@cheqd/did-provider-cheqd 3.7.0-develop.1 → 4.0.0-develop.1

package/build/cjs/agent/ICheqd.js

@@ -16,9 +16,10 @@ const vc_status_list_1 = require("@digitalbazaar/vc-status-list");
 const uuid_1 = require("uuid");
 const fs_1 = __importDefault(require("fs"));
 const debug_1 = __importDefault(require("debug"));
-const lit_protocol_js_1 = require("../dkg-threshold/lit-protocol.js");
+const v3_js_1 = require("../dkg-threshold/lit-protocol/v3.js");
 const helpers_js_1 = require("../utils/helpers.js");
 const cheqd_did_resolver_js_1 = require("../did-manager/cheqd-did-resolver.js");
+const v2_js_1 = require("../dkg-threshold/lit-protocol/v2.js");
 const debug = (0, debug_1.default)('veramo:did-provider-cheqd');
 exports.AccessControlConditionTypes = {
     timelockPayment: 'timelockPayment',
@@ -659,8 +660,10 @@ class Cheqd {
         // construct data and metadata tuple
         const data = args.encrypted
             ? await (async function (that) {
+                // encrypt bitstring - case: symmetric
+                const { encryptedString: symmetricEncryptionCiphertext, symmetricKey } = await v3_js_1.LitProtocol.encryptDirect((0, uint8arrays_1.fromString)(bitstring, args?.statusListEncoding || cheqd_did_provider_js_1.DefaultStatusList2021Encodings.base64url));
                 // instantiate dkg-threshold client, in which case lit-protocol is used
-                const lit = await lit_protocol_js_1.LitProtocol.create({
+                const lit = await v3_js_1.LitProtocol.create({
                     chain: args?.dkgOptions?.chain || that.didProvider.dkgOptions.chain,
                     litNetwork: args?.dkgOptions?.network || that.didProvider.dkgOptions.network,
                 });
@@ -668,7 +671,7 @@ class Cheqd {
                 const unifiedAccessControlConditions = await Promise.all(args.paymentConditions.map(async (condition) => {
                     switch (condition.type) {
                         case exports.AccessControlConditionTypes.timelockPayment:
-                            return await lit_protocol_js_1.LitProtocol.generateCosmosAccessControlConditionInverseTimelock({
+                            return await v3_js_1.LitProtocol.generateCosmosAccessControlConditionInverseTimelock({
                                 key: '$.tx_responses.*.timestamp',
                                 comparator: '<=',
                                 value: `${condition.intervalInSeconds}`,
@@ -677,8 +680,10 @@ class Cheqd {
                             throw new Error(`[did-provider-cheqd]: unsupported access control condition type ${condition.type}`);
                     }
                 }));
-                // encrypt bitstring
-                const { encryptedString, encryptedSymmetricKey, symmetricKey } = await lit.encrypt(bitstring, unifiedAccessControlConditions, true);
+                // encrypt bitstring - case: threshold
+                const { encryptedString: thresholdEncryptionCiphertext, stringHash } = await lit.encrypt((0, uint8arrays_1.fromString)(bitstring, args?.statusListEncoding || cheqd_did_provider_js_1.DefaultStatusList2021Encodings.base64url), unifiedAccessControlConditions);
+                // construct encoded list
+                const encodedList = `${await (0, helpers_js_1.blobToHexString)(symmetricEncryptionCiphertext)}-${(0, uint8arrays_1.toString)(thresholdEncryptionCiphertext, 'hex')}`;
                 // return result tuple
                 switch (args.statusPurpose) {
                     case cheqd_did_provider_js_1.DefaultStatusList2021StatusPurposeTypes.revocation:
@@ -686,7 +691,7 @@ class Cheqd {
                             {
                                 StatusList2021: {
                                     statusPurpose: args.statusPurpose,
-                                    encodedList: await (0, helpers_js_1.blobToHexString)(encryptedString),
+                                    encodedList,
                                     validFrom: new Date().toISOString(),
                                     validUntil: args?.validUntil,
                                 },
@@ -694,14 +699,15 @@ class Cheqd {
                                     type: cheqd_did_provider_js_1.DefaultStatusList2021ResourceTypes.revocation,
                                     encrypted: true,
                                     encoding: args?.statusListEncoding || cheqd_did_provider_js_1.DefaultStatusList2021Encodings.base64url,
-                                    encryptedSymmetricKey,
+                                    statusListHash: stringHash,
                                     paymentConditions: args.paymentConditions,
                                 },
                             },
                             {
+                                symmetricEncryptionCiphertext: await (0, helpers_js_1.blobToHexString)(symmetricEncryptionCiphertext),
+                                thresholdEncryptionCiphertext: (0, uint8arrays_1.toString)(thresholdEncryptionCiphertext, 'hex'),
+                                stringHash,
                                 symmetricKey: (0, uint8arrays_1.toString)(symmetricKey, 'hex'),
-                                encryptedSymmetricKey,
-                                encryptedString: await (0, helpers_js_1.blobToHexString)(encryptedString),
                             },
                         ];
                     case cheqd_did_provider_js_1.DefaultStatusList2021StatusPurposeTypes.suspension:
@@ -709,7 +715,7 @@ class Cheqd {
                             {
                                 StatusList2021: {
                                     statusPurpose: args.statusPurpose,
-                                    encodedList: await (0, helpers_js_1.blobToHexString)(encryptedString),
+                                    encodedList,
                                     validFrom: new Date().toISOString(),
                                     validUntil: args?.validUntil,
                                 },
@@ -717,14 +723,15 @@ class Cheqd {
                                     type: cheqd_did_provider_js_1.DefaultStatusList2021ResourceTypes.suspension,
                                     encrypted: true,
                                     encoding: args?.statusListEncoding || cheqd_did_provider_js_1.DefaultStatusList2021Encodings.base64url,
-                                    encryptedSymmetricKey,
+                                    statusListHash: stringHash,
                                     paymentConditions: args.paymentConditions,
                                 },
                             },
                             {
+                                symmetricEncryptionCiphertext: await (0, helpers_js_1.blobToHexString)(symmetricEncryptionCiphertext),
+                                thresholdEncryptionCiphertext: (0, uint8arrays_1.toString)(thresholdEncryptionCiphertext, 'hex'),
+                                stringHash,
                                 symmetricKey: (0, uint8arrays_1.toString)(symmetricKey, 'hex'),
-                                encryptedSymmetricKey,
-                                encryptedString: await (0, helpers_js_1.blobToHexString)(encryptedString),
                             },
                         ];
                     default:
@@ -796,7 +803,7 @@ class Cheqd {
                 },
             }),
             encrypted: args.encrypted,
-            symmetricKey: args?.returnSymmetricKey ? data[1]?.symmetricKey : undefined,
+            symmetricKey: args.encrypted && args.returnSymmetricKey ? data[1]?.symmetricKey : undefined,
         };
     }
     async BroadcastStatusList2021(args, context) {
@@ -922,8 +929,6 @@ class Cheqd {
         switch (args?.bitstringEncoding) {
             case 'base64url':
                 return encoded;
-            case 'base64':
-                return (0, uint8arrays_1.toString)((0, uint8arrays_1.fromString)(encoded, 'base64url'), 'base64');
