@cheqd/did-provider-cheqd 3.2.1 → 3.3.0-develop.1

package/build/esm/agent/ICheqd.js

@@ -2,20 +2,45 @@
 // any is used for extensibility
 // unused vars are kept by convention
 // non-null assertion is used when we know better than the compiler that the value is not null or undefined
-import { createDidPayload, createDidVerificationMethod, createKeyPairBase64, createKeyPairHex, createVerificationKeys } from '@cheqd/sdk';
+import { CheqdNetwork, createDidPayload, createDidVerificationMethod, createKeyPairBase64, createKeyPairHex, createVerificationKeys } from '@cheqd/sdk';
+import { DefaultRESTUrls } from '../did-manager/cheqd-did-provider.js';
 import { fromString, toString } from 'uint8arrays';
+import { decodeJWT } from 'did-jwt';
+import { StatusList } from '@digitalbazaar/vc-status-list';
 import { v4 } from 'uuid';
 import fs from 'fs';
 import Debug from 'debug';
+import { LitCompatibleCosmosChains, LitProtocol } from '../dkg-threshold/lit-protocol.js';
+import { blobToHexString, randomFromRange, toBlob, unescapeUnicode } from '../utils/helpers.js';
+import { resolverUrl } from '../did-manager/cheqd-did-resolver.js';
 const debug = Debug('veramo:did-provider-cheqd');
+export const AccessControlConditionTypes = { memoNonce: 'memoNonce', balance: 'balance' };
+export const AccessControlConditionReturnValueComparators = { lessThan: '<', greaterThan: '>', equalTo: '=', lessThanOrEqualTo: '<=', greaterThanOrEqualTo: '>=' };
 const CreateIdentifierMethodName = 'cheqdCreateIdentifier';
 const UpdateIdentifierMethodName = 'cheqdUpdateIdentifier';
 const DeactivateIdentifierMethodName = 'cheqdDeactivateIdentifier';
 const CreateResourceMethodName = 'cheqdCreateLinkedResource';
+const CreateStatusList2021MethodName = 'cheqdCreateStatusList2021';
+const CreateEncryptedStatusList2021MethodName = 'cheqdCreateEncryptedStatusList2021';
 const GenerateDidDocMethodName = 'cheqdGenerateDidDoc';
 const GenerateDidDocWithLinkedResourceMethodName = 'cheqdGenerateDidDocWithLinkedResource';
 const GenerateKeyPairMethodName = 'cheqdGenerateIdentityKeys';
 const GenerateVersionIdMethodName = 'cheqdGenerateVersionId';
+const GenerateStatusList2021MethodName = 'cheqdGenerateStatusList2021';
+const GenerateEncryptedStatusList2021MethodName = 'cheqdGenerateEncryptedStatusList2021';
+const IssueRevocableCredentialWithStatusList2021MethodName = 'cheqdIssueRevocableCredentialWithStatusList2021';
+const IssueSuspendableCredentialWithStatusList2021MethodName = 'cheqdIssueSuspendableCredentialWithStatusList2021';
+const VerifyCredentialMethodName = 'cheqdVerifyCredential';
+const VerifyPresentationMethodName = 'cheqdVerifyPresentation';
+const CheckCredentialStatusMethodName = 'cheqdCheckCredentialStatus';
+const RevokeCredentialMethodName = 'cheqdRevokeCredential';
+const RevokeCredentialsMethodName = 'cheqdRevokeCredentials';
+const SuspendCredentialMethodName = 'cheqdSuspendCredential';
+const SuspendCredentialsMethodName = 'cheqdSuspendCredentials';
+const UnsuspendCredentialMethodName = 'cheqdUnsuspendCredential';
+const UnsuspendCredentialsMethodName = 'cheqdUnsuspendCredentials';
+const TransactVerifierPaysIssuerMethodName = 'cheqdTransactVerifierPaysIssuer';
+const ObserveVerifierPaysIssuerMethodName = 'cheqdObserveVerifierPaysIssuer';
 const DidPrefix = 'did';
 const CheqdDidMethod = 'cheqd';
 export class Cheqd {
@@ -92,6 +117,42 @@ export class Cheqd {
                             "args"
                         ]
                     },
+                    "returnType": {
+                        "type": "boolean"
+                    }
+                },
+                "cheqdCreateStatusList2021": {
+                    "description": "Create a new Status List 2021",
+                    "arguments": {
+                        "type": "object",
+                        "properties": {
+                            "args": {
+                                "type": "object",
+                                "description": "A cheqdCreateStatusList2021Args object as any for extensibility"
+                            }
+                        },
+                        "required": [
+                            "args"
+                        ]
+                    },
+                    "returnType": {
+                        "type": "boolean"
+                    }
+                },
+                "cheqdCreateEncryptedStatusList2021": {
+                    "description": "Create a new Encrypted Status List 2021",
+                    "arguments": {
+                        "type": "object",
+                        "properties": {
+                            "args": {
+                                "type": "object",
+                                "description": "A cheqdCreateEncryptedStatusList2021Args object as any for extensibility"
+                            }
+                        },
+                        "required": [
+                            "args"
+                        ]
+                    },
                     "returnType": {
                         "type": "object"
                     }
@@ -156,7 +217,274 @@ export class Cheqd {
                                 "type": "object",
                                 "description": "A cheqdGenerateVersionIdArgs object as any for extensibility"
                             }
-                        }
+                        },
+                    },
+                    "returnType": {
+                        "type": "object"
+                    }
+                },
+                "cheqdGenerateStatusList2021": {
+                    "description": "Generate a new Status List 2021",
+                    "arguments": {
+                        "type": "object",
+                        "properties": {
+                            "args": {
+                                "type": "object",
+                                "description": "A cheqdGenerateStatusList2021Args object as any for extensibility"
+                            }
+                        },
+                    },
+                    "returnType": {
+                        "type": "string"
+                    }
+                },
+                "cheqdGenerateEncryptedStatusList2021": {
+                    "description": "Generate a new encrypted Status List 2021",
+                    "arguments": {
+                        "type": "object",
+                        "properties": {
+                            "args": {
+                                "type": "object",
+                                "description": "A cheqdGenerateEncryptedStatusList2021Args object as any for extensibility"
+                            }
+                        },
+                        "required": [
+                            "args"
+                        ]
+                    },
+                    "returnType": {
+                        "type": "string"
+                    }
+                },
+                "cheqdIssueRevocableCredentialWithStatusList2021": {
+                    "description": "Issue a revocable credential with a Status List 2021 as credential status registry",
+                    "arguments": {
+                        "type": "object",
+                        "properties": {
+                            "args": {
+                                "type": "object",
+                                "description": "A cheqdIssueCredentialWithStatusList2021Args object as any for extensibility"
+                            }
+                        },
+                        "required": [
+                            "args"
+                        ]
+                    },
+                    "returnType": {
+                        "type": "object"
+                    }
+                },
+                "cheqdIssueSuspendableCredentialWithStatusList2021": {
+                    "description": "Issue a suspendable credential with a Status List 2021 as credential status registry",
+                    "arguments": {
+                        "type": "object",
+                        "properties": {
+                            "args": {
+                                "type": "object",
+                                "description": "A cheqdIssueCredentialWithStatusList2021Args object as any for extensibility"
+                            }
+                        },
+                        "required": [
+                            "args"
+                        ]
+                    },
+                    "returnType": {
+                        "type": "object"
+                    }
+                },
+                "cheqdVerifyCredential": {
+                    "description": "Verify a credential, enhanced by revocation / suspension check with a Status List 2021 as credential status registry",
+                    "arguments": {
+                        "type": "object",
+                        "properties": {
+                            "args": {
+                                "type": "object",
+                                "description": "A cheqdVerifyCredentialWithStatusList2021Args object as any for extensibility"
+                            }
+                        },
+                        "required": [
+                            "args"
+                        ]
+                    },
+                    "returnType": {
+                        "type": "object"
+                    }
+                },
+                "cheqdVerifyPresentation": {
+                    "description": "Verify a presentation, enhanced by revocation / suspension check with a Status List 2021 as credential status registry",
+                    "arguments": {
+                        "type": "object",
+                        "properties": {
+                            "args": {
+                                "type": "object",
+                                "description": "A cheqdVerifyPresentationWithStatusList2021Args object as any for extensibility"
+                            }
+                        },
+                        "required": [
+                            "args"
+                        ]
+                    },
+                    "returnType": {
+                        "type": "object"
+                    }
+                },
+                "cheqdCheckCredentialStatus": {
+                    "description": "Check the revocation / suspension status of a credential with a Status List 2021 as credential status registry",
+                    "arguments": {
+                        "type": "object",
+                        "properties": {
+                            "args": {
+                                "type": "object",
