@cheqd/did-provider-cheqd 3.4.0-develop.1 → 3.4.0-develop.2

package/build/esm/agent/ICheqd.js

@@ -3,7 +3,7 @@
 // unused vars are kept by convention
 // non-null assertion is used when we know better than the compiler that the value is not null or undefined
 import { CheqdNetwork, createDidPayload, createDidVerificationMethod, createKeyPairBase64, createKeyPairHex, createVerificationKeys } from '@cheqd/sdk';
-import { DefaultRESTUrls } from '../did-manager/cheqd-did-provider.js';
+import { DefaultRESTUrls, DefaultStatusList2021Encodings, DefaultStatusList2021ResourceTypes, DefaultStatusList2021StatusPurposeTypes, } from '../did-manager/cheqd-did-provider.js';
 import { fromString, toString } from 'uint8arrays';
 import { decodeJWT } from 'did-jwt';
 import { StatusList } from '@digitalbazaar/vc-status-list';
@@ -14,14 +14,45 @@ import { LitCompatibleCosmosChains, LitProtocol } from '../dkg-threshold/lit-pro
 import { blobToHexString, randomFromRange, toBlob, unescapeUnicode } from '../utils/helpers.js';
 import { resolverUrl } from '../did-manager/cheqd-did-resolver.js';
 const debug = Debug('veramo:did-provider-cheqd');
-export const AccessControlConditionTypes = { memoNonce: 'memoNonce', balance: 'balance' };
+// TODO: revisit while implementing timelock payment
+//? CheckSequenceVerify (CSV) is a script opcode used to implement relative timelocks.
+//? It is a conditional opcode that consumes a minimum of two stack items and compares their relative locktime values.
+//? If the relative locktime of the first item is equal to or greater than the relative locktime of the second item, then the script evaluates to true, otherwise it evaluates to false.
+//? The relative locktime of an item is the number of seconds since the item was confirmed.
+//? The following apply:
+//?  - Relative locktimes are measured from the time a transaction is confirmed, not from the time a transaction is created.
+//?  - Relative locktimes are not affected by time zone or daylight saving time.
+//?  - Relative locktimes are not affected by the time a transaction is broadcast.
+//?  - Relative locktimes are not affected by the time a transaction is mined.
+//?  - Relative locktimes are not affected by the time a transaction is included in a block.
+//?  - Relative locktimes are not affected by the time a block is mined.
+// Implementation as per:
+//
+//  - Generate a random nonce client-side.
+//    - Utilise the nonce as the memo.
+//    - Observed by the recipient client-side.
+//    - Gives turn to initiate decryption of the status list + status verification.
+//  - Define time interval OR block height interval client-side.
+//    - Utilised as inverse timelock.
+//    - Observed by dkg nodes.
+//      - TODO: Add chained AND conditions to return value tests, dkg node-side.
+//        - e.g. if timelockPayment (a <= now <= b) AND memoNonce strict equality (uuid, IMPORTANT: condition is updateable).
+//    - Optionally, recycled per encryption of the status list.
+//      - Will be published as part of the status list, if recycled + interval is altered.
+// Issuer initiated immutable steps:
+//  - Initilise ACC with timelockPayment, nonce. <-- Nonce is timestamped as per time of encryption.
+//  - On a per transaction basis:
+//    - Update ACC with revelant memoNonce.
+//    - Rotate symmetric key.
+export const AccessControlConditionTypes = { timelockPayment: 'timelockPayment', memoNonce: 'memoNonce', balance: 'balance' };
 export const AccessControlConditionReturnValueComparators = { lessThan: '<', greaterThan: '>', equalTo: '=', lessThanOrEqualTo: '<=', greaterThanOrEqualTo: '>=' };
+export const RemoteListPattern = /^(https:\/\/)?[a-z0-9_-]+(\.[a-z0-9_-]+)*\.[a-z]{2,}\/1\.0\/identifiers\/did:cheqd:[a-z]+:[a-zA-Z0-9-]+\?((resourceName=[^&]*)&(resourceType=[^&]*)|((resourceType=[^&]*)&(resourceName=[^&]*)))$/;
 const CreateIdentifierMethodName = 'cheqdCreateIdentifier';
 const UpdateIdentifierMethodName = 'cheqdUpdateIdentifier';
 const DeactivateIdentifierMethodName = 'cheqdDeactivateIdentifier';
 const CreateResourceMethodName = 'cheqdCreateLinkedResource';
 const CreateStatusList2021MethodName = 'cheqdCreateStatusList2021';
-const CreateEncryptedStatusList2021MethodName = 'cheqdCreateEncryptedStatusList2021';
+const BroadcastStatusList2021MethodName = 'cheqdBroadcastStatusList2021';
 const GenerateDidDocMethodName = 'cheqdGenerateDidDoc';
 const GenerateDidDocWithLinkedResourceMethodName = 'cheqdGenerateDidDocWithLinkedResource';
 const GenerateKeyPairMethodName = 'cheqdGenerateIdentityKeys';
@@ -136,17 +167,17 @@ export class Cheqd {
                         ]
                     },
                     "returnType": {
-                        "type": "boolean"
+                        "type": "object"
                     }
                 },
-                "cheqdCreateEncryptedStatusList2021": {
-                    "description": "Create a new Encrypted Status List 2021",
+                "cheqdBroadcastStatusList2021": {
+                    "description": "Broadcast a Status List 2021 to cheqd ledger",
                     "arguments": {
                         "type": "object",
                         "properties": {
                             "args": {
                                 "type": "object",
-                                "description": "A cheqdCreateEncryptedStatusList2021Args object as any for extensibility"
+                                "description": "A cheqdBroadcastStatusList2021Args object as any for extensibility"
                             }
                         },
                         "required": [
@@ -512,7 +543,7 @@ export class Cheqd {
             [DeactivateIdentifierMethodName]: this.DeactivateIdentifier.bind(this),
             [CreateResourceMethodName]: this.CreateResource.bind(this),
             [CreateStatusList2021MethodName]: this.CreateStatusList2021.bind(this),
-            [CreateEncryptedStatusList2021MethodName]: this.CreateEncryptedStatusList2021.bind(this),
+            [BroadcastStatusList2021MethodName]: this.BroadcastStatusList2021.bind(this),
             [GenerateDidDocMethodName]: this.GenerateDidDoc.bind(this),
             [GenerateDidDocWithLinkedResourceMethodName]: this.GenerateDidDocWithLinkedResource.bind(this),
             [GenerateKeyPairMethodName]: this.GenerateIdentityKeys.bind(this),
@@ -630,33 +661,125 @@ export class Cheqd {
         if (typeof args.kms !== 'string') {
             throw new Error('[did-provider-cheqd]: kms is required');
         }
-        if (typeof args.payload !== 'object') {
-            throw new Error('[did-provider-cheqd]: payload object is required');
+        if (typeof args.issuerDid !== 'string' || !args.issuerDid) {
+            throw new Error('[did-provider-cheqd]: issuerDid is required');
         }
-        if (typeof args.network !== 'string') {
-            throw new Error('[did-provider-cheqd]: network is required');
+        if (typeof args.statusListName !== 'string' || !args.statusListName) {
+            throw new Error('[did-provider-cheqd]: statusListName is required');
         }
-        if (args?.file) {
-            args.payload.data = await Cheqd.getFile(args.file);
+        if (typeof args.statusPurpose !== 'string' || !args.statusPurpose) {
+            throw new Error('[did-provider-cheqd]: statusPurpose is required');
         }
-        if (typeof args?.payload?.data === 'string') {
-            args.payload.data = fromString(args.payload.data, 'base64');
+        if (typeof args.encrypted === 'undefined') {
+            throw new Error('[did-provider-cheqd]: encrypted is required');
         }
-        // TODO: validate data as per bitstring
-        // set default resource type in runtime
-        args.payload.resourceType = 'StatusList2021';
-        this.providerId = Cheqd.generateProviderId(args.network);
-        this.didProvider = await Cheqd.loadProvider({ id: this.providerId }, this.supportedDidProviders);
-        return await this.didProvider.createResource({
-            options: {
-                kms: args.kms,
-                payload: args.payload,
-                signInputs: args.signInputs,
-                fee: args?.fee
+        // validate statusPurpose
+        if (!Object.values(DefaultStatusList2021StatusPurposeTypes).includes(args.statusPurpose)) {
+            throw new Error(`[did-provider-cheqd]: statusPurpose must be one of ${Object.values(DefaultStatusList2021StatusPurposeTypes).join(', ')}`);
+        }
+        // validate statusListLength
+        if (args?.statusListLength) {
+            if (typeof args.statusListLength !== 'number') {
+                throw new Error('[did-provider-cheqd]: statusListLength must be number');
             }
-        }, context);
+            if (args.statusListLength < Cheqd.defaultStatusList2021Length) {
+                throw new Error(`[did-provider-cheqd]: statusListLength must be greater than or equal to ${Cheqd.defaultStatusList2021Length} number of entries`);
+            }
+        }
+        // validate statusListEncoding
+        if (args?.statusListEncoding) {
+            if (typeof args.statusListEncoding !== 'string') {
+                throw new Error('[did-provider-cheqd]: statusListEncoding must be string');
+            }
+            if (!Object.values(DefaultStatusList2021Encodings).includes(args.statusListEncoding)) {
+                throw new Error(`[did-provider-cheqd]: statusListEncoding must be one of ${Object.values(DefaultStatusList2021Encodings).join(', ')}`);
+            }
+        }
+        // validate validUntil
+        if (args?.validUntil) {
+            if (typeof args.validUntil !== 'string') {
+                throw new Error('[did-provider-cheqd]: validUntil must be string');
+            }
+            if (new Date() <= new Date(args.validUntil)) {
+                throw new Error('[did-provider-cheqd]: validUntil must be greater than current date');
+            }
+        }
+        // validate args in pairs - case: encrypted
+        if (args.encrypted) {
+            // validate paymentConditions
+            if (!args?.paymentConditions || !args?.paymentConditions?.length || !Array.isArray(args?.paymentConditions) || args?.paymentConditions.length === 0) {
+                throw new Error('[did-provider-cheqd]: paymentConditions is required');
+            }
+            if (!args?.paymentConditions?.every((condition) => condition.feePaymentAddress && condition.feePaymentAmount)) {
+                throw new Error('[did-provider-cheqd]: paymentConditions must contain feePaymentAddress and feeAmount');
+            }
+            if (!args?.paymentConditions?.every((condition) => typeof condition.feePaymentAddress === 'string' && typeof condition.feePaymentAmount === 'string')) {
+                throw new Error('[did-provider-cheqd]: feePaymentAddress and feePaymentAmount must be string');
+            }
+            if (!args?.paymentConditions?.every((condition) => condition.type === AccessControlConditionTypes.timelockPayment)) {
+                throw new Error('[did-provider-cheqd]: paymentConditions must be of type timelockPayment');
+            }
+        }
+        // get network
+        const network = args.issuerDid.split(':')[2];
+        // generate bitstring
+        const bitstring = await context.agent[GenerateStatusList2021MethodName]({ length: args?.statusListLength || Cheqd.defaultStatusList2021Length, bitstringEncoding: args?.statusListEncoding || DefaultStatusList2021Encodings.base64url });
+        // construct data
+        const data = args.encrypted
+            ? (await (async function () {
+                // TODO: implement
+                throw new Error('[did-provider-cheqd]: encrypted status list is not implemented yet');
+            }()))
+            : (await (async function () {
+                switch (args.statusPurpose) {
+                    case DefaultStatusList2021StatusPurposeTypes.revocation:
+                        return {
+                            StatusList2021: {
+                                type: DefaultStatusList2021ResourceTypes.revocation,
+                                encodedList: bitstring,
+                                validFrom: new Date().toISOString(),
+                                validUntil: args?.validUntil
+                            },
+                            metadata: {
+                                encrypted: false,
+                                encoding: args?.statusListEncoding || DefaultStatusList2021Encodings.base64url,
+                            }
+                        };
+                    case DefaultStatusList2021StatusPurposeTypes.suspension:
+                        return {
+                            StatusList2021: {
+                                type: DefaultStatusList2021ResourceTypes.suspension,
+                                encodedList: bitstring,
+                                validFrom: new Date().toISOString(),
+                                validUntil: args?.validUntil
+                            },
+                            metadata: {
+                                encrypted: false,
+                                encoding: args?.statusListEncoding || DefaultStatusList2021Encodings.base64url,
+                            }
+                        };
+                    default:
+                        throw new Error('[did-provider-cheqd]: statusPurpose is not valid');
+                }
+            }()));
+        // construct payload
+        const payload = {
+            id: v4(),
+            collectionId: args.issuerDid.split(':').reverse()[0],
+            name: args.statusListName,
+            resourceType: DefaultStatusList2021ResourceTypes[args.statusPurpose],
+            version: args?.resourceVersion || new Date().toISOString(),
+            alsoKnownAs: args?.alsoKnownAs || [],
+            data: fromString(JSON.stringify(data), 'utf-8'),
+        };
+        // return result
+        return {
+            created: await context.agent[BroadcastStatusList2021MethodName]({ kms: args.kms, payload, network: network }),
+            statusList2021: data,
+            resourceMetadata: await Cheqd.fetchStatusList2021Metadata({ credentialStatus: { id: `${resolverUrl}${args.issuerDid}?resourceName=${args.statusListName}&resourceType=${DefaultStatusList2021ResourceTypes[args.statusPurpose]}`, type: 'StatusList2021Entry' } })
+        };
     }
-    async CreateEncryptedStatusList2021(args, context) {
+    async BroadcastStatusList2021(args, context) {
         if (typeof args.kms !== 'string') {
             throw new Error('[did-provider-cheqd]: kms is required');
         }
@@ -673,48 +796,13 @@ export class Cheqd {
             args.payload.data = fromString(args.payload.data, 'base64');
         }
         // TODO: validate data as per bitstring
-        if (!args?.encryptionOptions) {
-            throw new Error('[did-provider-cheqd]: encryptionOptions is required');
-        }
-        if (!args?.bootstrapOptions) {
-            throw new Error('[did-provider-cheqd]: bootstrapOptions is required');
+        // validate resource type
+        if (!Object.values(DefaultStatusList2021ResourceTypes).includes(args?.payload?.resourceType)) {
+            throw new Error(`[did-provider-cheqd]: resourceType must be one of ${Object.values(DefaultStatusList2021ResourceTypes).join(', ')}`);
         }
-        if (!args?.encryptionOptions?.accessControlConditions) {
-            throw new Error('[did-provider-cheqd]: accessControlConditions is required');
-        }
-        // instantiate dkg-threshold client, in which case lit-protocol is used
-        const lit = await LitProtocol.create({
-            chain: args.bootstrapOptions?.chain,
-            litNetwork: args.bootstrapOptions?.litNetwork
-        });
-        // construct access control conditions
-        const unifiedAccessControlConditions = await Promise.all(args.encryptionOptions.accessControlConditions.map(async (condition) => {
-            switch (condition.type) {
-                case AccessControlConditionTypes.memoNonce:
-                    return await LitProtocol.generateCosmosAccessControlConditionTransactionMemo({
-                        key: '$.txs.*.body.memo',
-                        comparator: 'contains',
-                        value: condition?.specificNonce || await LitProtocol.generateTxNonce(condition?.nonceFormat)
-                    }, condition.amountObserved, condition.senderAddressObserved, condition.recipientAddressObserved, args.bootstrapOptions.chain);
-                case AccessControlConditionTypes.balance:
-                    return await LitProtocol.generateCosmosAccessControlConditionBalance({
-                        key: '$.balances[0].amount',
-                        comparator: condition.comparator,
-                        value: condition.amountObserved
-                    }, args.bootstrapOptions.chain, condition.addressObserved);
-                default:
-                    throw new Error(`[did-provider-cheqd]: accessControlCondition type is not supported`);
-            }
-        }));
-        // encrypt data
-        const { encryptedString, encryptedSymmetricKey, symmetricKey } = await lit.encrypt(toString(args.payload.data, 'base64url'), unifiedAccessControlConditions, true);
