator, oldToken.privileged, [oldToken.securityLevel, oldToken.protocol], oldToken.counterparty);
+        const oldTokens = await this.findAllProtocolTokens(oldToken.originator, oldToken.privileged, [oldToken.securityLevel, oldToken.protocol], oldToken.counterparty, this.buildOriginatorLookupValues(oldToken.rawOriginator, oldToken.originator));
         // If so, coalesce them into a single token first, to avoid bloat
         if (oldTokens.length > 1) {
-            const txid = await this.coalescePermissionTokens(oldTokens, newScript, {
+            await this.coalescePermissionTokens(oldTokens, newScript, {
                 tags,
                 basket: BASKET_MAP[r.type],
                 description: `Coalesce ${r.type} permission tokens`
             });
-            console.log('Coalesced permission tokens:', txid);
         }
         else {
             // Otherwise, just proceed with the single-token renewal
@@ -1245,7 +1331,9 @@ class WalletPermissionsManager {
                 tags.push(`privileged ${!!r.privileged}`);
                 tags.push(`protocolName ${r.protocolID[1]}`);
                 tags.push(`protocolSecurityLevel ${r.protocolID[0]}`);
-                tags.push(`counterparty ${r.counterparty}`);
+                if (r.protocolID[0] === 2) {
+                    tags.push(`counterparty ${r.counterparty}`);
+                }
                 break;
             }
             case 'basket': {
@@ -1279,56 +1367,70 @@ class WalletPermissionsManager {
      */
     async listProtocolPermissions({ originator, privileged, protocolName, protocolSecurityLevel, counterparty } = {}) {
         const basketName = BASKET_MAP.protocol;
-        const tags = [];
-        if (originator) {
-            tags.push(`originator ${originator}`);
-        }
+        const baseTags = [];
         if (privileged !== undefined) {
-            tags.push(`privileged ${!!privileged}`);
+            baseTags.push(`privileged ${!!privileged}`);
         }
         if (protocolName) {
-            tags.push(`protocolName ${protocolName}`);
+            baseTags.push(`protocolName ${protocolName}`);
         }
         if (protocolSecurityLevel !== undefined) {
-            tags.push(`protocolSecurityLevel ${protocolSecurityLevel}`);
+            baseTags.push(`protocolSecurityLevel ${protocolSecurityLevel}`);
         }
         if (counterparty) {
-            tags.push(`counterparty ${counterparty}`);
+            baseTags.push(`counterparty ${counterparty}`);
         }
-        const result = await this.underlying.listOutputs({
-            basket: basketName,
-            tags,
-            tagQueryMode: 'all',
-            include: 'entire transactions',
-            limit: 100
-        }, this.adminOriginator);
+        const originFilter = originator ? this.prepareOriginator(originator) : undefined;
+        const originVariants = originFilter ? originFilter.lookupValues : [undefined];
+        const seen = new Set();
         const tokens = [];
-        for (const out of result.outputs) {
-            const [txid, outputIndexStr] = out.outpoint.split('.');
-            const tx = sdk_1.Transaction.fromBEEF(result.BEEF, txid);
-            const dec = sdk_1.PushDrop.decode(tx.outputs[Number(outputIndexStr)].lockingScript);
-            if (!(dec === null || dec === void 0 ? void 0 : dec.fields) || dec.fields.length < 6)
-                continue;
-            const [domainRaw, expiryRaw, privRaw, secRaw, protoRaw, cptyRaw] = dec.fields;
-            const domainDec = sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(domainRaw));
-            const expiryDec = parseInt(sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(expiryRaw)), 10);
-            const privDec = sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(privRaw)) === 'true';
-            const secDec = parseInt(sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(secRaw)), 10);
-            const protoDec = sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(protoRaw));
-            const cptyDec = sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(cptyRaw));
-            tokens.push({
-                tx: tx.toBEEF(),
-                txid: out.outpoint.split('.')[0],
-                outputIndex: parseInt(out.outpoint.split('.')[1], 10),
-                outputScript: tx.outputs[Number(outputIndexStr)].lockingScript.toHex(),
-                satoshis: out.satoshis,
-                originator: domainDec,
-                expiry: expiryDec,
-                privileged: privDec,
-                securityLevel: secDec,
-                protocol: protoDec,
-                counterparty: cptyDec
-            });
+        for (const originTag of originVariants) {
+            const tags = [...baseTags];
+            if (originTag) {
+                tags.push(`originator ${originTag}`);
+            }
+            const result = await this.underlying.listOutputs({
+                basket: basketName,
+                tags,
+                tagQueryMode: 'all',
+                include: 'entire transactions',
+                limit: 100
+            }, this.adminOriginator);
+            for (const out of result.outputs) {
+                if (seen.has(out.outpoint))
+                    continue;
+                const [txid, outputIndexStr] = out.outpoint.split('.');
