@cheqd/did-provider-cheqd 3.5.0 → 3.6.0-develop.1

package/build/esm/agent/ICheqd.js

@@ -10,8 +10,8 @@ import { StatusList } from '@digitalbazaar/vc-status-list';
 import { v4 } from 'uuid';
 import fs from 'fs';
 import Debug from 'debug';
-import { LitCompatibleCosmosChains, LitProtocol } from '../dkg-threshold/lit-protocol.js';
-import { blobToHexString, randomFromRange, toBlob, unescapeUnicode } from '../utils/helpers.js';
+import { LitCompatibleCosmosChains, LitProtocol, } from '../dkg-threshold/lit-protocol.js';
+import { blobToHexString, randomFromRange, toBlob, } from '../utils/helpers.js';
 import { resolverUrl } from '../did-manager/cheqd-did-resolver.js';
 const debug = Debug('veramo:did-provider-cheqd');
 export const AccessControlConditionTypes = { timelockPayment: 'timelockPayment', memoNonce: 'memoNonce', balance: 'balance' };
@@ -28,7 +28,6 @@ const GenerateDidDocWithLinkedResourceMethodName = 'cheqdGenerateDidDocWithLinke
 const GenerateKeyPairMethodName = 'cheqdGenerateIdentityKeys';
 const GenerateVersionIdMethodName = 'cheqdGenerateVersionId';
 const GenerateStatusList2021MethodName = 'cheqdGenerateStatusList2021';
-const GenerateEncryptedStatusList2021MethodName = 'cheqdGenerateEncryptedStatusList2021';
 const IssueRevocableCredentialWithStatusList2021MethodName = 'cheqdIssueRevocableCredentialWithStatusList2021';
 const IssueSuspendableCredentialWithStatusList2021MethodName = 'cheqdIssueSuspendableCredentialWithStatusList2021';
 const VerifyCredentialMethodName = 'cheqdVerifyCredential';
@@ -40,8 +39,8 @@ const SuspendCredentialMethodName = 'cheqdSuspendCredential';
 const SuspendCredentialsMethodName = 'cheqdSuspendCredentials';
 const UnsuspendCredentialMethodName = 'cheqdUnsuspendCredential';
 const UnsuspendCredentialsMethodName = 'cheqdUnsuspendCredentials';
-const TransactVerifierPaysIssuerMethodName = 'cheqdTransactVerifierPaysIssuer';
-const ObserveVerifierPaysIssuerMethodName = 'cheqdObserveVerifierPaysIssuer';
+const TransactSendTokensMethodName = 'cheqdTransactSendTokens';
+const ObservePaymentConditionMethodName = 'cheqdObservePaymentCondition';
 const DidPrefix = 'did';
 const CheqdDidMethod = 'cheqd';
 export class Cheqd {
@@ -239,24 +238,6 @@ export class Cheqd {
                         "type": "string"
                     }
                 },
-                "cheqdGenerateEncryptedStatusList2021": {
-                    "description": "Generate a new encrypted Status List 2021",
-                    "arguments": {
-                        "type": "object",
-                        "properties": {
-                            "args": {
-                                "type": "object",
-                                "description": "A cheqdGenerateEncryptedStatusList2021Args object as any for extensibility"
-                            }
-                        },
-                        "required": [
-                            "args"
-                        ]
-                    },
-                    "returnType": {
-                        "type": "string"
-                    }
-                },
                 "cheqdIssueRevocableCredentialWithStatusList2021": {
                     "description": "Issue a revocable credential with a Status List 2021 as credential status registry",
                     "arguments": {
@@ -455,14 +436,14 @@ export class Cheqd {
                         "type": "array"
                     }
                 },
-                "cheqdTransactVerifierPaysIssuer": {
-                    "description": "Initiate a transaction where the verifier pays the issuer for a credential status check",
+                "cheqdTransactSendTokens": {
+                    "description": "Send tokens from one account to another",
                     "arguments": {
                         "type": "object",
                         "properties": {
                             "args": {
                                 "type": "object",
-                                "description": "A cheqdTransactVerifierPaysIssuerArgs object as any for extensibility"
+                                "description": "A cheqdTransactSendTokensArgs object as any for extensibility"
                             }
                         },
                         "required": [
@@ -473,14 +454,14 @@ export class Cheqd {
                         "type": "object"
                     }
                 },
-                "cheqdObserveVerifierPaysIssuer": {
-                    "description": "Observe a transaction where the verifier pays the issuer for a credential status check",
+                "cheqdObservePaymentCondition": {
+                    "description": "Observe payment conditions for a given set of payment conditions",
                     "arguments": {
                         "type": "object",
                         "properties": {
                             "args": {
                                 "type": "object",
-                                "description": "cheqdObserveVerifierPaysIssuerArgs object as any for extensibility"
+                                "description": "cheqdObservePaymentConditionArgs object as any for extensibility"
                             }
                         },
                         "required": [
@@ -519,7 +500,6 @@ export class Cheqd {
             [GenerateKeyPairMethodName]: this.GenerateIdentityKeys.bind(this),
             [GenerateVersionIdMethodName]: this.GenerateVersionId.bind(this),
             [GenerateStatusList2021MethodName]: this.GenerateStatusList2021.bind(this),
-            [GenerateEncryptedStatusList2021MethodName]: this.GenerateEncryptedStatusList2021.bind(this),
             [IssueRevocableCredentialWithStatusList2021MethodName]: this.IssueRevocableCredentialWithStatusList2021.bind(this),
             [IssueSuspendableCredentialWithStatusList2021MethodName]: this.IssueSuspendableCredentialWithStatusList2021.bind(this),
             [VerifyCredentialMethodName]: this.VerifyCredentialWithStatusList2021.bind(this),
@@ -531,8 +511,8 @@ export class Cheqd {
             [SuspendCredentialsMethodName]: this.SuspendBulkCredentialsWithStatusList2021.bind(this),
             [UnsuspendCredentialMethodName]: this.UnsuspendCredentialWithStatusList2021.bind(this),
             [UnsuspendCredentialsMethodName]: this.UnsuspendBulkCredentialsWithStatusList2021.bind(this),
-            [TransactVerifierPaysIssuerMethodName]: this.TransactVerifierPaysIssuer.bind(this),
-            [ObserveVerifierPaysIssuerMethodName]: this.ObserveVerifierPaysIssuer.bind(this),
+            [TransactSendTokensMethodName]: this.TransactSendTokens.bind(this),
+            [ObservePaymentConditionMethodName]: this.ObservePaymentCondition.bind(this),
         };
     }
     async CreateIdentifier(args, context) {
@@ -680,11 +660,11 @@ export class Cheqd {
             if (!args?.paymentConditions || !args?.paymentConditions?.length || !Array.isArray(args?.paymentConditions) || args?.paymentConditions.length === 0) {
                 throw new Error('[did-provider-cheqd]: paymentConditions is required');
             }
-            if (!args?.paymentConditions?.every((condition) => condition.feePaymentAddress && condition.feePaymentAmount)) {
-                throw new Error('[did-provider-cheqd]: paymentConditions must contain feePaymentAddress and feeAmount');
+            if (!args?.paymentConditions?.every((condition) => condition.feePaymentAddress && condition.feePaymentAmount && condition.intervalInSeconds)) {
+                throw new Error('[did-provider-cheqd]: paymentConditions must contain feePaymentAddress and feeAmount and intervalInSeconds');
             }
-            if (!args?.paymentConditions?.every((condition) => typeof condition.feePaymentAddress === 'string' && typeof condition.feePaymentAmount === 'string')) {
-                throw new Error('[did-provider-cheqd]: feePaymentAddress and feePaymentAmount must be string');
+            if (!args?.paymentConditions?.every((condition) => typeof condition.feePaymentAddress === 'string' && typeof condition.feePaymentAmount === 'string' && typeof condition.intervalInSeconds === 'number')) {
+                throw new Error('[did-provider-cheqd]: feePaymentAddress and feePaymentAmount must be string and intervalInSeconds must be number');
             }
             if (!args?.paymentConditions?.every((condition) => condition.type === AccessControlConditionTypes.timelockPayment)) {
                 throw new Error('[did-provider-cheqd]: paymentConditions must be of type timelockPayment');
@@ -694,42 +674,111 @@ export class Cheqd {
         const network = args.issuerDid.split(':')[2];
         // generate bitstring
         const bitstring = await context.agent[GenerateStatusList2021MethodName]({ length: args?.statusListLength || Cheqd.defaultStatusList2021Length, bitstringEncoding: args?.statusListEncoding || DefaultStatusList2021Encodings.base64url });
-        // construct data
+        // construct data and metadata tuple
         const data = args.encrypted
-            ? (await (async function () {
-                // TODO: implement
-                throw new Error('[did-provider-cheqd]: encrypted status list is not implemented yet');
-            }()))
-            : (await (async function () {
+            ? (await (async function (that) {
+                // instantiate dkg-threshold client, in which case lit-protocol is used
+                const lit = await LitProtocol.create({
+                    chain: args?.dkgOptions?.chain || that.didProvider.dkgOptions.chain,
+                    litNetwork: args?.dkgOptions?.network || that.didProvider.dkgOptions.network,
+                });
+                // construct access control conditions
+                const unifiedAccessControlConditions = await Promise.all(args.paymentConditions.map(async (condition) => {
+                    switch (condition.type) {
+                        case AccessControlConditionTypes.timelockPayment:
+                            return await LitProtocol.generateCosmosAccessControlConditionInverseTimelock({
+                                key: '$.tx_responses.*.timestamp',
+                                comparator: '<=',
+                                value: `${condition.intervalInSeconds}`,
+                            }, condition.feePaymentAmount, condition.feePaymentAddress, condition?.blockHeight, args?.dkgOptions?.chain || that.didProvider.dkgOptions.chain);
+                        default:
+                            throw new Error(`[did-provider-cheqd]: unsupported access control condition type ${condition.type}`);
+                    }
+                }));
+                // encrypt bitstring
+                const { encryptedString, encryptedSymmetricKey, symmetricKey } = await lit.encrypt(bitstring, unifiedAccessControlConditions, true);
+                // return result tuple
                 switch (args.statusPurpose) {
                     case DefaultStatusList2021StatusPurposeTypes.revocation:
-                        return {
-                            StatusList2021: {
-                                statusPurpose: args.statusPurpose,
-                                encodedList: bitstring,
-                                validFrom: new Date().toISOString(),
-                                validUntil: args?.validUntil
+                        return [{
+                                StatusList2021: {
+                                    statusPurpose: args.statusPurpose,
+                                    encodedList: await blobToHexString(encryptedString),
+                                    validFrom: new Date().toISOString(),
+                                    validUntil: args?.validUntil
+                                },
+                                metadata: {
+                                    type: DefaultStatusList2021ResourceTypes.revocation,
+                                    encrypted: true,
+                                    encoding: args?.statusListEncoding || DefaultStatusList2021Encodings.base64url,
+                                    encryptedSymmetricKey,
+                                    paymentConditions: args.paymentConditions
+                                }
                             },
-                            metadata: {
-                                type: DefaultStatusList2021ResourceTypes.revocation,
-                                encrypted: false,
-                                encoding: args?.statusListEncoding || DefaultStatusList2021Encodings.base64url,
+                            {
+                                symmetricKey: toString(symmetricKey, 'hex'),
+                                encryptedSymmetricKey,
+                                encryptedString: await blobToHexString(encryptedString),
                             }
-                        };
+                        ];
                     case DefaultStatusList2021StatusPurposeTypes.suspension:
-                        return {
-                            StatusList2021: {
-                                statusPurpose: args.statusPurpose,
-                                encodedList: bitstring,
-                                validFrom: new Date().toISOString(),
-                                validUntil: args?.validUntil
+                        return [{
+                                StatusList2021: {
+                                    statusPurpose: args.statusPurpose,
+                                    encodedList: await blobToHexString(encryptedString),
+                                    validFrom: new Date().toISOString(),
+                                    validUntil: args?.validUntil
+                                },
+                                metadata: {
+                                    type: DefaultStatusList2021ResourceTypes.suspension,
+                                    encrypted: true,
+                                    encoding: args?.statusListEncoding || DefaultStatusList2021Encodings.base64url,
+                                    encryptedSymmetricKey,
+                                    paymentConditions: args.paymentConditions
+                                }
                             },
-                            metadata: {
-                                type: DefaultStatusList2021ResourceTypes.suspension,
-                                encrypted: false,
-                                encoding: args?.statusListEncoding || DefaultStatusList2021Encodings.base64url,
+                            {
+                                symmetricKey: toString(symmetricKey, 'hex'),
+                                encryptedSymmetricKey,
+                                encryptedString: await blobToHexString(encryptedString),
                             }
-                        };
+                        ];
+                    default:
+                        throw new Error(`[did-provider-cheqd]: status purpose is not valid ${args.statusPurpose}`);
+                }
+            }(this)))
+            : (await (async function () {
+                switch (args.statusPurpose) {
+                    case DefaultStatusList2021StatusPurposeTypes.revocation:
+                        return [{
+                                StatusList2021: {
+                                    statusPurpose: args.statusPurpose,
+                                    encodedList: bitstring,
+                                    validFrom: new Date().toISOString(),
+                                    validUntil: args?.validUntil
+                                },
+                                metadata: {
+                                    type: DefaultStatusList2021ResourceTypes.revocation,
+                                    encrypted: false,
+                                    encoding: args?.statusListEncoding || DefaultStatusList2021Encodings.base64url,
+                                }
+                            },
+                            undefined];
+                    case DefaultStatusList2021StatusPurposeTypes.suspension:
+                        return [{
+                                StatusList2021: {
+                                    statusPurpose: args.statusPurpose,
+                                    encodedList: bitstring,
+                                    validFrom: new Date().toISOString(),
+                                    validUntil: args?.validUntil
+                                },
+                                metadata: {
+                                    type: DefaultStatusList2021ResourceTypes.suspension,
+                                    encrypted: false,
+                                    encoding: args?.statusListEncoding || DefaultStatusList2021Encodings.base64url,
+                                }
+                            },
+                            undefined];
                     default:
                         throw new Error('[did-provider-cheqd]: statusPurpose is not valid');
                 }
@@ -742,13 +791,15 @@ export class Cheqd {
             resourceType: DefaultStatusList2021ResourceTypes[args.statusPurpose],
             version: args?.resourceVersion || new Date().toISOString(),
             alsoKnownAs: args?.alsoKnownAs || [],
-            data: fromString(JSON.stringify(data), 'utf-8'),
+            data: fromString(JSON.stringify(data[0]), 'utf-8'),