+                                "description": "A cheqdCheckCredentialStatusWithStatusList2021Args object as any for extensibility"
+                            }
+                        },
+                        "required": [
+                            "args"
+                        ]
+                    },
+                    "returnType": {
+                        "type": "object"
+                    }
+                },
+                "cheqdRevokeCredential": {
+                    "description": "Revoke a credential against a Status List 2021 as credential status registry",
+                    "arguments": {
+                        "type": "object",
+                        "properties": {
+                            "args": {
+                                "type": "object",
+                                "description": "A cheqdRevokeCredentialWithStatusList2021Args object as any for extensibility"
+                            }
+                        },
+                        "required": [
+                            "args"
+                        ]
+                    },
+                    "returnType": {
+                        "type": "object"
+                    }
+                },
+                "cheqdRevokeCredentials": {
+                    "description": "Revoke multiple credentials against a Status List 2021 as credential status registry",
+                    "arguments": {
+                        "type": "object",
+                        "properties": {
+                            "args": {
+                                "type": "object",
+                                "description": "A cheqdRevokeBulkCredentialsWithStatusList2021Args object as any for extensibility"
+                            }
+                        },
+                        "required": [
+                            "args"
+                        ]
+                    },
+                    "returnType": {
+                        "type": "array"
+                    }
+                },
+                "cheqdSuspendCredential": {
+                    "description": "Suspend a credential against a Status List 2021 as credential status registry",
+                    "arguments": {
+                        "type": "object",
+                        "properties": {
+                            "args": {
+                                "type": "object",
+                                "description": "A cheqdSuspendCredentialWithStatusList2021Args object as any for extensibility"
+                            }
+                        },
+                        "required": [
+                            "args"
+                        ]
+                    },
+                    "returnType": {
+                        "type": "object"
+                    }
+                },
+                "cheqdSuspendCredentials": {
+                    "description": "Suspend multiple credentials against a Status List 2021 as credential status registry",
+                    "arguments": {
+                        "type": "object",
+                        "properties": {
+                            "args": {
+                                "type": "object",
+                                "description": "A cheqdSuspendBulkCredentialsWithStatusList2021Args object as any for extensibility"
+                            }
+                        },
+                        "required": [
+                            "args"
+                        ]
+                    },
+                    "returnType": {
+                        "type": "array"
+                    }
+                },
+                "cheqdUnsuspendCredential": {
+                    "description": "Unsuspend a credential against a Status List 2021 as credential status registry",
+                    "arguments": {
+                        "type": "object",
+                        "properties": {
+                            "args": {
+                                "type": "object",
+                                "description": "cheqdUnsuspendCredentialWithStatusList2021Args object as any for extensibility"
+                            }
+                        },
+                        "required": [
+                            "args"
+                        ]
+                    },
+                    "returnType": {
+                        "type": "object"
+                    }
+                },
+                "cheqdUnsuspendCredentials": {
+                    "description": "Unsuspend multiple credentials against a Status List 2021 as credential status registry",
+                    "arguments": {
+                        "type": "object",
+                        "properties": {
+                            "args": {
+                                "type": "object",
+                                "description": "A cheqdUnsuspendBulkCredentialsWithStatusList2021Args object as any for extensibility"
+                            }
+                        },
+                        "required": [
+                            "args"
+                        ]
+                    },
+                    "returnType": {
+                        "type": "array"
+                    }
+                },
+                "cheqdTransactVerifierPaysIssuer": {
+                    "description": "Initiate a transaction where the verifier pays the issuer for a credential status check",
+                    "arguments": {
+                        "type": "object",
+                        "properties": {
+                            "args": {
+                                "type": "object",
+                                "description": "A cheqdTransactVerifierPaysIssuerArgs object as any for extensibility"
+                            }
+                        },
+                        "required": [
+                            "args"
+                        ]
+                    },
+                    "returnType": {
+                        "type": "object"
+                    }
+                },
+                "cheqdObserveVerifierPaysIssuer": {
+                    "description": "Observe a transaction where the verifier pays the issuer for a credential status check",
+                    "arguments": {
+                        "type": "object",
+                        "properties": {
+                            "args": {
+                                "type": "object",
+                                "description": "cheqdObserveVerifierPaysIssuerArgs object as any for extensibility"
+                            }
+                        },
+                        "required": [
+                            "args"
+                        ]
                     },
                     "returnType": {
                         "type": "object"
@@ -168,6 +496,9 @@ export class Cheqd {
     supportedDidProviders;
     didProvider;
     providerId;
+    static defaultStatusList2021Length = 16 * 1024 * 8; // 16KB in bits or 131072 bits / entries
+    static defaultContextV1 = 'https://www.w3.org/2018/credentials/v1';
+    static statusList2021Context = 'https://w3id.org/vc-status-list-2021/v1';
     constructor(args) {
         if (typeof args.providers !== 'object') {
             throw new Error('[did-provider-cheqd]: at least one did provider is required');
@@ -180,10 +511,27 @@ export class Cheqd {
             [UpdateIdentifierMethodName]: this.UpdateIdentifier.bind(this),
             [DeactivateIdentifierMethodName]: this.DeactivateIdentifier.bind(this),
             [CreateResourceMethodName]: this.CreateResource.bind(this),
+            [CreateStatusList2021MethodName]: this.CreateStatusList2021.bind(this),
+            [CreateEncryptedStatusList2021MethodName]: this.CreateEncryptedStatusList2021.bind(this),
             [GenerateDidDocMethodName]: this.GenerateDidDoc.bind(this),
             [GenerateDidDocWithLinkedResourceMethodName]: this.GenerateDidDocWithLinkedResource.bind(this),
             [GenerateKeyPairMethodName]: this.GenerateIdentityKeys.bind(this),
-            [GenerateVersionIdMethodName]: this.GenerateVersionId.bind(this)
+            [GenerateVersionIdMethodName]: this.GenerateVersionId.bind(this),
+            [GenerateStatusList2021MethodName]: this.GenerateStatusList2021.bind(this),
+            [GenerateEncryptedStatusList2021MethodName]: this.GenerateEncryptedStatusList2021.bind(this),
+            [IssueRevocableCredentialWithStatusList2021MethodName]: this.IssueRevocableCredentialWithStatusList2021.bind(this),
+            [IssueSuspendableCredentialWithStatusList2021MethodName]: this.IssueSuspendableCredentialWithStatusList2021.bind(this),
+            [VerifyCredentialMethodName]: this.VerifyCredentialWithStatusList2021.bind(this),
+            [VerifyPresentationMethodName]: this.VerifyPresentationWithStatusList2021.bind(this),
+            [CheckCredentialStatusMethodName]: this.CheckCredentialStatusWithStatusList2021.bind(this),
+            [RevokeCredentialMethodName]: this.RevokeCredentialWithStatusList2021.bind(this),
+            [RevokeCredentialsMethodName]: this.RevokeBulkCredentialsWithStatusList2021.bind(this),
+            [SuspendCredentialMethodName]: this.SuspendCredentialWithStatusList2021.bind(this),
+            [SuspendCredentialsMethodName]: this.SuspendBulkCredentialsWithStatusList2021.bind(this),
+            [UnsuspendCredentialMethodName]: this.UnsuspendCredentialWithStatusList2021.bind(this),
+            [UnsuspendCredentialsMethodName]: this.UnsuspendBulkCredentialsWithStatusList2021.bind(this),
+            [TransactVerifierPaysIssuerMethodName]: this.TransactVerifierPaysIssuer.bind(this),
+            [ObserveVerifierPaysIssuerMethodName]: this.ObserveVerifierPaysIssuer.bind(this),
         };
     }
     async CreateIdentifier(args, context) {
@@ -224,7 +572,6 @@ export class Cheqd {
         return await context.agent.didManagerUpdate({
             did: args.document.id,
             document: args.document,
-            provider: this.providerId,
             options: {
                 kms: args.kms,
                 keys: args.keys,
@@ -263,7 +610,7 @@ export class Cheqd {
             throw new Error('[did-provider-cheqd]: network is required');
         }
         if (args?.file) {
-            args.payload.data = toString(await Cheqd.getFile(args.file), 'base64');
+            args.payload.data = await Cheqd.getFile(args.file);
         }
         if (typeof args?.payload?.data === 'string') {
             args.payload.data = fromString(args.payload.data, 'base64');
@@ -279,6 +626,110 @@ export class Cheqd {
             }
         }, context);
     }
+    async CreateStatusList2021(args, context) {