-        // set encrypted data
-        args.payload.data = new Uint8Array(await encryptedString.arrayBuffer());
-        // set default resource type in runtime
-        args.payload.resourceType = 'StatusList2021';
         this.providerId = Cheqd.generateProviderId(args.network);
         this.didProvider = await Cheqd.loadProvider({ id: this.providerId }, this.supportedDidProviders);
-        const created = await this.didProvider.createResource({
+        return await this.didProvider.createResource({
             options: {
                 kms: args.kms,
                 payload: args.payload,
@@ -722,13 +810,6 @@ export class Cheqd {
                 fee: args?.fee
             }
         }, context);
-        return {
-            created,
-            encryptedSymmetricKey,
-            encryptedStatusList2021: await blobToHexString(encryptedString),
-            symmetricKey: args?.encryptionOptions?.returnSymmetricKey ? toString(symmetricKey, 'hex') : undefined,
-            unifiedAccessControlConditions
-        };
     }
     async GenerateDidDoc(args, context) {
         if (typeof args.verificationMethod !== 'string') {
@@ -878,14 +959,13 @@ export class Cheqd {
             ? args.issuanceOptions.credential.issuer.id
             : args.issuanceOptions.credential.issuer;
         // generate status list credential
-        const statusListCredential = `${resolverUrl}${issuer}?resourceName=${args.statusOptions.statusListName}`;
+        const statusListCredential = `${resolverUrl}${issuer}?resourceName=${args.statusOptions.statusListName}&resourceType=StatusList2021Revocation`;
         // construct credential status
         const credentialStatus = {
             id: `${statusListCredential}#${statusListIndex}`,
             type: 'StatusList2021Entry',
             statusPurpose: 'revocation',
             statusListIndex: `${statusListIndex}`,
-            statusListCredential,
         };
         // add credential status to credential
         args.issuanceOptions.credential.credentialStatus = credentialStatus;
@@ -920,14 +1000,13 @@ export class Cheqd {
             ? args.issuanceOptions.credential.issuer.id
             : args.issuanceOptions.credential.issuer;
         // generate status list credential
-        const statusListCredential = `${resolverUrl}${issuer}?resourceName=${args.statusOptions.statusListName}`;
+        const statusListCredential = `${resolverUrl}${issuer}?resourceName=${args.statusOptions.statusListName}&resourceType=StatusList2021Suspension`;
         // construct credential status
         const credentialStatus = {
             id: `${statusListCredential}#${statusListIndex}`,
             type: 'StatusList2021Entry',
             statusPurpose: 'suspension',
             statusListIndex: `${statusListIndex}`,
-            statusListCredential,
         };
         // add credential status to credential
         args.issuanceOptions.credential.credentialStatus = credentialStatus;
@@ -966,6 +1045,7 @@ export class Cheqd {
         if (!verificationResult.verified) {
             return { verified: false, error: verificationResult.error };
         }
+        // if jwt credential, decode it
         const credential = typeof args.credential === 'string' ? await Cheqd.decodeCredentialJWT(args.credential) : args.credential;
         // verify credential status
         switch (credential.credentialStatus?.statusPurpose) {
@@ -1016,6 +1096,7 @@ export class Cheqd {
         return { verified: true };
     }
     async CheckCredentialStatusWithStatusList2021(args, context) {
+        // if jwt credential, decode it
         const credential = typeof args.credential === 'string' ? await Cheqd.decodeCredentialJWT(args.credential) : args.credential;
         switch (credential.credentialStatus?.statusPurpose) {
             case 'revocation':
@@ -1031,6 +1112,51 @@ export class Cheqd {
         }
     }
     async RevokeCredentialWithStatusList2021(args, context) {
+        // verify credential, if provided and revocation options are not
+        if (args?.credential && !args?.revocationOptions) {
+            const verificationResult = await context.agent.verifyCredential({
+                credential: args.credential,
+                policies: {
+                    credentialStatus: false
+                }
+            });
+            // early return if verification failed
+            if (!verificationResult.verified) {
+                return { revoked: false, error: verificationResult.error };
+            }
+        }
+        // if revocation options are provided, give precedence
+        if (args?.revocationOptions) {
+            // validate revocation options - case: revocationOptions.issuerDid
+            if (!args.revocationOptions.issuerDid)
+                throw new Error('[did-provider-cheqd]: revocation: revocationOptions.issuerDid is required');
+            // validate revocation options - case: revocationOptions.statusListName
+            if (!args.revocationOptions.statusListName)
+                throw new Error('[did-provider-cheqd]: revocation: revocationOptions.statusListName is required');
+            // validate revocation options - case: revocationOptions.statusListIndex
+            if (!args.revocationOptions.statusListIndex)
+                throw new Error('[did-provider-cheqd]: revocation: revocationOptions.statusListIndex is required');
+            // construct status list credential
+            const statusListCredential = `${resolverUrl}${args.revocationOptions.issuerDid}?resourceName=${args.revocationOptions.statusListName}&resourceType=StatusList2021Revocation`;
+            // construct credential status
+            args.credential = {
+                '@context': [],
+                issuer: args.revocationOptions.issuerDid,
+                credentialSubject: {},
+                credentialStatus: {
+                    id: `${statusListCredential}#${args.revocationOptions.statusListIndex}`,
+                    type: 'StatusList2021Entry',
+                    statusPurpose: 'revocation',
+                    statusListIndex: `${args.revocationOptions.statusListIndex}`,
+                },
+                issuanceDate: '',
+                proof: {}
+            };
+        }
+        // validate args - case: credential
+        if (!args.credential)
+            throw new Error('[did-provider-cheqd]: revocation: credential is required');
+        // if jwt credential, decode it
         const credential = typeof args.credential === 'string' ? await Cheqd.decodeCredentialJWT(args.credential) : args.credential;
         // validate status purpose
         if (credential.credentialStatus?.statusPurpose !== 'revocation') {
@@ -1058,18 +1184,142 @@ export class Cheqd {
             topArgs: args,
             publishOptions: {
                 context,
+                statusListEncoding: args?.options?.statusListEncoding,
+                statusListValidUntil: args?.options?.statusListValidUntil,
                 resourceId: args?.options?.resourceId,
                 resourceVersion: args?.options?.resourceVersion,
+                resourceAlsoKnownAs: args?.options?.alsoKnownAs,
                 signInputs: args?.options?.signInputs,
                 fee: args?.options?.fee
             }
         });
     }
     async RevokeBulkCredentialsWithStatusList2021(args, context) {
-        // TODO: implement
-        throw new Error('[did-provider-cheqd]: revocation: bulk revocation is not implemented yet');
+        // verify credential, if provided and revocation options are not
+        if (args?.credentials && !args?.revocationOptions) {
+            const verificationResult = await Promise.all(args.credentials.map(async (credential) => {
+                return await context.agent.verifyCredential({
+                    credential,
+                    policies: {
+                        credentialStatus: false
+                    }
+                });
+            }));
+            // early return if verification failed for any credential
+            if (verificationResult.some(result => !result.verified)) {
+                // define verified
+                return { revoked: Array(args.credentials.length).fill(false), error: verificationResult.find(result => !result.verified).error || { message: 'verification: could not verify credential' } };
+            }
+        }
+        // if revocation options are provided, give precedence
+        if (args?.revocationOptions) {
+            // validate revocation options - case: revocationOptions.issuerDid
+            if (!args.revocationOptions.issuerDid)
+                throw new Error('[did-provider-cheqd]: revocation: revocationOptions.issuerDid is required');
+            // validate revocation options - case: revocationOptions.statusListName
+            if (!args.revocationOptions.statusListName)
+                throw new Error('[did-provider-cheqd]: revocation: revocationOptions.statusListName is required');
+            // validate revocation options - case: revocationOptions.statusListIndices
+            if (!args.revocationOptions.statusListIndices || !args.revocationOptions.statusListIndices.length || args.revocationOptions.statusListIndices.length === 0 || !args.revocationOptions.statusListIndices.every(index => !isNaN(+index)))
+                throw new Error('[did-provider-cheqd]: revocation: revocationOptions.statusListIndex is required and must be an array of indices');
+            // construct status list credential
+            const statusListCredential = `${resolverUrl}${args.revocationOptions.issuerDid}?resourceName=${args.revocationOptions.statusListName}&resourceType=StatusList2021Revocation`;
+            // construct credential status
+            args.credentials = args.revocationOptions.statusListIndices.map(index => ({
+                '@context': [],
+                issuer: args.revocationOptions.issuerDid,
+                credentialSubject: {},
+                credentialStatus: {
+                    id: `${statusListCredential}#${index}`,
+                    type: 'StatusList2021Entry',
+                    statusPurpose: 'revocation',
+                    statusListIndex: `${index}`,
+                },
+                issuanceDate: '',
+                proof: {}
+            }));
+        }
+        // validate args - case: credentials
+        if (!args.credentials || !args.credentials.length || args.credentials.length === 0)
+            throw new Error('[did-provider-cheqd]: revocation: credentials is required and must be an array of credentials');
+        // if jwt credentials, decode them
+        const credentials = await Promise.all(args.credentials.map(async (credential) => typeof credential === 'string' ? await Cheqd.decodeCredentialJWT(credential) : credential));
+        // validate args in pairs - case: statusListFile and statusList
+        if (args.options?.statusListFile && args.options?.statusList) {
+            throw new Error('[did-provider-cheqd]: revocation: statusListFile and statusList are mutually exclusive');
+        }
+        // validate args in pairs - case: statusListFile and fetchList
+        if (args.options?.statusListFile && args.options?.fetchList) {
+            throw new Error('[did-provider-cheqd]: revocation: statusListFile and fetchList are mutually exclusive');
+        }
+        // validate args in pairs - case: statusList and fetchList
+        if (args.options?.statusList && args.options?.fetchList) {
+            throw new Error('[did-provider-cheqd]: revocation: statusList and fetchList are mutually exclusive');
+        }
+        // validate args in pairs - case: publish
+        if (args.options?.publish && !args.fetchList && !(args.options?.statusListFile || args.options?.statusList)) {
+            throw new Error('[did-provider-cheqd]: revocation: publish requires statusListFile or statusList, if fetchList is disabled');
+        }
+        // revoke credentials
+        return await Cheqd.revokeCredentials(credentials, {
+            ...args.options,
+            topArgs: args,
+            publishOptions: {
+                context,
+                resourceId: args?.options?.resourceId,
+                resourceVersion: args?.options?.resourceVersion,
+                resourceAlsoKnownAs: args?.options?.alsoKnownAs,
+                signInputs: args?.options?.signInputs,
+                fee: args?.options?.fee
+            }
+        });
     }
     async SuspendCredentialWithStatusList2021(args, context) {
+        // verify credential, if provided and suspension options are not
+        if (args?.credential && !args?.suspensionOptions) {
+            const verificationResult = await context.agent.verifyCredential({
+                credential: args.credential,
+                policies: {
+                    credentialStatus: false
+                }
+            });
+            // early return if verification failed
+            if (!verificationResult.verified) {
+                return { suspended: false, error: verificationResult.error };
+            }
+        }
+        // if suspension options are provided, give precedence
+        if (args?.suspensionOptions) {
+            // validate suspension options - case: suspensionOptions.issuerDid
+            if (!args.suspensionOptions.issuerDid)
+                throw new Error('[did-provider-cheqd]: suspension: suspensionOptions.issuerDid is required');
+            // validate suspension options - case: suspensionOptions.statusListName
+            if (!args.suspensionOptions.statusListName)
+                throw new Error('[did-provider-cheqd]: suspension: suspensionOptions.statusListName is required');
+            // validate suspension options - case: suspensionOptions.statusListIndex
+            if (!args.suspensionOptions.statusListIndex)
+                throw new Error('[did-provider-cheqd]: suspension: suspensionOptions.statusListIndex is required');
+            // construct status list credential
+            const statusListCredential = `${resolverUrl}${args.suspensionOptions.issuerDid}?resourceName=${args.suspensionOptions.statusListName}&resourceType=StatusList2021Suspension`;
+            // construct credential status
+            args.credential = {
+                '@context': [],
+                issuer: args.suspensionOptions.issuerDid,
+                credentialSubject: {},
+                credentialStatus: {
+                    id: `${statusListCredential}#${args.suspensionOptions.statusListIndex}`,
+                    type: 'StatusList2021Entry',
+                    statusPurpose: 'suspension',
+                    statusListIndex: `${args.suspensionOptions.statusListIndex}`,
+                },
+                issuanceDate: '',
+                proof: {}
+            };
+        }
+        // validate args - case: credential
+        if (!args.credential)
+            throw new Error('[did-provider-cheqd]: suspension: credential is required');
+        // if jwt credential, decode it
         const credential = typeof args.credential === 'string' ? await Cheqd.decodeCredentialJWT(args.credential) : args.credential;
         // validate status purpose
         if (credential.credentialStatus?.statusPurpose !== 'suspension') {
@@ -1097,18 +1347,142 @@ export class Cheqd {
             topArgs: args,
             publishOptions: {
                 context,
+                statusListEncoding: args?.options?.statusListEncoding,
+                statusListValidUntil: args?.options?.statusListValidUntil,
                 resourceId: args?.options?.resourceId,
                 resourceVersion: args?.options?.resourceVersion,
+                resourceAlsoKnownAs: args?.options?.alsoKnownAs,
                 signInputs: args?.options?.signInputs,
                 fee: args?.options?.fee
             }
         });
     }
     async SuspendBulkCredentialsWithStatusList2021(args, context) {
-        // TODO: implement
-        throw new Error('[did-provider-cheqd]: suspension: bulk suspension is not implemented yet');
+        // verify credential, if provided and suspension options are not
+        if (args?.credentials && !args?.suspensionOptions) {
+            const verificationResult = await Promise.all(args.credentials.map(async (credential) => {
+                return await context.agent.verifyCredential({
+                    credential,
+                    policies: {
+                        credentialStatus: false
+                    }
+                });
+            }));
+            // early return if verification failed for any credential
+            if (verificationResult.some(result => !result.verified)) {
+                // define verified
+                return { suspended: Array(args.credentials.length).fill(false), error: verificationResult.find(result => !result.verified).error || { message: 'verification: could not verify credential' } };
+            }
+        }
+        // if suspension options are provided, give precedence
+        if (args?.suspensionOptions) {
+            // validate suspension options - case: suspensionOptions.issuerDid
+            if (!args.suspensionOptions.issuerDid)
+                throw new Error('[did-provider-cheqd]: suspension: suspensionOptions.issuerDid is required');