         };
         // return result
         return {
             created: await context.agent[BroadcastStatusList2021MethodName]({ kms: args.kms, payload, network: network }),
-            statusList2021: data,
-            resourceMetadata: await Cheqd.fetchStatusList2021Metadata({ credentialStatus: { id: `${resolverUrl}${args.issuerDid}?resourceName=${args.statusListName}&resourceType=${DefaultStatusList2021ResourceTypes[args.statusPurpose]}`, type: 'StatusList2021Entry' } })
+            resource: data[0],
+            resourceMetadata: await Cheqd.fetchStatusList2021Metadata({ credentialStatus: { id: `${resolverUrl}${args.issuerDid}?resourceName=${args.statusListName}&resourceType=${DefaultStatusList2021ResourceTypes[args.statusPurpose]}`, type: 'StatusList2021Entry' } }),
+            encrypted: args.encrypted,
+            symmetricKey: args?.returnSymmetricKey ? data[1]?.symmetricKey : undefined,
         };
     }
     async BroadcastStatusList2021(args, context) {
@@ -875,54 +926,6 @@ export class Cheqd {
                 return encoded;
         }
     }
-    async GenerateEncryptedStatusList2021(args, context) {
-        // validate encryptionOptions
-        if (!args.encryptionOptions) {
-            throw new Error('[did-provider-cheqd]: encryptionOptions is required');
-        }
-        // validate encryptionOptions.accessControlConditions
-        if (!args.encryptionOptions.accessControlConditions) {
-            throw new Error('[did-provider-cheqd]: encryptionOptions.accessControlConditions is required');
-        }
-        // generate status list
-        const statusList = args?.buffer
-            ? new StatusList({ buffer: args.buffer })
-            : new StatusList({ length: args?.length || Cheqd.defaultStatusList2021Length });
-        // encode status list
-        const encoded = await statusList.encode();
-        // instantiate dkg-threshold client, in which case lit-protocol is used
-        const lit = await LitProtocol.create({
-            chain: args.bootstrapOptions.chain,
-            litNetwork: args.bootstrapOptions.litNetwork,
-        });
-        // construct access control conditions
-        const unifiedAccessControlConditions = await Promise.all(args.encryptionOptions.accessControlConditions.map(async (condition) => {
-            switch (condition.type) {
-                case AccessControlConditionTypes.memoNonce:
-                    return await LitProtocol.generateCosmosAccessControlConditionTransactionMemo({
-                        key: '$.txs.*.body.memo',
-                        comparator: 'contains',
-                        value: condition?.specificNonce || await LitProtocol.generateTxNonce(condition?.nonceFormat)
-                    }, condition.amountObserved, condition.senderAddressObserved, condition.recipientAddressObserved, args.bootstrapOptions.chain);
-                case AccessControlConditionTypes.balance:
-                    return await LitProtocol.generateCosmosAccessControlConditionBalance({
-                        key: '$.balances[0].amount',
-                        comparator: condition.comparator,
-                        value: condition.amountObserved
-                    }, args.bootstrapOptions.chain, condition.addressObserved);
-                default:
-                    throw new Error(`[did-provider-cheqd]: accessControlCondition type is not supported`);
-            }
-        }));
-        // encrypt data
-        const { encryptedString, encryptedSymmetricKey } = await lit.encrypt(encoded, unifiedAccessControlConditions);
-        // return result
-        return {
-            encryptedStatusList2021: await blobToHexString(encryptedString),
-            encryptedSymmetricKey,
-            unifiedAccessControlConditions
-        };
-    }
     async IssueRevocableCredentialWithStatusList2021(args, context) {
         // generate index
         const statusListIndex = args.statusOptions.statusListIndex || await randomFromRange(args.statusOptions.statusListRangeStart || 0, (args.statusOptions.statusListRangeEnd || Cheqd.defaultStatusList2021Length) - 1, args.statusOptions.indexNotIn || []);
@@ -1021,6 +1024,8 @@ export class Cheqd {
         }
         // if jwt credential, decode it
         const credential = typeof args.credential === 'string' ? await Cheqd.decodeCredentialJWT(args.credential) : args.credential;
+        // define dkg options, if provided
+        args.dkgOptions ||= this.didProvider.dkgOptions;
         // verify credential status
         switch (credential.credentialStatus?.statusPurpose) {
             case 'revocation':
@@ -1049,8 +1054,11 @@ export class Cheqd {
         if (!verificationResult.verified) {
             return { verified: false, error: verificationResult.error };
         }
+        // early return if no verifiable credentials are provided
         if (!args.presentation.verifiableCredential)
             throw new Error('[did-provider-cheqd]: verify presentation: presentation.verifiableCredential is required');
+        // define dkg options, if provided
+        args.dkgOptions ||= this.didProvider.dkgOptions;
         // verify credential(s) status(es)
         for (let credential of args.presentation.verifiableCredential) {
             // if jwt credential, decode it
@@ -1123,6 +1131,8 @@ export class Cheqd {
             throw new Error('[did-provider-cheqd]: revocation: credential is required');
         // if jwt credential, decode it
         const credential = typeof args.credential === 'string' ? await Cheqd.decodeCredentialJWT(args.credential) : args.credential;
+        // define dkg options, if provided
+        args.dkgOptions ||= this.didProvider.dkgOptions;
         switch (credential.credentialStatus?.statusPurpose) {
             case 'revocation':
                 if (await Cheqd.checkRevoked(credential, { ...args.options, topArgs: args }))
@@ -1203,6 +1213,8 @@ export class Cheqd {
         if (args.options?.publish && !args.fetchList && !(args.options?.statusListFile || args.options?.statusList)) {
             throw new Error('[did-provider-cheqd]: revocation: publish requires statusListFile or statusList, if fetchList is disabled');
         }
+        // define dkg options, if provided
+        args.dkgOptions ||= this.didProvider.dkgOptions;
         // revoke credential
         return await Cheqd.revokeCredential(credential, {
             ...args.options,
@@ -1285,6 +1297,8 @@ export class Cheqd {
         if (args.options?.publish && !args.fetchList && !(args.options?.statusListFile || args.options?.statusList)) {
             throw new Error('[did-provider-cheqd]: revocation: publish requires statusListFile or statusList, if fetchList is disabled');
         }
+        // define dkg options, if provided
+        args.dkgOptions ||= this.didProvider.dkgOptions;
         // revoke credentials
         return await Cheqd.revokeCredentials(credentials, {
             ...args.options,
@@ -1625,13 +1639,13 @@ export class Cheqd {
             }
         });
     }
-    async TransactVerifierPaysIssuer(args, context) {
+    async TransactSendTokens(args, context) {
         try {
             // delegate to provider
             const transactionResult = await this.didProvider.transactSendTokens({
                 recipientAddress: args.recipientAddress,
                 amount: args.amount,
-                memoNonce: args.memoNonce,
+                memo: args.memo,
                 txBytes: args.txBytes,
             });
             // return transaction result
@@ -1651,9 +1665,27 @@ export class Cheqd {
             };
         }
     }
-    async ObserveVerifierPaysIssuer(args, context) {
-        // verify with raw unified access control conditions, if any
+    async ObservePaymentCondition(args, context) {
+        // verify with raw unified access control condition, if any
         if (args?.unifiedAccessControlCondition) {
+            // validate args - case: unifiedAccessControlCondition.chain
+            if (!args.unifiedAccessControlCondition.chain || !Object.values(LitCompatibleCosmosChains).includes(args.unifiedAccessControlCondition.chain))
+                throw new Error('[did-provider-cheqd]: observe: unifiedAccessControlCondition.chain is required and must be a valid Lit-compatible chain');
+            // validate args - case: unifiedAccessControlCondition.path
+            if (!args.unifiedAccessControlCondition.path)
+                throw new Error('[did-provider-cheqd]: observe: unifiedAccessControlCondition.path is required');
+            // validate args - case: unifiedAccessControlCondition.conditionType
+            if (args.unifiedAccessControlCondition.conditionType !== 'cosmos')
+                throw new Error('[did-provider-cheqd]: observe: unifiedAccessControlCondition.conditionType must be cosmos');
+            // validate args - case: unifiedAccessControlCondition.method
+            if (args.unifiedAccessControlCondition.method !== 'timelock')
+                throw new Error('[did-provider-cheqd]: observe: unifiedAccessControlCondition.method must be timelock');
+            // validate args - case: unifiedAccessControlCondition.parameters
+            if (!args.unifiedAccessControlCondition.parameters || !Array.isArray(args.unifiedAccessControlCondition.parameters) || args.unifiedAccessControlCondition.parameters.length === 0 || args.unifiedAccessControlCondition.parameters.length > 1)
+                throw new Error('[did-provider-cheqd]: observe: unifiedAccessControlCondition.parameters is required and must be an array of length 1 of type string content');
+            // validate args - case: unifiedAccessControlCondition.returnValueTest
+            if (!args.unifiedAccessControlCondition.returnValueTest || !args.unifiedAccessControlCondition.returnValueTest.comparator || !args.unifiedAccessControlCondition.returnValueTest.key || !args.unifiedAccessControlCondition.returnValueTest.value)
+                throw new Error('[did-provider-cheqd]: observe: unifiedAccessControlCondition.returnValueTest is required');
             try {
                 // define network
                 const network = (function () {
@@ -1666,12 +1698,39 @@ export class Cheqd {
                             throw new Error(`[did-provider-cheqd]: observe: Unsupported chain: ${args.unifiedAccessControlCondition.chain}`);
                     }
                 }());
+                // get block height url
+                const blockHeightUrl = function () {
+                    switch (args.unifiedAccessControlCondition.parameters[0]) {
+                        case 'latest':
+                            return `${DefaultRESTUrls[network]}/cosmos/base/tendermint/v1beta1/blocks/latest`;
+                        default:
+                            return `${DefaultRESTUrls[network]}/cosmos/base/tendermint/v1beta1/blocks/${args.unifiedAccessControlCondition.parameters[0]}`;
+                    }
+                }();
+                // fetch block response
+                const blockHeightResponse = await (await fetch(blockHeightUrl)).json();
+                // get timestamp from block response
+                const blockTimestamp = Date.parse(blockHeightResponse.block.header.time);
                 // construct url
                 const url = `${DefaultRESTUrls[network]}${args.unifiedAccessControlCondition.path}`;
                 // fetch relevant txs
                 const txs = await (await fetch(url)).json();
-                // skim through txs for relevant events, in which case memoNonce is present and strict equals to the one provided
-                const meetsConditionTxIndex = txs?.txs?.findIndex(tx => unescapeUnicode(tx.body.memo) === unescapeUnicode(args.unifiedAccessControlCondition.returnValueTest.value));
+                // skim through txs for relevant events, in which case the transaction timestamp is within the defined interval in seconds, from the block timestamp
+                const meetsConditionTxIndex = txs?.tx_responses?.findIndex((tx) => {
+                    // get tx timestamp
+                    const txTimestamp = Date.parse(tx.timestamp);
+                    // calculate diff in seconds
+                    const diffInSeconds = Math.floor((blockTimestamp - txTimestamp) / 1000);
+                    // return meets condition
+                    switch (args.unifiedAccessControlCondition.returnValueTest.comparator) {
+                        case '<':
+                            return diffInSeconds < parseInt(args.unifiedAccessControlCondition.returnValueTest.value);
+                        case '<=':
+                            return diffInSeconds <= parseInt(args.unifiedAccessControlCondition.returnValueTest.value);
+                        default:
+                            throw new Error(`[did-provider-cheqd]: observe: Unsupported comparator: ${args.unifiedAccessControlCondition.returnValueTest.comparator}`);
+                    }
+                });
                 // define meetsCondition
                 const meetsCondition = (typeof meetsConditionTxIndex !== 'undefined' && meetsConditionTxIndex !== -1);
                 // return observation result
@@ -1693,10 +1752,6 @@ export class Cheqd {
                 };
             }
         }
-        // validate access control conditions components - case: senderAddress
-        if (!args.senderAddress) {
-            throw new Error('[did-provider-cheqd]: observation: senderAddress is required');
-        }
         // validate access control conditions components - case: recipientAddress
         if (!args.recipientAddress) {
             throw new Error('[did-provider-cheqd]: observation: recipientAddress is required');
@@ -1705,21 +1760,54 @@ export class Cheqd {
         if (!args.amount || !args.amount.amount || !args.amount.denom || args.amount.denom !== 'ncheq') {
             throw new Error('[did-provider-cheqd]: observation: amount is required, and must be an object with amount and denom valid string properties, amongst which denom must be `ncheq`');
         }
-        // validate access control conditions components - case: memoNonce
-        if (!args.memoNonce) {
-            throw new Error('[did-provider-cheqd]: observation: memoNonce is required');
+        // validate access control conditions components - case: intervalInSeconds
+        if (!args.intervalInSeconds) {
+            throw new Error('[did-provider-cheqd]: observation: intervalInSeconds is required');
+        }
+        // validate access control conditions components - case: comparator
+        if (!args.comparator || (args.comparator !== '<' && args.comparator !== '<=')) {
+            throw new Error('[did-provider-cheqd]: observation: comparator is required and must be either `<` or `<=`');
         }
         // validate access control conditions components - case: network
         if (!args.network) {
             throw new Error('[did-provider-cheqd]: observation: network is required');
         }
+        // define block height, if not provided
+        args.blockHeight ||= 'latest';
         try {
+            // get block height url
+            const blockHeightUrl = function () {
+                switch (args.blockHeight) {
+                    case 'latest':
+                        return `${DefaultRESTUrls[args.network]}/cosmos/base/tendermint/v1beta1/blocks/latest`;
+                    default:
+                        return `${DefaultRESTUrls[args.network]}/cosmos/base/tendermint/v1beta1/blocks/${args.blockHeight}`;
+                }
+            }();
+            // fetch block response
+            const blockHeightResponse = await (await fetch(blockHeightUrl)).json();
+            // get timestamp from block response
+            const blockTimestamp = Date.parse(blockHeightResponse.block.header.time);
             // otherwise, construct url, as per components
-            const url = `${DefaultRESTUrls[args.network]}/cosmos/tx/v1beta1/txs?events=transfer.recipient='${args.recipientAddress}'&events=transfer.sender='${args.senderAddress}'&events=transfer.amount='${args.amount.amount}${args.amount.denom}'`;
+            const url = `${DefaultRESTUrls[args.network]}/cosmos/tx/v1beta1/txs?events=transfer.recipient='${args.recipientAddress}'&events=transfer.amount='${args.amount.amount}${args.amount.denom}'&order_by=2&pagination.limit=1`;
             // fetch relevant txs
             const txs = await (await fetch(url)).json();
-            // skim through txs for relevant events, in which case memoNonce is present and strict equals to the one provided
-            const meetsConditionTxIndex = txs?.txs?.findIndex(tx => unescapeUnicode(tx.body.memo) === unescapeUnicode(args.memoNonce));
+            // skim through txs for relevant events, in which case the transaction timestamp is within the defined interval in seconds, from the block timestamp
+            const meetsConditionTxIndex = txs?.tx_responses?.findIndex((tx) => {
+                // get tx timestamp
+                const txTimestamp = Date.parse(tx.timestamp);
+                // calculate diff in seconds
+                const diffInSeconds = Math.floor((blockTimestamp - txTimestamp) / 1000);
+                // return meets condition
+                switch (args.comparator) {
+                    case '<':
+                        return diffInSeconds < args.intervalInSeconds;
+                    case '<=':
+                        return diffInSeconds <= args.intervalInSeconds;