             case 'hex':
                 return (0, uint8arrays_1.toString)((0, uint8arrays_1.fromString)(encoded, 'base64url'), 'hex');
             default:
@@ -939,12 +944,12 @@ class Cheqd {
             ? args.issuanceOptions.credential.issuer.id
             : args.issuanceOptions.credential.issuer;
         // generate status list credential
-        const statusListCredential = `${cheqd_did_resolver_js_1.DefaultResolverUrl}${issuer}?resourceName=${args.statusOptions.statusListName}&resourceType=StatusList2021Revocation`;
+        const statusListCredential = `${cheqd_did_resolver_js_1.DefaultResolverUrl}${issuer}?resourceName=${args.statusOptions.statusListName}&resourceType=${cheqd_did_provider_js_1.DefaultStatusList2021ResourceTypes.revocation}`;
         // construct credential status
         const credentialStatus = {
             id: `${statusListCredential}#${statusListIndex}`,
             type: 'StatusList2021Entry',
-            statusPurpose: 'revocation',
+            statusPurpose: cheqd_did_provider_js_1.DefaultStatusList2021StatusPurposeTypes.revocation,
             statusListIndex: `${statusListIndex}`,
         };
         // add credential status to credential
@@ -981,12 +986,12 @@ class Cheqd {
             ? args.issuanceOptions.credential.issuer.id
             : args.issuanceOptions.credential.issuer;
         // generate status list credential
-        const statusListCredential = `${cheqd_did_resolver_js_1.DefaultResolverUrl}${issuer}?resourceName=${args.statusOptions.statusListName}&resourceType=StatusList2021Suspension`;
+        const statusListCredential = `${cheqd_did_resolver_js_1.DefaultResolverUrl}${issuer}?resourceName=${args.statusOptions.statusListName}&resourceType=${cheqd_did_provider_js_1.DefaultStatusList2021ResourceTypes.suspension}`;
         // construct credential status
         const credentialStatus = {
             id: `${statusListCredential}#${statusListIndex}`,
             type: 'StatusList2021Entry',
-            statusPurpose: 'suspension',
+            statusPurpose: cheqd_did_provider_js_1.DefaultStatusList2021StatusPurposeTypes.suspension,
             statusListIndex: `${statusListIndex}`,
         };
         // add credential status to credential
@@ -1040,14 +1045,16 @@ class Cheqd {
         args.dkgOptions ||= this.didProvider.dkgOptions;
         // verify credential status
         switch (credential.credentialStatus?.statusPurpose) {
-            case 'revocation':
-                if (await Cheqd.checkRevoked(credential, { ...args.options, topArgs: args }))
-                    return { ...verificationResult, revoked: true };
-                return { ...verificationResult, revoked: false };
-            case 'suspension':
-                if (await Cheqd.checkSuspended(credential, { ...args.options, topArgs: args }))
-                    return { ...verificationResult, suspended: true };
-                return { ...verificationResult, suspended: false };
+            case cheqd_did_provider_js_1.DefaultStatusList2021StatusPurposeTypes.revocation:
+                return {
+                    ...verificationResult,
+                    revoked: await Cheqd.checkRevoked(credential, { ...args.options, topArgs: args }),
+                };
+            case cheqd_did_provider_js_1.DefaultStatusList2021StatusPurposeTypes.suspension:
+                return {
+                    ...verificationResult,
+                    suspended: await Cheqd.checkSuspended(credential, { ...args.options, topArgs: args }),
+                };
             default:
                 throw new Error(`[did-provider-cheqd]: verify credential: Unsupported status purpose: ${credential.credentialStatus?.statusPurpose}`);
         }
@@ -1083,14 +1090,16 @@ class Cheqd {
             // define dkg options, if provided
             args.dkgOptions ||= this.didProvider.dkgOptions;
             switch (credential.credentialStatus?.statusPurpose) {
-                case 'revocation':
-                    if (await Cheqd.checkRevoked(credential, { ...args.options, topArgs: args }))
-                        return { ...verificationResult, revoked: true };
-                    break;
-                case 'suspension':
-                    if (await Cheqd.checkSuspended(credential, { ...args.options, topArgs: args }))
-                        return { ...verificationResult, suspended: true };
-                    break;
+                case cheqd_did_provider_js_1.DefaultStatusList2021StatusPurposeTypes.revocation:
+                    return {
+                        ...verificationResult,
+                        revoked: await Cheqd.checkRevoked(credential, { ...args.options, topArgs: args }),
+                    };
+                case cheqd_did_provider_js_1.DefaultStatusList2021StatusPurposeTypes.suspension:
+                    return {
+                        ...verificationResult,
+                        suspended: await Cheqd.checkSuspended(credential, { ...args.options, topArgs: args }),
+                    };
                 default:
                     throw new Error(`[did-provider-cheqd]: verify presentation: Unsupported status purpose: ${credential.credentialStatus?.statusPurpose}`);
             }
@@ -1127,9 +1136,9 @@ class Cheqd {
             if (!args.statusOptions.statusListIndex)
                 throw new Error('[did-provider-cheqd]: check status: statusOptions.statusListIndex is required');
             // generate resource type
-            const resourceType = args.statusOptions.statusPurpose === 'revocation'
-                ? 'StatusList2021Revocation'
-                : 'StatusList2021Suspension';
+            const resourceType = args.statusOptions.statusPurpose === cheqd_did_provider_js_1.DefaultStatusList2021StatusPurposeTypes.revocation
+                ? cheqd_did_provider_js_1.DefaultStatusList2021ResourceTypes.revocation
+                : cheqd_did_provider_js_1.DefaultStatusList2021ResourceTypes.suspension;
             // construct status list credential
             const statusListCredential = `${cheqd_did_resolver_js_1.DefaultResolverUrl}${args.statusOptions.issuerDid}?resourceName=${args.statusOptions.statusListName}&resourceType=${resourceType}`;
             // construct credential status
@@ -1161,14 +1170,10 @@ class Cheqd {
         // define dkg options, if provided
         args.dkgOptions ||= this.didProvider.dkgOptions;
         switch (credential.credentialStatus?.statusPurpose) {
-            case 'revocation':
-                if (await Cheqd.checkRevoked(credential, { ...args.options, topArgs: args }))
-                    return { revoked: true };
-                return { revoked: false };
-            case 'suspension':
-                if (await Cheqd.checkSuspended(credential, { ...args.options, topArgs: args }))
-                    return { suspended: true };
-                return { suspended: false };
+            case cheqd_did_provider_js_1.DefaultStatusList2021StatusPurposeTypes.revocation:
+                return { revoked: await Cheqd.checkRevoked(credential, { ...args.options, topArgs: args }) };
+            case cheqd_did_provider_js_1.DefaultStatusList2021StatusPurposeTypes.suspension:
+                return { suspended: await Cheqd.checkSuspended(credential, { ...args.options, topArgs: args }) };
             default:
                 throw new Error(`[did-provider-cheqd]: check status: Unsupported status purpose: ${credential.credentialStatus?.statusPurpose}`);
         }
@@ -1200,7 +1205,7 @@ class Cheqd {
             if (!args.revocationOptions.statusListIndex)
                 throw new Error('[did-provider-cheqd]: revocation: revocationOptions.statusListIndex is required');
             // construct status list credential
-            const statusListCredential = `${cheqd_did_resolver_js_1.DefaultResolverUrl}${args.revocationOptions.issuerDid}?resourceName=${args.revocationOptions.statusListName}&resourceType=StatusList2021Revocation`;