+            // validate suspension options - case: suspensionOptions.statusListName
+            if (!args.suspensionOptions.statusListName)
+                throw new Error('[did-provider-cheqd]: suspension: suspensionOptions.statusListName is required');
+            // validate suspension options - case: suspensionOptions.statusListIndices
+            if (!args.suspensionOptions.statusListIndices || !args.suspensionOptions.statusListIndices.length || args.suspensionOptions.statusListIndices.length === 0 || !args.suspensionOptions.statusListIndices.every(index => !isNaN(+index)))
+                throw new Error('[did-provider-cheqd]: suspension: suspensionOptions.statusListIndex is required and must be an array of indices');
+            // construct status list credential
+            const statusListCredential = `${resolverUrl}${args.suspensionOptions.issuerDid}?resourceName=${args.suspensionOptions.statusListName}&resourceType=StatusList2021Suspension`;
+            // construct credential status
+            args.credentials = args.suspensionOptions.statusListIndices.map(index => ({
+                '@context': [],
+                issuer: args.suspensionOptions.issuerDid,
+                credentialSubject: {},
+                credentialStatus: {
+                    id: `${statusListCredential}#${index}`,
+                    type: 'StatusList2021Entry',
+                    statusPurpose: 'suspension',
+                    statusListIndex: `${index}`,
+                },
+                issuanceDate: '',
+                proof: {}
+            }));
+        }
+        // validate args - case: credentials
+        if (!args.credentials || !args.credentials.length || args.credentials.length === 0)
+            throw new Error('[did-provider-cheqd]: suspension: credentials is required and must be an array of credentials');
+        // if jwt credentials, decode them
+        const credentials = await Promise.all(args.credentials.map(async (credential) => typeof credential === 'string' ? await Cheqd.decodeCredentialJWT(credential) : credential));
+        // validate args in pairs - case: statusListFile and statusList
+        if (args.options?.statusListFile && args.options?.statusList) {
+            throw new Error('[did-provider-cheqd]: suspension: statusListFile and statusList are mutually exclusive');
+        }
+        // validate args in pairs - case: statusListFile and fetchList
+        if (args.options?.statusListFile && args.options?.fetchList) {
+            throw new Error('[did-provider-cheqd]: suspension: statusListFile and fetchList are mutually exclusive');
+        }
+        // validate args in pairs - case: statusList and fetchList
+        if (args.options?.statusList && args.options?.fetchList) {
+            throw new Error('[did-provider-cheqd]: suspension: statusList and fetchList are mutually exclusive');
+        }
+        // validate args in pairs - case: publish
+        if (args.options?.publish && !args.fetchList && !(args.options?.statusListFile || args.options?.statusList)) {
+            throw new Error('[did-provider-cheqd]: suspension: publish requires statusListFile or statusList, if fetchList is disabled');
+        }
+        // suspend credentials
+        return await Cheqd.suspendCredentials(credentials, {
+            ...args.options,
+            topArgs: args,
+            publishOptions: {
+                context,
+                resourceId: args?.options?.resourceId,
+                resourceVersion: args?.options?.resourceVersion,
+                resourceAlsoKnownAs: args?.options?.alsoKnownAs,
+                signInputs: args?.options?.signInputs,
+                fee: args?.options?.fee
+            }
+        });
     }
     async UnsuspendCredentialWithStatusList2021(args, context) {
+        // verify credential, if provided and unsuspension options are not
+        if (args?.credential && !args?.unsuspensionOptions) {
+            const verificationResult = await context.agent.verifyCredential({
+                credential: args.credential,
+                policies: {
+                    credentialStatus: false
+                }
+            });
+            // early return if verification failed
+            if (!verificationResult.verified) {
+                return { unsuspended: false, error: verificationResult.error };
+            }
+        }
+        // if unsuspension options are provided, give precedence
+        if (args?.unsuspensionOptions) {
+            // validate unsuspension options - case: unsuspensionOptions.issuerDid
+            if (!args.unsuspensionOptions.issuerDid)
+                throw new Error('[did-provider-cheqd]: unsuspension: unsuspensionOptions.issuerDid is required');
+            // validate unsuspension options - case: unsuspensionOptions.statusListName
+            if (!args.unsuspensionOptions.statusListName)
+                throw new Error('[did-provider-cheqd]: unsuspension: unsuspensionOptions.statusListName is required');
+            // validate unsuspension options - case: unsuspensionOptions.statusListIndex
+            if (!args.unsuspensionOptions.statusListIndex)
+                throw new Error('[did-provider-cheqd]: unsuspension: unsuspensionOptions.statusListIndex is required');
+            // construct status list credential
+            const statusListCredential = `${resolverUrl}${args.unsuspensionOptions.issuerDid}?resourceName=${args.unsuspensionOptions.statusListName}&resourceType=StatusList2021Suspension`;
+            // construct credential status
+            args.credential = {
+                '@context': [],
+                issuer: args.unsuspensionOptions.issuerDid,
+                credentialSubject: {},
+                credentialStatus: {
+                    id: `${statusListCredential}#${args.unsuspensionOptions.statusListIndex}`,
+                    type: 'StatusList2021Entry',
+                    statusPurpose: 'suspension',
+                    statusListIndex: `${args.unsuspensionOptions.statusListIndex}`,
+                },
+                issuanceDate: '',
+                proof: {}
+            };
+        }
+        // validate args - case: credential
+        if (!args.credential)
+            throw new Error('[did-provider-cheqd]: unsuspension: credential is required');
+        // if jwt credential, decode it
         const credential = typeof args.credential === 'string' ? await Cheqd.decodeCredentialJWT(args.credential) : args.credential;
         // validate status purpose
         if (credential.credentialStatus?.statusPurpose !== 'suspension') {
@@ -1136,16 +1510,95 @@ export class Cheqd {
             topArgs: args,
             publishOptions: {
                 context,
+                statusListEncoding: args?.options?.statusListEncoding,
+                statusListValidUntil: args?.options?.statusListValidUntil,
                 resourceId: args?.options?.resourceId,
                 resourceVersion: args?.options?.resourceVersion,
+                resourceAlsoKnownAs: args?.options?.alsoKnownAs,
                 signInputs: args?.options?.signInputs,
                 fee: args?.options?.fee
             }
         });
     }
     async UnsuspendBulkCredentialsWithStatusList2021(args, context) {
-        // TODO: implement
-        throw new Error('[did-provider-cheqd]: suspension: bulk unsuspension is not implemented yet');
+        // verify credential, if provided and unsuspension options are not
+        if (args?.credentials && !args?.unsuspensionOptions) {
+            const verificationResult = await Promise.all(args.credentials.map(async (credential) => {
+                return await context.agent.verifyCredential({
+                    credential,
+                    policies: {
+                        credentialStatus: false
+                    }
+                });
+            }));
+            // early return if verification failed for any credential
+            if (verificationResult.some(result => !result.verified)) {
+                // define verified
+                return { unsuspended: Array(args.credentials.length).fill(false), error: verificationResult.find(result => !result.verified).error || { message: 'verification: could not verify credential' } };
+            }
+        }
+        // if unsuspension options are provided, give precedence
+        if (args?.unsuspensionOptions) {
+            // validate unsuspension options - case: unsuspensionOptions.issuerDid
+            if (!args.unsuspensionOptions.issuerDid)
+                throw new Error('[did-provider-cheqd]: unsuspension: unsuspensionOptions.issuerDid is required');
+            // validate unsuspension options - case: unsuspensionOptions.statusListName
+            if (!args.unsuspensionOptions.statusListName)
+                throw new Error('[did-provider-cheqd]: unsuspension: unsuspensionOptions.statusListName is required');
+            // validate unsuspension options - case: unsuspensionOptions.statusListIndices
+            if (!args.unsuspensionOptions.statusListIndices || !args.unsuspensionOptions.statusListIndices.length || args.unsuspensionOptions.statusListIndices.length === 0 || !args.unsuspensionOptions.statusListIndices.every(index => !isNaN(+index)))
+                throw new Error('[did-provider-cheqd]: unsuspension: unsuspensionOptions.statusListIndex is required and must be an array of indices');
+            // construct status list credential
+            const statusListCredential = `${resolverUrl}${args.unsuspensionOptions.issuerDid}?resourceName=${args.unsuspensionOptions.statusListName}&resourceType=StatusList2021Suspension`;
+            // construct credential status
+            args.credentials = args.unsuspensionOptions.statusListIndices.map(index => ({
+                '@context': [],
+                issuer: args.unsuspensionOptions.issuerDid,
+                credentialSubject: {},
+                credentialStatus: {
+                    id: `${statusListCredential}#${index}`,
+                    type: 'StatusList2021Entry',
+                    statusPurpose: 'suspension',
+                    statusListIndex: `${index}`,
+                },
+                issuanceDate: '',
+                proof: {}
+            }));
+        }
+        // validate args - case: credentials
+        if (!args.credentials || !args.credentials.length || args.credentials.length === 0)
+            throw new Error('[did-provider-cheqd]: unsuspension: credentials is required and must be an array of credentials');
+        // if jwt credentials, decode them
+        const credentials = await Promise.all(args.credentials.map(async (credential) => typeof credential === 'string' ? await Cheqd.decodeCredentialJWT(credential) : credential));
+        // validate args in pairs - case: statusListFile and statusList
+        if (args.options?.statusListFile && args.options?.statusList) {
+            throw new Error('[did-provider-cheqd]: unsuspension: statusListFile and statusList are mutually exclusive');
+        }
+        // validate args in pairs - case: statusListFile and fetchList
+        if (args.options?.statusListFile && args.options?.fetchList) {
+            throw new Error('[did-provider-cheqd]: unsuspension: statusListFile and fetchList are mutually exclusive');
+        }
+        // validate args in pairs - case: statusList and fetchList
+        if (args.options?.statusList && args.options?.fetchList) {
+            throw new Error('[did-provider-cheqd]: unsuspension: statusList and fetchList are mutually exclusive');
+        }
+        // validate args in pairs - case: publish
+        if (args.options?.publish && !args.fetchList && !(args.options?.statusListFile || args.options?.statusList)) {
+            throw new Error('[did-provider-cheqd]: unsuspension: publish requires statusListFile or statusList, if fetchList is disabled');
+        }
+        // suspend credentials
+        return await Cheqd.unsuspendCredentials(credentials, {
+            ...args.options,
+            topArgs: args,
+            publishOptions: {
+                context,
+                resourceId: args?.options?.resourceId,
+                resourceVersion: args?.options?.resourceVersion,
+                resourceAlsoKnownAs: args?.options?.alsoKnownAs,
+                signInputs: args?.options?.signInputs,
+                fee: args?.options?.fee
+            }
+        });
     }
     async TransactVerifierPaysIssuer(args, context) {
         try {
@@ -1268,46 +1721,56 @@ export class Cheqd {
             // validate status purpose
             if (credential?.credentialStatus?.statusPurpose !== 'revocation')
                 throw new Error('[did-provider-cheqd]: revocation: Invalid status purpose');
-            // fetch status list 2021 metadata
-            const metadata = (await Cheqd.fetchStatusList2021Metadata(credential));
-            // detect if encrypted
-            const isEncrypted = function () {
-                switch (metadata.mediaType) {
-                    case 'application/octet-stream':
-                        return true;
-                    case 'application/gzip':
-                        return false;
-                    default:
-                        throw new Error(`[did-provider-cheqd]: revocation: Unsupported media type: ${metadata.mediaType}`);
-                }
-            }();
+            // fetch status list 2021
+            const publishedList = (await Cheqd.fetchStatusList2021(credential));
             // early return, if encrypted and no decryption key provided
-            if (isEncrypted && !options?.topArgs?.symmetricKey)
+            if (publishedList.metadata.encrypted && !options?.topArgs?.symmetricKey)
                 throw new Error('[did-provider-cheqd]: revocation: symmetricKey is required, if status list 2021 is encrypted');
             // fetch status list 2021 inscribed in credential
             const statusList2021 = options?.topArgs?.fetchList
                 ? (await async function () {
                     // if not encrypted, return bitstring
-                    if (!isEncrypted)
-                        return await Cheqd.fetchStatusList2021(credential);
+                    if (!publishedList.metadata.encrypted)
+                        return publishedList.metadata.encoding === 'base64url'
+                            ? publishedList.StatusList2021.encodedList
+                            : toString(fromString(publishedList.StatusList2021.encodedList, publishedList.metadata.encoding), 'base64url');
                     // otherwise, decrypt and return bitstring
-                    const scopedRawBlob = await toBlob(await Cheqd.fetchStatusList2021(credential, true));
+                    const scopedRawBlob = await toBlob(fromString(publishedList.StatusList2021.encodedList, publishedList.metadata.encoding));
                     // decrypt
                     return await LitProtocol.decryptDirect(scopedRawBlob, fromString(options?.topArgs?.symmetricKey, 'hex'));
                 }())
                 : (await async function () {
+                    // transcode to base64url, if needed
+                    const publishedListTranscoded = publishedList.metadata.encoding === 'base64url'
+                        ? publishedList.StatusList2021.encodedList
+                        : toString(fromString(publishedList.StatusList2021.encodedList, publishedList.metadata.encoding), 'base64url');
                     // if status list 2021 is not fetched, read from file
                     if (options?.statusListFile) {
                         // if not encrypted, return bitstring
-                        if (!isEncrypted)
-                            return new StatusList({ buffer: await Cheqd.getFile(options.statusListFile) }).encode();
+                        if (!publishedList.metadata.encrypted) {
+                            // construct encoded status list
+                            const encoded = new StatusList({ buffer: await Cheqd.getFile(options.statusListFile) }).encode();
+                            // validate against published list
+                            if (encoded !== publishedListTranscoded)
+                                throw new Error('[did-provider-cheqd]: revocation: statusListFile does not match published status list 2021');
+                            // return encoded
+                            return encoded;
+                        }
                         // otherwise, decrypt and return bitstring
                         const scopedRawBlob = await toBlob(await Cheqd.getFile(options.statusListFile));
                         // decrypt
-                        return await LitProtocol.decryptDirect(scopedRawBlob, fromString(options?.topArgs?.symmetricKey, 'hex'));
+                        const decrypted = await LitProtocol.decryptDirect(scopedRawBlob, fromString(options?.topArgs?.symmetricKey, 'hex'));
+                        // validate against published list
+                        if (decrypted !== publishedListTranscoded)
+                            throw new Error('[did-provider-cheqd]: revocation: statusListFile does not match published status list 2021');
+                        // return decrypted