+                    default:
+                        throw new Error(`[did-provider-cheqd]: observe: Unsupported comparator: ${args.unifiedAccessControlCondition.returnValueTest.comparator}`);
+                }
+            });
             // define meetsCondition
             const meetsCondition = (typeof meetsConditionTxIndex !== 'undefined' && meetsConditionTxIndex !== -1);
             // return observation result
@@ -1759,8 +1847,8 @@ export class Cheqd {
                         return publishedList.metadata.encoding === 'base64url'
                             ? publishedList.StatusList2021.encodedList
                             : toString(fromString(publishedList.StatusList2021.encodedList, publishedList.metadata.encoding), 'base64url');
-                    // otherwise, decrypt and return bitstring
-                    const scopedRawBlob = await toBlob(fromString(publishedList.StatusList2021.encodedList, publishedList.metadata.encoding));
+                    // otherwise, decrypt and return raw bitstring
+                    const scopedRawBlob = await toBlob(fromString(publishedList.StatusList2021.encodedList, 'hex'));
                     // decrypt
                     return await LitProtocol.decryptDirect(scopedRawBlob, fromString(options?.topArgs?.symmetricKey, 'hex'));
                 }())
@@ -1822,16 +1910,111 @@ export class Cheqd {
                     // publish status list 2021 as new version
                     const scoped = topArgs.publishEncrypted
                         ? (await async function () {
+                            // validate encoding, if provided
+                            if (options?.publishOptions?.statusListEncoding && !Object.values(DefaultStatusList2021Encodings).includes(options?.publishOptions?.statusListEncoding)) {
+                                throw new Error('[did-provider-cheqd]: revocation: Invalid status list encoding');
+                            }
+                            // validate validUntil, if provided
+                            if (options?.publishOptions?.statusListValidUntil) {
+                                // validate validUntil as string
+                                if (typeof options?.publishOptions?.statusListValidUntil !== 'string')
+                                    throw new Error('[did-provider-cheqd]: revocation: Invalid status list validUntil (must be string)');
+                                // validate validUntil as date
+                                if (isNaN(Date.parse(options?.publishOptions?.statusListValidUntil)))
+                                    throw new Error('[did-provider-cheqd]: revocation: Invalid status list validUntil (must be date)');
+                                // validate validUntil as future date
+                                if (new Date(options?.publishOptions?.statusListValidUntil) < new Date())
+                                    throw new Error('[did-provider-cheqd]: revocation: Invalid status list validUntil (must be future date)');
+                                // validate validUntil towards validFrom
+                                if (new Date(options?.publishOptions?.statusListValidUntil) <= new Date(publishedList.StatusList2021.validFrom))
+                                    throw new Error('[did-provider-cheqd]: revocation: Invalid status list validUntil (must be after validFrom)');
+                            }
+                            // validate paymentConditions, if provided
+                            if (topArgs?.paymentConditions) {
+                                if (!topArgs?.paymentConditions?.every((condition) => condition.feePaymentAddress && condition.feePaymentAmount && condition.intervalInSeconds)) {
+                                    throw new Error('[did-provider-cheqd]: paymentConditions must contain feePaymentAddress and feeAmount and intervalInSeconds');
+                                }
+                                if (!topArgs?.paymentConditions?.every((condition) => typeof condition.feePaymentAddress === 'string' && typeof condition.feePaymentAmount === 'string' && typeof condition.intervalInSeconds === 'number')) {
+                                    throw new Error('[did-provider-cheqd]: feePaymentAddress and feePaymentAmount must be string and intervalInSeconds must be number');
+                                }
+                                if (!topArgs?.paymentConditions?.every((condition) => condition.type === AccessControlConditionTypes.timelockPayment)) {
+                                    throw new Error('[did-provider-cheqd]: paymentConditions must be of type timelockPayment');
+                                }
+                            }
+                            // validate dkgOptions
+                            if (!topArgs?.dkgOptions || !topArgs?.dkgOptions?.chain || !topArgs?.dkgOptions?.network) {
+                                throw new Error('[did-provider-cheqd]: dkgOptions is required');
+                            }
                             // instantiate dkg-threshold client, in which case lit-protocol is used
                             const lit = await LitProtocol.create({
-                                chain: options?.topArgs?.bootstrapOptions?.chain,
-                                litNetwork: options?.topArgs?.bootstrapOptions?.litNetwork
+                                chain: topArgs?.dkgOptions?.chain,
+                                litNetwork: topArgs?.dkgOptions?.network
                             });
-                            // encrypt
-                            const { encryptedString, encryptedSymmetricKey, symmetricKey } = await lit.encrypt(bitstring, options?.topArgs?.encryptionOptions?.unifiedAccessControlConditions, true);
+                            // construct access control conditions and payment conditions tuple
+                            const unifiedAccessControlConditionsTuple = publishedList.metadata.encrypted
+                                ? (await (async function () {
+                                    // define payment conditions, give precedence to top-level args
+                                    const paymentConditions = topArgs?.paymentConditions || publishedList.metadata.paymentConditions;
+                                    // return access control conditions and payment conditions tuple
+                                    return [
+                                        await Promise.all(paymentConditions.map(async (condition) => {
+                                            switch (condition.type) {
+                                                case AccessControlConditionTypes.timelockPayment:
+                                                    return await LitProtocol.generateCosmosAccessControlConditionInverseTimelock({
+                                                        key: '$.tx_responses.*.timestamp',
+                                                        comparator: '<=',
+                                                        value: `${condition.intervalInSeconds}`,
+                                                    }, condition.feePaymentAmount, condition.feePaymentAddress, condition?.blockHeight, topArgs?.dkgOptions?.chain);
+                                                default:
+                                                    throw new Error(`[did-provider-cheqd]: unsupported access control condition type ${condition.type}`);
+                                            }
+                                        })),
+                                        paymentConditions
+                                    ];
+                                }()))
+                                : (await (async function () {
+                                    // validate paymentConditions
+                                    if (!topArgs?.paymentConditions) {
+                                        throw new Error('[did-provider-cheqd]: paymentConditions is required');
+                                    }
+                                    // return access control conditions and payment conditions tuple
+                                    return [
+                                        await Promise.all(topArgs.paymentConditions.map(async (condition) => {
+                                            switch (condition.type) {
+                                                case AccessControlConditionTypes.timelockPayment:
+                                                    return await LitProtocol.generateCosmosAccessControlConditionInverseTimelock({
+                                                        key: '$.tx_responses.*.timestamp',
+                                                        comparator: '<=',
+                                                        value: `${condition.intervalInSeconds}`,
+                                                    }, condition.feePaymentAmount, condition.feePaymentAddress, condition?.blockHeight);
+                                                default:
+                                                    throw new Error(`[did-provider-cheqd]: unsupported access control condition type ${condition.type}`);
+                                            }
+                                        })),
+                                        topArgs.paymentConditions
+                                    ];
+                                }()));
+                            // encrypt bitstring
+                            const { encryptedString, encryptedSymmetricKey, symmetricKey } = await lit.encrypt(bitstring, unifiedAccessControlConditionsTuple[0], true);
+                            // define status list content
+                            const content = {
+                                StatusList2021: {
+                                    statusPurpose: publishedList.StatusList2021.statusPurpose,
+                                    encodedList: await blobToHexString(encryptedString),
+                                    validFrom: publishedList.StatusList2021.validFrom,
+                                    validUntil: options?.publishOptions?.statusListValidUntil || publishedList.StatusList2021.validUntil
+                                },
+                                metadata: {
+                                    type: publishedList.metadata.type,
+                                    encrypted: true,
+                                    encoding: options?.publishOptions?.statusListEncoding || publishedList.metadata.encoding,
+                                    encryptedSymmetricKey,
+                                    paymentConditions: unifiedAccessControlConditionsTuple[1]
+                                }
+                            };
                             // return tuple of publish result and encryption relevant metadata
                             return [
-                                await Cheqd.publishStatusList2021(new Uint8Array(await encryptedString.arrayBuffer()), statusListMetadata, options?.publishOptions),
+                                await Cheqd.publishStatusList2021(fromString(JSON.stringify(content), 'utf-8'), statusListMetadata, options?.publishOptions),
                                 { encryptedString, encryptedSymmetricKey, symmetricKey: toString(symmetricKey, 'hex') }
                             ];
                         }())
@@ -1886,8 +2069,6 @@ export class Cheqd {
                 revoked: true,
                 published: topArgs?.publish ? true : undefined,
                 statusList: topArgs?.returnUpdatedStatusList ? await Cheqd.fetchStatusList2021(credential) : undefined,
-                encryptedStatusList: topArgs?.returnUpdatedEncryptedStatusList ? await blobToHexString(published?.[1]?.encryptedString) : undefined,
-                encryptedSymmetricKey: topArgs?.returnEncryptedSymmetricKey ? published?.[1]?.encryptedSymmetricKey : undefined,
                 symmetricKey: topArgs?.returnSymmetricKey ? published?.[1]?.symmetricKey : undefined,
                 resourceMetadata: topArgs?.returnStatusListMetadata ? await Cheqd.fetchStatusList2021Metadata(credential) : undefined
             };
@@ -1945,8 +2126,8 @@ export class Cheqd {
                         return publishedList.metadata.encoding === 'base64url'
                             ? publishedList.StatusList2021.encodedList
                             : toString(fromString(publishedList.StatusList2021.encodedList, publishedList.metadata.encoding), 'base64url');
-                    // otherwise, decrypt and return bitstring
-                    const scopedRawBlob = await toBlob(fromString(publishedList.StatusList2021.encodedList, publishedList.metadata.encoding));
+                    // otherwise, decrypt and return raw bitstring
+                    const scopedRawBlob = await toBlob(fromString(publishedList.StatusList2021.encodedList, 'hex'));
                     // decrypt
                     return await LitProtocol.decryptDirect(scopedRawBlob, fromString(options?.topArgs?.symmetricKey, 'hex'));
                 }())
@@ -2021,16 +2202,111 @@ export class Cheqd {
                     // publish status list 2021 as new version
                     const scoped = topArgs.publishEncrypted
                         ? (await async function () {
+                            // validate encoding, if provided
+                            if (options?.publishOptions?.statusListEncoding && !Object.values(DefaultStatusList2021Encodings).includes(options?.publishOptions?.statusListEncoding)) {
+                                throw new Error('[did-provider-cheqd]: revocation: Invalid status list encoding');
+                            }
+                            // validate validUntil, if provided
+                            if (options?.publishOptions?.statusListValidUntil) {
+                                // validate validUntil as string
+                                if (typeof options?.publishOptions?.statusListValidUntil !== 'string')
+                                    throw new Error('[did-provider-cheqd]: revocation: Invalid status list validUntil (must be string)');
+                                // validate validUntil as date
+                                if (isNaN(Date.parse(options?.publishOptions?.statusListValidUntil)))
+                                    throw new Error('[did-provider-cheqd]: revocation: Invalid status list validUntil (must be date)');
+                                // validate validUntil as future date
+                                if (new Date(options?.publishOptions?.statusListValidUntil) < new Date())
+                                    throw new Error('[did-provider-cheqd]: revocation: Invalid status list validUntil (must be future date)');
+                                // validate validUntil towards validFrom
+                                if (new Date(options?.publishOptions?.statusListValidUntil) <= new Date(publishedList.StatusList2021.validFrom))
+                                    throw new Error('[did-provider-cheqd]: revocation: Invalid status list validUntil (must be after validFrom)');
+                            }
+                            // validate paymentConditions, if provided
+                            if (topArgs?.paymentConditions) {
+                                if (!topArgs?.paymentConditions?.every((condition) => condition.feePaymentAddress && condition.feePaymentAmount && condition.intervalInSeconds)) {
+                                    throw new Error('[did-provider-cheqd]: paymentConditions must contain feePaymentAddress and feeAmount and intervalInSeconds');
+                                }
+                                if (!topArgs?.paymentConditions?.every((condition) => typeof condition.feePaymentAddress === 'string' && typeof condition.feePaymentAmount === 'string' && typeof condition.intervalInSeconds === 'number')) {
+                                    throw new Error('[did-provider-cheqd]: feePaymentAddress and feePaymentAmount must be string and intervalInSeconds must be number');
+                                }
+                                if (!topArgs?.paymentConditions?.every((condition) => condition.type === AccessControlConditionTypes.timelockPayment)) {
+                                    throw new Error('[did-provider-cheqd]: paymentConditions must be of type timelockPayment');
+                                }
+                            }
+                            // validate dkgOptions
+                            if (!topArgs?.dkgOptions || !topArgs?.dkgOptions?.chain || !topArgs?.dkgOptions?.network) {
+                                throw new Error('[did-provider-cheqd]: dkgOptions is required');
+                            }
                             // instantiate dkg-threshold client, in which case lit-protocol is used
                             const lit = await LitProtocol.create({
-                                chain: options?.topArgs?.bootstrapOptions?.chain,
-                                litNetwork: options?.topArgs?.bootstrapOptions?.litNetwork
+                                chain: topArgs?.dkgOptions?.chain,
+                                litNetwork: topArgs?.dkgOptions?.network
                             });
-                            // encrypt