+        if (typeof args.kms !== 'string') {
+            throw new Error('[did-provider-cheqd]: kms is required');
+        }
+        if (typeof args.payload !== 'object') {
+            throw new Error('[did-provider-cheqd]: payload object is required');
+        }
+        if (typeof args.network !== 'string') {
+            throw new Error('[did-provider-cheqd]: network is required');
+        }
+        if (args?.file) {
+            args.payload.data = await Cheqd.getFile(args.file);
+        }
+        if (typeof args?.payload?.data === 'string') {
+            args.payload.data = fromString(args.payload.data, 'base64');
+        }
+        // TODO: validate data as per bitstring
+        // set default resource type in runtime
+        args.payload.resourceType = 'StatusList2021';
+        this.providerId = Cheqd.generateProviderId(args.network);
+        this.didProvider = await Cheqd.loadProvider({ id: this.providerId }, this.supportedDidProviders);
+        return await this.didProvider.createResource({
+            options: {
+                kms: args.kms,
+                payload: args.payload,
+                signInputs: args.signInputs,
+                fee: args?.fee
+            }
+        }, context);
+    }
+    async CreateEncryptedStatusList2021(args, context) {
+        if (typeof args.kms !== 'string') {
+            throw new Error('[did-provider-cheqd]: kms is required');
+        }
+        if (typeof args.payload !== 'object') {
+            throw new Error('[did-provider-cheqd]: payload object is required');
+        }
+        if (typeof args.network !== 'string') {
+            throw new Error('[did-provider-cheqd]: network is required');
+        }
+        if (args?.file) {
+            args.payload.data = await Cheqd.getFile(args.file);
+        }
+        if (typeof args?.payload?.data === 'string') {
+            args.payload.data = fromString(args.payload.data, 'base64');
+        }
+        // TODO: validate data as per bitstring
+        if (!args?.encryptionOptions) {
+            throw new Error('[did-provider-cheqd]: encryptionOptions is required');
+        }
+        if (!args?.bootstrapOptions) {
+            throw new Error('[did-provider-cheqd]: bootstrapOptions is required');
+        }
+        if (!args?.encryptionOptions?.accessControlConditions) {
+            throw new Error('[did-provider-cheqd]: accessControlConditions is required');
+        }
+        // instantiate dkg-threshold client, in which case lit-protocol is used
+        const lit = await LitProtocol.create({
+            chain: args.bootstrapOptions?.chain,
+            litNetwork: args.bootstrapOptions?.litNetwork
+        });
+        // construct access control conditions
+        const unifiedAccessControlConditions = await Promise.all(args.encryptionOptions.accessControlConditions.map(async (condition) => {
+            switch (condition.type) {
+                case AccessControlConditionTypes.memoNonce:
+                    return await LitProtocol.generateCosmosAccessControlConditionTransactionMemo({
+                        key: '$.txs.*.body.memo',
+                        comparator: 'contains',
+                        value: condition?.specificNonce || await LitProtocol.generateTxNonce(condition?.nonceFormat)
+                    }, condition.amountObserved, condition.senderAddressObserved, condition.recipientAddressObserved, args.bootstrapOptions.chain);
+                case AccessControlConditionTypes.balance:
+                    return await LitProtocol.generateCosmosAccessControlConditionBalance({
+                        key: '$.balances[0].amount',
+                        comparator: condition.comparator,
+                        value: condition.amountObserved
+                    }, args.bootstrapOptions.chain, condition.addressObserved);
+                default:
+                    throw new Error(`[did-provider-cheqd]: accessControlCondition type is not supported`);
+            }
+        }));
+        // encrypt data
+        const { encryptedString, encryptedSymmetricKey, symmetricKey } = await lit.encrypt(toString(args.payload.data, 'base64url'), unifiedAccessControlConditions, true);
+        // set encrypted data
+        args.payload.data = new Uint8Array(await encryptedString.arrayBuffer());
+        // set default resource type in runtime
+        args.payload.resourceType = 'StatusList2021';
+        this.providerId = Cheqd.generateProviderId(args.network);
+        this.didProvider = await Cheqd.loadProvider({ id: this.providerId }, this.supportedDidProviders);
+        const created = await this.didProvider.createResource({
+            options: {
+                kms: args.kms,
+                payload: args.payload,
+                signInputs: args.signInputs,
+                fee: args?.fee
+            }
+        }, context);
+        return {
+            created,
+            encryptedSymmetricKey,
+            encryptedStatusList2021: await blobToHexString(encryptedString),
+            symmetricKey: args?.encryptionOptions?.returnSymmetricKey ? toString(symmetricKey, 'hex') : undefined,
+            unifiedAccessControlConditions
+        };
+    }
     async GenerateDidDoc(args, context) {
         if (typeof args.verificationMethod !== 'string') {
             throw new Error('[did-provider-cheqd]: verificationMethod is required');
@@ -355,6 +806,978 @@ export class Cheqd {
     async GenerateVersionId(args, context) {
         return v4();
     }
+    async GenerateStatusList2021(args, context) {
+        const statusList = args?.buffer
+            ? new StatusList({ buffer: args.buffer })
+            : new StatusList({ length: args?.length || Cheqd.defaultStatusList2021Length });
+        const encoded = await statusList.encode();
+        switch (args?.bitstringEncoding) {
+            case 'base64url':
+                return encoded;
+            case 'base64':
+                return toString(fromString(encoded, 'base64url'), 'base64');
+            case 'hex':
+                return toString(fromString(encoded, 'base64url'), 'hex');
+            default:
+                return encoded;
+        }
+    }
+    async GenerateEncryptedStatusList2021(args, context) {
+        // validate encryptionOptions
+        if (!args.encryptionOptions) {
+            throw new Error('[did-provider-cheqd]: encryptionOptions is required');
+        }
+        // validate encryptionOptions.accessControlConditions
+        if (!args.encryptionOptions.accessControlConditions) {
+            throw new Error('[did-provider-cheqd]: encryptionOptions.accessControlConditions is required');
+        }
+        // generate status list
+        const statusList = args?.buffer
+            ? new StatusList({ buffer: args.buffer })
+            : new StatusList({ length: args?.length || Cheqd.defaultStatusList2021Length });
+        // encode status list
+        const encoded = await statusList.encode();
+        // instantiate dkg-threshold client, in which case lit-protocol is used
+        const lit = await LitProtocol.create({
+            chain: args.bootstrapOptions.chain,
+            litNetwork: args.bootstrapOptions.litNetwork,
+        });
+        // construct access control conditions
+        const unifiedAccessControlConditions = await Promise.all(args.encryptionOptions.accessControlConditions.map(async (condition) => {
+            switch (condition.type) {
+                case AccessControlConditionTypes.memoNonce:
+                    return await LitProtocol.generateCosmosAccessControlConditionTransactionMemo({
+                        key: '$.txs.*.body.memo',
+                        comparator: 'contains',
+                        value: condition?.specificNonce || await LitProtocol.generateTxNonce(condition?.nonceFormat)
+                    }, condition.amountObserved, condition.senderAddressObserved, condition.recipientAddressObserved, args.bootstrapOptions.chain);
+                case AccessControlConditionTypes.balance:
+                    return await LitProtocol.generateCosmosAccessControlConditionBalance({
+                        key: '$.balances[0].amount',
+                        comparator: condition.comparator,
+                        value: condition.amountObserved
+                    }, args.bootstrapOptions.chain, condition.addressObserved);
+                default:
+                    throw new Error(`[did-provider-cheqd]: accessControlCondition type is not supported`);
+            }
+        }));
+        // encrypt data
+        const { encryptedString, encryptedSymmetricKey } = await lit.encrypt(encoded, unifiedAccessControlConditions);
+        // return result
+        return {
+            encryptedStatusList2021: await blobToHexString(encryptedString),
+            encryptedSymmetricKey,
+            unifiedAccessControlConditions
+        };
+    }
+    async IssueRevocableCredentialWithStatusList2021(args, context) {
+        // generate index
+        const statusListIndex = args.statusOptions.statusListIndex || await randomFromRange(args.statusOptions.statusListRangeStart || 0, (args.statusOptions.statusListRangeEnd || Cheqd.defaultStatusList2021Length) - 1, args.statusOptions.indexNotIn || []);
+        // construct issuer
+        const issuer = (args.issuanceOptions.credential.issuer.id)
+            ? args.issuanceOptions.credential.issuer.id
+            : args.issuanceOptions.credential.issuer;
+        // generate status list credential
+        const statusListCredential = `${resolverUrl}${issuer}?resourceName=${args.statusOptions.statusListName}`;
+        // construct credential status
+        const credentialStatus = {
+            id: `${statusListCredential}#${statusListIndex}`,
+            type: 'StatusList2021Entry',
+            statusPurpose: 'revocation',
+            statusListIndex: `${statusListIndex}`,
+            statusListCredential,
+        };
+        // add credential status to credential
+        args.issuanceOptions.credential.credentialStatus = credentialStatus;
+        // add relevant context
+        args.issuanceOptions.credential['@context'] = function () {
+            // if no context is provided, add default context
+            if (!args.issuanceOptions.credential['@context']) {
+                return [Cheqd.defaultContextV1, Cheqd.statusList2021Context];
+            }
+            // if context is provided as an array, add default context if it is not already present
+            if (Array.isArray(args.issuanceOptions.credential['@context'])) {
+                if (args.issuanceOptions.credential['@context'].length === 0) {
+                    return [Cheqd.defaultContextV1, Cheqd.statusList2021Context];
+                }