+                        return decrypted;
                     }
                     if (!options?.statusListInlineBitstring)
                         throw new Error('[did-provider-cheqd]: revocation: statusListInlineBitstring is required, if statusListFile is not provided');
+                    // validate against published list
+                    if (options?.statusListInlineBitstring !== publishedListTranscoded)
+                        throw new Error('[did-provider-cheqd]: revocation: statusListInlineBitstring does not match published status list 2021');
                     // otherwise, read from inline bitstring
                     return options?.statusListInlineBitstring;
                 }());
@@ -1347,7 +1810,45 @@ export class Cheqd {
                                 { encryptedString, encryptedSymmetricKey, symmetricKey: toString(symmetricKey, 'hex') }
                             ];
                         }())
-                        : [await Cheqd.publishStatusList2021(fromString(bitstring, 'base64url'), statusListMetadata, options?.publishOptions), undefined];
+                        : (await async function () {
+                            // validate encoding, if provided
+                            if (options?.publishOptions?.statusListEncoding && !Object.values(DefaultStatusList2021Encodings).includes(options?.publishOptions?.statusListEncoding)) {
+                                throw new Error('[did-provider-cheqd]: revocation: Invalid status list encoding');
+                            }
+                            // validate validUntil, if provided
+                            if (options?.publishOptions?.statusListValidUntil) {
+                                // validate validUntil as string
+                                if (typeof options?.publishOptions?.statusListValidUntil !== 'string')
+                                    throw new Error('[did-provider-cheqd]: revocation: Invalid status list validUntil (must be string)');
+                                // validate validUntil as date
+                                if (isNaN(Date.parse(options?.publishOptions?.statusListValidUntil)))
+                                    throw new Error('[did-provider-cheqd]: revocation: Invalid status list validUntil (must be date)');
+                                // validate validUntil as future date
+                                if (new Date(options?.publishOptions?.statusListValidUntil) < new Date())
+                                    throw new Error('[did-provider-cheqd]: revocation: Invalid status list validUntil (must be future date)');
+                                // validate validUntil towards validFrom
+                                if (new Date(options?.publishOptions?.statusListValidUntil) <= new Date(publishedList.StatusList2021.validFrom))
+                                    throw new Error('[did-provider-cheqd]: revocation: Invalid status list validUntil (must be after validFrom)');
+                            }
+                            // define status list content
+                            const content = {
+                                StatusList2021: {
+                                    type: publishedList.StatusList2021.type,
+                                    encodedList: publishedList.metadata.encoding === 'base64url' ? bitstring : toString(fromString(bitstring, 'base64url'), options.publishOptions.statusListEncoding),
+                                    validFrom: publishedList.StatusList2021.validFrom,
+                                    validUntil: options?.publishOptions?.statusListValidUntil || publishedList.StatusList2021.validUntil
+                                },
+                                metadata: {
+                                    encoding: options?.publishOptions?.statusListEncoding || publishedList.metadata.encoding,
+                                    encrypted: false,
+                                }
+                            };
+                            // return tuple of publish result and encryption relevant metadata
+                            return [
+                                await Cheqd.publishStatusList2021(fromString(JSON.stringify(content), 'utf-8'), statusListMetadata, options?.publishOptions),
+                                undefined
+                            ];
+                        }());
                     // early exit, if publish failed
                     if (!scoped[0])
                         throw new Error('[did-provider-cheqd]: revocation: Failed to publish status list 2021');
@@ -1358,7 +1859,7 @@ export class Cheqd {
             return {
                 revoked: true,
                 published: topArgs?.publish ? true : undefined,
-                statusList: topArgs?.returnUpdatedStatusList ? bitstring : undefined,
+                statusList: topArgs?.returnUpdatedStatusList ? await Cheqd.fetchStatusList2021(credential) : undefined,
                 encryptedStatusList: topArgs?.returnUpdatedEncryptedStatusList ? await blobToHexString(published?.[1]?.encryptedString) : undefined,
                 encryptedSymmetricKey: topArgs?.returnEncryptedSymmetricKey ? published?.[1]?.encryptedSymmetricKey : undefined,
                 symmetricKey: topArgs?.returnSymmetricKey ? published?.[1]?.symmetricKey : undefined,
@@ -1366,56 +1867,264 @@ export class Cheqd {
             };
         }
         catch (error) {
-            // silent fail + early exit, optimised for parallelisation, use with Promise.allSettled
+            // silent fail + early exit
             console.error(error);
             return { revoked: false, error: error };
         }
     }
+    static async revokeCredentials(credentials, options) {
+        // validate credentials - case: empty
+        if (!credentials.length || credentials.length === 0)
+            throw new Error('[did-provider-cheqd]: revocation: No credentials provided');
+        // validate credentials - case: consistent issuer
+        if (credentials.map((credential) => {
+            return (credential.issuer.id)
+                ? credential.issuer.id
+                : credential.issuer;
+        }).filter((value, _, self) => value && value !== self[0]).length > 0)
+            throw new Error('[did-provider-cheqd]: revocation: Credentials must be issued by the same issuer');
+        // validate credentials - case: status list index
+        if (credentials.map((credential) => credential.credentialStatus.statusListIndex).filter((value, index, self) => self.indexOf(value) !== index).length > 0)
+            throw new Error('[did-provider-cheqd]: revocation: Credentials must have unique status list index');
+        // validate credentials - case: status purpose
+        if (!credentials.every((credential) => credential.credentialStatus?.statusPurpose === 'revocation'))
+            throw new Error('[did-provider-cheqd]: revocation: Invalid status purpose');
+        // validate credentials - case: status list id
+        const remote = credentials[0].credentialStatus?.id
+            ? credentials[0].credentialStatus.id.split('#')[0]
+            : (function () {
+                throw new Error('[did-provider-cheqd]: revocation: Invalid status list id');
+            }());
+        // validate credentials - case: status list id format
+        if (!RemoteListPattern.test(remote))
+            throw new Error('[did-provider-cheqd]: revocation: Invalid status list id format: expected: https://<optional_subdomain>.<sld>.<tld>/1.0/identifiers/<did:cheqd:<namespace>:<method_specific_id>>?resourceName=<resource_name>&resourceType=<resource_type>');
+        if (!credentials.every((credential) => {
+            return credential.credentialStatus.id.split('#')[0] === remote;
+        }))
+            throw new Error('[did-provider-cheqd]: revocation: Credentials must belong to the same status list');
+        // validate credentials - case: status list type
+        if (!credentials.every((credential) => credential.credentialStatus?.type === 'StatusList2021Entry'))
+            throw new Error('[did-provider-cheqd]: revocation: Invalid status list type');
+        try {
+            // fetch status list 2021
+            const publishedList = (await Cheqd.fetchStatusList2021(credentials[0]));
+            // early return, if encrypted and no decryption key provided
+            if (publishedList.metadata.encrypted && !options?.topArgs?.symmetricKey)
+                throw new Error('[did-provider-cheqd]: revocation: symmetricKey is required, if status list 2021 is encrypted');
+            // fetch status list 2021 inscribed in credential
+            const statusList2021 = options?.topArgs?.fetchList
+                ? (await async function () {
+                    // if not encrypted, return bitstring
+                    if (!publishedList.metadata.encrypted)
+                        return publishedList.metadata.encoding === 'base64url'
+                            ? publishedList.StatusList2021.encodedList
+                            : toString(fromString(publishedList.StatusList2021.encodedList, publishedList.metadata.encoding), 'base64url');
+                    // otherwise, decrypt and return bitstring
+                    const scopedRawBlob = await toBlob(fromString(publishedList.StatusList2021.encodedList, publishedList.metadata.encoding));
+                    // decrypt
+                    return await LitProtocol.decryptDirect(scopedRawBlob, fromString(options?.topArgs?.symmetricKey, 'hex'));
+                }())
+                : (await async function () {
+                    // transcode to base64url, if needed
+                    const publishedListTranscoded = publishedList.metadata.encoding === 'base64url'
+                        ? publishedList.StatusList2021.encodedList
+                        : toString(fromString(publishedList.StatusList2021.encodedList, publishedList.metadata.encoding), 'base64url');
+                    // if status list 2021 is not fetched, read from file
+                    if (options?.statusListFile) {
+                        // if not encrypted, return bitstring
+                        if (!publishedList.metadata.encrypted) {
+                            // construct encoded status list
+                            const encoded = new StatusList({ buffer: await Cheqd.getFile(options.statusListFile) }).encode();
+                            // validate against published list
+                            if (encoded !== publishedListTranscoded)
+                                throw new Error('[did-provider-cheqd]: revocation: statusListFile does not match published status list 2021');
+                            // return encoded
+                            return encoded;
+                        }
+                        // otherwise, decrypt and return bitstring
+                        const scopedRawBlob = await toBlob(await Cheqd.getFile(options.statusListFile));
+                        // decrypt
+                        const decrypted = await LitProtocol.decryptDirect(scopedRawBlob, fromString(options?.topArgs?.symmetricKey, 'hex'));
+                        // validate against published list
+                        if (decrypted !== publishedListTranscoded)
+                            throw new Error('[did-provider-cheqd]: revocation: statusListFile does not match published status list 2021');
+                        // return decrypted
+                        return decrypted;
+                    }
+                    if (!options?.statusListInlineBitstring)
+                        throw new Error('[did-provider-cheqd]: revocation: statusListInlineBitstring is required, if statusListFile is not provided');
+                    // validate against published list
+                    if (options?.statusListInlineBitstring !== publishedListTranscoded)
+                        throw new Error('[did-provider-cheqd]: revocation: statusListInlineBitstring does not match published status list 2021');
+                    // otherwise, read from inline bitstring
+                    return options?.statusListInlineBitstring;
+                }());
+            // parse status list 2021
+            const statusList = await StatusList.decode({ encodedList: statusList2021 });
+            // initiate bulk revocation
+            const revoked = await Promise.allSettled(credentials.map((credential) => {
+                return async function () {
+                    // early return, if no credential status
+                    if (!credential.credentialStatus)
+                        return { revoked: false };
+                    // early exit, if credential is already revoked
+                    if (statusList.getStatus(Number(credential.credentialStatus.statusListIndex)))
+                        return { revoked: false };
+                    // update revocation status
+                    statusList.setStatus(Number(credential.credentialStatus.statusListIndex), true);
+                    // return revocation status
+                    return { revoked: true };
+                }();
+            }));
+            // revert bulk ops, if some failed
+            if (revoked.some((result) => result.status === 'fulfilled' && !result.value.revoked))
+                throw new Error(`[did-provider-cheqd]: revocation: Bulk revocation failed: already revoked credentials in revocation bundle: raw log: ${JSON.stringify(revoked.map((result) => ({ revoked: result.status === 'fulfilled' ? result.value.revoked : false })))}`);
+            // set in-memory status list ref
+            const bitstring = await statusList.encode();
+            // cast top-level args
+            const topArgs = options?.topArgs;
+            // write status list 2021 to file, if provided
+            if (topArgs?.writeToFile) {
+                await Cheqd.writeFile(fromString(bitstring, 'base64url'), options?.statusListFile);
+            }
+            // publish status list 2021, if provided
+            const published = topArgs?.publish
+                ? (await async function () {
+                    // fetch status list 2021 metadata
+                    const statusListMetadata = await Cheqd.fetchStatusList2021Metadata(credentials[0]);
+                    // publish status list 2021 as new version
+                    const scoped = topArgs.publishEncrypted
+                        ? (await async function () {
+                            // instantiate dkg-threshold client, in which case lit-protocol is used
+                            const lit = await LitProtocol.create({
+                                chain: options?.topArgs?.bootstrapOptions?.chain,
+                                litNetwork: options?.topArgs?.bootstrapOptions?.litNetwork
+                            });
+                            // encrypt
+                            const { encryptedString, encryptedSymmetricKey, symmetricKey } = await lit.encrypt(bitstring, options?.topArgs?.encryptionOptions?.unifiedAccessControlConditions, true);
+                            // return tuple of publish result and encryption relevant metadata
+                            return [
+                                await Cheqd.publishStatusList2021(new Uint8Array(await encryptedString.arrayBuffer()), statusListMetadata, options?.publishOptions),
+                                { encryptedString, encryptedSymmetricKey, symmetricKey: toString(symmetricKey, 'hex') }
+                            ];
+                        }())
+                        : (await async function () {
+                            // validate encoding, if provided
+                            if (options?.publishOptions?.statusListEncoding && !Object.values(DefaultStatusList2021Encodings).includes(options?.publishOptions?.statusListEncoding)) {
+                                throw new Error('[did-provider-cheqd]: revocation: Invalid status list encoding');
+                            }
+                            // validate validUntil, if provided
+                            if (options?.publishOptions?.statusListValidUntil) {
+                                // validate validUntil as string
+                                if (typeof options?.publishOptions?.statusListValidUntil !== 'string')
+                                    throw new Error('[did-provider-cheqd]: revocation: Invalid status list validUntil (must be string)');
+                                // validate validUntil as date
+                                if (isNaN(Date.parse(options?.publishOptions?.statusListValidUntil)))
+                                    throw new Error('[did-provider-cheqd]: revocation: Invalid status list validUntil (must be date)');
+                                // validate validUntil as future date
+                                if (new Date(options?.publishOptions?.statusListValidUntil) < new Date())
+                                    throw new Error('[did-provider-cheqd]: revocation: Invalid status list validUntil (must be future date)');
+                                // validate validUntil towards validFrom
+                                if (new Date(options?.publishOptions?.statusListValidUntil) <= new Date(publishedList.StatusList2021.validFrom))