+            const statusListCredential = `${cheqd_did_resolver_js_1.DefaultResolverUrl}${args.revocationOptions.issuerDid}?resourceName=${args.revocationOptions.statusListName}&resourceType=${cheqd_did_provider_js_1.DefaultStatusList2021ResourceTypes.revocation}`;
             // construct credential status
             args.credential = {
                 '@context': [],
@@ -1209,7 +1214,7 @@ class Cheqd {
                 credentialStatus: {
                     id: `${statusListCredential}#${args.revocationOptions.statusListIndex}`,
                     type: 'StatusList2021Entry',
-                    statusPurpose: 'revocation',
+                    statusPurpose: cheqd_did_provider_js_1.DefaultStatusList2021StatusPurposeTypes.revocation,
                     statusListIndex: `${args.revocationOptions.statusListIndex}`,
                 },
                 issuanceDate: '',
@@ -1222,7 +1227,7 @@ class Cheqd {
         // if jwt credential, decode it
         const credential = typeof args.credential === 'string' ? await Cheqd.decodeCredentialJWT(args.credential) : args.credential;
         // validate status purpose
-        if (credential.credentialStatus?.statusPurpose !== 'revocation') {
+        if (credential.credentialStatus?.statusPurpose !== cheqd_did_provider_js_1.DefaultStatusList2021StatusPurposeTypes.revocation) {
             throw new Error(`[did-provider-cheqd]: revocation: Unsupported status purpose: ${credential.credentialStatus?.statusPurpose}`);
         }
         // validate args in pairs - case: statusListFile and statusList
@@ -1303,7 +1308,7 @@ class Cheqd {
                 !args.revocationOptions.statusListIndices.every((index) => !isNaN(+index)))
                 throw new Error('[did-provider-cheqd]: revocation: revocationOptions.statusListIndex is required and must be an array of indices');
             // construct status list credential
-            const statusListCredential = `${cheqd_did_resolver_js_1.DefaultResolverUrl}${args.revocationOptions.issuerDid}?resourceName=${args.revocationOptions.statusListName}&resourceType=StatusList2021Revocation`;
+            const statusListCredential = `${cheqd_did_resolver_js_1.DefaultResolverUrl}${args.revocationOptions.issuerDid}?resourceName=${args.revocationOptions.statusListName}&resourceType=${cheqd_did_provider_js_1.DefaultStatusList2021ResourceTypes.revocation}`;
             // construct credential status
             args.credentials = args.revocationOptions.statusListIndices.map((index) => ({
                 '@context': [],
@@ -1312,7 +1317,7 @@ class Cheqd {
                 credentialStatus: {
                     id: `${statusListCredential}#${index}`,
                     type: 'StatusList2021Entry',
-                    statusPurpose: 'revocation',
+                    statusPurpose: cheqd_did_provider_js_1.DefaultStatusList2021StatusPurposeTypes.revocation,
                     statusListIndex: `${index}`,
                 },
                 issuanceDate: '',
@@ -1391,7 +1396,7 @@ class Cheqd {
             if (!args.suspensionOptions.statusListIndex)
                 throw new Error('[did-provider-cheqd]: suspension: suspensionOptions.statusListIndex is required');
             // construct status list credential
-            const statusListCredential = `${cheqd_did_resolver_js_1.DefaultResolverUrl}${args.suspensionOptions.issuerDid}?resourceName=${args.suspensionOptions.statusListName}&resourceType=StatusList2021Suspension`;
+            const statusListCredential = `${cheqd_did_resolver_js_1.DefaultResolverUrl}${args.suspensionOptions.issuerDid}?resourceName=${args.suspensionOptions.statusListName}&resourceType=${cheqd_did_provider_js_1.DefaultStatusList2021ResourceTypes.suspension}`;
             // construct credential status
             args.credential = {
                 '@context': [],
@@ -1400,7 +1405,7 @@ class Cheqd {
                 credentialStatus: {
                     id: `${statusListCredential}#${args.suspensionOptions.statusListIndex}`,
                     type: 'StatusList2021Entry',
-                    statusPurpose: 'suspension',
+                    statusPurpose: cheqd_did_provider_js_1.DefaultStatusList2021StatusPurposeTypes.suspension,
                     statusListIndex: `${args.suspensionOptions.statusListIndex}`,
                 },
                 issuanceDate: '',
@@ -1413,7 +1418,7 @@ class Cheqd {
         // if jwt credential, decode it
         const credential = typeof args.credential === 'string' ? await Cheqd.decodeCredentialJWT(args.credential) : args.credential;
         // validate status purpose
-        if (credential.credentialStatus?.statusPurpose !== 'suspension') {
+        if (credential.credentialStatus?.statusPurpose !== cheqd_did_provider_js_1.DefaultStatusList2021StatusPurposeTypes.suspension) {
             throw new Error(`[did-provider-cheqd]: suspension: Unsupported status purpose: ${credential.credentialStatus?.statusPurpose}`);
         }
         // validate args in pairs - case: statusListFile and statusList
@@ -1494,7 +1499,7 @@ class Cheqd {
                 !args.suspensionOptions.statusListIndices.every((index) => !isNaN(+index)))
                 throw new Error('[did-provider-cheqd]: suspension: suspensionOptions.statusListIndex is required and must be an array of indices');
             // construct status list credential
-            const statusListCredential = `${cheqd_did_resolver_js_1.DefaultResolverUrl}${args.suspensionOptions.issuerDid}?resourceName=${args.suspensionOptions.statusListName}&resourceType=StatusList2021Suspension`;
+            const statusListCredential = `${cheqd_did_resolver_js_1.DefaultResolverUrl}${args.suspensionOptions.issuerDid}?resourceName=${args.suspensionOptions.statusListName}&resourceType=${cheqd_did_provider_js_1.DefaultStatusList2021ResourceTypes.suspension}`;
             // construct credential status
             args.credentials = args.suspensionOptions.statusListIndices.map((index) => ({
                 '@context': [],
@@ -1503,7 +1508,7 @@ class Cheqd {
                 credentialStatus: {
                     id: `${statusListCredential}#${index}`,
                     type: 'StatusList2021Entry',
-                    statusPurpose: 'suspension',
+                    statusPurpose: cheqd_did_provider_js_1.DefaultStatusList2021StatusPurposeTypes.suspension,
                     statusListIndex: `${index}`,
                 },
                 issuanceDate: '',
@@ -1582,7 +1587,7 @@ class Cheqd {
             if (!args.unsuspensionOptions.statusListIndex)
                 throw new Error('[did-provider-cheqd]: unsuspension: unsuspensionOptions.statusListIndex is required');
             // construct status list credential
-            const statusListCredential = `${cheqd_did_resolver_js_1.DefaultResolverUrl}${args.unsuspensionOptions.issuerDid}?resourceName=${args.unsuspensionOptions.statusListName}&resourceType=StatusList2021Suspension`;
+            const statusListCredential = `${cheqd_did_resolver_js_1.DefaultResolverUrl}${args.unsuspensionOptions.issuerDid}?resourceName=${args.unsuspensionOptions.statusListName}&resourceType=${cheqd_did_provider_js_1.DefaultStatusList2021ResourceTypes.suspension}`;
             // construct credential status
             args.credential = {
                 '@context': [],
@@ -1591,7 +1596,7 @@ class Cheqd {
                 credentialStatus: {
                     id: `${statusListCredential}#${args.unsuspensionOptions.statusListIndex}`,
                     type: 'StatusList2021Entry',
-                    statusPurpose: 'suspension',
+                    statusPurpose: cheqd_did_provider_js_1.DefaultStatusList2021StatusPurposeTypes.suspension,
                     statusListIndex: `${args.unsuspensionOptions.statusListIndex}`,
                 },
                 issuanceDate: '',
@@ -1604,7 +1609,7 @@ class Cheqd {