-                            const { encryptedString, encryptedSymmetricKey, symmetricKey } = await lit.encrypt(bitstring, options?.topArgs?.encryptionOptions?.unifiedAccessControlConditions, true);
+                            // construct access control conditions and payment conditions tuple
+                            const unifiedAccessControlConditionsTuple = publishedList.metadata.encrypted
+                                ? (await (async function () {
+                                    // define payment conditions, give precedence to top-level args
+                                    const paymentConditions = topArgs?.paymentConditions || publishedList.metadata.paymentConditions;
+                                    // return access control conditions and payment conditions tuple
+                                    return [
+                                        await Promise.all(paymentConditions.map(async (condition) => {
+                                            switch (condition.type) {
+                                                case AccessControlConditionTypes.timelockPayment:
+                                                    return await LitProtocol.generateCosmosAccessControlConditionInverseTimelock({
+                                                        key: '$.tx_responses.*.timestamp',
+                                                        comparator: '<=',
+                                                        value: `${condition.intervalInSeconds}`,
+                                                    }, condition.feePaymentAmount, condition.feePaymentAddress, condition?.blockHeight, topArgs?.dkgOptions?.chain);
+                                                default:
+                                                    throw new Error(`[did-provider-cheqd]: unsupported access control condition type ${condition.type}`);
+                                            }
+                                        })),
+                                        paymentConditions
+                                    ];
+                                }()))
+                                : (await (async function () {
+                                    // validate paymentConditions
+                                    if (!topArgs?.paymentConditions) {
+                                        throw new Error('[did-provider-cheqd]: paymentConditions is required');
+                                    }
+                                    // return access control conditions and payment conditions tuple
+                                    return [
+                                        await Promise.all(topArgs.paymentConditions.map(async (condition) => {
+                                            switch (condition.type) {
+                                                case AccessControlConditionTypes.timelockPayment:
+                                                    return await LitProtocol.generateCosmosAccessControlConditionInverseTimelock({
+                                                        key: '$.tx_responses.*.timestamp',
+                                                        comparator: '<=',
+                                                        value: `${condition.intervalInSeconds}`,
+                                                    }, condition.feePaymentAmount, condition.feePaymentAddress, condition?.blockHeight);
+                                                default:
+                                                    throw new Error(`[did-provider-cheqd]: unsupported access control condition type ${condition.type}`);
+                                            }
+                                        })),
+                                        topArgs.paymentConditions
+                                    ];
+                                }()));
+                            // encrypt bitstring
+                            const { encryptedString, encryptedSymmetricKey, symmetricKey } = await lit.encrypt(bitstring, unifiedAccessControlConditionsTuple[0], true);
+                            // define status list content
+                            const content = {
+                                StatusList2021: {
+                                    statusPurpose: publishedList.StatusList2021.statusPurpose,
+                                    encodedList: await blobToHexString(encryptedString),
+                                    validFrom: publishedList.StatusList2021.validFrom,
+                                    validUntil: options?.publishOptions?.statusListValidUntil || publishedList.StatusList2021.validUntil
+                                },
+                                metadata: {
+                                    type: publishedList.metadata.type,
+                                    encrypted: true,
+                                    encoding: options?.publishOptions?.statusListEncoding || publishedList.metadata.encoding,
+                                    encryptedSymmetricKey,
+                                    paymentConditions: unifiedAccessControlConditionsTuple[1]
+                                }
+                            };
                             // return tuple of publish result and encryption relevant metadata
                             return [
-                                await Cheqd.publishStatusList2021(new Uint8Array(await encryptedString.arrayBuffer()), statusListMetadata, options?.publishOptions),
+                                await Cheqd.publishStatusList2021(fromString(JSON.stringify(content), 'utf-8'), statusListMetadata, options?.publishOptions),
                                 { encryptedString, encryptedSymmetricKey, symmetricKey: toString(symmetricKey, 'hex') }
                             ];
                         }())
@@ -2085,8 +2361,6 @@ export class Cheqd {
                 revoked: revoked.map((result) => result.status === 'fulfilled' ? result.value.revoked : false),
                 published: topArgs?.publish ? true : undefined,
                 statusList: topArgs?.returnUpdatedStatusList ? await Cheqd.fetchStatusList2021(credentials[0]) : undefined,
-                encryptedStatusList: topArgs?.returnUpdatedEncryptedStatusList ? await blobToHexString(published?.[1]?.encryptedString) : undefined,
-                encryptedSymmetricKey: topArgs?.returnEncryptedSymmetricKey ? published?.[1]?.encryptedSymmetricKey : undefined,
                 symmetricKey: topArgs?.returnSymmetricKey ? published?.[1]?.symmetricKey : undefined,
                 resourceMetadata: topArgs?.returnStatusListMetadata ? await Cheqd.fetchStatusList2021Metadata(credentials[0]) : undefined
             };
@@ -2115,8 +2389,8 @@ export class Cheqd {
                         return publishedList.metadata.encoding === 'base64url'
                             ? publishedList.StatusList2021.encodedList
                             : toString(fromString(publishedList.StatusList2021.encodedList, publishedList.metadata.encoding), 'base64url');
-                    // otherwise, decrypt and return bitstring
-                    const scopedRawBlob = await toBlob(await Cheqd.fetchStatusList2021(credential, true));
+                    // otherwise, decrypt and return raw bitstring
+                    const scopedRawBlob = await toBlob(fromString(publishedList.StatusList2021.encodedList, 'hex'));
                     // decrypt
                     return await LitProtocol.decryptDirect(scopedRawBlob, fromString(options?.topArgs?.symmetricKey, 'hex'));
                 }())
@@ -2133,7 +2407,7 @@ export class Cheqd {
                             const encoded = new StatusList({ buffer: await Cheqd.getFile(options.statusListFile) }).encode();
                             // validate against published list
                             if (encoded !== publishedListTranscoded)
-                                throw new Error('[did-provider-cheqd]: revocation: statusListFile does not match published status list 2021');
+                                throw new Error('[did-provider-cheqd]: suspension: statusListFile does not match published status list 2021');
                             // return encoded
                             return encoded;
                         }
@@ -2143,15 +2417,15 @@ export class Cheqd {
                         const decrypted = await LitProtocol.decryptDirect(scopedRawBlob, fromString(options?.topArgs?.symmetricKey, 'hex'));
                         // validate against published list
                         if (decrypted !== publishedListTranscoded)
-                            throw new Error('[did-provider-cheqd]: revocation: statusListFile does not match published status list 2021');
+                            throw new Error('[did-provider-cheqd]: suspension: statusListFile does not match published status list 2021');
                         // return decrypted
                         return decrypted;
                     }
                     if (!options?.statusListInlineBitstring)
-                        throw new Error('[did-provider-cheqd]: revocation: statusListInlineBitstring is required, if statusListFile is not provided');
+                        throw new Error('[did-provider-cheqd]: suspension: statusListInlineBitstring is required, if statusListFile is not provided');
                     // validate against published list
                     if (options?.statusListInlineBitstring !== publishedListTranscoded)
-                        throw new Error('[did-provider-cheqd]: revocation: statusListInlineBitstring does not match published status list 2021');
+                        throw new Error('[did-provider-cheqd]: suspension: statusListInlineBitstring does not match published status list 2021');
                     // otherwise, read from inline bitstring
                     return options?.statusListInlineBitstring;
                 }());
@@ -2178,38 +2452,133 @@ export class Cheqd {
                     // publish status list 2021 as new version
                     const scoped = topArgs.publishEncrypted
                         ? (await async function () {
+                            // validate encoding, if provided
+                            if (options?.publishOptions?.statusListEncoding && !Object.values(DefaultStatusList2021Encodings).includes(options?.publishOptions?.statusListEncoding)) {
+                                throw new Error('[did-provider-cheqd]: suspension: Invalid status list encoding');
+                            }
+                            // validate validUntil, if provided
+                            if (options?.publishOptions?.statusListValidUntil) {
+                                // validate validUntil as string
+                                if (typeof options?.publishOptions?.statusListValidUntil !== 'string')
+                                    throw new Error('[did-provider-cheqd]: suspension: Invalid status list validUntil (must be string)');
+                                // validate validUntil as date
+                                if (isNaN(Date.parse(options?.publishOptions?.statusListValidUntil)))
+                                    throw new Error('[did-provider-cheqd]: suspension: Invalid status list validUntil (must be date)');
+                                // validate validUntil as future date
+                                if (new Date(options?.publishOptions?.statusListValidUntil) < new Date())
+                                    throw new Error('[did-provider-cheqd]: suspension: Invalid status list validUntil (must be future date)');
+                                // validate validUntil towards validFrom
+                                if (new Date(options?.publishOptions?.statusListValidUntil) <= new Date(publishedList.StatusList2021.validFrom))
+                                    throw new Error('[did-provider-cheqd]: suspension: Invalid status list validUntil (must be after validFrom)');
+                            }
+                            // validate paymentConditions, if provided
+                            if (topArgs?.paymentConditions) {
+                                if (!topArgs?.paymentConditions?.every((condition) => condition.feePaymentAddress && condition.feePaymentAmount && condition.intervalInSeconds)) {
+                                    throw new Error('[did-provider-cheqd]: paymentConditions must contain feePaymentAddress and feeAmount and intervalInSeconds');
+                                }
+                                if (!topArgs?.paymentConditions?.every((condition) => typeof condition.feePaymentAddress === 'string' && typeof condition.feePaymentAmount === 'string' && typeof condition.intervalInSeconds === 'number')) {
+                                    throw new Error('[did-provider-cheqd]: feePaymentAddress and feePaymentAmount must be string and intervalInSeconds must be number');
+                                }
+                                if (!topArgs?.paymentConditions?.every((condition) => condition.type === AccessControlConditionTypes.timelockPayment)) {
+                                    throw new Error('[did-provider-cheqd]: paymentConditions must be of type timelockPayment');
+                                }
+                            }
+                            // validate dkgOptions
+                            if (!topArgs?.dkgOptions || !topArgs?.dkgOptions?.chain || !topArgs?.dkgOptions?.network) {
+                                throw new Error('[did-provider-cheqd]: dkgOptions is required');
+                            }
                             // instantiate dkg-threshold client, in which case lit-protocol is used
                             const lit = await LitProtocol.create({
-                                chain: options?.topArgs?.bootstrapOptions?.chain,
-                                litNetwork: options?.topArgs?.bootstrapOptions?.litNetwork
+                                chain: topArgs?.dkgOptions?.chain,
+                                litNetwork: topArgs?.dkgOptions?.network
                             });
-                            // encrypt
-                            const { encryptedString, encryptedSymmetricKey, symmetricKey } = await lit.encrypt(bitstring, options?.topArgs?.encryptionOptions?.unifiedAccessControlConditions, true);
+                            // construct access control conditions and payment conditions tuple
+                            const unifiedAccessControlConditionsTuple = publishedList.metadata.encrypted
+                                ? (await (async function () {
+                                    // define payment conditions, give precedence to top-level args
+                                    const paymentConditions = topArgs?.paymentConditions || publishedList.metadata.paymentConditions;
+                                    // return access control conditions and payment conditions tuple
+                                    return [
+                                        await Promise.all(paymentConditions.map(async (condition) => {
+                                            switch (condition.type) {
+                                                case AccessControlConditionTypes.timelockPayment:
+                                                    return await LitProtocol.generateCosmosAccessControlConditionInverseTimelock({
+                                                        key: '$.tx_responses.*.timestamp',
+                                                        comparator: '<=',
+                                                        value: `${condition.intervalInSeconds}`,
+                                                    }, condition.feePaymentAmount, condition.feePaymentAddress, condition?.blockHeight, topArgs?.dkgOptions?.chain);
+                                                default:
+                                                    throw new Error(`[did-provider-cheqd]: unsupported access control condition type ${condition.type}`);
+                                            }
+                                        })),
+                                        paymentConditions
+                                    ];
+                                }()))
+                                : (await (async function () {
+                                    // validate paymentConditions
+                                    if (!topArgs?.paymentConditions) {
+                                        throw new Error('[did-provider-cheqd]: paymentConditions is required');
+                                    }
+                                    // return access control conditions and payment conditions tuple
+                                    return [
+                                        await Promise.all(topArgs.paymentConditions.map(async (condition) => {
+                                            switch (condition.type) {
+                                                case AccessControlConditionTypes.timelockPayment:
+                                                    return await LitProtocol.generateCosmosAccessControlConditionInverseTimelock({
+                                                        key: '$.tx_responses.*.timestamp',
+                                                        comparator: '<=',
+                                                        value: `${condition.intervalInSeconds}`,