+                                    throw new Error('[did-provider-cheqd]: revocation: Invalid status list validUntil (must be after validFrom)');
+                            }
+                            // define status list content
+                            const content = {
+                                StatusList2021: {
+                                    type: publishedList.StatusList2021.type,
+                                    encodedList: publishedList.metadata.encoding === 'base64url' ? bitstring : toString(fromString(bitstring, 'base64url'), options.publishOptions.statusListEncoding),
+                                    validFrom: publishedList.StatusList2021.validFrom,
+                                    validUntil: options?.publishOptions?.statusListValidUntil || publishedList.StatusList2021.validUntil
+                                },
+                                metadata: {
+                                    encoding: options?.publishOptions?.statusListEncoding || publishedList.metadata.encoding,
+                                    encrypted: false,
+                                }
+                            };
+                            // return tuple of publish result and encryption relevant metadata
+                            return [
+                                await Cheqd.publishStatusList2021(fromString(JSON.stringify(content), 'utf-8'), statusListMetadata, options?.publishOptions),
+                                undefined
+                            ];
+                        }());
+                    // early exit, if publish failed
+                    if (!scoped[0])
+                        throw new Error('[did-provider-cheqd]: revocation: Failed to publish status list 2021');
+                    // return publish result
+                    return scoped;
+                }())
+                : undefined;
+            return {
+                revoked: revoked.map((result) => result.status === 'fulfilled' ? result.value.revoked : false),
+                published: topArgs?.publish ? true : undefined,
+                statusList: topArgs?.returnUpdatedStatusList ? await Cheqd.fetchStatusList2021(credentials[0]) : undefined,
+                encryptedStatusList: topArgs?.returnUpdatedEncryptedStatusList ? await blobToHexString(published?.[1]?.encryptedString) : undefined,
+                encryptedSymmetricKey: topArgs?.returnEncryptedSymmetricKey ? published?.[1]?.encryptedSymmetricKey : undefined,
+                symmetricKey: topArgs?.returnSymmetricKey ? published?.[1]?.symmetricKey : undefined,
+                resourceMetadata: topArgs?.returnStatusListMetadata ? await Cheqd.fetchStatusList2021Metadata(credentials[0]) : undefined
+            };
+        }
+        catch (error) {
+            // silent fail + early exit
+            console.error(error);
+            return { revoked: [], error: error };
+        }
+    }
     static async suspendCredential(credential, options) {
         try {
             // validate status purpose
             if (credential?.credentialStatus?.statusPurpose !== 'suspension')
                 throw new Error('[did-provider-cheqd]: suspension: Invalid status purpose');
-            // fetch status list 2021 metadata
-            const metadata = (await Cheqd.fetchStatusList2021Metadata(credential));
-            // detect if encrypted
-            const isEncrypted = function () {
-                switch (metadata.mediaType) {
-                    case 'application/octet-stream':
-                        return true;
-                    case 'application/gzip':
-                        return false;
-                    default:
-                        throw new Error(`[did-provider-cheqd]: suspension: Unsupported media type: ${metadata.mediaType}`);
-                }
-            }();
+            // fetch status list 2021
+            const publishedList = (await Cheqd.fetchStatusList2021(credential));
             // early return, if encrypted and no decryption key provided
-            if (isEncrypted && !options?.topArgs?.symmetricKey)
+            if (publishedList.metadata.encrypted && !options?.topArgs?.symmetricKey)
                 throw new Error('[did-provider-cheqd]: suspension: symmetricKey is required, if status list 2021 is encrypted');
             // fetch status list 2021 inscribed in credential
             const statusList2021 = options?.topArgs?.fetchList
                 ? (await async function () {
                     // if not encrypted, return bitstring
-                    if (!isEncrypted)
-                        return await Cheqd.fetchStatusList2021(credential);
+                    if (!publishedList.metadata.encrypted)
+                        return publishedList.metadata.encoding === 'base64url'
+                            ? publishedList.StatusList2021.encodedList
+                            : toString(fromString(publishedList.StatusList2021.encodedList, publishedList.metadata.encoding), 'base64url');
                     // otherwise, decrypt and return bitstring
                     const scopedRawBlob = await toBlob(await Cheqd.fetchStatusList2021(credential, true));
                     // decrypt
                     return await LitProtocol.decryptDirect(scopedRawBlob, fromString(options?.topArgs?.symmetricKey, 'hex'));
                 }())
                 : (await async function () {
+                    // transcode to base64url, if needed
+                    const publishedListTranscoded = publishedList.metadata.encoding === 'base64url'
+                        ? publishedList.StatusList2021.encodedList
+                        : toString(fromString(publishedList.StatusList2021.encodedList, publishedList.metadata.encoding), 'base64url');
                     // if status list 2021 is not fetched, read from file
                     if (options?.statusListFile) {
                         // if not encrypted, return bitstring
-                        if (!isEncrypted)
-                            return new StatusList({ buffer: await Cheqd.getFile(options.statusListFile) }).encode();
+                        if (!publishedList.metadata.encrypted) {
+                            // construct encoded status list
+                            const encoded = new StatusList({ buffer: await Cheqd.getFile(options.statusListFile) }).encode();
+                            // validate against published list
+                            if (encoded !== publishedListTranscoded)
+                                throw new Error('[did-provider-cheqd]: revocation: statusListFile does not match published status list 2021');
+                            // return encoded
+                            return encoded;
+                        }
                         // otherwise, decrypt and return bitstring
                         const scopedRawBlob = await toBlob(await Cheqd.getFile(options.statusListFile));
                         // decrypt
-                        return await LitProtocol.decryptDirect(scopedRawBlob, fromString(options?.topArgs?.symmetricKey, 'hex'));
+                        const decrypted = await LitProtocol.decryptDirect(scopedRawBlob, fromString(options?.topArgs?.symmetricKey, 'hex'));
+                        // validate against published list
+                        if (decrypted !== publishedListTranscoded)
+                            throw new Error('[did-provider-cheqd]: revocation: statusListFile does not match published status list 2021');
+                        // return decrypted
+                        return decrypted;
                     }
                     if (!options?.statusListInlineBitstring)
-                        throw new Error('[did-provider-cheqd]: suspension: statusListInlineBitstring is required, if statusListFile is not provided');
+                        throw new Error('[did-provider-cheqd]: revocation: statusListInlineBitstring is required, if statusListFile is not provided');
+                    // validate against published list
+                    if (options?.statusListInlineBitstring !== publishedListTranscoded)
+                        throw new Error('[did-provider-cheqd]: revocation: statusListInlineBitstring does not match published status list 2021');
                     // otherwise, read from inline bitstring
                     return options?.statusListInlineBitstring;
                 }());
@@ -1455,7 +2164,45 @@ export class Cheqd {
                                 { encryptedString, encryptedSymmetricKey, symmetricKey: toString(symmetricKey, 'hex') }
                             ];
                         }())
-                        : [await Cheqd.publishStatusList2021(fromString(bitstring, 'base64url'), statusListMetadata, options?.publishOptions), undefined];
+                        : (await async function () {
+                            // validate encoding, if provided
+                            if (options?.publishOptions?.statusListEncoding && !Object.values(DefaultStatusList2021Encodings).includes(options?.publishOptions?.statusListEncoding)) {
+                                throw new Error('[did-provider-cheqd]: revocation: Invalid status list encoding');
+                            }
+                            // validate validUntil, if provided
+                            if (options?.publishOptions?.statusListValidUntil) {
+                                // validate validUntil as string
+                                if (typeof options?.publishOptions?.statusListValidUntil !== 'string')
+                                    throw new Error('[did-provider-cheqd]: revocation: Invalid status list validUntil (must be string)');
+                                // validate validUntil as date
+                                if (isNaN(Date.parse(options?.publishOptions?.statusListValidUntil)))
+                                    throw new Error('[did-provider-cheqd]: revocation: Invalid status list validUntil (must be date)');
+                                // validate validUntil as future date
+                                if (new Date(options?.publishOptions?.statusListValidUntil) < new Date())
+                                    throw new Error('[did-provider-cheqd]: revocation: Invalid status list validUntil (must be future date)');
+                                // validate validUntil towards validFrom
+                                if (new Date(options?.publishOptions?.statusListValidUntil) <= new Date(publishedList.StatusList2021.validFrom))
+                                    throw new Error('[did-provider-cheqd]: revocation: Invalid status list validUntil (must be after validFrom)');
+                            }
+                            // define status list content
+                            const content = {
+                                StatusList2021: {
+                                    type: publishedList.StatusList2021.type,
+                                    encodedList: publishedList.metadata.encoding === 'base64url' ? bitstring : toString(fromString(bitstring, 'base64url'), options.publishOptions.statusListEncoding),
+                                    validFrom: publishedList.StatusList2021.validFrom,
+                                    validUntil: options?.publishOptions?.statusListValidUntil || publishedList.StatusList2021.validUntil
+                                },
+                                metadata: {
+                                    encoding: options?.publishOptions?.statusListEncoding || publishedList.metadata.encoding,
+                                    encrypted: false,
+                                }
+                            };
+                            // return tuple of publish result and encryption relevant metadata
+                            return [
+                                await Cheqd.publishStatusList2021(fromString(JSON.stringify(content), 'utf-8'), statusListMetadata, options?.publishOptions),
+                                undefined
+                            ];
+                        }());
                     // early exit, if publish failed
                     if (!scoped[0])
                         throw new Error('[did-provider-cheqd]: suspension: Failed to publish status list 2021');
@@ -1466,7 +2213,7 @@ export class Cheqd {
             return {
                 suspended: true,
                 published: topArgs?.publish ? true : undefined,
-                statusList: topArgs?.returnUpdatedStatusList ? bitstring : undefined,
+                statusList: topArgs?.returnUpdatedStatusList ? await Cheqd.fetchStatusList2021(credential) : undefined,
                 encryptedStatusList: topArgs?.returnUpdatedEncryptedStatusList ? await blobToHexString(published?.[1]?.encryptedString) : undefined,
                 encryptedSymmetricKey: topArgs?.returnEncryptedSymmetricKey ? published?.[1]?.encryptedSymmetricKey : undefined,
                 symmetricKey: topArgs?.returnSymmetricKey ? published?.[1]?.symmetricKey : undefined,
@@ -1474,56 +2221,264 @@ export class Cheqd {
             };
         }
         catch (error) {
-            // silent fail + early exit, optimised for parallelisation, use with Promise.allSettled
+            // silent fail + early exit
             console.error(error);
             return { suspended: false, error: error };
         }
     }
+    static async suspendCredentials(credentials, options) {
+        // validate credentials - case: empty
+        if (!credentials.length || credentials.length === 0)
+            throw new Error('[did-provider-cheqd]: suspension: No credentials provided');
+        // validate credentials - case: consistent issuer
+        if (credentials.map((credential) => {
+            return (credential.issuer.id)
+                ? credential.issuer.id
+                : credential.issuer;
+        }).filter((value, _, self) => value && value !== self[0]).length > 0)
+            throw new Error('[did-provider-cheqd]: suspension: Credentials must be issued by the same issuer');
+        // validate credentials - case: status list index
+        if (credentials.map((credential) => credential.credentialStatus.statusListIndex).filter((value, index, self) => self.indexOf(value) !== index).length > 0)
+            throw new Error('[did-provider-cheqd]: suspension: Credentials must have unique status list index');
+        // validate credentials - case: status purpose
+        if (!credentials.every((credential) => credential.credentialStatus?.statusPurpose === 'suspension'))
+            throw new Error('[did-provider-cheqd]: suspension: Invalid status purpose');
+        // validate credentials - case: status list id
+        const remote = credentials[0].credentialStatus?.id
+            ? credentials[0].credentialStatus.id.split('#')[0]
+            : (function () {
+                throw new Error('[did-provider-cheqd]: suspension: Invalid status list id');
+            }());
+        // validate credentials - case: status list id format
+        if (!RemoteListPattern.test(remote))
+            throw new Error('[did-provider-cheqd]: suspension: Invalid status list id format: expected: https://<optional_subdomain>.<sld>.<tld>/1.0/identifiers/<did:cheqd:<namespace>:<method_specific_id>>?resourceName=<resource_name>&resourceType=<resource_type>');
+        if (!credentials.every((credential) => {
+            return credential.credentialStatus.id.split('#')[0] === remote;
+        }))
+            throw new Error('[did-provider-cheqd]: suspension: Credentials must belong to the same status list');
+        // validate credentials - case: status list type
+        if (!credentials.every((credential) => credential.credentialStatus?.type === 'StatusList2021Entry'))
+            throw new Error('[did-provider-cheqd]: suspension: Invalid status list type');
+        try {
+            // fetch status list 2021
+            const publishedList = (await Cheqd.fetchStatusList2021(credentials[0]));
+            // early return, if encrypted and no decryption key provided
+            if (publishedList.metadata.encrypted && !options?.topArgs?.symmetricKey)
+                throw new Error('[did-provider-cheqd]: suspension: symmetricKey is required, if status list 2021 is encrypted');
+            // fetch status list 2021 inscribed in credential
+            const statusList2021 = options?.topArgs?.fetchList
+                ? (await async function () {
+                    // if not encrypted, return bitstring
+                    if (!publishedList.metadata.encrypted)
+                        return publishedList.metadata.encoding === 'base64url'
+                            ? publishedList.StatusList2021.encodedList
+                            : toString(fromString(publishedList.StatusList2021.encodedList, publishedList.metadata.encoding), 'base64url');
+                    // otherwise, decrypt and return bitstring
+                    const scopedRawBlob = await toBlob(await Cheqd.fetchStatusList2021(credentials[0], true));
+                    // decrypt
+                    return await LitProtocol.decryptDirect(scopedRawBlob, fromString(options?.topArgs?.symmetricKey, 'hex'));
+                }())
+                : (await async function () {