+                const tx = sdk_1.Transaction.fromBEEF(result.BEEF, txid);
+                const dec = sdk_1.PushDrop.decode(tx.outputs[Number(outputIndexStr)].lockingScript);
+                if (!(dec === null || dec === void 0 ? void 0 : dec.fields) || dec.fields.length < 6)
+                    continue;
+                const [domainRaw, expiryRaw, privRaw, secRaw, protoRaw, cptyRaw] = dec.fields;
+                const domainDec = sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(domainRaw));
+                const normalizedDomain = this.normalizeOriginator(domainDec);
+                if (originFilter && normalizedDomain !== originFilter.normalized) {
+                    continue;
+                }
+                const expiryDec = parseInt(sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(expiryRaw)), 10);
+                const privDec = sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(privRaw)) === 'true';
+                const secDec = parseInt(sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(secRaw)), 10);
+                const protoDec = sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(protoRaw));
+                const cptyDec = sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(cptyRaw));
+                seen.add(out.outpoint);
+                tokens.push({
+                    tx: tx.toBEEF(),
+                    txid: out.outpoint.split('.')[0],
+                    outputIndex: parseInt(out.outpoint.split('.')[1], 10),
+                    outputScript: tx.outputs[Number(outputIndexStr)].lockingScript.toHex(),
+                    satoshis: out.satoshis,
+                    originator: normalizedDomain,
+                    rawOriginator: domainDec,
+                    expiry: expiryDec,
+                    privileged: privDec,
+                    securityLevel: secDec,
+                    protocol: protoDec,
+                    counterparty: cptyDec
+                });
+            }
         }
         return tokens;
     }
@@ -1358,41 +1460,55 @@ class WalletPermissionsManager {
      */
     async listBasketAccess(params = {}) {
         const basketName = BASKET_MAP.basket;
-        const tags = [];
-        if (params.originator) {
-            tags.push(`originator ${params.originator}`);
-        }
+        const baseTags = [];
         if (params.basket) {
-            tags.push(`basket ${params.basket}`);
+            baseTags.push(`basket ${params.basket}`);
         }
-        const result = await this.underlying.listOutputs({
-            basket: basketName,
-            tags,
-            tagQueryMode: 'all',
-            include: 'entire transactions',
-            limit: 10000
-        }, this.adminOriginator);
+        const originFilter = params.originator ? this.prepareOriginator(params.originator) : undefined;
+        const originVariants = originFilter ? originFilter.lookupValues : [undefined];
+        const seen = new Set();
         const tokens = [];
-        for (const out of result.outputs) {
-            const [txid, outputIndexStr] = out.outpoint.split('.');
-            const tx = sdk_1.Transaction.fromBEEF(result.BEEF, txid);
-            const dec = sdk_1.PushDrop.decode(tx.outputs[Number(outputIndexStr)].lockingScript);
-            if (!(dec === null || dec === void 0 ? void 0 : dec.fields) || dec.fields.length < 3)
-                continue;
-            const [domainRaw, expiryRaw, basketRaw] = dec.fields;
-            const domainDecoded = sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(domainRaw));
-            const expiryDecoded = parseInt(sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(expiryRaw)), 10);
-            const basketDecoded = sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(basketRaw));
-            tokens.push({
-                tx: tx.toBEEF(),
-                txid: out.outpoint.split('.')[0],
-                outputIndex: parseInt(out.outpoint.split('.')[1], 10),
-                satoshis: out.satoshis,
-                outputScript: tx.outputs[Number(outputIndexStr)].lockingScript.toHex(),
-                originator: domainDecoded,
-                basketName: basketDecoded,
-                expiry: expiryDecoded
-            });
+        for (const originTag of originVariants) {
+            const tags = [...baseTags];
+            if (originTag) {
+                tags.push(`originator ${originTag}`);
+            }
+            const result = await this.underlying.listOutputs({
+                basket: basketName,
+                tags,
+                tagQueryMode: 'all',
+                include: 'entire transactions',
+                limit: 10000
+            }, this.adminOriginator);
+            for (const out of result.outputs) {
+                if (seen.has(out.outpoint))
+                    continue;
+                const [txid, outputIndexStr] = out.outpoint.split('.');
+                const tx = sdk_1.Transaction.fromBEEF(result.BEEF, txid);
+                const dec = sdk_1.PushDrop.decode(tx.outputs[Number(outputIndexStr)].lockingScript);
+                if (!(dec === null || dec === void 0 ? void 0 : dec.fields) || dec.fields.length < 3)
+                    continue;
+                const [domainRaw, expiryRaw, basketRaw] = dec.fields;
+                const domainDecoded = sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(domainRaw));