+                                                    }, condition.feePaymentAmount, condition.feePaymentAddress, condition?.blockHeight);
+                                                default:
+                                                    throw new Error(`[did-provider-cheqd]: unsupported access control condition type ${condition.type}`);
+                                            }
+                                        })),
+                                        topArgs.paymentConditions
+                                    ];
+                                }()));
+                            // encrypt bitstring
+                            const { encryptedString, encryptedSymmetricKey, symmetricKey } = await lit.encrypt(bitstring, unifiedAccessControlConditionsTuple[0], true);
+                            // define status list content
+                            const content = {
+                                StatusList2021: {
+                                    statusPurpose: publishedList.StatusList2021.statusPurpose,
+                                    encodedList: await blobToHexString(encryptedString),
+                                    validFrom: publishedList.StatusList2021.validFrom,
+                                    validUntil: options?.publishOptions?.statusListValidUntil || publishedList.StatusList2021.validUntil
+                                },
+                                metadata: {
+                                    type: publishedList.metadata.type,
+                                    encrypted: true,
+                                    encoding: options?.publishOptions?.statusListEncoding || publishedList.metadata.encoding,
+                                    encryptedSymmetricKey,
+                                    paymentConditions: unifiedAccessControlConditionsTuple[1]
+                                }
+                            };
                             // return tuple of publish result and encryption relevant metadata
                             return [
-                                await Cheqd.publishStatusList2021(new Uint8Array(await encryptedString.arrayBuffer()), statusListMetadata, options?.publishOptions),
+                                await Cheqd.publishStatusList2021(fromString(JSON.stringify(content), 'utf-8'), statusListMetadata, options?.publishOptions),
                                 { encryptedString, encryptedSymmetricKey, symmetricKey: toString(symmetricKey, 'hex') }
                             ];
                         }())
                         : (await async function () {
                             // validate encoding, if provided
                             if (options?.publishOptions?.statusListEncoding && !Object.values(DefaultStatusList2021Encodings).includes(options?.publishOptions?.statusListEncoding)) {
-                                throw new Error('[did-provider-cheqd]: revocation: Invalid status list encoding');
+                                throw new Error('[did-provider-cheqd]: suspension: Invalid status list encoding');
                             }
                             // validate validUntil, if provided
                             if (options?.publishOptions?.statusListValidUntil) {
                                 // validate validUntil as string
                                 if (typeof options?.publishOptions?.statusListValidUntil !== 'string')
-                                    throw new Error('[did-provider-cheqd]: revocation: Invalid status list validUntil (must be string)');
+                                    throw new Error('[did-provider-cheqd]: suspension: Invalid status list validUntil (must be string)');
                                 // validate validUntil as date
                                 if (isNaN(Date.parse(options?.publishOptions?.statusListValidUntil)))
-                                    throw new Error('[did-provider-cheqd]: revocation: Invalid status list validUntil (must be date)');
+                                    throw new Error('[did-provider-cheqd]: suspension: Invalid status list validUntil (must be date)');
                                 // validate validUntil as future date
                                 if (new Date(options?.publishOptions?.statusListValidUntil) < new Date())
-                                    throw new Error('[did-provider-cheqd]: revocation: Invalid status list validUntil (must be future date)');
+                                    throw new Error('[did-provider-cheqd]: suspension: Invalid status list validUntil (must be future date)');
                                 // validate validUntil towards validFrom
                                 if (new Date(options?.publishOptions?.statusListValidUntil) <= new Date(publishedList.StatusList2021.validFrom))
-                                    throw new Error('[did-provider-cheqd]: revocation: Invalid status list validUntil (must be after validFrom)');
+                                    throw new Error('[did-provider-cheqd]: suspension: Invalid status list validUntil (must be after validFrom)');
                             }
                             // define status list content
                             const content = {
@@ -2242,8 +2611,6 @@ export class Cheqd {
                 suspended: true,
                 published: topArgs?.publish ? true : undefined,
                 statusList: topArgs?.returnUpdatedStatusList ? await Cheqd.fetchStatusList2021(credential) : undefined,
-                encryptedStatusList: topArgs?.returnUpdatedEncryptedStatusList ? await blobToHexString(published?.[1]?.encryptedString) : undefined,
-                encryptedSymmetricKey: topArgs?.returnEncryptedSymmetricKey ? published?.[1]?.encryptedSymmetricKey : undefined,
                 symmetricKey: topArgs?.returnSymmetricKey ? published?.[1]?.symmetricKey : undefined,
                 resourceMetadata: topArgs?.returnStatusListMetadata ? await Cheqd.fetchStatusList2021Metadata(credential) : undefined
             };
@@ -2301,8 +2668,8 @@ export class Cheqd {
                         return publishedList.metadata.encoding === 'base64url'
                             ? publishedList.StatusList2021.encodedList
                             : toString(fromString(publishedList.StatusList2021.encodedList, publishedList.metadata.encoding), 'base64url');
-                    // otherwise, decrypt and return bitstring
-                    const scopedRawBlob = await toBlob(await Cheqd.fetchStatusList2021(credentials[0], true));
+                    // otherwise, decrypt and return raw bitstring
+                    const scopedRawBlob = await toBlob(fromString(publishedList.StatusList2021.encodedList, 'hex'));
                     // decrypt
                     return await LitProtocol.decryptDirect(scopedRawBlob, fromString(options?.topArgs?.symmetricKey, 'hex'));
                 }())
@@ -2319,7 +2686,7 @@ export class Cheqd {
                             const encoded = new StatusList({ buffer: await Cheqd.getFile(options.statusListFile) }).encode();
                             // validate against published list
                             if (encoded !== publishedListTranscoded)
-                                throw new Error('[did-provider-cheqd]: revocation: statusListFile does not match published status list 2021');
+                                throw new Error('[did-provider-cheqd]: suspension: statusListFile does not match published status list 2021');
                             // return encoded
                             return encoded;
                         }
@@ -2329,15 +2696,15 @@ export class Cheqd {
                         const decrypted = await LitProtocol.decryptDirect(scopedRawBlob, fromString(options?.topArgs?.symmetricKey, 'hex'));
                         // validate against published list
                         if (decrypted !== publishedListTranscoded)
-                            throw new Error('[did-provider-cheqd]: revocation: statusListFile does not match published status list 2021');
+                            throw new Error('[did-provider-cheqd]: suspension: statusListFile does not match published status list 2021');
                         // return decrypted
                         return decrypted;
                     }
                     if (!options?.statusListInlineBitstring)
-                        throw new Error('[did-provider-cheqd]: revocation: statusListInlineBitstring is required, if statusListFile is not provided');
+                        throw new Error('[did-provider-cheqd]: suspension: statusListInlineBitstring is required, if statusListFile is not provided');
                     // validate against published list
                     if (options?.statusListInlineBitstring !== publishedListTranscoded)
-                        throw new Error('[did-provider-cheqd]: revocation: statusListInlineBitstring does not match published status list 2021');
+                        throw new Error('[did-provider-cheqd]: suspension: statusListInlineBitstring does not match published status list 2021');
                     // otherwise, read from inline bitstring
                     return options?.statusListInlineBitstring;
                 }());
@@ -2377,38 +2744,133 @@ export class Cheqd {
                     // publish status list 2021 as new version
                     const scoped = topArgs.publishEncrypted
                         ? (await async function () {
+                            // validate encoding, if provided
+                            if (options?.publishOptions?.statusListEncoding && !Object.values(DefaultStatusList2021Encodings).includes(options?.publishOptions?.statusListEncoding)) {
+                                throw new Error('[did-provider-cheqd]: suspension: Invalid status list encoding');
+                            }
+                            // validate validUntil, if provided
+                            if (options?.publishOptions?.statusListValidUntil) {
+                                // validate validUntil as string
+                                if (typeof options?.publishOptions?.statusListValidUntil !== 'string')
+                                    throw new Error('[did-provider-cheqd]: suspension: Invalid status list validUntil (must be string)');
+                                // validate validUntil as date
+                                if (isNaN(Date.parse(options?.publishOptions?.statusListValidUntil)))
+                                    throw new Error('[did-provider-cheqd]: suspension: Invalid status list validUntil (must be date)');
+                                // validate validUntil as future date
+                                if (new Date(options?.publishOptions?.statusListValidUntil) < new Date())
+                                    throw new Error('[did-provider-cheqd]: suspension: Invalid status list validUntil (must be future date)');
+                                // validate validUntil towards validFrom
+                                if (new Date(options?.publishOptions?.statusListValidUntil) <= new Date(publishedList.StatusList2021.validFrom))
+                                    throw new Error('[did-provider-cheqd]: suspension: Invalid status list validUntil (must be after validFrom)');
+                            }
+                            // validate paymentConditions, if provided
+                            if (topArgs?.paymentConditions) {
+                                if (!topArgs?.paymentConditions?.every((condition) => condition.feePaymentAddress && condition.feePaymentAmount && condition.intervalInSeconds)) {
+                                    throw new Error('[did-provider-cheqd]: paymentConditions must contain feePaymentAddress and feeAmount and intervalInSeconds');
+                                }
+                                if (!topArgs?.paymentConditions?.every((condition) => typeof condition.feePaymentAddress === 'string' && typeof condition.feePaymentAmount === 'string' && typeof condition.intervalInSeconds === 'number')) {
+                                    throw new Error('[did-provider-cheqd]: feePaymentAddress and feePaymentAmount must be string and intervalInSeconds must be number');
+                                }
+                                if (!topArgs?.paymentConditions?.every((condition) => condition.type === AccessControlConditionTypes.timelockPayment)) {
+                                    throw new Error('[did-provider-cheqd]: paymentConditions must be of type timelockPayment');
+                                }
+                            }
+                            // validate dkgOptions
+                            if (!topArgs?.dkgOptions || !topArgs?.dkgOptions?.chain || !topArgs?.dkgOptions?.network) {
+                                throw new Error('[did-provider-cheqd]: dkgOptions is required');
+                            }
                             // instantiate dkg-threshold client, in which case lit-protocol is used
                             const lit = await LitProtocol.create({
-                                chain: options?.topArgs?.bootstrapOptions?.chain,
-                                litNetwork: options?.topArgs?.bootstrapOptions?.litNetwork
+                                chain: topArgs?.dkgOptions?.chain,
+                                litNetwork: topArgs?.dkgOptions?.network
                             });
-                            // encrypt
-                            const { encryptedString, encryptedSymmetricKey, symmetricKey } = await lit.encrypt(bitstring, options?.topArgs?.encryptionOptions?.unifiedAccessControlConditions, true);
+                            // construct access control conditions and payment conditions tuple
+                            const unifiedAccessControlConditionsTuple = publishedList.metadata.encrypted
+                                ? (await (async function () {
+                                    // define payment conditions, give precedence to top-level args
+                                    const paymentConditions = topArgs?.paymentConditions || publishedList.metadata.paymentConditions;
+                                    // return access control conditions and payment conditions tuple
+                                    return [
+                                        await Promise.all(paymentConditions.map(async (condition) => {
+                                            switch (condition.type) {
+                                                case AccessControlConditionTypes.timelockPayment:
+                                                    return await LitProtocol.generateCosmosAccessControlConditionInverseTimelock({
+                                                        key: '$.tx_responses.*.timestamp',
+                                                        comparator: '<=',
+                                                        value: `${condition.intervalInSeconds}`,
+                                                    }, condition.feePaymentAmount, condition.feePaymentAddress, condition?.blockHeight, topArgs?.dkgOptions?.chain);
+                                                default:
+                                                    throw new Error(`[did-provider-cheqd]: unsupported access control condition type ${condition.type}`);
+                                            }
+                                        })),
+                                        paymentConditions
+                                    ];
+                                }()))
+                                : (await (async function () {
+                                    // validate paymentConditions
+                                    if (!topArgs?.paymentConditions) {
+                                        throw new Error('[did-provider-cheqd]: paymentConditions is required');
+                                    }
+                                    // return access control conditions and payment conditions tuple
+                                    return [
+                                        await Promise.all(topArgs.paymentConditions.map(async (condition) => {
+                                            switch (condition.type) {
+                                                case AccessControlConditionTypes.timelockPayment:
+                                                    return await LitProtocol.generateCosmosAccessControlConditionInverseTimelock({
+                                                        key: '$.tx_responses.*.timestamp',
+                                                        comparator: '<=',
+                                                        value: `${condition.intervalInSeconds}`,
+                                                    }, condition.feePaymentAmount, condition.feePaymentAddress, condition?.blockHeight);
+                                                default:
+                                                    throw new Error(`[did-provider-cheqd]: unsupported access control condition type ${condition.type}`);
+                                            }
+                                        })),
+                                        topArgs.paymentConditions
+                                    ];
+                                }()));
+                            // encrypt bitstring