         // if jwt credential, decode it
         const credential = typeof args.credential === 'string' ? await Cheqd.decodeCredentialJWT(args.credential) : args.credential;
         // validate status purpose
-        if (credential.credentialStatus?.statusPurpose !== 'suspension') {
+        if (credential.credentialStatus?.statusPurpose !== cheqd_did_provider_js_1.DefaultStatusList2021StatusPurposeTypes.suspension) {
             throw new Error(`[did-provider-cheqd]: suspension: Unsupported status purpose: ${credential.credentialStatus?.statusPurpose}`);
         }
         // validate args in pairs - case: statusListFile and statusList
@@ -1685,7 +1690,7 @@ class Cheqd {
                 !args.unsuspensionOptions.statusListIndices.every((index) => !isNaN(+index)))
                 throw new Error('[did-provider-cheqd]: unsuspension: unsuspensionOptions.statusListIndex is required and must be an array of indices');
             // construct status list credential
-            const statusListCredential = `${cheqd_did_resolver_js_1.DefaultResolverUrl}${args.unsuspensionOptions.issuerDid}?resourceName=${args.unsuspensionOptions.statusListName}&resourceType=StatusList2021Suspension`;
+            const statusListCredential = `${cheqd_did_resolver_js_1.DefaultResolverUrl}${args.unsuspensionOptions.issuerDid}?resourceName=${args.unsuspensionOptions.statusListName}&resourceType=${cheqd_did_provider_js_1.DefaultStatusList2021ResourceTypes.suspension}`;
             // construct credential status
             args.credentials = args.unsuspensionOptions.statusListIndices.map((index) => ({
                 '@context': [],
@@ -1694,7 +1699,7 @@ class Cheqd {
                 credentialStatus: {
                     id: `${statusListCredential}#${index}`,
                     type: 'StatusList2021Entry',
-                    statusPurpose: 'suspension',
+                    statusPurpose: cheqd_did_provider_js_1.DefaultStatusList2021StatusPurposeTypes.suspension,
                     statusListIndex: `${index}`,
                 },
                 issuanceDate: '',
@@ -1785,7 +1790,7 @@ class Cheqd {
         if (args?.unifiedAccessControlCondition) {
             // validate args - case: unifiedAccessControlCondition.chain
             if (!args.unifiedAccessControlCondition.chain ||
-                !Object.values(lit_protocol_js_1.LitCompatibleCosmosChains).includes(args.unifiedAccessControlCondition.chain))
+                !Object.values(v3_js_1.LitCompatibleCosmosChains).includes(args.unifiedAccessControlCondition.chain))
                 throw new Error('[did-provider-cheqd]: observe: unifiedAccessControlCondition.chain is required and must be a valid Lit-compatible chain');
             // validate args - case: unifiedAccessControlCondition.path
             if (!args.unifiedAccessControlCondition.path)
@@ -1812,9 +1817,9 @@ class Cheqd {
                 // define network
                 const network = (function () {
                     switch (args.unifiedAccessControlCondition.chain) {
-                        case lit_protocol_js_1.LitCompatibleCosmosChains.cheqdMainnet:
+                        case v3_js_1.LitCompatibleCosmosChains.cheqdMainnet:
                             return sdk_1.CheqdNetwork.Mainnet;
-                        case lit_protocol_js_1.LitCompatibleCosmosChains.cheqdTestnet:
+                        case v3_js_1.LitCompatibleCosmosChains.cheqdTestnet:
                             return sdk_1.CheqdNetwork.Testnet;
                         default:
                             throw new Error(`[did-provider-cheqd]: observe: Unsupported chain: ${args.unifiedAccessControlCondition.chain}`);
@@ -1962,7 +1967,7 @@ class Cheqd {
     static async revokeCredential(credential, options) {
         try {
             // validate status purpose
-            if (credential?.credentialStatus?.statusPurpose !== 'revocation')
+            if (credential?.credentialStatus?.statusPurpose !== cheqd_did_provider_js_1.DefaultStatusList2021StatusPurposeTypes.revocation)
                 throw new Error('[did-provider-cheqd]: revocation: Invalid status purpose');
             // fetch status list 2021
             const publishedList = (await Cheqd.fetchStatusList2021(credential));
@@ -1977,10 +1982,17 @@ class Cheqd {
                         return publishedList.metadata.encoding === 'base64url'
                             ? publishedList.StatusList2021.encodedList
                             : (0, uint8arrays_1.toString)((0, uint8arrays_1.fromString)(publishedList.StatusList2021.encodedList, publishedList.metadata.encoding), 'base64url');
+                    // decrypt + return bitstring, if qualified for migration
+                    if (publishedList.metadata.encryptedSymmetricKey)
+                        return await v2_js_1.LitProtocolV2.decryptDirect(await (0, helpers_js_1.toBlob)((0, uint8arrays_1.fromString)(publishedList.StatusList2021
+                            .encodedList, 'hex')), (0, uint8arrays_1.fromString)(options?.topArgs?.symmetricKey, 'hex'));
+                    // validate encoded list
+                    if (!(0, helpers_js_1.isEncodedList)(publishedList.StatusList2021.encodedList))
+                        throw new Error('[did-provider-cheqd]: revocation: Invalid encoded list');
                     // otherwise, decrypt and return raw bitstring
-                    const scopedRawBlob = await (0, helpers_js_1.toBlob)((0, uint8arrays_1.fromString)(publishedList.StatusList2021.encodedList, 'hex'));
+                    const scopedRawBlob = await (0, helpers_js_1.toBlob)((0, uint8arrays_1.fromString)((0, helpers_js_1.getEncodedList)(publishedList.StatusList2021.encodedList, false)[0], 'hex'));
                     // decrypt
-                    return await lit_protocol_js_1.LitProtocol.decryptDirect(scopedRawBlob, (0, uint8arrays_1.fromString)(options?.topArgs?.symmetricKey, 'hex'));
+                    return (0, uint8arrays_1.toString)(await v3_js_1.LitProtocol.decryptDirect(scopedRawBlob, await (0, helpers_js_1.safeDeserialise)(options?.topArgs?.symmetricKey, uint8arrays_1.fromString, ['hex'], 'Invalid symmetric key')), 'base64url');
                 })()
                 : await (async function () {
                     // transcode to base64url, if needed
@@ -2004,7 +2016,7 @@ class Cheqd {
                         // otherwise, decrypt and return bitstring
                         const scopedRawBlob = await (0, helpers_js_1.toBlob)(await Cheqd.getFile(options.statusListFile));
                         // decrypt
-                        const decrypted = await lit_protocol_js_1.LitProtocol.decryptDirect(scopedRawBlob, (0, uint8arrays_1.fromString)(options?.topArgs?.symmetricKey, 'hex'));
+                        const decrypted = (0, uint8arrays_1.toString)(await v3_js_1.LitProtocol.decryptDirect(scopedRawBlob, await (0, helpers_js_1.safeDeserialise)(options?.topArgs?.symmetricKey, uint8arrays_1.fromString, ['hex'], 'Invalid symmetric key')), 'base64url');
                         // validate against published list
                         if (decrypted !== publishedListTranscoded)
                             throw new Error('[did-provider-cheqd]: revocation: statusListFile does not match published status list 2021');
@@ -2023,7 +2035,7 @@ class Cheqd {
             const statusList = await vc_status_list_1.StatusList.decode({ encodedList: statusList2021 });
             // early exit, if credential is already revoked
             if (statusList.getStatus(Number(credential.credentialStatus.statusListIndex)))
-                return { revoked: false };
+                return { revoked: true };
             // update revocation status
             statusList.setStatus(Number(credential.credentialStatus.statusListIndex), true);
             // set in-memory status list ref
@@ -2085,8 +2097,10 @@ class Cheqd {
                                 !topArgs?.dkgOptions?.network) {