+                    // transcode to base64url, if needed
+                    const publishedListTranscoded = publishedList.metadata.encoding === 'base64url'
+                        ? publishedList.StatusList2021.encodedList
+                        : toString(fromString(publishedList.StatusList2021.encodedList, publishedList.metadata.encoding), 'base64url');
+                    // if status list 2021 is not fetched, read from file
+                    if (options?.statusListFile) {
+                        // if not encrypted, return bitstring
+                        if (!publishedList.metadata.encrypted) {
+                            // construct encoded status list
+                            const encoded = new StatusList({ buffer: await Cheqd.getFile(options.statusListFile) }).encode();
+                            // validate against published list
+                            if (encoded !== publishedListTranscoded)
+                                throw new Error('[did-provider-cheqd]: revocation: statusListFile does not match published status list 2021');
+                            // return encoded
+                            return encoded;
+                        }
+                        // otherwise, decrypt and return bitstring
+                        const scopedRawBlob = await toBlob(await Cheqd.getFile(options.statusListFile));
+                        // decrypt
+                        const decrypted = await LitProtocol.decryptDirect(scopedRawBlob, fromString(options?.topArgs?.symmetricKey, 'hex'));
+                        // validate against published list
+                        if (decrypted !== publishedListTranscoded)
+                            throw new Error('[did-provider-cheqd]: revocation: statusListFile does not match published status list 2021');
+                        // return decrypted
+                        return decrypted;
+                    }
+                    if (!options?.statusListInlineBitstring)
+                        throw new Error('[did-provider-cheqd]: revocation: statusListInlineBitstring is required, if statusListFile is not provided');
+                    // validate against published list
+                    if (options?.statusListInlineBitstring !== publishedListTranscoded)
+                        throw new Error('[did-provider-cheqd]: revocation: statusListInlineBitstring does not match published status list 2021');
+                    // otherwise, read from inline bitstring
+                    return options?.statusListInlineBitstring;
+                }());
+            // parse status list 2021
+            const statusList = await StatusList.decode({ encodedList: statusList2021 });
+            // initiate bulk suspension
+            const suspended = await Promise.allSettled(credentials.map((credential) => {
+                return async function () {
+                    // early return, if no credential status
+                    if (!credential.credentialStatus)
+                        return { suspended: false };
+                    // early exit, if credential is already suspended
+                    if (statusList.getStatus(Number(credential.credentialStatus.statusListIndex)))
+                        return { suspended: false };
+                    // update suspension status
+                    statusList.setStatus(Number(credential.credentialStatus.statusListIndex), true);
+                    // return suspension status
+                    return { suspended: true };
+                }();
+            }));
+            // revert bulk ops, if some failed
+            if (suspended.some((result) => result.status === 'fulfilled' && !result.value.suspended))
+                throw new Error(`[did-provider-cheqd]: suspension: Bulk suspension failed: already suspended credentials in suspension bundle: raw log: ${JSON.stringify(suspended.map((result) => ({ suspended: result.status === 'fulfilled' ? result.value.suspended : false })))}`);
+            // set in-memory status list ref
+            const bitstring = await statusList.encode();
+            // cast top-level args
+            const topArgs = options?.topArgs;
+            // write status list 2021 to file, if provided
+            if (topArgs?.writeToFile) {
+                await Cheqd.writeFile(fromString(bitstring, 'base64url'), options?.statusListFile);
+            }
+            // publish status list 2021, if provided
+            const published = topArgs?.publish
+                ? (await async function () {
+                    // fetch status list 2021 metadata
+                    const statusListMetadata = await Cheqd.fetchStatusList2021Metadata(credentials[0]);
+                    // publish status list 2021 as new version
+                    const scoped = topArgs.publishEncrypted
+                        ? (await async function () {
+                            // instantiate dkg-threshold client, in which case lit-protocol is used
+                            const lit = await LitProtocol.create({
+                                chain: options?.topArgs?.bootstrapOptions?.chain,
+                                litNetwork: options?.topArgs?.bootstrapOptions?.litNetwork
+                            });
+                            // encrypt
+                            const { encryptedString, encryptedSymmetricKey, symmetricKey } = await lit.encrypt(bitstring, options?.topArgs?.encryptionOptions?.unifiedAccessControlConditions, true);
+                            // return tuple of publish result and encryption relevant metadata
+                            return [
+                                await Cheqd.publishStatusList2021(new Uint8Array(await encryptedString.arrayBuffer()), statusListMetadata, options?.publishOptions),
+                                { encryptedString, encryptedSymmetricKey, symmetricKey: toString(symmetricKey, 'hex') }
+                            ];
+                        }())
+                        : (await async function () {
+                            // validate encoding, if provided
+                            if (options?.publishOptions?.statusListEncoding && !Object.values(DefaultStatusList2021Encodings).includes(options?.publishOptions?.statusListEncoding)) {
+                                throw new Error('[did-provider-cheqd]: revocation: Invalid status list encoding');
+                            }
+                            // validate validUntil, if provided
+                            if (options?.publishOptions?.statusListValidUntil) {
+                                // validate validUntil as string
+                                if (typeof options?.publishOptions?.statusListValidUntil !== 'string')
+                                    throw new Error('[did-provider-cheqd]: revocation: Invalid status list validUntil (must be string)');
+                                // validate validUntil as date
+                                if (isNaN(Date.parse(options?.publishOptions?.statusListValidUntil)))
+                                    throw new Error('[did-provider-cheqd]: revocation: Invalid status list validUntil (must be date)');
+                                // validate validUntil as future date
+                                if (new Date(options?.publishOptions?.statusListValidUntil) < new Date())
+                                    throw new Error('[did-provider-cheqd]: revocation: Invalid status list validUntil (must be future date)');
+                                // validate validUntil towards validFrom
+                                if (new Date(options?.publishOptions?.statusListValidUntil) <= new Date(publishedList.StatusList2021.validFrom))
+                                    throw new Error('[did-provider-cheqd]: revocation: Invalid status list validUntil (must be after validFrom)');
+                            }
+                            // define status list content
+                            const content = {
+                                StatusList2021: {
+                                    type: publishedList.StatusList2021.type,
+                                    encodedList: publishedList.metadata.encoding === 'base64url' ? bitstring : toString(fromString(bitstring, 'base64url'), options.publishOptions.statusListEncoding),
+                                    validFrom: publishedList.StatusList2021.validFrom,
+                                    validUntil: options?.publishOptions?.statusListValidUntil || publishedList.StatusList2021.validUntil
+                                },
+                                metadata: {
+                                    encoding: options?.publishOptions?.statusListEncoding || publishedList.metadata.encoding,
+                                    encrypted: false,
+                                }
+                            };
+                            // return tuple of publish result and encryption relevant metadata
+                            return [
+                                await Cheqd.publishStatusList2021(fromString(JSON.stringify(content), 'utf-8'), statusListMetadata, options?.publishOptions),
+                                undefined
+                            ];
+                        }());
+                    // early exit, if publish failed
+                    if (!scoped[0])
+                        throw new Error('[did-provider-cheqd]: suspension: Failed to publish status list 2021');
+                    // return publish result
+                    return scoped;
+                }())
+                : undefined;
+            return {
+                suspended: suspended.map((result) => result.status === 'fulfilled' ? result.value.suspended : false),
+                published: topArgs?.publish ? true : undefined,
+                statusList: topArgs?.returnUpdatedStatusList ? await Cheqd.fetchStatusList2021(credentials[0]) : undefined,
+                encryptedStatusList: topArgs?.returnUpdatedEncryptedStatusList ? await blobToHexString(published?.[1]?.encryptedString) : undefined,
+                encryptedSymmetricKey: topArgs?.returnEncryptedSymmetricKey ? published?.[1]?.encryptedSymmetricKey : undefined,
+                symmetricKey: topArgs?.returnSymmetricKey ? published?.[1]?.symmetricKey : undefined,
+                resourceMetadata: topArgs?.returnStatusListMetadata ? await Cheqd.fetchStatusList2021Metadata(credentials[0]) : undefined
+            };
+        }
+        catch (error) {
+            // silent fail + early exit
+            console.error(error);
+            return { suspended: [], error: error };
+        }
+    }
     static async unsuspendCredential(credential, options) {
         try {
             // validate status purpose
             if (credential?.credentialStatus?.statusPurpose !== 'suspension')
                 throw new Error('[did-provider-cheqd]: unsuspension: Invalid status purpose');
-            // fetch status list 2021 metadata
-            const metadata = (await Cheqd.fetchStatusList2021Metadata(credential));
-            // detect if encrypted
-            const isEncrypted = function () {
-                switch (metadata.mediaType) {
-                    case 'application/octet-stream':
-                        return true;
-                    case 'application/gzip':
-                        return false;
-                    default:
-                        throw new Error(`[did-provider-cheqd]: unsuspension: Unsupported media type: ${metadata.mediaType}`);
-                }
-            }();
+            // fetch status list 2021
+            const publishedList = (await Cheqd.fetchStatusList2021(credential));
             // early return, if encrypted and no decryption key provided
-            if (isEncrypted && !options?.topArgs?.symmetricKey)
-                throw new Error('[did-provider-cheqd]: unsuspension: symmetricKey is required, if status list 2021 is encrypted');
+            if (publishedList.metadata.encrypted && !options?.topArgs?.symmetricKey)
+                throw new Error('[did-provider-cheqd]: suspension: symmetricKey is required, if status list 2021 is encrypted');
             // fetch status list 2021 inscribed in credential
             const statusList2021 = options?.topArgs?.fetchList
                 ? (await async function () {
                     // if not encrypted, return bitstring
-                    if (!isEncrypted)
-                        return await Cheqd.fetchStatusList2021(credential);
+                    if (!publishedList.metadata.encrypted)
+                        return publishedList.metadata.encoding === 'base64url'
+                            ? publishedList.StatusList2021.encodedList
+                            : toString(fromString(publishedList.StatusList2021.encodedList, publishedList.metadata.encoding), 'base64url');
                     // otherwise, decrypt and return bitstring
                     const scopedRawBlob = await toBlob(await Cheqd.fetchStatusList2021(credential, true));
                     // decrypt
                     return await LitProtocol.decryptDirect(scopedRawBlob, fromString(options?.topArgs?.symmetricKey, 'hex'));
                 }())
                 : (await async function () {
+                    // transcode to base64url, if needed
+                    const publishedListTranscoded = publishedList.metadata.encoding === 'base64url'
+                        ? publishedList.StatusList2021.encodedList
+                        : toString(fromString(publishedList.StatusList2021.encodedList, publishedList.metadata.encoding), 'base64url');
                     // if status list 2021 is not fetched, read from file
                     if (options?.statusListFile) {
                         // if not encrypted, return bitstring
-                        if (!isEncrypted)
-                            return new StatusList({ buffer: await Cheqd.getFile(options.statusListFile) }).encode();
+                        if (!publishedList.metadata.encrypted) {
+                            // construct encoded status list
+                            const encoded = new StatusList({ buffer: await Cheqd.getFile(options.statusListFile) }).encode();
+                            // validate against published list
+                            if (encoded !== publishedListTranscoded)
+                                throw new Error('[did-provider-cheqd]: revocation: statusListFile does not match published status list 2021');
+                            // return encoded
+                            return encoded;
+                        }
                         // otherwise, decrypt and return bitstring
                         const scopedRawBlob = await toBlob(await Cheqd.getFile(options.statusListFile));
                         // decrypt
-                        return await LitProtocol.decryptDirect(scopedRawBlob, fromString(options?.topArgs?.symmetricKey, 'hex'));
+                        const decrypted = await LitProtocol.decryptDirect(scopedRawBlob, fromString(options?.topArgs?.symmetricKey, 'hex'));
+                        // validate against published list
+                        if (decrypted !== publishedListTranscoded)
+                            throw new Error('[did-provider-cheqd]: revocation: statusListFile does not match published status list 2021');
+                        // return decrypted
+                        return decrypted;
                     }
                     if (!options?.statusListInlineBitstring)
-                        throw new Error('[did-provider-cheqd]: unsuspension: statusListInlineBitstring is required, if statusListFile is not provided');
+                        throw new Error('[did-provider-cheqd]: revocation: statusListInlineBitstring is required, if statusListFile is not provided');
+                    // validate against published list
+                    if (options?.statusListInlineBitstring !== publishedListTranscoded)
+                        throw new Error('[did-provider-cheqd]: revocation: statusListInlineBitstring does not match published status list 2021');
                     // otherwise, read from inline bitstring
                     return options?.statusListInlineBitstring;
                 }());
@@ -1563,7 +2518,45 @@ export class Cheqd {
                                 { encryptedString, encryptedSymmetricKey, symmetricKey: toString(symmetricKey, 'hex') }
                             ];
                         }())
-                        : [await Cheqd.publishStatusList2021(fromString(bitstring, 'base64url'), statusListMetadata, options?.publishOptions), undefined];
+                        : (await async function () {
+                            // validate encoding, if provided
+                            if (options?.publishOptions?.statusListEncoding && !Object.values(DefaultStatusList2021Encodings).includes(options?.publishOptions?.statusListEncoding)) {
+                                throw new Error('[did-provider-cheqd]: revocation: Invalid status list encoding');
+                            }
+                            // validate validUntil, if provided
+                            if (options?.publishOptions?.statusListValidUntil) {