+                            const { encryptedString, encryptedSymmetricKey, symmetricKey } = await lit.encrypt(bitstring, unifiedAccessControlConditionsTuple[0], true);
+                            // define status list content
+                            const content = {
+                                StatusList2021: {
+                                    statusPurpose: publishedList.StatusList2021.statusPurpose,
+                                    encodedList: await blobToHexString(encryptedString),
+                                    validFrom: publishedList.StatusList2021.validFrom,
+                                    validUntil: options?.publishOptions?.statusListValidUntil || publishedList.StatusList2021.validUntil
+                                },
+                                metadata: {
+                                    type: publishedList.metadata.type,
+                                    encrypted: true,
+                                    encoding: options?.publishOptions?.statusListEncoding || publishedList.metadata.encoding,
+                                    encryptedSymmetricKey,
+                                    paymentConditions: unifiedAccessControlConditionsTuple[1]
+                                }
+                            };
                             // return tuple of publish result and encryption relevant metadata
                             return [
-                                await Cheqd.publishStatusList2021(new Uint8Array(await encryptedString.arrayBuffer()), statusListMetadata, options?.publishOptions),
+                                await Cheqd.publishStatusList2021(fromString(JSON.stringify(content), 'utf-8'), statusListMetadata, options?.publishOptions),
                                 { encryptedString, encryptedSymmetricKey, symmetricKey: toString(symmetricKey, 'hex') }
                             ];
                         }())
                         : (await async function () {
                             // validate encoding, if provided
                             if (options?.publishOptions?.statusListEncoding && !Object.values(DefaultStatusList2021Encodings).includes(options?.publishOptions?.statusListEncoding)) {
-                                throw new Error('[did-provider-cheqd]: revocation: Invalid status list encoding');
+                                throw new Error('[did-provider-cheqd]: suspension: Invalid status list encoding');
                             }
                             // validate validUntil, if provided
                             if (options?.publishOptions?.statusListValidUntil) {
                                 // validate validUntil as string
                                 if (typeof options?.publishOptions?.statusListValidUntil !== 'string')
-                                    throw new Error('[did-provider-cheqd]: revocation: Invalid status list validUntil (must be string)');
+                                    throw new Error('[did-provider-cheqd]: suspension: Invalid status list validUntil (must be string)');
                                 // validate validUntil as date
                                 if (isNaN(Date.parse(options?.publishOptions?.statusListValidUntil)))
-                                    throw new Error('[did-provider-cheqd]: revocation: Invalid status list validUntil (must be date)');
+                                    throw new Error('[did-provider-cheqd]: suspension: Invalid status list validUntil (must be date)');
                                 // validate validUntil as future date
                                 if (new Date(options?.publishOptions?.statusListValidUntil) < new Date())
-                                    throw new Error('[did-provider-cheqd]: revocation: Invalid status list validUntil (must be future date)');
+                                    throw new Error('[did-provider-cheqd]: suspension: Invalid status list validUntil (must be future date)');
                                 // validate validUntil towards validFrom
                                 if (new Date(options?.publishOptions?.statusListValidUntil) <= new Date(publishedList.StatusList2021.validFrom))
-                                    throw new Error('[did-provider-cheqd]: revocation: Invalid status list validUntil (must be after validFrom)');
+                                    throw new Error('[did-provider-cheqd]: suspension: Invalid status list validUntil (must be after validFrom)');
                             }
                             // define status list content
                             const content = {
@@ -2441,8 +2903,6 @@ export class Cheqd {
                 suspended: suspended.map((result) => result.status === 'fulfilled' ? result.value.suspended : false),
                 published: topArgs?.publish ? true : undefined,
                 statusList: topArgs?.returnUpdatedStatusList ? await Cheqd.fetchStatusList2021(credentials[0]) : undefined,
-                encryptedStatusList: topArgs?.returnUpdatedEncryptedStatusList ? await blobToHexString(published?.[1]?.encryptedString) : undefined,
-                encryptedSymmetricKey: topArgs?.returnEncryptedSymmetricKey ? published?.[1]?.encryptedSymmetricKey : undefined,
                 symmetricKey: topArgs?.returnSymmetricKey ? published?.[1]?.symmetricKey : undefined,
                 resourceMetadata: topArgs?.returnStatusListMetadata ? await Cheqd.fetchStatusList2021Metadata(credentials[0]) : undefined
             };
@@ -2462,7 +2922,7 @@ export class Cheqd {
             const publishedList = (await Cheqd.fetchStatusList2021(credential));
             // early return, if encrypted and no decryption key provided
             if (publishedList.metadata.encrypted && !options?.topArgs?.symmetricKey)
-                throw new Error('[did-provider-cheqd]: suspension: symmetricKey is required, if status list 2021 is encrypted');
+                throw new Error('[did-provider-cheqd]: unsuspension: symmetricKey is required, if status list 2021 is encrypted');
             // fetch status list 2021 inscribed in credential
             const statusList2021 = options?.topArgs?.fetchList
                 ? (await async function () {
@@ -2471,8 +2931,8 @@ export class Cheqd {
                         return publishedList.metadata.encoding === 'base64url'
                             ? publishedList.StatusList2021.encodedList
                             : toString(fromString(publishedList.StatusList2021.encodedList, publishedList.metadata.encoding), 'base64url');
-                    // otherwise, decrypt and return bitstring
-                    const scopedRawBlob = await toBlob(await Cheqd.fetchStatusList2021(credential, true));
+                    // otherwise, decrypt and return raw bitstring
+                    const scopedRawBlob = await toBlob(fromString(publishedList.StatusList2021.encodedList, 'hex'));
                     // decrypt
                     return await LitProtocol.decryptDirect(scopedRawBlob, fromString(options?.topArgs?.symmetricKey, 'hex'));
                 }())
@@ -2489,7 +2949,7 @@ export class Cheqd {
                             const encoded = new StatusList({ buffer: await Cheqd.getFile(options.statusListFile) }).encode();
                             // validate against published list
                             if (encoded !== publishedListTranscoded)
-                                throw new Error('[did-provider-cheqd]: revocation: statusListFile does not match published status list 2021');
+                                throw new Error('[did-provider-cheqd]: unsuspension: statusListFile does not match published status list 2021');
                             // return encoded
                             return encoded;
                         }
@@ -2499,15 +2959,15 @@ export class Cheqd {
                         const decrypted = await LitProtocol.decryptDirect(scopedRawBlob, fromString(options?.topArgs?.symmetricKey, 'hex'));
                         // validate against published list
                         if (decrypted !== publishedListTranscoded)
-                            throw new Error('[did-provider-cheqd]: revocation: statusListFile does not match published status list 2021');
+                            throw new Error('[did-provider-cheqd]: unsuspension: statusListFile does not match published status list 2021');
                         // return decrypted
                         return decrypted;
                     }
                     if (!options?.statusListInlineBitstring)
-                        throw new Error('[did-provider-cheqd]: revocation: statusListInlineBitstring is required, if statusListFile is not provided');
+                        throw new Error('[did-provider-cheqd]: unsuspension: statusListInlineBitstring is required, if statusListFile is not provided');
                     // validate against published list
                     if (options?.statusListInlineBitstring !== publishedListTranscoded)
-                        throw new Error('[did-provider-cheqd]: revocation: statusListInlineBitstring does not match published status list 2021');
+                        throw new Error('[did-provider-cheqd]: unsuspension: statusListInlineBitstring does not match published status list 2021');
                     // otherwise, read from inline bitstring
                     return options?.statusListInlineBitstring;
                 }());
@@ -2534,38 +2994,133 @@ export class Cheqd {
                     // publish status list 2021 as new version
                     const scoped = topArgs.publishEncrypted
                         ? (await async function () {
+                            // validate encoding, if provided
+                            if (options?.publishOptions?.statusListEncoding && !Object.values(DefaultStatusList2021Encodings).includes(options?.publishOptions?.statusListEncoding)) {
+                                throw new Error('[did-provider-cheqd]: unsuspension: Invalid status list encoding');
+                            }
+                            // validate validUntil, if provided
+                            if (options?.publishOptions?.statusListValidUntil) {
+                                // validate validUntil as string
+                                if (typeof options?.publishOptions?.statusListValidUntil !== 'string')
+                                    throw new Error('[did-provider-cheqd]: unsuspension: Invalid status list validUntil (must be string)');
+                                // validate validUntil as date
+                                if (isNaN(Date.parse(options?.publishOptions?.statusListValidUntil)))
+                                    throw new Error('[did-provider-cheqd]: unsuspension: Invalid status list validUntil (must be date)');
+                                // validate validUntil as future date
+                                if (new Date(options?.publishOptions?.statusListValidUntil) < new Date())
+                                    throw new Error('[did-provider-cheqd]: unsuspension: Invalid status list validUntil (must be future date)');
+                                // validate validUntil towards validFrom
+                                if (new Date(options?.publishOptions?.statusListValidUntil) <= new Date(publishedList.StatusList2021.validFrom))
+                                    throw new Error('[did-provider-cheqd]: unsuspension: Invalid status list validUntil (must be after validFrom)');
+                            }
+                            // validate paymentConditions, if provided
+                            if (topArgs?.paymentConditions) {
+                                if (!topArgs?.paymentConditions?.every((condition) => condition.feePaymentAddress && condition.feePaymentAmount && condition.intervalInSeconds)) {
+                                    throw new Error('[did-provider-cheqd]: paymentConditions must contain feePaymentAddress and feeAmount and intervalInSeconds');
+                                }
+                                if (!topArgs?.paymentConditions?.every((condition) => typeof condition.feePaymentAddress === 'string' && typeof condition.feePaymentAmount === 'string' && typeof condition.intervalInSeconds === 'number')) {
+                                    throw new Error('[did-provider-cheqd]: feePaymentAddress and feePaymentAmount must be string and intervalInSeconds must be number');
+                                }
+                                if (!topArgs?.paymentConditions?.every((condition) => condition.type === AccessControlConditionTypes.timelockPayment)) {
+                                    throw new Error('[did-provider-cheqd]: paymentConditions must be of type timelockPayment');
+                                }
+                            }
+                            // validate dkgOptions
+                            if (!topArgs?.dkgOptions || !topArgs?.dkgOptions?.chain || !topArgs?.dkgOptions?.network) {
+                                throw new Error('[did-provider-cheqd]: dkgOptions is required');
+                            }
                             // instantiate dkg-threshold client, in which case lit-protocol is used
                             const lit = await LitProtocol.create({
-                                chain: options?.topArgs?.bootstrapOptions?.chain,
-                                litNetwork: options?.topArgs?.bootstrapOptions?.litNetwork
+                                chain: topArgs?.dkgOptions?.chain,
+                                litNetwork: topArgs?.dkgOptions?.network
                             });
-                            // encrypt
-                            const { encryptedString, encryptedSymmetricKey, symmetricKey } = await lit.encrypt(bitstring, options?.topArgs?.encryptionOptions?.unifiedAccessControlConditions, true);
+                            // construct access control conditions and payment conditions tuple
+                            const unifiedAccessControlConditionsTuple = publishedList.metadata.encrypted
+                                ? (await (async function () {
+                                    // define payment conditions, give precedence to top-level args
+                                    const paymentConditions = topArgs?.paymentConditions || publishedList.metadata.paymentConditions;
+                                    // return access control conditions and payment conditions tuple
+                                    return [
+                                        await Promise.all(paymentConditions.map(async (condition) => {
+                                            switch (condition.type) {
+                                                case AccessControlConditionTypes.timelockPayment:
+                                                    return await LitProtocol.generateCosmosAccessControlConditionInverseTimelock({
+                                                        key: '$.tx_responses.*.timestamp',
+                                                        comparator: '<=',
+                                                        value: `${condition.intervalInSeconds}`,
+                                                    }, condition.feePaymentAmount, condition.feePaymentAddress, condition?.blockHeight, topArgs?.dkgOptions?.chain);
+                                                default:
+                                                    throw new Error(`[did-provider-cheqd]: unsupported access control condition type ${condition.type}`);
+                                            }
+                                        })),
+                                        paymentConditions
+                                    ];
+                                }()))
+                                : (await (async function () {
+                                    // validate paymentConditions
+                                    if (!topArgs?.paymentConditions) {
+                                        throw new Error('[did-provider-cheqd]: paymentConditions is required');
+                                    }
+                                    // return access control conditions and payment conditions tuple
+                                    return [
+                                        await Promise.all(topArgs.paymentConditions.map(async (condition) => {
+                                            switch (condition.type) {
+                                                case AccessControlConditionTypes.timelockPayment:
+                                                    return await LitProtocol.generateCosmosAccessControlConditionInverseTimelock({
+                                                        key: '$.tx_responses.*.timestamp',
+                                                        comparator: '<=',
+                                                        value: `${condition.intervalInSeconds}`,
+                                                    }, condition.feePaymentAmount, condition.feePaymentAddress, condition?.blockHeight);
+                                                default:
+                                                    throw new Error(`[did-provider-cheqd]: unsupported access control condition type ${condition.type}`);
+                                            }
+                                        })),