                                 throw new Error('[did-provider-cheqd]: dkgOptions is required');
                             }
+                            // encrypt bitstring - case: symmetric
+                            const { encryptedString: symmetricEncryptionCiphertext, stringHash: symmetricEncryptionStringHash, symmetricKey, } = await v3_js_1.LitProtocol.encryptDirect((0, uint8arrays_1.fromString)(bitstring, 'base64url'));
                             // instantiate dkg-threshold client, in which case lit-protocol is used
-                            const lit = await lit_protocol_js_1.LitProtocol.create({
+                            const lit = await v3_js_1.LitProtocol.create({
                                 chain: topArgs?.dkgOptions?.chain,
                                 litNetwork: topArgs?.dkgOptions?.network,
                             });
@@ -2101,7 +2115,7 @@ class Cheqd {
                                         await Promise.all(paymentConditions.map(async (condition) => {
                                             switch (condition.type) {
                                                 case exports.AccessControlConditionTypes.timelockPayment:
-                                                    return await lit_protocol_js_1.LitProtocol.generateCosmosAccessControlConditionInverseTimelock({
+                                                    return await v3_js_1.LitProtocol.generateCosmosAccessControlConditionInverseTimelock({
                                                         key: '$.tx_responses.*.timestamp',
                                                         comparator: '<=',
                                                         value: `${condition.intervalInSeconds}`,
@@ -2123,7 +2137,7 @@ class Cheqd {
                                         await Promise.all(topArgs.paymentConditions.map(async (condition) => {
                                             switch (condition.type) {
                                                 case exports.AccessControlConditionTypes.timelockPayment:
-                                                    return await lit_protocol_js_1.LitProtocol.generateCosmosAccessControlConditionInverseTimelock({
+                                                    return await v3_js_1.LitProtocol.generateCosmosAccessControlConditionInverseTimelock({
                                                         key: '$.tx_responses.*.timestamp',
                                                         comparator: '<=',
                                                         value: `${condition.intervalInSeconds}`,
@@ -2135,13 +2149,15 @@ class Cheqd {
                                         topArgs.paymentConditions,
                                     ];
                                 })();
-                            // encrypt bitstring
-                            const { encryptedString, encryptedSymmetricKey, symmetricKey } = await lit.encrypt(bitstring, unifiedAccessControlConditionsTuple[0], true);
+                            // encrypt bitstring - case: threshold
+                            const { encryptedString: thresholdEncryptionCiphertext, stringHash: thresholdEncryptionStringHash, } = await lit.encrypt((0, uint8arrays_1.fromString)(bitstring, 'base64url'), unifiedAccessControlConditionsTuple[0]);
+                            // construct encoded list
+                            const encodedList = `${await (0, helpers_js_1.blobToHexString)(symmetricEncryptionCiphertext)}-${(0, uint8arrays_1.toString)(thresholdEncryptionCiphertext, 'hex')}`;
                             // define status list content
                             const content = {
                                 StatusList2021: {
                                     statusPurpose: publishedList.StatusList2021.statusPurpose,
-                                    encodedList: await (0, helpers_js_1.blobToHexString)(encryptedString),
+                                    encodedList,
                                     validFrom: publishedList.StatusList2021.validFrom,
                                     validUntil: options?.publishOptions?.statusListValidUntil ||
                                         publishedList.StatusList2021.validUntil,
@@ -2150,7 +2166,11 @@ class Cheqd {
                                     type: publishedList.metadata.type,
                                     encrypted: true,
                                     encoding: options?.publishOptions?.statusListEncoding || publishedList.metadata.encoding,
-                                    encryptedSymmetricKey,
+                                    statusListHash: symmetricEncryptionStringHash === thresholdEncryptionStringHash
+                                        ? symmetricEncryptionStringHash
+                                        : (function () {
+                                            throw new Error('[did-provider-cheqd]: revocation: symmetricEncryptionStringHash and thresholdEncryptionStringHash do not match');
+                                        })(),
                                     paymentConditions: unifiedAccessControlConditionsTuple[1],
                                 },
                             };
@@ -2158,9 +2178,10 @@ class Cheqd {
                             return [
                                 await Cheqd.publishStatusList2021((0, uint8arrays_1.fromString)(JSON.stringify(content), 'utf-8'), statusListMetadata, options?.publishOptions),
                                 {
-                                    encryptedString,
-                                    encryptedSymmetricKey,
-                                    symmetricKey: (0, uint8arrays_1.toString)(symmetricKey, 'hex'),
+                                    symmetricEncryptionCiphertext,
+                                    thresholdEncryptionCiphertext,
+                                    stringHash: symmetricEncryptionStringHash,
+                                    symmetricKey,
                                 },
                             ];
                         })()
@@ -2224,7 +2245,7 @@ class Cheqd {
                     ? (await Cheqd.fetchStatusList2021(credential))
                     : undefined,
                 symmetricKey: topArgs?.returnSymmetricKey
-                    ? published?.[1]?.symmetricKey
+                    ? (0, uint8arrays_1.toString)(published?.[1]?.symmetricKey, 'hex')
                     : undefined,
                 resourceMetadata: topArgs?.returnStatusListMetadata
                     ? await Cheqd.fetchStatusList2021Metadata(credential)
@@ -2256,7 +2277,7 @@ class Cheqd {
             .filter((value, index, self) => self.indexOf(value) !== index).length > 0)
             throw new Error('[did-provider-cheqd]: revocation: Credentials must have unique status list index');
         // validate credentials - case: status purpose
-        if (!credentials.every((credential) => credential.credentialStatus?.statusPurpose === 'revocation'))
+        if (!credentials.every((credential) => credential.credentialStatus?.statusPurpose === cheqd_did_provider_js_1.DefaultStatusList2021StatusPurposeTypes.revocation))
             throw new Error('[did-provider-cheqd]: revocation: Invalid status purpose');
         // validate credentials - case: status list id
         const remote = credentials[0].credentialStatus?.id
@@ -2288,10 +2309,17 @@ class Cheqd {
                         return publishedList.metadata.encoding === 'base64url'
                             ? publishedList.StatusList2021.encodedList
                             : (0, uint8arrays_1.toString)((0, uint8arrays_1.fromString)(publishedList.StatusList2021.encodedList, publishedList.metadata.encoding), 'base64url');
+                    // decrypt + return bitstring, if qualified for migration
+                    if (publishedList.metadata.encryptedSymmetricKey)