+                if (!args.issuanceOptions.credential['@context'].includes(Cheqd.statusList2021Context)) {
+                    return [...args.issuanceOptions.credential['@context'], Cheqd.statusList2021Context];
+                }
+            }
+            // if context is provided as a string, add default context if it is not already present
+            if (typeof args.issuanceOptions.credential['@context'] === 'string')
+                return [Cheqd.defaultContextV1, Cheqd.statusList2021Context];
+        }();
+        // create a credential
+        const credential = await context.agent.createVerifiableCredential(args.issuanceOptions);
+        return credential;
+    }
+    async IssueSuspendableCredentialWithStatusList2021(args, context) {
+        // generate index
+        const statusListIndex = args.statusOptions.statusListIndex || await randomFromRange(args.statusOptions.statusListRangeStart || 0, (args.statusOptions.statusListRangeEnd || Cheqd.defaultStatusList2021Length) - 1, args.statusOptions.indexNotIn || []);
+        // construct issuer
+        const issuer = (args.issuanceOptions.credential.issuer.id)
+            ? args.issuanceOptions.credential.issuer.id
+            : args.issuanceOptions.credential.issuer;
+        // generate status list credential
+        const statusListCredential = `${resolverUrl}${issuer}?resourceName=${args.statusOptions.statusListName}`;
+        // construct credential status
+        const credentialStatus = {
+            id: `${statusListCredential}#${statusListIndex}`,
+            type: 'StatusList2021Entry',
+            statusPurpose: 'suspension',
+            statusListIndex: `${statusListIndex}`,
+            statusListCredential,
+        };
+        // add credential status to credential
+        args.issuanceOptions.credential.credentialStatus = credentialStatus;
+        // add relevant context
+        args.issuanceOptions.credential['@context'] = function () {
+            // if no context is provided, add default context
+            if (!args.issuanceOptions.credential['@context']) {
+                return [Cheqd.defaultContextV1, Cheqd.statusList2021Context];
+            }
+            // if context is provided as an array, add default context if it is not already present
+            if (Array.isArray(args.issuanceOptions.credential['@context'])) {
+                if (args.issuanceOptions.credential['@context'].length === 0) {
+                    return [Cheqd.defaultContextV1, Cheqd.statusList2021Context];
+                }
+                if (!args.issuanceOptions.credential['@context'].includes(Cheqd.statusList2021Context)) {
+                    return [...args.issuanceOptions.credential['@context'], Cheqd.statusList2021Context];
+                }
+            }
+            // if context is provided as a string, add default context if it is not already present
+            if (typeof args.issuanceOptions.credential['@context'] === 'string')
+                return [Cheqd.defaultContextV1, Cheqd.statusList2021Context];
+        }();
+        // create a credential
+        const credential = await context.agent.createVerifiableCredential(args.issuanceOptions);
+        return credential;
+    }
+    async VerifyCredentialWithStatusList2021(args, context) {
+        // verify default policies
+        const verificationResult = await context.agent.verifyCredential({
+            credential: args.credential,
+            policies: {
+                credentialStatus: false
+            }
+        });
+        // early return if verification failed
+        if (!verificationResult.verified) {
+            return { verified: false, error: verificationResult.error };
+        }
+        // verify credential status
+        switch (args.credential.credentialStatus?.statusPurpose) {
+            case 'revocation':
+                if (await Cheqd.checkRevoked(args.credential, { ...args.options, topArgs: args }))
+                    return { verified: false, revoked: true };
+                return { verified: true, revoked: false };
+            case 'suspension':
+                if (await Cheqd.checkSuspended(args.credential, { ...args.options, topArgs: args }))
+                    return { verified: false, suspended: true };
+                return { verified: true, suspended: false };
+            default:
+                throw new Error(`[did-provider-cheqd]: verify credential: Unsupported status purpose: ${args.credential.credentialStatus?.statusPurpose}`);
+        }
+    }
+    async VerifyPresentationWithStatusList2021(args, context) {
+        // verify default policies
+        const verificationResult = await context.agent.verifyPresentation({
+            presentation: args.presentation,
+            policies: {
+                credentialStatus: false
+            }
+        });
+        // early return if verification failed
+        if (!verificationResult.verified) {
+            return { verified: false, error: verificationResult.error };
+        }
+        if (!args.presentation.verifiableCredential)
+            throw new Error('[did-provider-cheqd]: verify presentation: presentation.verifiableCredential is required');
+        // verify credential(s) status(es)
+        for (let credential of args.presentation.verifiableCredential) {
+            // if jwt credential, decode it
+            if (typeof credential === 'string') {
+                const decodedCredential = decodeJWT(credential);
+                // validate credential payload
+                if (!decodedCredential.payload)
+                    throw new Error('[did-provider-cheqd]: verify presentation: decodedCredential.payload is required');
+                // validate credential payload ref as VerifiableCredential
+                if (!decodedCredential.payload.vc)
+                    throw new Error('[did-provider-cheqd]: verify presentation: decodedCredential.payload.vc is required');
+                credential = decodedCredential.payload.vc;
+            }
+            switch (credential.credentialStatus?.statusPurpose) {
+                case 'revocation':
+                    if (await Cheqd.checkRevoked(credential, { ...args.options, topArgs: args }))
+                        return { verified: false, revoked: true };
+                    break;
+                case 'suspension':
+                    if (await Cheqd.checkSuspended(credential, { ...args.options, topArgs: args }))
+                        return { verified: false, suspended: true };
+                    break;
+                default:
+                    throw new Error(`[did-provider-cheqd]: verify presentation: Unsupported status purpose: ${credential.credentialStatus?.statusPurpose}`);
+            }
+        }
+        return { verified: true };
+    }
+    async CheckCredentialStatusWithStatusList2021(args, context) {
+        switch (args.credential.credentialStatus?.statusPurpose) {
+            case 'revocation':
+                if (await Cheqd.checkRevoked(args.credential, { ...args.options, topArgs: args }))
+                    return { revoked: true };
+                return { revoked: false };
+            case 'suspension':
+                if (await Cheqd.checkSuspended(args.credential, { ...args.options, topArgs: args }))
+                    return { suspended: true };
+                return { suspended: false };
+            default:
+                throw new Error(`[did-provider-cheqd]: check status: Unsupported status purpose: ${args.credential.credentialStatus?.statusPurpose}`);
+        }
+    }
+    async RevokeCredentialWithStatusList2021(args, context) {
+        // validate status purpose
+        if (args.credential.credentialStatus?.statusPurpose !== 'revocation') {
+            throw new Error(`[did-provider-cheqd]: revocation: Unsupported status purpose: ${args.credential.credentialStatus?.statusPurpose}`);
+        }
+        // validate args in pairs - case: statusListFile and statusList
+        if (args.options?.statusListFile && args.options?.statusList) {
+            throw new Error('[did-provider-cheqd]: revocation: statusListFile and statusList are mutually exclusive');
+        }
+        // validate args in pairs - case: statusListFile and fetchList
+        if (args.options?.statusListFile && args.options?.fetchList) {
+            throw new Error('[did-provider-cheqd]: revocation: statusListFile and fetchList are mutually exclusive');
+        }
+        // validate args in pairs - case: statusList and fetchList
+        if (args.options?.statusList && args.options?.fetchList) {
+            throw new Error('[did-provider-cheqd]: revocation: statusList and fetchList are mutually exclusive');
+        }
+        // validate args in pairs - case: publish
+        if (args.options?.publish && !args.fetchList && !(args.options?.statusListFile || args.options?.statusList)) {
+            throw new Error('[did-provider-cheqd]: revocation: publish requires statusListFile or statusList, if fetchList is disabled');
+        }
+        // revoke credential
+        return await Cheqd.revokeCredential(args.credential, {
+            ...args.options,
+            topArgs: args,
+            publishOptions: {
+                context,
+                resourceId: args?.options?.resourceId,
+                resourceVersion: args?.options?.resourceVersion,
+                signInputs: args?.options?.signInputs,
+                fee: args?.options?.fee
+            }
+        });
+    }
+    async RevokeBulkCredentialsWithStatusList2021(args, context) {
+        // TODO: implement
+        throw new Error('[did-provider-cheqd]: revocation: bulk revocation is not implemented yet');
+    }
+    async SuspendCredentialWithStatusList2021(args, context) {
+        // validate status purpose
+        if (args.credential.credentialStatus?.statusPurpose !== 'suspension') {
+            throw new Error(`[did-provider-cheqd]: suspension: Unsupported status purpose: ${args.credential.credentialStatus?.statusPurpose}`);
+        }
+        // validate args in pairs - case: statusListFile and statusList
+        if (args.options?.statusListFile && args.options?.statusList) {
+            throw new Error('[did-provider-cheqd]: suspension: statusListFile and statusList are mutually exclusive');
+        }
+        // validate args in pairs - case: statusListFile and fetchList
+        if (args.options?.statusListFile && args.options?.fetchList) {
+            throw new Error('[did-provider-cheqd]: suspension: statusListFile and fetchList are mutually exclusive');
+        }
+        // validate args in pairs - case: statusList and fetchList
+        if (args.options?.statusList && args.options?.fetchList) {
+            throw new Error('[did-provider-cheqd]: suspension: statusList and fetchList are mutually exclusive');