+                const normalizedDomain = this.normalizeOriginator(domainDecoded);
+                if (originFilter && normalizedDomain !== originFilter.normalized) {
+                    continue;
+                }
+                const expiryDecoded = parseInt(sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(expiryRaw)), 10);
+                const basketDecoded = sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(basketRaw));
+                seen.add(out.outpoint);
+                tokens.push({
+                    tx: tx.toBEEF(),
+                    txid: out.outpoint.split('.')[0],
+                    outputIndex: parseInt(out.outpoint.split('.')[1], 10),
+                    satoshis: out.satoshis,
+                    outputScript: tx.outputs[Number(outputIndexStr)].lockingScript.toHex(),
+                    originator: normalizedDomain,
+                    rawOriginator: domainDecoded,
+                    basketName: basketDecoded,
+                    expiry: expiryDecoded
+                });
+            }
         }
         return tokens;
     }
@@ -1480,54 +1596,68 @@ class WalletPermissionsManager {
      */
     async listCertificateAccess(params = {}) {
         const basketName = BASKET_MAP.certificate;
-        const tags = [];
-        if (params.originator) {
-            tags.push(`originator ${params.originator}`);
-        }
+        const baseTags = [];
         if (params.privileged !== undefined) {
-            tags.push(`privileged ${!!params.privileged}`);
+            baseTags.push(`privileged ${!!params.privileged}`);
         }
         if (params.certType) {
-            tags.push(`type ${params.certType}`);
+            baseTags.push(`type ${params.certType}`);
         }
         if (params.verifier) {
-            tags.push(`verifier ${params.verifier}`);
+            baseTags.push(`verifier ${params.verifier}`);
         }
-        const result = await this.underlying.listOutputs({
-            basket: basketName,
-            tags,
-            tagQueryMode: 'all',
-            include: 'entire transactions',
-            limit: 10000
-        }, this.adminOriginator);
+        const originFilter = params.originator ? this.prepareOriginator(params.originator) : undefined;
+        const originVariants = originFilter ? originFilter.lookupValues : [undefined];
+        const seen = new Set();
         const tokens = [];
-        for (const out of result.outputs) {
-            const [txid, outputIndexStr] = out.outpoint.split('.');
-            const tx = sdk_1.Transaction.fromBEEF(result.BEEF, txid);
-            const dec = sdk_1.PushDrop.decode(tx.outputs[Number(outputIndexStr)].lockingScript);
-            if (!(dec === null || dec === void 0 ? void 0 : dec.fields) || dec.fields.length < 6)
-                continue;
-            const [domainRaw, expiryRaw, privRaw, typeRaw, fieldsRaw, verifierRaw] = dec.fields;
-            const domainDecoded = sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(domainRaw));
-            const expiryDecoded = parseInt(sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(expiryRaw)), 10);
-            const privDecoded = sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(privRaw)) === 'true';
-            const typeDecoded = sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(typeRaw));
-            const verifierDec = sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(verifierRaw));
-            const fieldsJson = await this.decryptPermissionTokenField(fieldsRaw);
-            const allFields = JSON.parse(sdk_1.Utils.toUTF8(fieldsJson));
-            tokens.push({
-                tx: tx.toBEEF(),
-                txid: out.outpoint.split('.')[0],
-                outputIndex: parseInt(out.outpoint.split('.')[1], 10),
-                satoshis: out.satoshis,
-                outputScript: tx.outputs[Number(outputIndexStr)].lockingScript.toHex(),
-                originator: domainDecoded,
-                privileged: privDecoded,
-                certType: typeDecoded,
-                certFields: allFields,
-                verifier: verifierDec,
-                expiry: expiryDecoded
-            });
+        for (const originTag of originVariants) {
+            const tags = [...baseTags];
+            if (originTag) {
+                tags.push(`originator ${originTag}`);
+            }
+            const result = await this.underlying.listOutputs({
+                basket: basketName,
+                tags,
+                tagQueryMode: 'all',
+                include: 'entire transactions',
+                limit: 10000
+            }, this.adminOriginator);
+            for (const out of result.outputs) {
+                if (seen.has(out.outpoint))
+                    continue;
+                const [txid, outputIndexStr] = out.outpoint.split('.');
+                const tx = sdk_1.Transaction.fromBEEF(result.BEEF, txid);
+                const dec = sdk_1.PushDrop.decode(tx.outputs[Number(outputIndexStr)].lockingScript);
+                if (!(dec === null || dec === void 0 ? void 0 : dec.fields) || dec.fields.length < 6)
+                    continue;
+                const [domainRaw, expiryRaw, privRaw, typeRaw, fieldsRaw, verifierRaw] = dec.fields;
+                const domainDecoded = sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(domainRaw));