+                        return await v2_js_1.LitProtocolV2.decryptDirect(await (0, helpers_js_1.toBlob)((0, uint8arrays_1.fromString)(publishedList.StatusList2021
+                            .encodedList, 'hex')), (0, uint8arrays_1.fromString)(options?.topArgs?.symmetricKey, 'hex'));
+                    // validate encoded list
+                    if (!(0, helpers_js_1.isEncodedList)(publishedList.StatusList2021.encodedList))
+                        throw new Error('[did-provider-cheqd]: revocation: Invalid encoded list');
                     // otherwise, decrypt and return raw bitstring
-                    const scopedRawBlob = await (0, helpers_js_1.toBlob)((0, uint8arrays_1.fromString)(publishedList.StatusList2021.encodedList, 'hex'));
+                    const scopedRawBlob = await (0, helpers_js_1.toBlob)((0, uint8arrays_1.fromString)((0, helpers_js_1.getEncodedList)(publishedList.StatusList2021.encodedList, false)[0], 'hex'));
                     // decrypt
-                    return await lit_protocol_js_1.LitProtocol.decryptDirect(scopedRawBlob, (0, uint8arrays_1.fromString)(options?.topArgs?.symmetricKey, 'hex'));
+                    return (0, uint8arrays_1.toString)(await v3_js_1.LitProtocol.decryptDirect(scopedRawBlob, await (0, helpers_js_1.safeDeserialise)(options?.topArgs?.symmetricKey, uint8arrays_1.fromString, ['hex'], 'Invalid symmetric key')), 'base64url');
                 })()
                 : await (async function () {
                     // transcode to base64url, if needed
@@ -2315,7 +2343,7 @@ class Cheqd {
                         // otherwise, decrypt and return bitstring
                         const scopedRawBlob = await (0, helpers_js_1.toBlob)(await Cheqd.getFile(options.statusListFile));
                         // decrypt
-                        const decrypted = await lit_protocol_js_1.LitProtocol.decryptDirect(scopedRawBlob, (0, uint8arrays_1.fromString)(options?.topArgs?.symmetricKey, 'hex'));
+                        const decrypted = (0, uint8arrays_1.toString)(await v3_js_1.LitProtocol.decryptDirect(scopedRawBlob, await (0, helpers_js_1.safeDeserialise)(options?.topArgs?.symmetricKey, uint8arrays_1.fromString, ['hex'], 'Invalid symmetric key')), 'base64url');
                         // validate against published list
                         if (decrypted !== publishedListTranscoded)
                             throw new Error('[did-provider-cheqd]: revocation: statusListFile does not match published status list 2021');
@@ -2411,8 +2439,10 @@ class Cheqd {
                                 !topArgs?.dkgOptions?.network) {
                                 throw new Error('[did-provider-cheqd]: dkgOptions is required');
                             }
+                            // encrypt bitstring - case: symmetric
+                            const { encryptedString: symmetricEncryptionCiphertext, stringHash: symmetricEncryptionStringHash, symmetricKey, } = await v3_js_1.LitProtocol.encryptDirect((0, uint8arrays_1.fromString)(bitstring, 'base64url'));
                             // instantiate dkg-threshold client, in which case lit-protocol is used
-                            const lit = await lit_protocol_js_1.LitProtocol.create({
+                            const lit = await v3_js_1.LitProtocol.create({
                                 chain: topArgs?.dkgOptions?.chain,
                                 litNetwork: topArgs?.dkgOptions?.network,
                             });
@@ -2427,7 +2457,7 @@ class Cheqd {
                                         await Promise.all(paymentConditions.map(async (condition) => {
                                             switch (condition.type) {
                                                 case exports.AccessControlConditionTypes.timelockPayment:
-                                                    return await lit_protocol_js_1.LitProtocol.generateCosmosAccessControlConditionInverseTimelock({
+                                                    return await v3_js_1.LitProtocol.generateCosmosAccessControlConditionInverseTimelock({
                                                         key: '$.tx_responses.*.timestamp',
                                                         comparator: '<=',
                                                         value: `${condition.intervalInSeconds}`,
@@ -2449,7 +2479,7 @@ class Cheqd {
                                         await Promise.all(topArgs.paymentConditions.map(async (condition) => {
                                             switch (condition.type) {
                                                 case exports.AccessControlConditionTypes.timelockPayment:
-                                                    return await lit_protocol_js_1.LitProtocol.generateCosmosAccessControlConditionInverseTimelock({
+                                                    return await v3_js_1.LitProtocol.generateCosmosAccessControlConditionInverseTimelock({
                                                         key: '$.tx_responses.*.timestamp',
                                                         comparator: '<=',
                                                         value: `${condition.intervalInSeconds}`,
@@ -2461,13 +2491,15 @@ class Cheqd {
                                         topArgs.paymentConditions,
                                     ];
                                 })();
-                            // encrypt bitstring
-                            const { encryptedString, encryptedSymmetricKey, symmetricKey } = await lit.encrypt(bitstring, unifiedAccessControlConditionsTuple[0], true);
+                            // encrypt bitstring - case: threshold
+                            const { encryptedString: thresholdEncryptionCiphertext, stringHash: thresholdEncryptionStringHash, } = await lit.encrypt((0, uint8arrays_1.fromString)(bitstring, 'base64url'), unifiedAccessControlConditionsTuple[0]);
+                            // construct encoded list
+                            const encodedList = `${await (0, helpers_js_1.blobToHexString)(symmetricEncryptionCiphertext)}-${(0, uint8arrays_1.toString)(thresholdEncryptionCiphertext, 'hex')}`;
                             // define status list content
                             const content = {
                                 StatusList2021: {
                                     statusPurpose: publishedList.StatusList2021.statusPurpose,
-                                    encodedList: await (0, helpers_js_1.blobToHexString)(encryptedString),
+                                    encodedList,
                                     validFrom: publishedList.StatusList2021.validFrom,
                                     validUntil: options?.publishOptions?.statusListValidUntil ||
                                         publishedList.StatusList2021.validUntil,
@@ -2476,7 +2508,11 @@ class Cheqd {
                                     type: publishedList.metadata.type,
                                     encrypted: true,
                                     encoding: options?.publishOptions?.statusListEncoding || publishedList.metadata.encoding,
-                                    encryptedSymmetricKey,
+                                    statusListHash: symmetricEncryptionStringHash === thresholdEncryptionStringHash
+                                        ? symmetricEncryptionStringHash
+                                        : (function () {
+                                            throw new Error('[did-provider-cheqd]: revocation: symmetricEncryptionStringHash and thresholdEncryptionStringHash do not match');
+                                        })(),
                                     paymentConditions: unifiedAccessControlConditionsTuple[1],
                                 },
                             };
@@ -2484,9 +2520,10 @@ class Cheqd {
                             return [