+        }
+        // validate args in pairs - case: publish
+        if (args.options?.publish && !args.fetchList && !(args.options?.statusListFile || args.options?.statusList)) {
+            throw new Error('[did-provider-cheqd]: suspension: publish requires statusListFile or statusList, if fetchList is disabled');
+        }
+        // suspend credential
+        return await Cheqd.suspendCredential(args.credential, {
+            ...args.options,
+            topArgs: args,
+            publishOptions: {
+                context,
+                resourceId: args?.options?.resourceId,
+                resourceVersion: args?.options?.resourceVersion,
+                signInputs: args?.options?.signInputs,
+                fee: args?.options?.fee
+            }
+        });
+    }
+    async SuspendBulkCredentialsWithStatusList2021(args, context) {
+        // TODO: implement
+        throw new Error('[did-provider-cheqd]: suspension: bulk suspension is not implemented yet');
+    }
+    async UnsuspendCredentialWithStatusList2021(args, context) {
+        // validate status purpose
+        if (args.credential.credentialStatus?.statusPurpose !== 'suspension') {
+            throw new Error(`[did-provider-cheqd]: suspension: Unsupported status purpose: ${args.credential.credentialStatus?.statusPurpose}`);
+        }
+        // validate args in pairs - case: statusListFile and statusList
+        if (args.options?.statusListFile && args.options?.statusList) {
+            throw new Error('[did-provider-cheqd]: suspension: statusListFile and statusList are mutually exclusive');
+        }
+        // validate args in pairs - case: statusListFile and fetchList
+        if (args.options?.statusListFile && args.options?.fetchList) {
+            throw new Error('[did-provider-cheqd]: suspension: statusListFile and fetchList are mutually exclusive');
+        }
+        // validate args in pairs - case: statusList and fetchList
+        if (args.options?.statusList && args.options?.fetchList) {
+            throw new Error('[did-provider-cheqd]: suspension: statusList and fetchList are mutually exclusive');
+        }
+        // validate args in pairs - case: publish
+        if (args.options?.publish && !args.fetchList && !(args.options?.statusListFile || args.options?.statusList)) {
+            throw new Error('[did-provider-cheqd]: suspension: publish requires statusListFile or statusList, if fetchList is disabled');
+        }
+        // suspend credential
+        return await Cheqd.unsuspendCredential(args.credential, {
+            ...args.options,
+            topArgs: args,
+            publishOptions: {
+                context,
+                resourceId: args?.options?.resourceId,
+                resourceVersion: args?.options?.resourceVersion,
+                signInputs: args?.options?.signInputs,
+                fee: args?.options?.fee
+            }
+        });
+    }
+    async UnsuspendBulkCredentialsWithStatusList2021(args, context) {
+        // TODO: implement
+        throw new Error('[did-provider-cheqd]: suspension: bulk unsuspension is not implemented yet');
+    }
+    async TransactVerifierPaysIssuer(args, context) {
+        try {
+            // delegate to provider
+            const transactionResult = await this.didProvider.transactSendTokens({
+                recipientAddress: args.recipientAddress,
+                amount: args.amount,
+                memoNonce: args.memoNonce,
+                txBytes: args.txBytes,
+            });
+            // return transaction result
+            return {
+                successful: !transactionResult.code,
+                transactionHash: transactionResult.transactionHash,
+                events: transactionResult.events,
+                rawLog: transactionResult.rawLog,
+                txResponse: args?.returnTxResponse ? transactionResult : undefined
+            };
+        }
+        catch (error) {
+            // return error
+            return {
+                successful: false,
+                error: error
+            };
+        }
+    }
+    async ObserveVerifierPaysIssuer(args, context) {
+        // verify with raw unified access control conditions, if any
+        if (args?.unifiedAccessControlCondition) {
+            try {
+                // define network
+                const network = (function () {
+                    switch (args.unifiedAccessControlCondition.chain) {
+                        case LitCompatibleCosmosChains.cheqdMainnet:
+                            return CheqdNetwork.Mainnet;
+                        case LitCompatibleCosmosChains.cheqdTestnet:
+                            return CheqdNetwork.Testnet;
+                        default:
+                            throw new Error(`[did-provider-cheqd]: observe: Unsupported chain: ${args.unifiedAccessControlCondition.chain}`);
+                    }
+                }());
+                // construct url
+                const url = `${DefaultRESTUrls[network]}${args.unifiedAccessControlCondition.path}`;
+                // fetch relevant txs
+                const txs = await (await fetch(url)).json();
+                // skim through txs for relevant events, in which case memoNonce is present and strict equals to the one provided
+                const meetsConditionTxIndex = txs?.txs?.findIndex(tx => unescapeUnicode(tx.body.memo) === unescapeUnicode(args.unifiedAccessControlCondition.returnValueTest.value));
+                // define meetsCondition
+                const meetsCondition = (typeof meetsConditionTxIndex !== 'undefined' && meetsConditionTxIndex !== -1);
+                // return observation result
+                return {
+                    subscribed: true,
+                    meetsCondition: meetsCondition,
+                    transactionHash: meetsCondition ? txs.tx_responses[meetsConditionTxIndex].txhash : undefined,
+                    events: meetsCondition ? txs.tx_responses[meetsConditionTxIndex].events : undefined,
+                    rawLog: meetsCondition ? txs.tx_responses[meetsConditionTxIndex].raw_log : undefined,
+                    txResponse: meetsCondition ? (args?.returnTxResponse ? txs.tx_responses[meetsConditionTxIndex] : undefined) : undefined
+                };
+            }
+            catch (error) {
+                // return error
+                return {
+                    subscribed: false,
+                    meetsCondition: false,
+                    error: error
+                };
+            }
+        }
+        // validate access control conditions components - case: senderAddress
+        if (!args.senderAddress) {
+            throw new Error('[did-provider-cheqd]: observation: senderAddress is required');
+        }
+        // validate access control conditions components - case: recipientAddress
+        if (!args.recipientAddress) {
+            throw new Error('[did-provider-cheqd]: observation: recipientAddress is required');
+        }
+        // validate access control conditions components - case: amount
+        if (!args.amount || !args.amount.amount || !args.amount.denom || args.amount.denom !== 'ncheq') {
+            throw new Error('[did-provider-cheqd]: observation: amount is required, and must be an object with amount and denom valid string properties, amongst which denom must be `ncheq`');
+        }
+        // validate access control conditions components - case: memoNonce
+        if (!args.memoNonce) {
+            throw new Error('[did-provider-cheqd]: observation: memoNonce is required');
+        }
+        // validate access control conditions components - case: network
+        if (!args.network) {
+            throw new Error('[did-provider-cheqd]: observation: network is required');
+        }
+        try {
+            // otherwise, construct url, as per components
+            const url = `${DefaultRESTUrls[args.network]}/cosmos/tx/v1beta1/txs?events=transfer.recipient='${args.recipientAddress}'&events=transfer.sender='${args.senderAddress}'&events=transfer.amount='${args.amount.amount}${args.amount.denom}'`;
+            // fetch relevant txs
+            const txs = await (await fetch(url)).json();
+            // skim through txs for relevant events, in which case memoNonce is present and strict equals to the one provided
+            const meetsConditionTxIndex = txs?.txs?.findIndex(tx => unescapeUnicode(tx.body.memo) === unescapeUnicode(args.memoNonce));
+            // define meetsCondition
+            const meetsCondition = (typeof meetsConditionTxIndex !== 'undefined' && meetsConditionTxIndex !== -1);
+            // return observation result
+            return {
+                subscribed: true,
+                meetsCondition: meetsCondition,
+                transactionHash: meetsCondition ? txs.tx_responses[meetsConditionTxIndex].txhash : undefined,
+                events: meetsCondition ? txs.tx_responses[meetsConditionTxIndex].events : undefined,
+                rawLog: meetsCondition ? txs.tx_responses[meetsConditionTxIndex].raw_log : undefined,
+                txResponse: meetsCondition ? (args?.returnTxResponse ? txs.tx_responses[meetsConditionTxIndex] : undefined) : undefined
+            };
+        }
+        catch (error) {
+            // return error
+            return {
+                subscribed: false,
+                meetsCondition: false,
+                error: error
+            };
+        }
+    }
+    static async revokeCredential(credential, options) {
+        try {
+            // validate status purpose
+            if (credential?.credentialStatus?.statusPurpose !== 'revocation')
+                throw new Error('[did-provider-cheqd]: revocation: Invalid status purpose');
+            // fetch status list 2021 metadata
+            const metadata = (await Cheqd.fetchStatusList2021Metadata(credential));
+            // detect if encrypted
+            const isEncrypted = function () {
+                switch (metadata.mediaType) {
+                    case 'application/octet-stream':
+                        return true;
+                    case 'application/gzip':
+                        return false;
+                    default:
+                        throw new Error(`[did-provider-cheqd]: revocation: Unsupported media type: ${metadata.mediaType}`);
+                }
+            }();
+            // early return, if encrypted and no decryption key provided
+            if (isEncrypted && !options?.topArgs?.symmetricKey)
+                throw new Error('[did-provider-cheqd]: revocation: symmetricKey is required, if status list 2021 is encrypted');
+            // fetch status list 2021 inscribed in credential