+                                // validate validUntil as string
+                                if (typeof options?.publishOptions?.statusListValidUntil !== 'string')
+                                    throw new Error('[did-provider-cheqd]: revocation: Invalid status list validUntil (must be string)');
+                                // validate validUntil as date
+                                if (isNaN(Date.parse(options?.publishOptions?.statusListValidUntil)))
+                                    throw new Error('[did-provider-cheqd]: revocation: Invalid status list validUntil (must be date)');
+                                // validate validUntil as future date
+                                if (new Date(options?.publishOptions?.statusListValidUntil) < new Date())
+                                    throw new Error('[did-provider-cheqd]: revocation: Invalid status list validUntil (must be future date)');
+                                // validate validUntil towards validFrom
+                                if (new Date(options?.publishOptions?.statusListValidUntil) <= new Date(publishedList.StatusList2021.validFrom))
+                                    throw new Error('[did-provider-cheqd]: revocation: Invalid status list validUntil (must be after validFrom)');
+                            }
+                            // define status list content
+                            const content = {
+                                StatusList2021: {
+                                    type: publishedList.StatusList2021.type,
+                                    encodedList: publishedList.metadata.encoding === 'base64url' ? bitstring : toString(fromString(bitstring, 'base64url'), options.publishOptions.statusListEncoding),
+                                    validFrom: publishedList.StatusList2021.validFrom,
+                                    validUntil: options?.publishOptions?.statusListValidUntil || publishedList.StatusList2021.validUntil
+                                },
+                                metadata: {
+                                    encoding: options?.publishOptions?.statusListEncoding || publishedList.metadata.encoding,
+                                    encrypted: false,
+                                }
+                            };
+                            // return tuple of publish result and encryption relevant metadata
+                            return [
+                                await Cheqd.publishStatusList2021(fromString(JSON.stringify(content), 'utf-8'), statusListMetadata, options?.publishOptions),
+                                undefined
+                            ];
+                        }());
                     // early exit, if publish failed
                     if (!scoped[0])
                         throw new Error('[did-provider-cheqd]: unsuspension: Failed to publish status list 2021');
@@ -1574,7 +2567,7 @@ export class Cheqd {
             return {
                 unsuspended: true,
                 published: topArgs?.publish ? true : undefined,
-                statusList: topArgs?.returnUpdatedStatusList ? bitstring : undefined,
+                statusList: topArgs?.returnUpdatedStatusList ? await Cheqd.fetchStatusList2021(credential) : undefined,
                 encryptedStatusList: topArgs?.returnUpdatedEncryptedStatusList ? await blobToHexString(published?.[1]?.encryptedString) : undefined,
                 encryptedSymmetricKey: topArgs?.returnEncryptedSymmetricKey ? published?.[1]?.encryptedSymmetricKey : undefined,
                 symmetricKey: topArgs?.returnSymmetricKey ? published?.[1]?.symmetricKey : undefined,
@@ -1582,40 +2575,229 @@ export class Cheqd {
             };
         }
         catch (error) {
-            // silent fail + early exit, optimised for parallelisation, use with Promise.allSettled
+            // silent fail + early exit
             console.error(error);
             return { unsuspended: false, error: error };
         }
     }
+    static async unsuspendCredentials(credentials, options) {
+        // validate credentials - case: empty
+        if (!credentials.length || credentials.length === 0)
+            throw new Error('[did-provider-cheqd]: unsuspension: No credentials provided');
+        // validate credentials - case: consistent issuer
+        if (credentials.map((credential) => {
+            return (credential.issuer.id)
+                ? credential.issuer.id
+                : credential.issuer;
+        }).filter((value, _, self) => value && value !== self[0]).length > 0)
+            throw new Error('[did-provider-cheqd]: unsuspension: Credentials must be issued by the same issuer');
+        // validate credentials - case: status list index
+        if (credentials.map((credential) => credential.credentialStatus.statusListIndex).filter((value, index, self) => self.indexOf(value) !== index).length > 0)
+            throw new Error('[did-provider-cheqd]: unsuspension: Credentials must have unique status list index');
+        // validate credentials - case: status purpose
+        if (!credentials.every((credential) => credential.credentialStatus?.statusPurpose === 'suspension'))
+            throw new Error('[did-provider-cheqd]: unsuspension: Invalid status purpose');
+        // validate credentials - case: status list id
+        const remote = credentials[0].credentialStatus?.id
+            ? credentials[0].credentialStatus.id.split('#')[0]
+            : (function () {
+                throw new Error('[did-provider-cheqd]: unsuspension: Invalid status list id');
+            }());
+        // validate credentials - case: status list id format
+        if (!RemoteListPattern.test(remote))
+            throw new Error('[did-provider-cheqd]: unsuspension: Invalid status list id format: expected: https://<optional_subdomain>.<sld>.<tld>/1.0/identifiers/<did:cheqd:<namespace>:<method_specific_id>>?resourceName=<resource_name>&resourceType=<resource_type>');
+        if (!credentials.every((credential) => {
+            return credential.credentialStatus.id.split('#')[0] === remote;
+        }))
+            throw new Error('[did-provider-cheqd]: unsuspension: Credentials must belong to the same status list');
+        // validate credentials - case: status list type
+        if (!credentials.every((credential) => credential.credentialStatus?.type === 'StatusList2021Entry'))
+            throw new Error('[did-provider-cheqd]: unsuspension: Invalid status list type');
+        try {
+            // fetch status list 2021
+            const publishedList = (await Cheqd.fetchStatusList2021(credentials[0]));
+            // early return, if encrypted and no decryption key provided
+            if (publishedList.metadata.encrypted && !options?.topArgs?.symmetricKey)
+                throw new Error('[did-provider-cheqd]: unsuspension: symmetricKey is required, if status list 2021 is encrypted');
+            // fetch status list 2021 inscribed in credential
+            const statusList2021 = options?.topArgs?.fetchList
+                ? (await async function () {
+                    // if not encrypted, return bitstring
+                    if (!publishedList.metadata.encrypted)
+                        return publishedList.metadata.encoding === 'base64url'
+                            ? publishedList.StatusList2021.encodedList
+                            : toString(fromString(publishedList.StatusList2021.encodedList, publishedList.metadata.encoding), 'base64url');
+                    // otherwise, decrypt and return bitstring
+                    const scopedRawBlob = await toBlob(await Cheqd.fetchStatusList2021(credentials[0], true));
+                    // decrypt
+                    return await LitProtocol.decryptDirect(scopedRawBlob, fromString(options?.topArgs?.symmetricKey, 'hex'));
+                }())
+                : (await async function () {
+                    // transcode to base64url, if needed
+                    const publishedListTranscoded = publishedList.metadata.encoding === 'base64url'
+                        ? publishedList.StatusList2021.encodedList
+                        : toString(fromString(publishedList.StatusList2021.encodedList, publishedList.metadata.encoding), 'base64url');
+                    // if status list 2021 is not fetched, read from file
+                    if (options?.statusListFile) {
+                        // if not encrypted, return bitstring
+                        if (!publishedList.metadata.encrypted) {
+                            // construct encoded status list
+                            const encoded = new StatusList({ buffer: await Cheqd.getFile(options.statusListFile) }).encode();
+                            // validate against published list
+                            if (encoded !== publishedListTranscoded)
+                                throw new Error('[did-provider-cheqd]: revocation: statusListFile does not match published status list 2021');
+                            // return encoded
+                            return encoded;
+                        }
+                        // otherwise, decrypt and return bitstring
+                        const scopedRawBlob = await toBlob(await Cheqd.getFile(options.statusListFile));
+                        // decrypt
+                        const decrypted = await LitProtocol.decryptDirect(scopedRawBlob, fromString(options?.topArgs?.symmetricKey, 'hex'));
+                        // validate against published list
+                        if (decrypted !== publishedListTranscoded)
+                            throw new Error('[did-provider-cheqd]: revocation: statusListFile does not match published status list 2021');
+                        // return decrypted
+                        return decrypted;
+                    }
+                    if (!options?.statusListInlineBitstring)
+                        throw new Error('[did-provider-cheqd]: revocation: statusListInlineBitstring is required, if statusListFile is not provided');
+                    // validate against published list
+                    if (options?.statusListInlineBitstring !== publishedListTranscoded)
+                        throw new Error('[did-provider-cheqd]: revocation: statusListInlineBitstring does not match published status list 2021');
+                    // otherwise, read from inline bitstring
+                    return options?.statusListInlineBitstring;
+                }());
+            // parse status list 2021
+            const statusList = await StatusList.decode({ encodedList: statusList2021 });
+            // initiate bulk unsuspension
+            const unsuspended = await Promise.allSettled(credentials.map((credential) => {
+                return async function () {
+                    // early return, if no credential status
+                    if (!credential.credentialStatus)
+                        return { unsuspended: false };
+                    // early exit, if credential is already unsuspended
+                    if (!statusList.getStatus(Number(credential.credentialStatus.statusListIndex)))
+                        return { unsuspended: true };
+                    // update unsuspension status
+                    statusList.setStatus(Number(credential.credentialStatus.statusListIndex), false);
+                    // return unsuspension status
+                    return { unsuspended: true };
+                }();
+            }));
+            // revert bulk ops, if some failed
+            if (unsuspended.some((result) => result.status === 'fulfilled' && !result.value.unsuspended))
+                throw new Error(`[did-provider-cheqd]: unsuspension: Bulk unsuspension failed: already unsuspended credentials in unsuspension bundle: raw log: ${JSON.stringify(unsuspended.map((result) => ({ unsuspended: result.status === 'fulfilled' ? result.value.unsuspended : false })))}`);
+            // set in-memory status list ref
+            const bitstring = await statusList.encode();
+            // cast top-level args
+            const topArgs = options?.topArgs;
+            // write status list 2021 to file, if provided
+            if (topArgs?.writeToFile) {
+                await Cheqd.writeFile(fromString(bitstring, 'base64url'), options?.statusListFile);
+            }
+            // publish status list 2021, if provided
+            const published = topArgs?.publish
+                ? (await async function () {
+                    // fetch status list 2021 metadata
+                    const statusListMetadata = await Cheqd.fetchStatusList2021Metadata(credentials[0]);
+                    // publish status list 2021 as new version
+                    const scoped = topArgs.publishEncrypted
+                        ? (await async function () {
+                            // instantiate dkg-threshold client, in which case lit-protocol is used
+                            const lit = await LitProtocol.create({
+                                chain: options?.topArgs?.bootstrapOptions?.chain,
+                                litNetwork: options?.topArgs?.bootstrapOptions?.litNetwork
+                            });
+                            // encrypt
+                            const { encryptedString, encryptedSymmetricKey, symmetricKey } = await lit.encrypt(bitstring, options?.topArgs?.encryptionOptions?.unifiedAccessControlConditions, true);
+                            // return tuple of publish result and encryption relevant metadata
+                            return [
+                                await Cheqd.publishStatusList2021(new Uint8Array(await encryptedString.arrayBuffer()), statusListMetadata, options?.publishOptions),
+                                { encryptedString, encryptedSymmetricKey, symmetricKey: toString(symmetricKey, 'hex') }
+                            ];
+                        }())
+                        : (await async function () {
+                            // validate encoding, if provided
+                            if (options?.publishOptions?.statusListEncoding && !Object.values(DefaultStatusList2021Encodings).includes(options?.publishOptions?.statusListEncoding)) {
+                                throw new Error('[did-provider-cheqd]: revocation: Invalid status list encoding');
+                            }
+                            // validate validUntil, if provided
+                            if (options?.publishOptions?.statusListValidUntil) {
+                                // validate validUntil as string
+                                if (typeof options?.publishOptions?.statusListValidUntil !== 'string')
+                                    throw new Error('[did-provider-cheqd]: revocation: Invalid status list validUntil (must be string)');
+                                // validate validUntil as date
+                                if (isNaN(Date.parse(options?.publishOptions?.statusListValidUntil)))
+                                    throw new Error('[did-provider-cheqd]: revocation: Invalid status list validUntil (must be date)');
+                                // validate validUntil as future date
+                                if (new Date(options?.publishOptions?.statusListValidUntil) < new Date())
+                                    throw new Error('[did-provider-cheqd]: revocation: Invalid status list validUntil (must be future date)');
+                                // validate validUntil towards validFrom
+                                if (new Date(options?.publishOptions?.statusListValidUntil) <= new Date(publishedList.StatusList2021.validFrom))
+                                    throw new Error('[did-provider-cheqd]: revocation: Invalid status list validUntil (must be after validFrom)');
+                            }
+                            // define status list content
+                            const content = {
+                                StatusList2021: {
+                                    type: publishedList.StatusList2021.type,
+                                    encodedList: publishedList.metadata.encoding === 'base64url' ? bitstring : toString(fromString(bitstring, 'base64url'), options.publishOptions.statusListEncoding),
+                                    validFrom: publishedList.StatusList2021.validFrom,
+                                    validUntil: options?.publishOptions?.statusListValidUntil || publishedList.StatusList2021.validUntil
+                                },
+                                metadata: {
+                                    encoding: options?.publishOptions?.statusListEncoding || publishedList.metadata.encoding,
+                                    encrypted: false,
+                                }
+                            };
+                            // return tuple of publish result and encryption relevant metadata
+                            return [
+                                await Cheqd.publishStatusList2021(fromString(JSON.stringify(content), 'utf-8'), statusListMetadata, options?.publishOptions),
+                                undefined
+                            ];
+                        }());
+                    // early exit, if publish failed