+                                        topArgs.paymentConditions
+                                    ];
+                                }()));
+                            // encrypt bitstring
+                            const { encryptedString, encryptedSymmetricKey, symmetricKey } = await lit.encrypt(bitstring, unifiedAccessControlConditionsTuple[0], true);
+                            // define status list content
+                            const content = {
+                                StatusList2021: {
+                                    statusPurpose: publishedList.StatusList2021.statusPurpose,
+                                    encodedList: await blobToHexString(encryptedString),
+                                    validFrom: publishedList.StatusList2021.validFrom,
+                                    validUntil: options?.publishOptions?.statusListValidUntil || publishedList.StatusList2021.validUntil
+                                },
+                                metadata: {
+                                    type: publishedList.metadata.type,
+                                    encrypted: true,
+                                    encoding: options?.publishOptions?.statusListEncoding || publishedList.metadata.encoding,
+                                    encryptedSymmetricKey,
+                                    paymentConditions: unifiedAccessControlConditionsTuple[1]
+                                }
+                            };
                             // return tuple of publish result and encryption relevant metadata
                             return [
-                                await Cheqd.publishStatusList2021(new Uint8Array(await encryptedString.arrayBuffer()), statusListMetadata, options?.publishOptions),
+                                await Cheqd.publishStatusList2021(fromString(JSON.stringify(content), 'utf-8'), statusListMetadata, options?.publishOptions),
                                 { encryptedString, encryptedSymmetricKey, symmetricKey: toString(symmetricKey, 'hex') }
                             ];
                         }())
                         : (await async function () {
                             // validate encoding, if provided
                             if (options?.publishOptions?.statusListEncoding && !Object.values(DefaultStatusList2021Encodings).includes(options?.publishOptions?.statusListEncoding)) {
-                                throw new Error('[did-provider-cheqd]: revocation: Invalid status list encoding');
+                                throw new Error('[did-provider-cheqd]: unsuspension: Invalid status list encoding');
                             }
                             // validate validUntil, if provided
                             if (options?.publishOptions?.statusListValidUntil) {
                                 // validate validUntil as string
                                 if (typeof options?.publishOptions?.statusListValidUntil !== 'string')
-                                    throw new Error('[did-provider-cheqd]: revocation: Invalid status list validUntil (must be string)');
+                                    throw new Error('[did-provider-cheqd]: unsuspension: Invalid status list validUntil (must be string)');
                                 // validate validUntil as date
                                 if (isNaN(Date.parse(options?.publishOptions?.statusListValidUntil)))
-                                    throw new Error('[did-provider-cheqd]: revocation: Invalid status list validUntil (must be date)');
+                                    throw new Error('[did-provider-cheqd]: unsuspension: Invalid status list validUntil (must be date)');
                                 // validate validUntil as future date
                                 if (new Date(options?.publishOptions?.statusListValidUntil) < new Date())
-                                    throw new Error('[did-provider-cheqd]: revocation: Invalid status list validUntil (must be future date)');
+                                    throw new Error('[did-provider-cheqd]: unsuspension: Invalid status list validUntil (must be future date)');
                                 // validate validUntil towards validFrom
                                 if (new Date(options?.publishOptions?.statusListValidUntil) <= new Date(publishedList.StatusList2021.validFrom))
-                                    throw new Error('[did-provider-cheqd]: revocation: Invalid status list validUntil (must be after validFrom)');
+                                    throw new Error('[did-provider-cheqd]: unsuspension: Invalid status list validUntil (must be after validFrom)');
                             }
                             // define status list content
                             const content = {
@@ -2598,8 +3153,6 @@ export class Cheqd {
                 unsuspended: true,
                 published: topArgs?.publish ? true : undefined,
                 statusList: topArgs?.returnUpdatedStatusList ? await Cheqd.fetchStatusList2021(credential) : undefined,
-                encryptedStatusList: topArgs?.returnUpdatedEncryptedStatusList ? await blobToHexString(published?.[1]?.encryptedString) : undefined,
-                encryptedSymmetricKey: topArgs?.returnEncryptedSymmetricKey ? published?.[1]?.encryptedSymmetricKey : undefined,
                 symmetricKey: topArgs?.returnSymmetricKey ? published?.[1]?.symmetricKey : undefined,
                 resourceMetadata: topArgs?.returnStatusListMetadata ? await Cheqd.fetchStatusList2021Metadata(credential) : undefined
             };
@@ -2657,8 +3210,8 @@ export class Cheqd {
                         return publishedList.metadata.encoding === 'base64url'
                             ? publishedList.StatusList2021.encodedList
                             : toString(fromString(publishedList.StatusList2021.encodedList, publishedList.metadata.encoding), 'base64url');
-                    // otherwise, decrypt and return bitstring
-                    const scopedRawBlob = await toBlob(await Cheqd.fetchStatusList2021(credentials[0], true));
+                    // otherwise, decrypt and return raw bitstring
+                    const scopedRawBlob = await toBlob(fromString(publishedList.StatusList2021.encodedList, 'hex'));
                     // decrypt
                     return await LitProtocol.decryptDirect(scopedRawBlob, fromString(options?.topArgs?.symmetricKey, 'hex'));
                 }())
@@ -2675,7 +3228,7 @@ export class Cheqd {
                             const encoded = new StatusList({ buffer: await Cheqd.getFile(options.statusListFile) }).encode();
                             // validate against published list
                             if (encoded !== publishedListTranscoded)
-                                throw new Error('[did-provider-cheqd]: revocation: statusListFile does not match published status list 2021');
+                                throw new Error('[did-provider-cheqd]: unsuspension: statusListFile does not match published status list 2021');
                             // return encoded
                             return encoded;
                         }
@@ -2685,15 +3238,15 @@ export class Cheqd {
                         const decrypted = await LitProtocol.decryptDirect(scopedRawBlob, fromString(options?.topArgs?.symmetricKey, 'hex'));
                         // validate against published list
                         if (decrypted !== publishedListTranscoded)
-                            throw new Error('[did-provider-cheqd]: revocation: statusListFile does not match published status list 2021');
+                            throw new Error('[did-provider-cheqd]: unsuspension: statusListFile does not match published status list 2021');
                         // return decrypted
                         return decrypted;
                     }
                     if (!options?.statusListInlineBitstring)
-                        throw new Error('[did-provider-cheqd]: revocation: statusListInlineBitstring is required, if statusListFile is not provided');
+                        throw new Error('[did-provider-cheqd]: unsuspension: statusListInlineBitstring is required, if statusListFile is not provided');
                     // validate against published list
                     if (options?.statusListInlineBitstring !== publishedListTranscoded)
-                        throw new Error('[did-provider-cheqd]: revocation: statusListInlineBitstring does not match published status list 2021');
+                        throw new Error('[did-provider-cheqd]: unsuspension: statusListInlineBitstring does not match published status list 2021');
                     // otherwise, read from inline bitstring
                     return options?.statusListInlineBitstring;
                 }());
@@ -2733,38 +3286,133 @@ export class Cheqd {
                     // publish status list 2021 as new version
                     const scoped = topArgs.publishEncrypted
                         ? (await async function () {
+                            // validate encoding, if provided
+                            if (options?.publishOptions?.statusListEncoding && !Object.values(DefaultStatusList2021Encodings).includes(options?.publishOptions?.statusListEncoding)) {
+                                throw new Error('[did-provider-cheqd]: unsuspension: Invalid status list encoding');
+                            }
+                            // validate validUntil, if provided
+                            if (options?.publishOptions?.statusListValidUntil) {
+                                // validate validUntil as string
+                                if (typeof options?.publishOptions?.statusListValidUntil !== 'string')
+                                    throw new Error('[did-provider-cheqd]: unsuspension: Invalid status list validUntil (must be string)');
+                                // validate validUntil as date
+                                if (isNaN(Date.parse(options?.publishOptions?.statusListValidUntil)))
+                                    throw new Error('[did-provider-cheqd]: unsuspension: Invalid status list validUntil (must be date)');
+                                // validate validUntil as future date
+                                if (new Date(options?.publishOptions?.statusListValidUntil) < new Date())
+                                    throw new Error('[did-provider-cheqd]: unsuspension: Invalid status list validUntil (must be future date)');
+                                // validate validUntil towards validFrom
+                                if (new Date(options?.publishOptions?.statusListValidUntil) <= new Date(publishedList.StatusList2021.validFrom))
+                                    throw new Error('[did-provider-cheqd]: unsuspension: Invalid status list validUntil (must be after validFrom)');
+                            }
+                            // validate paymentConditions, if provided
+                            if (topArgs?.paymentConditions) {
+                                if (!topArgs?.paymentConditions?.every((condition) => condition.feePaymentAddress && condition.feePaymentAmount && condition.intervalInSeconds)) {
+                                    throw new Error('[did-provider-cheqd]: paymentConditions must contain feePaymentAddress and feeAmount and intervalInSeconds');
+                                }
+                                if (!topArgs?.paymentConditions?.every((condition) => typeof condition.feePaymentAddress === 'string' && typeof condition.feePaymentAmount === 'string' && typeof condition.intervalInSeconds === 'number')) {
+                                    throw new Error('[did-provider-cheqd]: feePaymentAddress and feePaymentAmount must be string and intervalInSeconds must be number');
+                                }
+                                if (!topArgs?.paymentConditions?.every((condition) => condition.type === AccessControlConditionTypes.timelockPayment)) {
+                                    throw new Error('[did-provider-cheqd]: paymentConditions must be of type timelockPayment');
+                                }
+                            }
+                            // validate dkgOptions
+                            if (!topArgs?.dkgOptions || !topArgs?.dkgOptions?.chain || !topArgs?.dkgOptions?.network) {
+                                throw new Error('[did-provider-cheqd]: dkgOptions is required');
+                            }
                             // instantiate dkg-threshold client, in which case lit-protocol is used
                             const lit = await LitProtocol.create({
-                                chain: options?.topArgs?.bootstrapOptions?.chain,
-                                litNetwork: options?.topArgs?.bootstrapOptions?.litNetwork
+                                chain: topArgs?.dkgOptions?.chain,
+                                litNetwork: topArgs?.dkgOptions?.network
                             });
-                            // encrypt
-                            const { encryptedString, encryptedSymmetricKey, symmetricKey } = await lit.encrypt(bitstring, options?.topArgs?.encryptionOptions?.unifiedAccessControlConditions, true);
+                            // construct access control conditions and payment conditions tuple
+                            const unifiedAccessControlConditionsTuple = publishedList.metadata.encrypted
+                                ? (await (async function () {
+                                    // define payment conditions, give precedence to top-level args
+                                    const paymentConditions = topArgs?.paymentConditions || publishedList.metadata.paymentConditions;
+                                    // return access control conditions and payment conditions tuple
+                                    return [
+                                        await Promise.all(paymentConditions.map(async (condition) => {
+                                            switch (condition.type) {
+                                                case AccessControlConditionTypes.timelockPayment:
+                                                    return await LitProtocol.generateCosmosAccessControlConditionInverseTimelock({
+                                                        key: '$.tx_responses.*.timestamp',
+                                                        comparator: '<=',
+                                                        value: `${condition.intervalInSeconds}`,
+                                                    }, condition.feePaymentAmount, condition.feePaymentAddress, condition?.blockHeight, topArgs?.dkgOptions?.chain);
+                                                default:
+                                                    throw new Error(`[did-provider-cheqd]: unsupported access control condition type ${condition.type}`);
+                                            }
+                                        })),
+                                        paymentConditions
+                                    ];
+                                }()))
+                                : (await (async function () {
+                                    // validate paymentConditions
+                                    if (!topArgs?.paymentConditions) {
+                                        throw new Error('[did-provider-cheqd]: paymentConditions is required');
+                                    }
+                                    // return access control conditions and payment conditions tuple
+                                    return [
+                                        await Promise.all(topArgs.paymentConditions.map(async (condition) => {
+                                            switch (condition.type) {
+                                                case AccessControlConditionTypes.timelockPayment:
+                                                    return await LitProtocol.generateCosmosAccessControlConditionInverseTimelock({
+                                                        key: '$.tx_responses.*.timestamp',
+                                                        comparator: '<=',
+                                                        value: `${condition.intervalInSeconds}`,
+                                                    }, condition.feePaymentAmount, condition.feePaymentAddress, condition?.blockHeight);
+                                                default:
+                                                    throw new Error(`[did-provider-cheqd]: unsupported access control condition type ${condition.type}`);
+                                            }
+                                        })),
+                                        topArgs.paymentConditions
+                                    ];
+                                }()));
+                            // encrypt bitstring
+                            const { encryptedString, encryptedSymmetricKey, symmetricKey } = await lit.encrypt(bitstring, unifiedAccessControlConditionsTuple[0], true);
+                            // define status list content
+                            const content = {
+                                StatusList2021: {
+                                    statusPurpose: publishedList.StatusList2021.statusPurpose,