+            const statusList2021 = options?.topArgs?.fetchList
+                ? (await async function () {
+                    // if not encrypted, return bitstring
+                    if (!isEncrypted)
+                        return await Cheqd.fetchStatusList2021(credential);
+                    // otherwise, decrypt and return bitstring
+                    const scopedRawBlob = await toBlob(await Cheqd.fetchStatusList2021(credential, true));
+                    // decrypt
+                    return await LitProtocol.decryptDirect(scopedRawBlob, fromString(options?.topArgs?.symmetricKey, 'hex'));
+                }())
+                : (await async function () {
+                    // if status list 2021 is not fetched, read from file
+                    if (options?.statusListFile) {
+                        // if not encrypted, return bitstring
+                        if (!isEncrypted)
+                            return new StatusList({ buffer: await Cheqd.getFile(options.statusListFile) }).encode();
+                        // otherwise, decrypt and return bitstring
+                        const scopedRawBlob = await toBlob(await Cheqd.getFile(options.statusListFile));
+                        // decrypt
+                        return await LitProtocol.decryptDirect(scopedRawBlob, fromString(options?.topArgs?.symmetricKey, 'hex'));
+                    }
+                    if (!options?.statusListInlineBitstring)
+                        throw new Error('[did-provider-cheqd]: revocation: statusListInlineBitstring is required, if statusListFile is not provided');
+                    // otherwise, read from inline bitstring
+                    return options?.statusListInlineBitstring;
+                }());
+            // parse status list 2021
+            const statusList = await StatusList.decode({ encodedList: statusList2021 });
+            // early exit, if credential is already revoked
+            if (statusList.getStatus(Number(credential.credentialStatus.statusListIndex)))
+                return { revoked: false };
+            // update revocation status
+            statusList.setStatus(Number(credential.credentialStatus.statusListIndex), true);
+            // set in-memory status list ref
+            const bitstring = await statusList.encode();
+            // cast top-level args
+            const topArgs = options?.topArgs;
+            // write status list 2021 to file, if provided
+            if (topArgs?.writeToFile) {
+                await Cheqd.writeFile(fromString(bitstring, 'base64url'), options?.statusListFile);
+            }
+            // publish status list 2021, if provided
+            const published = topArgs?.publish
+                ? (await async function () {
+                    // fetch status list 2021 metadata
+                    const statusListMetadata = await Cheqd.fetchStatusList2021Metadata(credential);
+                    // publish status list 2021 as new version
+                    const scoped = topArgs.publishEncrypted
+                        ? (await async function () {
+                            // instantiate dkg-threshold client, in which case lit-protocol is used
+                            const lit = await LitProtocol.create({
+                                chain: options?.topArgs?.bootstrapOptions?.chain,
+                                litNetwork: options?.topArgs?.bootstrapOptions?.litNetwork
+                            });
+                            // encrypt
+                            const { encryptedString, encryptedSymmetricKey, symmetricKey } = await lit.encrypt(bitstring, options?.topArgs?.encryptionOptions?.unifiedAccessControlConditions, true);
+                            // return tuple of publish result and encryption relevant metadata
+                            return [
+                                await Cheqd.publishStatusList2021(new Uint8Array(await encryptedString.arrayBuffer()), statusListMetadata, options?.publishOptions),
+                                { encryptedString, encryptedSymmetricKey, symmetricKey: toString(symmetricKey, 'hex') }
+                            ];
+                        }())
+                        : [await Cheqd.publishStatusList2021(fromString(bitstring, 'base64url'), statusListMetadata, options?.publishOptions), undefined];
+                    // early exit, if publish failed
+                    if (!scoped[0])
+                        throw new Error('[did-provider-cheqd]: revocation: Failed to publish status list 2021');
+                    // return publish result
+                    return scoped;
+                }())
+                : undefined;
+            return {
+                revoked: true,
+                published: topArgs?.publish ? true : undefined,
+                statusList: topArgs?.returnUpdatedStatusList ? bitstring : undefined,
+                encryptedStatusList: topArgs?.returnUpdatedEncryptedStatusList ? await blobToHexString(published?.[1]?.encryptedString) : undefined,
+                encryptedSymmetricKey: topArgs?.returnEncryptedSymmetricKey ? published?.[1]?.encryptedSymmetricKey : undefined,
+                symmetricKey: topArgs?.returnSymmetricKey ? published?.[1]?.symmetricKey : undefined,
+                resourceMetadata: topArgs?.returnStatusListMetadata ? await Cheqd.fetchStatusList2021Metadata(credential) : undefined
+            };
+        }
+        catch (error) {
+            // silent fail + early exit, optimised for parallelisation, use with Promise.allSettled
+            console.error(error);
+            return { revoked: false, error: error };
+        }
+    }
+    static async suspendCredential(credential, options) {
+        try {
+            // validate status purpose
+            if (credential?.credentialStatus?.statusPurpose !== 'suspension')
+                throw new Error('[did-provider-cheqd]: suspension: Invalid status purpose');
+            // fetch status list 2021 metadata
+            const metadata = (await Cheqd.fetchStatusList2021Metadata(credential));
+            // detect if encrypted
+            const isEncrypted = function () {
+                switch (metadata.mediaType) {
+                    case 'application/octet-stream':
+                        return true;
+                    case 'application/gzip':
+                        return false;
+                    default:
+                        throw new Error(`[did-provider-cheqd]: suspension: Unsupported media type: ${metadata.mediaType}`);
+                }
+            }();
+            // early return, if encrypted and no decryption key provided
+            if (isEncrypted && !options?.topArgs?.symmetricKey)
+                throw new Error('[did-provider-cheqd]: suspension: symmetricKey is required, if status list 2021 is encrypted');
+            // fetch status list 2021 inscribed in credential
+            const statusList2021 = options?.topArgs?.fetchList
+                ? (await async function () {
+                    // if not encrypted, return bitstring
+                    if (!isEncrypted)
+                        return await Cheqd.fetchStatusList2021(credential);
+                    // otherwise, decrypt and return bitstring
+                    const scopedRawBlob = await toBlob(await Cheqd.fetchStatusList2021(credential, true));
+                    // decrypt
+                    return await LitProtocol.decryptDirect(scopedRawBlob, fromString(options?.topArgs?.symmetricKey, 'hex'));
+                }())
+                : (await async function () {
+                    // if status list 2021 is not fetched, read from file
+                    if (options?.statusListFile) {
+                        // if not encrypted, return bitstring
+                        if (!isEncrypted)
+                            return new StatusList({ buffer: await Cheqd.getFile(options.statusListFile) }).encode();
+                        // otherwise, decrypt and return bitstring
+                        const scopedRawBlob = await toBlob(await Cheqd.getFile(options.statusListFile));
+                        // decrypt
+                        return await LitProtocol.decryptDirect(scopedRawBlob, fromString(options?.topArgs?.symmetricKey, 'hex'));
+                    }
+                    if (!options?.statusListInlineBitstring)
+                        throw new Error('[did-provider-cheqd]: suspension: statusListInlineBitstring is required, if statusListFile is not provided');
+                    // otherwise, read from inline bitstring
+                    return options?.statusListInlineBitstring;
+                }());
+            // parse status list 2021
+            const statusList = await StatusList.decode({ encodedList: statusList2021 });
+            // early exit, if already suspended
+            if (statusList.getStatus(Number(credential.credentialStatus.statusListIndex)))
+                return { suspended: false };
+            // update suspension status
+            statusList.setStatus(Number(credential.credentialStatus.statusListIndex), true);
+            // set in-memory status list ref
+            const bitstring = await statusList.encode();
+            // cast top-level args
+            const topArgs = options?.topArgs;
+            // write status list 2021 to file, if provided
+            if (topArgs?.writeToFile) {
+                await Cheqd.writeFile(fromString(bitstring, 'base64url'), options?.statusListFile);
+            }
+            // publish status list 2021, if provided
+            const published = topArgs?.publish
+                ? (await async function () {
+                    // fetch status list 2021 metadata
+                    const statusListMetadata = await Cheqd.fetchStatusList2021Metadata(credential);
+                    // publish status list 2021 as new version
+                    const scoped = topArgs.publishEncrypted
+                        ? (await async function () {
+                            // instantiate dkg-threshold client, in which case lit-protocol is used
+                            const lit = await LitProtocol.create({
+                                chain: options?.topArgs?.bootstrapOptions?.chain,
+                                litNetwork: options?.topArgs?.bootstrapOptions?.litNetwork
+                            });
+                            // encrypt
+                            const { encryptedString, encryptedSymmetricKey, symmetricKey } = await lit.encrypt(bitstring, options?.topArgs?.encryptionOptions?.unifiedAccessControlConditions, true);
+                            // return tuple of publish result and encryption relevant metadata
+                            return [