+                    if (!scoped[0])
+                        throw new Error('[did-provider-cheqd]: unsuspension: Failed to publish status list 2021');
+                    // return publish result
+                    return scoped;
+                }())
+                : undefined;
+            return {
+                unsuspended: unsuspended.map((result) => result.status === 'fulfilled' ? result.value.unsuspended : false),
+                published: topArgs?.publish ? true : undefined,
+                statusList: topArgs?.returnUpdatedStatusList ? await Cheqd.fetchStatusList2021(credentials[0]) : undefined,
+                encryptedStatusList: topArgs?.returnUpdatedEncryptedStatusList ? await blobToHexString(published?.[1]?.encryptedString) : undefined,
+                encryptedSymmetricKey: topArgs?.returnEncryptedSymmetricKey ? published?.[1]?.encryptedSymmetricKey : undefined,
+                symmetricKey: topArgs?.returnSymmetricKey ? published?.[1]?.symmetricKey : undefined,
+                resourceMetadata: topArgs?.returnStatusListMetadata ? await Cheqd.fetchStatusList2021Metadata(credentials[0]) : undefined
+            };
+        }
+        catch (error) {
+            // silent fail + early exit
+            console.error(error);
+            return { unsuspended: [], error: error };
+        }
+    }
     static async checkRevoked(credential, options = { fetchList: true }) {
         // validate status purpose
         if (credential.credentialStatus?.statusPurpose !== 'revocation') {
             throw new Error(`[did-provider-cheqd]: revocation: Unsupported status purpose: ${credential.credentialStatus?.statusPurpose}`);
         }
-        // fetch status list 2021 metadata
-        const metadata = (await Cheqd.fetchStatusList2021Metadata(credential));
-        // detect if encrypted
-        const isEncrypted = function () {
-            switch (metadata.mediaType) {
-                case 'application/octet-stream':
-                    return true;
-                case 'application/gzip':
-                    return false;
-                default:
-                    throw new Error(`[did-provider-cheqd]: revocation: Unsupported media type: ${metadata.mediaType}`);
-            }
-        }();
+        // fetch status list 2021
+        const publishedList = (await Cheqd.fetchStatusList2021(credential));
         // early return, if encrypted and decryption key is not provided
-        if (isEncrypted && !options?.topArgs?.encryptedSymmetricKey)
+        if (publishedList.metadata.encrypted && !options?.topArgs?.encryptedSymmetricKey)
             throw new Error('[did-provider-cheqd]: revocation: encryptedSymmetricKey is required, if status list 2021 is encrypted');
         // fetch status list 2021 inscribed in credential
         const statusList2021 = options?.topArgs?.fetchList
             ? (await async function () {
                 // if not encrypted, return bitstring
-                if (!isEncrypted)
-                    return await Cheqd.fetchStatusList2021(credential);
+                if (!publishedList.metadata.encrypted)
+                    return publishedList.metadata.encoding === 'base64url'
+                        ? publishedList.StatusList2021.encodedList
+                        : toString(fromString(publishedList.StatusList2021.encodedList, publishedList.metadata.encoding), 'base64url');
                 // otherwise, decrypt and return bitstring
-                const scopedRawBlob = await toBlob(await Cheqd.fetchStatusList2021(credential, true));
+                const scopedRawBlob = await toBlob(fromString(publishedList.StatusList2021.encodedList, publishedList.metadata.encoding));
                 // instantiate dkg-threshold client, in which case lit-protocol is used
                 const lit = await LitProtocol.create({
                     chain: options?.topArgs?.bootstrapOptions?.chain,
@@ -1625,23 +2807,37 @@ export class Cheqd {
                 return await lit.decrypt(scopedRawBlob, options?.topArgs?.encryptedSymmetricKey, options?.topArgs?.decryptionOptions?.unifiedAccessControlConditions);
             }())
             : (await async function () {
+                // transcode to base64url, if needed
+                const publishedListTranscoded = publishedList.metadata.encoding === 'base64url'
+                    ? publishedList.StatusList2021.encodedList
+                    : toString(fromString(publishedList.StatusList2021.encodedList, publishedList.metadata.encoding), 'base64url');
                 // if status list 2021 is not fetched, read from file
                 if (options?.statusListFile) {
                     // if not encrypted, return bitstring
-                    if (!isEncrypted)
-                        return new StatusList({ buffer: await Cheqd.getFile(options.statusListFile) }).encode();
+                    if (!publishedList.metadata.encrypted) {
+                        // construct encoded status list
+                        const encoded = new StatusList({ buffer: await Cheqd.getFile(options.statusListFile) }).encode();
+                        // validate against published list
+                        if (encoded !== publishedListTranscoded)
+                            throw new Error('[did-provider-cheqd]: revocation: statusListFile does not match published status list 2021');
+                        // return encoded
+                        return encoded;
+                    }
                     // otherwise, decrypt and return bitstring
                     const scopedRawBlob = await toBlob(await Cheqd.getFile(options.statusListFile));
-                    // instantiate dkg-threshold client, in which case lit-protocol is used
-                    const lit = await LitProtocol.create({
-                        chain: options?.topArgs?.bootstrapOptions?.chain,
-                        litNetwork: options?.topArgs?.bootstrapOptions?.litNetwork
-                    });
                     // decrypt
-                    return await lit.decrypt(scopedRawBlob, options?.topArgs?.encryptedSymmetricKey, options?.topArgs?.decryptionOptions?.unifiedAccessControlConditions);
+                    const decrypted = await LitProtocol.decryptDirect(scopedRawBlob, fromString(options?.topArgs?.symmetricKey, 'hex'));
+                    // validate against published list
+                    if (decrypted !== publishedListTranscoded)
+                        throw new Error('[did-provider-cheqd]: revocation: statusListFile does not match published status list 2021');
+                    // return decrypted
+                    return decrypted;
                 }
                 if (!options?.statusListInlineBitstring)
-                    throw new Error(' [did-provider-cheqd]: revocation: statusListInlineBitstring is required, if statusListFile is not provided');
+                    throw new Error('[did-provider-cheqd]: revocation: statusListInlineBitstring is required, if statusListFile is not provided');
+                // validate against published list
+                if (options?.statusListInlineBitstring !== publishedListTranscoded)
+                    throw new Error('[did-provider-cheqd]: revocation: statusListInlineBitstring does not match published status list 2021');
                 // otherwise, read from inline bitstring
                 return options?.statusListInlineBitstring;
             }());
@@ -1655,30 +2851,21 @@ export class Cheqd {
         if (credential.credentialStatus?.statusPurpose !== 'suspension') {
             throw new Error(`[did-provider-cheqd]: suspension: Unsupported status purpose: ${credential.credentialStatus?.statusPurpose}`);
         }
-        // fetch status list 2021 metadata
-        const metadata = (await Cheqd.fetchStatusList2021Metadata(credential));
-        // detect if encrypted
-        const isEncrypted = function () {
-            switch (metadata.mediaType) {
-                case 'application/octet-stream':
-                    return true;
-                case 'application/gzip':
-                    return false;
-                default:
-                    throw new Error(`[did-provider-cheqd]: suspension: Unsupported media type: ${metadata.mediaType}`);
-            }
-        }();
+        // fetch status list 2021
+        const publishedList = (await Cheqd.fetchStatusList2021(credential));
         // early return, if encrypted and decryption key is not provided
-        if (isEncrypted && !options?.topArgs?.encryptedSymmetricKey)
-            throw new Error('[did-provider-cheqd]: suspension: encryptedSymmetricKey is required, if status list 2021 is encrypted');
+        if (publishedList.metadata.encrypted && !options?.topArgs?.encryptedSymmetricKey)
+            throw new Error('[did-provider-cheqd]: revocation: encryptedSymmetricKey is required, if status list 2021 is encrypted');
         // fetch status list 2021 inscribed in credential
         const statusList2021 = options?.topArgs?.fetchList
             ? (await async function () {
                 // if not encrypted, return bitstring
-                if (!isEncrypted)
-                    return await Cheqd.fetchStatusList2021(credential);
+                if (!publishedList.metadata.encrypted)
+                    return publishedList.metadata.encoding === 'base64url'
+                        ? publishedList.StatusList2021.encodedList
+                        : toString(fromString(publishedList.StatusList2021.encodedList, publishedList.metadata.encoding), 'base64url');
                 // otherwise, decrypt and return bitstring
-                const scopedRawBlob = await toBlob(await Cheqd.fetchStatusList2021(credential, true));
+                const scopedRawBlob = await toBlob(fromString(publishedList.StatusList2021.encodedList, publishedList.metadata.encoding));
                 // instantiate dkg-threshold client, in which case lit-protocol is used
                 const lit = await LitProtocol.create({
                     chain: options?.topArgs?.bootstrapOptions?.chain,
@@ -1688,23 +2875,37 @@ export class Cheqd {
                 return await lit.decrypt(scopedRawBlob, options?.topArgs?.encryptedSymmetricKey, options?.topArgs?.decryptionOptions?.unifiedAccessControlConditions);
             }())
             : (await async function () {
+                // transcode to base64url, if needed
+                const publishedListTranscoded = publishedList.metadata.encoding === 'base64url'
+                    ? publishedList.StatusList2021.encodedList
+                    : toString(fromString(publishedList.StatusList2021.encodedList, publishedList.metadata.encoding), 'base64url');
                 // if status list 2021 is not fetched, read from file
                 if (options?.statusListFile) {
                     // if not encrypted, return bitstring
-                    if (!isEncrypted)
-                        return new StatusList({ buffer: await Cheqd.getFile(options.statusListFile) }).encode();
+                    if (!publishedList.metadata.encrypted) {
+                        // construct encoded status list
+                        const encoded = new StatusList({ buffer: await Cheqd.getFile(options.statusListFile) }).encode();
+                        // validate against published list
+                        if (encoded !== publishedListTranscoded)
+                            throw new Error('[did-provider-cheqd]: revocation: statusListFile does not match published status list 2021');
+                        // return encoded
+                        return encoded;
+                    }
                     // otherwise, decrypt and return bitstring
                     const scopedRawBlob = await toBlob(await Cheqd.getFile(options.statusListFile));
-                    // instantiate dkg-threshold client, in which case lit-protocol is used
-                    const lit = await LitProtocol.create({
-                        chain: options?.topArgs?.bootstrapOptions?.chain,
-                        litNetwork: options?.topArgs?.bootstrapOptions?.litNetwork
-                    });
                     // decrypt
-                    return await lit.decrypt(scopedRawBlob, options?.topArgs?.encryptedSymmetricKey, options?.topArgs?.decryptionOptions?.unifiedAccessControlConditions);
+                    const decrypted = await LitProtocol.decryptDirect(scopedRawBlob, fromString(options?.topArgs?.symmetricKey, 'hex'));
+                    // validate against published list
+                    if (decrypted !== publishedListTranscoded)
+                        throw new Error('[did-provider-cheqd]: revocation: statusListFile does not match published status list 2021');
+                    // return decrypted
+                    return decrypted;
                 }
                 if (!options?.statusListInlineBitstring)
-                    throw new Error(' [did-provider-cheqd]: suspension: statusListInlineBitstring is required, if statusListFile is not provided');
+                    throw new Error('[did-provider-cheqd]: revocation: statusListInlineBitstring is required, if statusListFile is not provided');
+                // validate against published list
+                if (options?.statusListInlineBitstring !== publishedListTranscoded)
+                    throw new Error('[did-provider-cheqd]: revocation: statusListInlineBitstring does not match published status list 2021');
                 // otherwise, read from inline bitstring
                 return options?.statusListInlineBitstring;
             }());
@@ -1720,10 +2921,11 @@ export class Cheqd {
             id: options?.resourceId || v4(),
             name: statusList2021Metadata.resourceName,
             version: options?.resourceVersion || new Date().toISOString(),
-            resourceType: 'StatusList2021',
+            alsoKnownAs: options?.resourceAlsoKnownAs || [],
+            resourceType: statusList2021Metadata.resourceType,
             data: statusList2021Raw
         };
-        return await options.context.agent[CreateStatusList2021MethodName]({
+        return await options.context.agent[BroadcastStatusList2021MethodName]({
             kms: (await options.context.agent.keyManagerGetKeyManagementSystems())[0],
             payload,
             network: statusList2021Metadata.resourceURI.split(':')[2],
@@ -1741,25 +2943,26 @@ export class Cheqd {
         // validate credential status list status purpose
         if (credential.credentialStatus.statusPurpose !== 'revocation' && credential.credentialStatus.statusPurpose !== 'suspension')
             throw new Error('[did-provider-cheqd]: fetch status list: Credential status purpose is not valid');
-        // validate credential status list status list credential
-        if (!credential.credentialStatus.statusListCredential)
-            throw new Error('[did-provider-cheqd]: fetch status list: Credential status list credential is not present');
         // fetch status list 2021
-        const raw = await (await fetch(credential.credentialStatus.statusListCredential)).arrayBuffer();
+        const content = await (await fetch(credential.credentialStatus.id.split('#')[0])).json();
         // return raw if requested
-        if (returnRaw)
-            return new Uint8Array(raw);
-        // otherwise, parse to bitstring and return
-        const bitstring = toString(new Uint8Array(raw), 'base64url');
-        return bitstring;
+        if (returnRaw) {
+            return fromString(content.StatusList2021.encodedList, content.metadata.encoding);
+        }
+        // otherwise, return content
+        return content;
     }
     static async fetchStatusList2021Metadata(credential) {
         // get base url
-        const baseUrl = new URL(credential.credentialStatus?.statusListCredential);
+        const baseUrl = new URL(credential.credentialStatus.id.split('#')[0]);
         // get resource name
         const resourceName = baseUrl.searchParams.get('resourceName');
+        // get resource type
+        const resourceType = baseUrl.searchParams.get('resourceType');
         // unset resource name
         baseUrl.searchParams.delete('resourceName');
+        // unset resource type
+        baseUrl.searchParams.delete('resourceType');
         // construct metadata url
         const metadataUrl = `${baseUrl.toString()}/metadata`;
         // fetch collection metadata
@@ -1768,7 +2971,7 @@ export class Cheqd {
         if (!collectionMetadata?.contentStream?.linkedResourceMetadata)
             throw new Error('[did-provider-cheqd]: fetch status list metadata: No linked resources found');
         // find relevant resources by resource name
-        const resourceVersioning = collectionMetadata.contentStream.linkedResourceMetadata.filter((resource) => resource.resourceName === resourceName);
+        const resourceVersioning = collectionMetadata.contentStream.linkedResourceMetadata.filter((resource) => resource.resourceName === resourceName && resource.resourceType === resourceType);
         // early exit if no relevant resources
         if (!resourceVersioning.length || resourceVersioning.length === 0)
             throw new Error(`[did-provider-cheqd]: fetch status list metadata: No relevant resources found by resource name ${resourceName}`);