+                const normalizedDomain = this.normalizeOriginator(domainDecoded);
+                if (originFilter && normalizedDomain !== originFilter.normalized) {
+                    continue;
+                }
+                const expiryDecoded = parseInt(sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(expiryRaw)), 10);
+                const privDecoded = sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(privRaw)) === 'true';
+                const typeDecoded = sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(typeRaw));
+                const verifierDec = sdk_1.Utils.toUTF8(await this.decryptPermissionTokenField(verifierRaw));
+                const fieldsJson = await this.decryptPermissionTokenField(fieldsRaw);
+                const allFields = JSON.parse(sdk_1.Utils.toUTF8(fieldsJson));
+                seen.add(out.outpoint);
+                tokens.push({
+                    tx: tx.toBEEF(),
+                    txid: out.outpoint.split('.')[0],
+                    outputIndex: parseInt(out.outpoint.split('.')[1], 10),
+                    satoshis: out.satoshis,
+                    outputScript: tx.outputs[Number(outputIndexStr)].lockingScript.toHex(),
+                    originator: normalizedDomain,
+                    rawOriginator: domainDecoded,
+                    privileged: privDecoded,
+                    certType: typeDecoded,
+                    certFields: allFields,
+                    verifier: verifierDec,
+                    expiry: expiryDecoded
+                });
+            }
         }
         return tokens;
     }
@@ -2063,8 +2193,10 @@ class WalletPermissionsManager {
     }
     async waitForAuthentication(...args) {
         var _a, _b, _c, _d, _e, _f, _g;
-        const [_, originator] = args;
+        let [_, originator] = args;
         if (this.config.seekGroupedPermission && originator) {
+            const { normalized: normalizedOriginator } = this.prepareOriginator(originator);
+            originator = normalizedOriginator;
             // 1. Fetch manifest.json from the originator
             let groupPermissions;
             try {
@@ -2146,7 +2278,7 @@ class WalletPermissionsManager {
                         try {
                             await new Promise(async (resolve, reject) => {
                                 this.activeRequests.set(key, {
-                                    request: { originator, permissions: permissionsToRequest },
+                                    request: { originator: originator, permissions: permissionsToRequest },
                                     pending: [{ resolve, reject }]
                                 });
                                 await this.callEvent('onGroupedPermissionRequested', {
@@ -2184,7 +2316,7 @@ class WalletPermissionsManager {
      * --------------------------------------------------------------------- */
     /** Returns true if the specified origin is the admin originator. */
     isAdminOriginator(originator) {
-        return originator === this.adminOriginator;
+        return this.normalizeOriginator(originator) === this.adminOriginator;
     }
     /**
      * Checks if the given protocol is admin-reserved per BRC-100 rules:
@@ -2252,27 +2384,113 @@ class WalletPermissionsManager {
     cachePermission(key, expiry) {
         this.permissionCache.set(key, { expiry, cachedAt: Date.now() });
     }
+    /** Records that a non-spending permission was just granted so we can skip re-prompting briefly. */
+    markRecentGrant(request) {
+        if (request.type === 'spending')
+            return;
+        const key = this.buildRequestKey(request);
+        if (!key)
+            return;
+        this.recentGrants.set(key, Date.now() + WalletPermissionsManager.RECENT_GRANT_COVER_MS);
+    }
+    /** Returns true if we are inside the short "cover window" immediately after granting permission. */
+    isRecentlyGranted(key) {
+        const expiry = this.recentGrants.get(key);
+        if (!expiry)
+            return false;
+        if (Date.now() > expiry) {
+            this.recentGrants.delete(key);
+            return false;
+        }
+        return true;
+    }
+    /** Normalizes and canonicalizes originator domains (e.g., lowercase + drop default ports). */
+    normalizeOriginator(originator) {
+        if (!originator)
+            return '';
+        const trimmed = originator.trim();
+        if (!trimmed) {
+            return '';
+        }
+        try {
+            const hasScheme = /^[a-zA-Z][a-zA-Z\d+\-.]*:\/\//.test(trimmed);
+            const candidate = hasScheme ? trimmed : `https://${trimmed}`;
+            const url = new URL(candidate);
+            if (!url.hostname) {
+                return trimmed.toLowerCase();
+            }
+            const hostname = url.hostname.toLowerCase();
+            const needsBrackets = hostname.includes(':');
+            const baseHost = needsBrackets ? `[${hostname}]` : hostname;
+            const port = url.port;
+            const defaultPort = WalletPermissionsManager.DEFAULT_PORTS[url.protocol];
+            if (port && defaultPort && port === defaultPort) {
+                return baseHost;
+            }
+            return port ? `${baseHost}:${port}` : baseHost;
+        }
+        catch (_a) {
+            // Fall back to a conservative lowercase trim if URL parsing fails.