+                                await Cheqd.publishStatusList2021(new Uint8Array(await encryptedString.arrayBuffer()), statusListMetadata, options?.publishOptions),
+                                { encryptedString, encryptedSymmetricKey, symmetricKey: toString(symmetricKey, 'hex') }
+                            ];
+                        }())
+                        : [await Cheqd.publishStatusList2021(fromString(bitstring, 'base64url'), statusListMetadata, options?.publishOptions), undefined];
+                    // early exit, if publish failed
+                    if (!scoped[0])
+                        throw new Error('[did-provider-cheqd]: suspension: Failed to publish status list 2021');
+                    // return publish result
+                    return scoped;
+                }())
+                : undefined;
+            return {
+                suspended: true,
+                published: topArgs?.publish ? true : undefined,
+                statusList: topArgs?.returnUpdatedStatusList ? bitstring : undefined,
+                encryptedStatusList: topArgs?.returnUpdatedEncryptedStatusList ? await blobToHexString(published?.[1]?.encryptedString) : undefined,
+                encryptedSymmetricKey: topArgs?.returnEncryptedSymmetricKey ? published?.[1]?.encryptedSymmetricKey : undefined,
+                symmetricKey: topArgs?.returnSymmetricKey ? published?.[1]?.symmetricKey : undefined,
+                resourceMetadata: topArgs?.returnStatusListMetadata ? await Cheqd.fetchStatusList2021Metadata(credential) : undefined
+            };
+        }
+        catch (error) {
+            // silent fail + early exit, optimised for parallelisation, use with Promise.allSettled
+            console.error(error);
+            return { suspended: false, error: error };
+        }
+    }
+    static async unsuspendCredential(credential, options) {
+        try {
+            // validate status purpose
+            if (credential?.credentialStatus?.statusPurpose !== 'suspension')
+                throw new Error('[did-provider-cheqd]: unsuspension: Invalid status purpose');
+            // fetch status list 2021 metadata
+            const metadata = (await Cheqd.fetchStatusList2021Metadata(credential));
+            // detect if encrypted
+            const isEncrypted = function () {
+                switch (metadata.mediaType) {
+                    case 'application/octet-stream':
+                        return true;
+                    case 'application/gzip':
+                        return false;
+                    default:
+                        throw new Error(`[did-provider-cheqd]: unsuspension: Unsupported media type: ${metadata.mediaType}`);
+                }
+            }();
+            // early return, if encrypted and no decryption key provided
+            if (isEncrypted && !options?.topArgs?.symmetricKey)
+                throw new Error('[did-provider-cheqd]: unsuspension: symmetricKey is required, if status list 2021 is encrypted');
+            // fetch status list 2021 inscribed in credential
+            const statusList2021 = options?.topArgs?.fetchList
+                ? (await async function () {
+                    // if not encrypted, return bitstring
+                    if (!isEncrypted)
+                        return await Cheqd.fetchStatusList2021(credential);
+                    // otherwise, decrypt and return bitstring
+                    const scopedRawBlob = await toBlob(await Cheqd.fetchStatusList2021(credential, true));
+                    // decrypt
+                    return await LitProtocol.decryptDirect(scopedRawBlob, fromString(options?.topArgs?.symmetricKey, 'hex'));
+                }())
+                : (await async function () {
+                    // if status list 2021 is not fetched, read from file
+                    if (options?.statusListFile) {
+                        // if not encrypted, return bitstring
+                        if (!isEncrypted)
+                            return new StatusList({ buffer: await Cheqd.getFile(options.statusListFile) }).encode();
+                        // otherwise, decrypt and return bitstring
+                        const scopedRawBlob = await toBlob(await Cheqd.getFile(options.statusListFile));
+                        // decrypt
+                        return await LitProtocol.decryptDirect(scopedRawBlob, fromString(options?.topArgs?.symmetricKey, 'hex'));
+                    }
+                    if (!options?.statusListInlineBitstring)
+                        throw new Error('[did-provider-cheqd]: unsuspension: statusListInlineBitstring is required, if statusListFile is not provided');
+                    // otherwise, read from inline bitstring
+                    return options?.statusListInlineBitstring;
+                }());
+            // parse status list 2021
+            const statusList = await StatusList.decode({ encodedList: statusList2021 });
+            // early exit, if already suspended
+            if (statusList.getStatus(Number(credential.credentialStatus.statusListIndex)))
+                return { unsuspended: false };
+            // update suspension status
+            statusList.setStatus(Number(credential.credentialStatus.statusListIndex), true);
+            // set in-memory status list ref
+            const bitstring = await statusList.encode();
+            // cast top-level args
+            const topArgs = options?.topArgs;
+            // write status list 2021 to file, if provided
+            if (topArgs?.writeToFile) {
+                await Cheqd.writeFile(fromString(bitstring, 'base64url'), options?.statusListFile);
+            }
+            // publish status list 2021, if provided
+            const published = topArgs?.publish
+                ? (await async function () {
+                    // fetch status list 2021 metadata
+                    const statusListMetadata = await Cheqd.fetchStatusList2021Metadata(credential);
+                    // publish status list 2021 as new version
+                    const scoped = topArgs.publishEncrypted
+                        ? (await async function () {
+                            // instantiate dkg-threshold client, in which case lit-protocol is used
+                            const lit = await LitProtocol.create({
+                                chain: options?.topArgs?.bootstrapOptions?.chain,
+                                litNetwork: options?.topArgs?.bootstrapOptions?.litNetwork
+                            });
+                            // encrypt
+                            const { encryptedString, encryptedSymmetricKey, symmetricKey } = await lit.encrypt(bitstring, options?.topArgs?.encryptionOptions?.unifiedAccessControlConditions, true);
+                            // return tuple of publish result and encryption relevant metadata
+                            return [
+                                await Cheqd.publishStatusList2021(new Uint8Array(await encryptedString.arrayBuffer()), statusListMetadata, options?.publishOptions),
+                                { encryptedString, encryptedSymmetricKey, symmetricKey: toString(symmetricKey, 'hex') }
+                            ];
+                        }())
+                        : [await Cheqd.publishStatusList2021(fromString(bitstring, 'base64url'), statusListMetadata, options?.publishOptions), undefined];
+                    // early exit, if publish failed
+                    if (!scoped[0])
+                        throw new Error('[did-provider-cheqd]: unsuspension: Failed to publish status list 2021');
+                    // return publish result
+                    return scoped;
+                }())
+                : undefined;
+            return {
+                unsuspended: true,
+                published: topArgs?.publish ? true : undefined,
+                statusList: topArgs?.returnUpdatedStatusList ? bitstring : undefined,
+                encryptedStatusList: topArgs?.returnUpdatedEncryptedStatusList ? await blobToHexString(published?.[1]?.encryptedString) : undefined,
+                encryptedSymmetricKey: topArgs?.returnEncryptedSymmetricKey ? published?.[1]?.encryptedSymmetricKey : undefined,
+                symmetricKey: topArgs?.returnSymmetricKey ? published?.[1]?.symmetricKey : undefined,
+                resourceMetadata: topArgs?.returnStatusListMetadata ? await Cheqd.fetchStatusList2021Metadata(credential) : undefined
+            };
+        }
+        catch (error) {
+            // silent fail + early exit, optimised for parallelisation, use with Promise.allSettled
+            console.error(error);
+            return { unsuspended: false, error: error };
+        }
+    }
+    static async checkRevoked(credential, options = { fetchList: true }) {
+        // validate status purpose
+        if (credential.credentialStatus?.statusPurpose !== 'revocation') {
+            throw new Error(`[did-provider-cheqd]: revocation: Unsupported status purpose: ${credential.credentialStatus?.statusPurpose}`);
+        }
+        // fetch status list 2021 metadata
+        const metadata = (await Cheqd.fetchStatusList2021Metadata(credential));
+        // detect if encrypted
+        const isEncrypted = function () {
+            switch (metadata.mediaType) {
+                case 'application/octet-stream':
+                    return true;
+                case 'application/gzip':
+                    return false;
+                default:
+                    throw new Error(`[did-provider-cheqd]: revocation: Unsupported media type: ${metadata.mediaType}`);
+            }
+        }();
+        // early return, if encrypted and decryption key is not provided
+        if (isEncrypted && !options?.topArgs?.encryptedSymmetricKey)
+            throw new Error('[did-provider-cheqd]: revocation: encryptedSymmetricKey is required, if status list 2021 is encrypted');
+        // fetch status list 2021 inscribed in credential
+        const statusList2021 = options?.topArgs?.fetchList
+            ? (await async function () {
+                // if not encrypted, return bitstring
+                if (!isEncrypted)
+                    return await Cheqd.fetchStatusList2021(credential);
+                // otherwise, decrypt and return bitstring
+                const scopedRawBlob = await toBlob(await Cheqd.fetchStatusList2021(credential, true));
+                // instantiate dkg-threshold client, in which case lit-protocol is used
+                const lit = await LitProtocol.create({
+                    chain: options?.topArgs?.bootstrapOptions?.chain,
+                    litNetwork: options?.topArgs?.bootstrapOptions?.litNetwork
+                });
+                // decrypt