                                 await Cheqd.publishStatusList2021((0, uint8arrays_1.fromString)(JSON.stringify(content), 'utf-8'), statusListMetadata, options?.publishOptions),
                                 {
-                                    encryptedString,
-                                    encryptedSymmetricKey,
-                                    symmetricKey: (0, uint8arrays_1.toString)(symmetricKey, 'hex'),
+                                    symmetricEncryptionCiphertext,
+                                    thresholdEncryptionCiphertext,
+                                    stringHash: symmetricEncryptionStringHash,
+                                    symmetricKey,
                                 },
                             ];
                         })()
@@ -2550,7 +2587,7 @@ class Cheqd {
                     ? (await Cheqd.fetchStatusList2021(credentials[0]))
                     : undefined,
                 symmetricKey: topArgs?.returnSymmetricKey
-                    ? published?.[1]?.symmetricKey
+                    ? (0, uint8arrays_1.toString)(published?.[1]?.symmetricKey, 'hex')
                     : undefined,
                 resourceMetadata: topArgs?.returnStatusListMetadata
                     ? await Cheqd.fetchStatusList2021Metadata(credentials[0])
@@ -2566,7 +2603,7 @@ class Cheqd {
     static async suspendCredential(credential, options) {
         try {
             // validate status purpose
-            if (credential?.credentialStatus?.statusPurpose !== 'suspension')
+            if (credential?.credentialStatus?.statusPurpose !== cheqd_did_provider_js_1.DefaultStatusList2021StatusPurposeTypes.suspension)
                 throw new Error('[did-provider-cheqd]: suspension: Invalid status purpose');
             // fetch status list 2021
             const publishedList = (await Cheqd.fetchStatusList2021(credential));
@@ -2581,10 +2618,17 @@ class Cheqd {
                         return publishedList.metadata.encoding === 'base64url'
                             ? publishedList.StatusList2021.encodedList
                             : (0, uint8arrays_1.toString)((0, uint8arrays_1.fromString)(publishedList.StatusList2021.encodedList, publishedList.metadata.encoding), 'base64url');
+                    // decrypt + return bitstring, if qualified for migration
+                    if (publishedList.metadata.encryptedSymmetricKey)
+                        return await v2_js_1.LitProtocolV2.decryptDirect(await (0, helpers_js_1.toBlob)((0, uint8arrays_1.fromString)(publishedList.StatusList2021
+                            .encodedList, 'hex')), (0, uint8arrays_1.fromString)(options?.topArgs?.symmetricKey, 'hex'));
+                    // validate encoded list
+                    if (!(0, helpers_js_1.isEncodedList)(publishedList.StatusList2021.encodedList))
+                        throw new Error('[did-provider-cheqd]: suspension: Invalid encoded list');
                     // otherwise, decrypt and return raw bitstring
-                    const scopedRawBlob = await (0, helpers_js_1.toBlob)((0, uint8arrays_1.fromString)(publishedList.StatusList2021.encodedList, 'hex'));
+                    const scopedRawBlob = await (0, helpers_js_1.toBlob)((0, uint8arrays_1.fromString)((0, helpers_js_1.getEncodedList)(publishedList.StatusList2021.encodedList, false)[0], 'hex'));
                     // decrypt
-                    return await lit_protocol_js_1.LitProtocol.decryptDirect(scopedRawBlob, (0, uint8arrays_1.fromString)(options?.topArgs?.symmetricKey, 'hex'));
+                    return (0, uint8arrays_1.toString)(await v3_js_1.LitProtocol.decryptDirect(scopedRawBlob, await (0, helpers_js_1.safeDeserialise)(options?.topArgs?.symmetricKey, uint8arrays_1.fromString, ['hex'], 'Invalid symmetric key')), 'base64url');
                 })()
                 : await (async function () {
                     // transcode to base64url, if needed
@@ -2608,7 +2652,7 @@ class Cheqd {
                         // otherwise, decrypt and return bitstring
                         const scopedRawBlob = await (0, helpers_js_1.toBlob)(await Cheqd.getFile(options.statusListFile));
                         // decrypt
-                        const decrypted = await lit_protocol_js_1.LitProtocol.decryptDirect(scopedRawBlob, (0, uint8arrays_1.fromString)(options?.topArgs?.symmetricKey, 'hex'));
+                        const decrypted = (0, uint8arrays_1.toString)(await v3_js_1.LitProtocol.decryptDirect(scopedRawBlob, await (0, helpers_js_1.safeDeserialise)(options?.topArgs?.symmetricKey, uint8arrays_1.fromString, ['hex'], 'Invalid symmetric key')), 'base64url');
                         // validate against published list
                         if (decrypted !== publishedListTranscoded)
                             throw new Error('[did-provider-cheqd]: suspension: statusListFile does not match published status list 2021');
@@ -2689,8 +2733,10 @@ class Cheqd {
                                 !topArgs?.dkgOptions?.network) {
                                 throw new Error('[did-provider-cheqd]: dkgOptions is required');
                             }
+                            // encrypt bitstring - case: symmetric
+                            const { encryptedString: symmetricEncryptionCiphertext, stringHash: symmetricEncryptionStringHash, symmetricKey, } = await v3_js_1.LitProtocol.encryptDirect((0, uint8arrays_1.fromString)(bitstring, 'base64url'));
                             // instantiate dkg-threshold client, in which case lit-protocol is used
-                            const lit = await lit_protocol_js_1.LitProtocol.create({
+                            const lit = await v3_js_1.LitProtocol.create({
                                 chain: topArgs?.dkgOptions?.chain,
                                 litNetwork: topArgs?.dkgOptions?.network,
                             });
@@ -2705,7 +2751,7 @@ class Cheqd {
                                         await Promise.all(paymentConditions.map(async (condition) => {
                                             switch (condition.type) {
                                                 case exports.AccessControlConditionTypes.timelockPayment:
-                                                    return await lit_protocol_js_1.LitProtocol.generateCosmosAccessControlConditionInverseTimelock({
+                                                    return await v3_js_1.LitProtocol.generateCosmosAccessControlConditionInverseTimelock({
                                                         key: '$.tx_responses.*.timestamp',
                                                         comparator: '<=',
                                                         value: `${condition.intervalInSeconds}`,
@@ -2727,7 +2773,7 @@ class Cheqd {
                                         await Promise.all(topArgs.paymentConditions.map(async (condition) => {
                                             switch (condition.type) {
                                                 case exports.AccessControlConditionTypes.timelockPayment:
-                                                    return await lit_protocol_js_1.LitProtocol.generateCosmosAccessControlConditionInverseTimelock({
+                                                    return await v3_js_1.LitProtocol.generateCosmosAccessControlConditionInverseTimelock({
                                                         key: '$.tx_responses.*.timestamp',
                                                         comparator: '<=',
                                                         value: `${condition.intervalInSeconds}`,
@@ -2739,13 +2785,15 @@ class Cheqd {
                                         topArgs.paymentConditions,
                                     ];
                                 })();
-                            // encrypt bitstring
-                            const { encryptedString, encryptedSymmetricKey, symmetricKey } = await lit.encrypt(bitstring, unifiedAccessControlConditionsTuple[0], true);