+                                    encodedList: await blobToHexString(encryptedString),
+                                    validFrom: publishedList.StatusList2021.validFrom,
+                                    validUntil: options?.publishOptions?.statusListValidUntil || publishedList.StatusList2021.validUntil
+                                },
+                                metadata: {
+                                    type: publishedList.metadata.type,
+                                    encrypted: true,
+                                    encoding: options?.publishOptions?.statusListEncoding || publishedList.metadata.encoding,
+                                    encryptedSymmetricKey,
+                                    paymentConditions: unifiedAccessControlConditionsTuple[1]
+                                }
+                            };
                             // return tuple of publish result and encryption relevant metadata
                             return [
-                                await Cheqd.publishStatusList2021(new Uint8Array(await encryptedString.arrayBuffer()), statusListMetadata, options?.publishOptions),
+                                await Cheqd.publishStatusList2021(fromString(JSON.stringify(content), 'utf-8'), statusListMetadata, options?.publishOptions),
                                 { encryptedString, encryptedSymmetricKey, symmetricKey: toString(symmetricKey, 'hex') }
                             ];
                         }())
                         : (await async function () {
                             // validate encoding, if provided
                             if (options?.publishOptions?.statusListEncoding && !Object.values(DefaultStatusList2021Encodings).includes(options?.publishOptions?.statusListEncoding)) {
-                                throw new Error('[did-provider-cheqd]: revocation: Invalid status list encoding');
+                                throw new Error('[did-provider-cheqd]: unsuspension: Invalid status list encoding');
                             }
                             // validate validUntil, if provided
                             if (options?.publishOptions?.statusListValidUntil) {
                                 // validate validUntil as string
                                 if (typeof options?.publishOptions?.statusListValidUntil !== 'string')
-                                    throw new Error('[did-provider-cheqd]: revocation: Invalid status list validUntil (must be string)');
+                                    throw new Error('[did-provider-cheqd]: unsuspension: Invalid status list validUntil (must be string)');
                                 // validate validUntil as date
                                 if (isNaN(Date.parse(options?.publishOptions?.statusListValidUntil)))
-                                    throw new Error('[did-provider-cheqd]: revocation: Invalid status list validUntil (must be date)');
+                                    throw new Error('[did-provider-cheqd]: unsuspension: Invalid status list validUntil (must be date)');
                                 // validate validUntil as future date
                                 if (new Date(options?.publishOptions?.statusListValidUntil) < new Date())
-                                    throw new Error('[did-provider-cheqd]: revocation: Invalid status list validUntil (must be future date)');
+                                    throw new Error('[did-provider-cheqd]: unsuspension: Invalid status list validUntil (must be future date)');
                                 // validate validUntil towards validFrom
                                 if (new Date(options?.publishOptions?.statusListValidUntil) <= new Date(publishedList.StatusList2021.validFrom))
-                                    throw new Error('[did-provider-cheqd]: revocation: Invalid status list validUntil (must be after validFrom)');
+                                    throw new Error('[did-provider-cheqd]: unsuspension: Invalid status list validUntil (must be after validFrom)');
                             }
                             // define status list content
                             const content = {
@@ -2797,8 +3445,6 @@ export class Cheqd {
                 unsuspended: unsuspended.map((result) => result.status === 'fulfilled' ? result.value.unsuspended : false),
                 published: topArgs?.publish ? true : undefined,
                 statusList: topArgs?.returnUpdatedStatusList ? await Cheqd.fetchStatusList2021(credentials[0]) : undefined,
-                encryptedStatusList: topArgs?.returnUpdatedEncryptedStatusList ? await blobToHexString(published?.[1]?.encryptedString) : undefined,
-                encryptedSymmetricKey: topArgs?.returnEncryptedSymmetricKey ? published?.[1]?.encryptedSymmetricKey : undefined,
                 symmetricKey: topArgs?.returnSymmetricKey ? published?.[1]?.symmetricKey : undefined,
                 resourceMetadata: topArgs?.returnStatusListMetadata ? await Cheqd.fetchStatusList2021Metadata(credentials[0]) : undefined
             };
@@ -2812,13 +3458,10 @@ export class Cheqd {
     static async checkRevoked(credential, options = { fetchList: true }) {
         // validate status purpose
         if (credential.credentialStatus?.statusPurpose !== 'revocation') {
-            throw new Error(`[did-provider-cheqd]: revocation: Unsupported status purpose: ${credential.credentialStatus?.statusPurpose}`);
+            throw new Error(`[did-provider-cheqd]: check: revocation: Unsupported status purpose: ${credential.credentialStatus?.statusPurpose}`);
         }
         // fetch status list 2021
         const publishedList = (await Cheqd.fetchStatusList2021(credential));
-        // early return, if encrypted and decryption key is not provided
-        if (publishedList.metadata.encrypted && !options?.topArgs?.encryptedSymmetricKey)
-            throw new Error('[did-provider-cheqd]: revocation: encryptedSymmetricKey is required, if status list 2021 is encrypted');
         // fetch status list 2021 inscribed in credential
         const statusList2021 = options?.topArgs?.fetchList
             ? (await async function () {
@@ -2827,15 +3470,28 @@ export class Cheqd {
                     return publishedList.metadata.encoding === 'base64url'
                         ? publishedList.StatusList2021.encodedList
                         : toString(fromString(publishedList.StatusList2021.encodedList, publishedList.metadata.encoding), 'base64url');
-                // otherwise, decrypt and return bitstring
-                const scopedRawBlob = await toBlob(fromString(publishedList.StatusList2021.encodedList, publishedList.metadata.encoding));
+                // otherwise, decrypt and return raw bitstring
+                const scopedRawBlob = await toBlob(fromString(publishedList.StatusList2021.encodedList, 'hex'));
                 // instantiate dkg-threshold client, in which case lit-protocol is used
                 const lit = await LitProtocol.create({
-                    chain: options?.topArgs?.bootstrapOptions?.chain,
-                    litNetwork: options?.topArgs?.bootstrapOptions?.litNetwork
+                    chain: options?.topArgs?.dkgOptions?.chain,
+                    litNetwork: options?.topArgs?.dkgOptions?.network
                 });
+                // construct access control conditions
+                const unifiedAccessControlConditions = await Promise.all(publishedList.metadata.paymentConditions.map(async (condition) => {
+                    switch (condition.type) {
+                        case AccessControlConditionTypes.timelockPayment:
+                            return await LitProtocol.generateCosmosAccessControlConditionInverseTimelock({
+                                key: '$.tx_responses.*.timestamp',
+                                comparator: '<=',
+                                value: `${condition.intervalInSeconds}`,
+                            }, condition.feePaymentAmount, condition.feePaymentAddress, condition?.blockHeight, options?.topArgs?.dkgOptions?.chain);
+                        default:
+                            throw new Error(`[did-provider-cheqd]: unsupported access control condition type ${condition.type}`);
+                    }
+                }));
                 // decrypt
-                return await lit.decrypt(scopedRawBlob, options?.topArgs?.encryptedSymmetricKey, options?.topArgs?.decryptionOptions?.unifiedAccessControlConditions);
+                return await lit.decrypt(scopedRawBlob, publishedList.metadata.encryptedSymmetricKey, unifiedAccessControlConditions);
             }())
             : (await async function () {
                 // transcode to base64url, if needed
@@ -2850,7 +3506,7 @@ export class Cheqd {
                         const encoded = new StatusList({ buffer: await Cheqd.getFile(options.statusListFile) }).encode();
                         // validate against published list
                         if (encoded !== publishedListTranscoded)
-                            throw new Error('[did-provider-cheqd]: revocation: statusListFile does not match published status list 2021');
+                            throw new Error('[did-provider-cheqd]: check: revocation: statusListFile does not match published status list 2021');
                         // return encoded
                         return encoded;
                     }
@@ -2860,33 +3516,34 @@ export class Cheqd {
                     const decrypted = await LitProtocol.decryptDirect(scopedRawBlob, fromString(options?.topArgs?.symmetricKey, 'hex'));
                     // validate against published list
                     if (decrypted !== publishedListTranscoded)
-                        throw new Error('[did-provider-cheqd]: revocation: statusListFile does not match published status list 2021');
+                        throw new Error('[did-provider-cheqd]: check: revocation: statusListFile does not match published status list 2021');
                     // return decrypted
                     return decrypted;
                 }
                 if (!options?.statusListInlineBitstring)
-                    throw new Error('[did-provider-cheqd]: revocation: statusListInlineBitstring is required, if statusListFile is not provided');
+                    throw new Error('[did-provider-cheqd]: check: revocation: statusListInlineBitstring is required, if statusListFile is not provided');
                 // validate against published list
                 if (options?.statusListInlineBitstring !== publishedListTranscoded)
-                    throw new Error('[did-provider-cheqd]: revocation: statusListInlineBitstring does not match published status list 2021');
+                    throw new Error('[did-provider-cheqd]: check: revocation: statusListInlineBitstring does not match published status list 2021');
                 // otherwise, read from inline bitstring
                 return options?.statusListInlineBitstring;
             }());
+        // transcode, if needed
+        const transcodedStatusList2021 = publishedList.metadata.encoding === 'base64url'
+            ? statusList2021
+            : toString(fromString(statusList2021, publishedList.metadata.encoding), 'base64url');
         // parse status list 2021
-        const statusList = await StatusList.decode({ encodedList: statusList2021 });
+        const statusList = await StatusList.decode({ encodedList: transcodedStatusList2021 });
         // get status by index
         return !!statusList.getStatus(Number(credential.credentialStatus.statusListIndex));
     }
     static async checkSuspended(credential, options = { fetchList: true }) {
         // validate status purpose
         if (credential.credentialStatus?.statusPurpose !== 'suspension') {
-            throw new Error(`[did-provider-cheqd]: suspension: Unsupported status purpose: ${credential.credentialStatus?.statusPurpose}`);
+            throw new Error(`[did-provider-cheqd]: check: suspension: Unsupported status purpose: ${credential.credentialStatus?.statusPurpose}`);
         }
         // fetch status list 2021
         const publishedList = (await Cheqd.fetchStatusList2021(credential));
-        // early return, if encrypted and decryption key is not provided
-        if (publishedList.metadata.encrypted && !options?.topArgs?.encryptedSymmetricKey)
-            throw new Error('[did-provider-cheqd]: revocation: encryptedSymmetricKey is required, if status list 2021 is encrypted');
         // fetch status list 2021 inscribed in credential
         const statusList2021 = options?.topArgs?.fetchList
             ? (await async function () {
@@ -2896,14 +3553,27 @@ export class Cheqd {
                         ? publishedList.StatusList2021.encodedList
                         : toString(fromString(publishedList.StatusList2021.encodedList, publishedList.metadata.encoding), 'base64url');
                 // otherwise, decrypt and return bitstring
-                const scopedRawBlob = await toBlob(fromString(publishedList.StatusList2021.encodedList, publishedList.metadata.encoding));
+                const scopedRawBlob = await toBlob(fromString(publishedList.StatusList2021.encodedList, 'hex'));
                 // instantiate dkg-threshold client, in which case lit-protocol is used
                 const lit = await LitProtocol.create({
-                    chain: options?.topArgs?.bootstrapOptions?.chain,
-                    litNetwork: options?.topArgs?.bootstrapOptions?.litNetwork
+                    chain: options?.topArgs?.dkgOptions?.chain,
+                    litNetwork: options?.topArgs?.dkgOptions?.network
                 });
+                // construct access control conditions
+                const unifiedAccessControlConditions = await Promise.all(publishedList.metadata.paymentConditions.map(async (condition) => {
+                    switch (condition.type) {
+                        case AccessControlConditionTypes.timelockPayment:
+                            return await LitProtocol.generateCosmosAccessControlConditionInverseTimelock({
+                                key: '$.tx_responses.*.timestamp',
+                                comparator: '<=',
+                                value: `${condition.intervalInSeconds}`,
+                            }, condition.feePaymentAmount, condition.feePaymentAddress, condition?.blockHeight, options?.topArgs?.dkgOptions?.chain);
+                        default:
+                            throw new Error(`[did-provider-cheqd]: unsupported access control condition type ${condition.type}`);
+                    }
+                }));
                 // decrypt
-                return await lit.decrypt(scopedRawBlob, options?.topArgs?.encryptedSymmetricKey, options?.topArgs?.decryptionOptions?.unifiedAccessControlConditions);
+                return await lit.decrypt(scopedRawBlob, publishedList.metadata.encryptedSymmetricKey, unifiedAccessControlConditions);
             }())
             : (await async function () {
                 // transcode to base64url, if needed
@@ -2918,7 +3588,7 @@ export class Cheqd {
                         const encoded = new StatusList({ buffer: await Cheqd.getFile(options.statusListFile) }).encode();
                         // validate against published list
                         if (encoded !== publishedListTranscoded)
-                            throw new Error('[did-provider-cheqd]: revocation: statusListFile does not match published status list 2021');
+                            throw new Error('[did-provider-cheqd]: check: suspension: statusListFile does not match published status list 2021');
                         // return encoded
                         return encoded;
                     }
@@ -2928,15 +3598,15 @@ export class Cheqd {
                     const decrypted = await LitProtocol.decryptDirect(scopedRawBlob, fromString(options?.topArgs?.symmetricKey, 'hex'));
                     // validate against published list
                     if (decrypted !== publishedListTranscoded)
-                        throw new Error('[did-provider-cheqd]: revocation: statusListFile does not match published status list 2021');
+                        throw new Error('[did-provider-cheqd]: check: suspension: statusListFile does not match published status list 2021');
                     // return decrypted
                     return decrypted;
                 }
                 if (!options?.statusListInlineBitstring)
-                    throw new Error('[did-provider-cheqd]: revocation: statusListInlineBitstring is required, if statusListFile is not provided');
+                    throw new Error('[did-provider-cheqd]: check: suspension: statusListInlineBitstring is required, if statusListFile is not provided');
                 // validate against published list
                 if (options?.statusListInlineBitstring !== publishedListTranscoded)
-                    throw new Error('[did-provider-cheqd]: revocation: statusListInlineBitstring does not match published status list 2021');
+                    throw new Error('[did-provider-cheqd]: check: suspension: statusListInlineBitstring does not match published status list 2021');
                 // otherwise, read from inline bitstring
                 return options?.statusListInlineBitstring;
             }());