+                return await lit.decrypt(scopedRawBlob, options?.topArgs?.encryptedSymmetricKey, options?.topArgs?.decryptionOptions?.unifiedAccessControlConditions);
+            }())
+            : (await async function () {
+                // if status list 2021 is not fetched, read from file
+                if (options?.statusListFile) {
+                    // if not encrypted, return bitstring
+                    if (!isEncrypted)
+                        return new StatusList({ buffer: await Cheqd.getFile(options.statusListFile) }).encode();
+                    // otherwise, decrypt and return bitstring
+                    const scopedRawBlob = await toBlob(await Cheqd.getFile(options.statusListFile));
+                    // instantiate dkg-threshold client, in which case lit-protocol is used
+                    const lit = await LitProtocol.create({
+                        chain: options?.topArgs?.bootstrapOptions?.chain,
+                        litNetwork: options?.topArgs?.bootstrapOptions?.litNetwork
+                    });
+                    // decrypt
+                    return await lit.decrypt(scopedRawBlob, options?.topArgs?.encryptedSymmetricKey, options?.topArgs?.decryptionOptions?.unifiedAccessControlConditions);
+                }
+                if (!options?.statusListInlineBitstring)
+                    throw new Error(' [did-provider-cheqd]: revocation: statusListInlineBitstring is required, if statusListFile is not provided');
+                // otherwise, read from inline bitstring
+                return options?.statusListInlineBitstring;
+            }());
+        // parse status list 2021
+        const statusList = await StatusList.decode({ encodedList: statusList2021 });
+        // get status by index
+        return !!statusList.getStatus(Number(credential.credentialStatus.statusListIndex));
+    }
+    static async checkSuspended(credential, options = { fetchList: true }) {
+        // validate status purpose
+        if (credential.credentialStatus?.statusPurpose !== 'suspension') {
+            throw new Error(`[did-provider-cheqd]: suspension: Unsupported status purpose: ${credential.credentialStatus?.statusPurpose}`);
+        }
+        // fetch status list 2021 metadata
+        const metadata = (await Cheqd.fetchStatusList2021Metadata(credential));
+        // detect if encrypted
+        const isEncrypted = function () {
+            switch (metadata.mediaType) {
+                case 'application/octet-stream':
+                    return true;
+                case 'application/gzip':
+                    return false;
+                default:
+                    throw new Error(`[did-provider-cheqd]: suspension: Unsupported media type: ${metadata.mediaType}`);
+            }
+        }();
+        // early return, if encrypted and decryption key is not provided
+        if (isEncrypted && !options?.topArgs?.encryptedSymmetricKey)
+            throw new Error('[did-provider-cheqd]: suspension: encryptedSymmetricKey is required, if status list 2021 is encrypted');
+        // fetch status list 2021 inscribed in credential
+        const statusList2021 = options?.topArgs?.fetchList
+            ? (await async function () {
+                // if not encrypted, return bitstring
+                if (!isEncrypted)
+                    return await Cheqd.fetchStatusList2021(credential);
+                // otherwise, decrypt and return bitstring
+                const scopedRawBlob = await toBlob(await Cheqd.fetchStatusList2021(credential, true));
+                // instantiate dkg-threshold client, in which case lit-protocol is used
+                const lit = await LitProtocol.create({
+                    chain: options?.topArgs?.bootstrapOptions?.chain,
+                    litNetwork: options?.topArgs?.bootstrapOptions?.litNetwork
+                });
+                // decrypt
+                return await lit.decrypt(scopedRawBlob, options?.topArgs?.encryptedSymmetricKey, options?.topArgs?.decryptionOptions?.unifiedAccessControlConditions);
+            }())
+            : (await async function () {
+                // if status list 2021 is not fetched, read from file
+                if (options?.statusListFile) {
+                    // if not encrypted, return bitstring
+                    if (!isEncrypted)
+                        return new StatusList({ buffer: await Cheqd.getFile(options.statusListFile) }).encode();
+                    // otherwise, decrypt and return bitstring
+                    const scopedRawBlob = await toBlob(await Cheqd.getFile(options.statusListFile));
+                    // instantiate dkg-threshold client, in which case lit-protocol is used
+                    const lit = await LitProtocol.create({
+                        chain: options?.topArgs?.bootstrapOptions?.chain,
+                        litNetwork: options?.topArgs?.bootstrapOptions?.litNetwork
+                    });
+                    // decrypt
+                    return await lit.decrypt(scopedRawBlob, options?.topArgs?.encryptedSymmetricKey, options?.topArgs?.decryptionOptions?.unifiedAccessControlConditions);
+                }
+                if (!options?.statusListInlineBitstring)
+                    throw new Error(' [did-provider-cheqd]: suspension: statusListInlineBitstring is required, if statusListFile is not provided');
+                // otherwise, read from inline bitstring
+                return options?.statusListInlineBitstring;
+            }());
+        // parse status list 2021
+        const statusList = await StatusList.decode({ encodedList: statusList2021 });
+        // get status by index
+        return !!statusList.getStatus(Number(credential.credentialStatus.statusListIndex));
+    }
+    static async publishStatusList2021(statusList2021Raw, statusList2021Metadata, options) {
+        // construct status list 2021 payload from previous version + new version
+        const payload = {
+            collectionId: statusList2021Metadata.resourceCollectionId,
+            id: options?.resourceId || v4(),
+            name: statusList2021Metadata.resourceName,
+            version: options?.resourceVersion || new Date().toISOString(),
+            resourceType: 'StatusList2021',
+            data: statusList2021Raw
+        };
+        return await options.context.agent[CreateStatusList2021MethodName]({
+            kms: (await options.context.agent.keyManagerGetKeyManagementSystems())[0],
+            payload,
+            network: statusList2021Metadata.resourceURI.split(':')[2],
+            signInputs: options?.signInputs,
+            fee: options?.fee
+        });
+    }
+    static async fetchStatusList2021(credential, returnRaw = false) {
+        // validate credential status
+        if (!credential.credentialStatus)
+            throw new Error('[did-provider-cheqd]: fetch status list: Credential status is not present');
+        // validate credential status type
+        if (credential.credentialStatus.type !== 'StatusList2021Entry')
+            throw new Error('[did-provider-cheqd]: fetch status list: Credential status type is not valid');
+        // validate credential status list status purpose
+        if (credential.credentialStatus.statusPurpose !== 'revocation' && credential.credentialStatus.statusPurpose !== 'suspension')
+            throw new Error('[did-provider-cheqd]: fetch status list: Credential status purpose is not valid');
+        // validate credential status list status list credential
+        if (!credential.credentialStatus.statusListCredential)
+            throw new Error('[did-provider-cheqd]: fetch status list: Credential status list credential is not present');
+        // fetch status list 2021
+        const raw = await (await fetch(credential.credentialStatus.statusListCredential)).arrayBuffer();
+        // return raw if requested
+        if (returnRaw)
+            return new Uint8Array(raw);
+        // otherwise, parse to bitstring and return
+        const bitstring = toString(new Uint8Array(raw), 'base64url');
+        return bitstring;
+    }
+    static async fetchStatusList2021Metadata(credential) {
+        // get base url
+        const baseUrl = new URL(credential.credentialStatus?.statusListCredential);
+        // get resource name
+        const resourceName = baseUrl.searchParams.get('resourceName');
+        // unset resource name
+        baseUrl.searchParams.delete('resourceName');
+        // construct metadata url
+        const metadataUrl = `${baseUrl.toString()}/metadata`;
+        // fetch collection metadata
+        const collectionMetadata = await (await fetch(metadataUrl)).json();
+        // early exit if no linked resources
+        if (!collectionMetadata?.contentStream?.linkedResourceMetadata)
+            throw new Error('[did-provider-cheqd]: fetch status list metadata: No linked resources found');
+        // find relevant resources by resource name
+        const resourceVersioning = collectionMetadata.contentStream.linkedResourceMetadata.filter((resource) => resource.resourceName === resourceName);
+        // early exit if no relevant resources
+        if (!resourceVersioning.length || resourceVersioning.length === 0)
+            throw new Error(`[did-provider-cheqd]: fetch status list metadata: No relevant resources found by resource name ${resourceName}`);
+        // get latest resource version by nextVersionId null pointer, or by latest created date as fallback
+        return resourceVersioning.find((resource) => !resource.nextVersionId) || resourceVersioning.sort((a, b) => new Date(b.created).getTime() - new Date(a.created).getTime())[0];
+    }
     static async loadProvider(document, providers) {
         const provider = providers.find((provider) => document.id.includes(`${DidPrefix}:${CheqdDidMethod}:${provider.network}`));
         if (!provider) {
@@ -381,5 +1804,23 @@ export class Cheqd {
             resolve(new Uint8Array(content));
         });
     }
+    static async writeFile(content, filename) {
+        if (!filename) {
+            filename = `statusList2021-${v4()}`;
+        }
+        // alert if file exists
+        if (fs.existsSync(filename)) {
+            debug(`[did-provider-cheqd]: File ${filename} already exists`);
+            console.warn(`[did-provider-cheqd]: File ${filename} already exists. Overwriting...`);
+        }
+        return new Promise((resolve, reject) => {
+            fs.writeFile(filename, content, (err) => {
+                if (err) {
+                    reject(new Error(`[did-provider-cheqd]: Error writing file ${filename}: reason: ${err}`));
+                }
+                resolve();
+            });
+        });
+    }
 }
 //# sourceMappingURL=ICheqd.js.map