+            return trimmed.toLowerCase();
+        }
+    }
+    /**
+     * Produces a normalized originator value along with the set of legacy
+     * representations that should be considered when searching for existing
+     * permission tokens (for backwards compatibility).
+     */
+    prepareOriginator(originator) {
+        const trimmed = originator === null || originator === void 0 ? void 0 : originator.trim();
+        if (!trimmed) {
+            throw new Error('Originator is required for permission checks.');
+        }
+        const normalized = this.normalizeOriginator(trimmed) || trimmed.toLowerCase();
+        const lookupValues = Array.from(new Set([trimmed, normalized])).filter(Boolean);
+        return { normalized, lookupValues };
+    }
+    /**
+     * Builds a unique list of originator variants that should be searched when
+     * looking up on-chain tokens (e.g., legacy raw + normalized forms).
+     */
+    buildOriginatorLookupValues(...origins) {
+        const variants = new Set();
+        for (const origin of origins) {
+            const trimmed = origin === null || origin === void 0 ? void 0 : origin.trim();
+            if (trimmed) {
+                variants.add(trimmed);
+            }
+        }
+        return Array.from(variants);
+    }
     /**
      * Builds a "map key" string so that identical requests (e.g. "protocol:domain:true:protoName:counterparty")
      * do not produce multiple user prompts.
      */
     buildRequestKey(r) {
         var _a, _b, _c, _d, _e;
+        const normalizedOriginator = this.normalizeOriginator(r.originator);
         switch (r.type) {
             case 'protocol':
-                return `proto:${r.originator}:${!!r.privileged}:${(_a = r.protocolID) === null || _a === void 0 ? void 0 : _a.join(',')}:${r.counterparty}`;
+                return `proto:${normalizedOriginator}:${!!r.privileged}:${(_a = r.protocolID) === null || _a === void 0 ? void 0 : _a.join(',')}:${r.counterparty}`;
             case 'basket':
-                return `basket:${r.originator}:${r.basket}`;
+                return `basket:${normalizedOriginator}:${r.basket}`;
             case 'certificate':
-                return `cert:${r.originator}:${!!r.privileged}:${(_b = r.certificate) === null || _b === void 0 ? void 0 : _b.verifier}:${(_c = r.certificate) === null || _c === void 0 ? void 0 : _c.certType}:${(_d = r.certificate) === null || _d === void 0 ? void 0 : _d.fields.join('|')}`;
+                return `cert:${normalizedOriginator}:${!!r.privileged}:${(_b = r.certificate) === null || _b === void 0 ? void 0 : _b.verifier}:${(_c = r.certificate) === null || _c === void 0 ? void 0 : _c.certType}:${(_d = r.certificate) === null || _d === void 0 ? void 0 : _d.fields.join('|')}`;
             case 'spending':
-                return `spend:${r.originator}:${(_e = r.spending) === null || _e === void 0 ? void 0 : _e.satoshis}`;
+                return `spend:${normalizedOriginator}:${(_e = r.spending) === null || _e === void 0 ? void 0 : _e.satoshis}`;
         }
     }
 }
 exports.WalletPermissionsManager = WalletPermissionsManager;
 /** How long a cached permission remains valid (5 minutes). */
 WalletPermissionsManager.CACHE_TTL_MS = 5 * 60 * 1000;
+/** Window during which freshly granted permissions are auto-allowed (except spending). */
+WalletPermissionsManager.RECENT_GRANT_COVER_MS = 15 * 1000;
+/** Default ports used when normalizing originator values. */
+WalletPermissionsManager.DEFAULT_PORTS = {
+    'http:': '80',
+    'https:': '443'
+};
 /* ---------------------------------------------------------------------
  *  4) SEARCH / DECODE / DECRYPT ON-CHAIN TOKENS (PushDrop Scripts)
  * --------------------------------------------------------------------- */