+                            // encrypt bitstring - case: threshold
+                            const { encryptedString: thresholdEncryptionCiphertext, stringHash: thresholdEncryptionStringHash, } = await lit.encrypt((0, uint8arrays_1.fromString)(bitstring, 'base64url'), unifiedAccessControlConditionsTuple[0]);
+                            // construct encoded list
+                            const encodedList = `${await (0, helpers_js_1.blobToHexString)(symmetricEncryptionCiphertext)}-${(0, uint8arrays_1.toString)(thresholdEncryptionCiphertext, 'hex')}`;
                             // define status list content
                             const content = {
                                 StatusList2021: {
                                     statusPurpose: publishedList.StatusList2021.statusPurpose,
-                                    encodedList: await (0, helpers_js_1.blobToHexString)(encryptedString),
+                                    encodedList,
                                     validFrom: publishedList.StatusList2021.validFrom,
                                     validUntil: options?.publishOptions?.statusListValidUntil ||
                                         publishedList.StatusList2021.validUntil,
@@ -2754,7 +2802,11 @@ class Cheqd {
                                     type: publishedList.metadata.type,
                                     encrypted: true,
                                     encoding: options?.publishOptions?.statusListEncoding || publishedList.metadata.encoding,
-                                    encryptedSymmetricKey,
+                                    statusListHash: symmetricEncryptionStringHash === thresholdEncryptionStringHash
+                                        ? symmetricEncryptionStringHash
+                                        : (function () {
+                                            throw new Error('[did-provider-cheqd]: suspension: symmetricEncryptionStringHash and thresholdEncryptionStringHash do not match');
+                                        })(),
                                     paymentConditions: unifiedAccessControlConditionsTuple[1],
                                 },
                             };
@@ -2762,9 +2814,10 @@ class Cheqd {
                             return [
                                 await Cheqd.publishStatusList2021((0, uint8arrays_1.fromString)(JSON.stringify(content), 'utf-8'), statusListMetadata, options?.publishOptions),
                                 {
-                                    encryptedString,
-                                    encryptedSymmetricKey,
-                                    symmetricKey: (0, uint8arrays_1.toString)(symmetricKey, 'hex'),
+                                    symmetricEncryptionCiphertext,
+                                    thresholdEncryptionCiphertext,
+                                    stringHash: symmetricEncryptionStringHash,
+                                    symmetricKey,
                                 },
                             ];
                         })()
@@ -2828,7 +2881,7 @@ class Cheqd {
                     ? (await Cheqd.fetchStatusList2021(credential))
                     : undefined,
                 symmetricKey: topArgs?.returnSymmetricKey
-                    ? published?.[1]?.symmetricKey
+                    ? (0, uint8arrays_1.toString)(published?.[1]?.symmetricKey, 'hex')
                     : undefined,
                 resourceMetadata: topArgs?.returnStatusListMetadata
                     ? await Cheqd.fetchStatusList2021Metadata(credential)
@@ -2860,7 +2913,7 @@ class Cheqd {
             .filter((value, index, self) => self.indexOf(value) !== index).length > 0)
             throw new Error('[did-provider-cheqd]: suspension: Credentials must have unique status list index');
         // validate credentials - case: status purpose
-        if (!credentials.every((credential) => credential.credentialStatus?.statusPurpose === 'suspension'))
+        if (!credentials.every((credential) => credential.credentialStatus?.statusPurpose === cheqd_did_provider_js_1.DefaultStatusList2021StatusPurposeTypes.suspension))
             throw new Error('[did-provider-cheqd]: suspension: Invalid status purpose');
         // validate credentials - case: status list id
         const remote = credentials[0].credentialStatus?.id
@@ -2892,10 +2945,17 @@ class Cheqd {
                         return publishedList.metadata.encoding === 'base64url'
                             ? publishedList.StatusList2021.encodedList
                             : (0, uint8arrays_1.toString)((0, uint8arrays_1.fromString)(publishedList.StatusList2021.encodedList, publishedList.metadata.encoding), 'base64url');
+                    // decrypt + return bitstring, if qualified for migration
+                    if (publishedList.metadata.encryptedSymmetricKey)
+                        return await v2_js_1.LitProtocolV2.decryptDirect(await (0, helpers_js_1.toBlob)((0, uint8arrays_1.fromString)(publishedList.StatusList2021
+                            .encodedList, 'hex')), (0, uint8arrays_1.fromString)(options?.topArgs?.symmetricKey, 'hex'));
+                    // validate encoded list
+                    if (!(0, helpers_js_1.isEncodedList)(publishedList.StatusList2021.encodedList))
+                        throw new Error('[did-provider-cheqd]: suspension: Invalid encoded list');
                     // otherwise, decrypt and return raw bitstring
-                    const scopedRawBlob = await (0, helpers_js_1.toBlob)((0, uint8arrays_1.fromString)(publishedList.StatusList2021.encodedList, 'hex'));
+                    const scopedRawBlob = await (0, helpers_js_1.toBlob)((0, uint8arrays_1.fromString)((0, helpers_js_1.getEncodedList)(publishedList.StatusList2021.encodedList, false)[0], 'hex'));
                     // decrypt
-                    return await lit_protocol_js_1.LitProtocol.decryptDirect(scopedRawBlob, (0, uint8arrays_1.fromString)(options?.topArgs?.symmetricKey, 'hex'));
+                    return (0, uint8arrays_1.toString)(await v3_js_1.LitProtocol.decryptDirect(scopedRawBlob, await (0, helpers_js_1.safeDeserialise)(options?.topArgs?.symmetricKey, uint8arrays_1.fromString, ['hex'], 'Invalid symmetric key')), 'base64url');
                 })()
                 : await (async function () {
                     // transcode to base64url, if needed
@@ -2919,7 +2979,7 @@ class Cheqd {
                         // otherwise, decrypt and return bitstring
                         const scopedRawBlob = await (0, helpers_js_1.toBlob)(await Cheqd.getFile(options.statusListFile));
                         // decrypt
-                        const decrypted = await lit_protocol_js_1.LitProtocol.decryptDirect(scopedRawBlob, (0, uint8arrays_1.fromString)(options?.topArgs?.symmetricKey, 'hex'));
+                        const decrypted = (0, uint8arrays_1.toString)(await v3_js_1.LitProtocol.decryptDirect(scopedRawBlob, await (0, helpers_js_1.safeDeserialise)(options?.topArgs?.symmetricKey, uint8arrays_1.fromString, ['hex'], 'Invalid symmetric key')), 'base64url');
                         // validate against published list
                         if (decrypted !== publishedListTranscoded)
                             throw new Error('[did-provider-cheqd]: suspension: statusListFile does not match published status list 2021');
@@ -3015,8 +3075,10 @@ class Cheqd {
                                 !topArgs?.dkgOptions?.network) {
                                 throw new Error('[did-provider-cheqd]: dkgOptions is required');
                             }
+                            // encrypt bitstring - case: symmetric
+                            const { encryptedString: symmetricEncryptionCiphertext, stringHash: symmetricEncryptionStringHash, symmetricKey, } = await v3_js_1.LitProtocol.encryptDirect((0, uint8arrays_1.fromString)(bitstring, 'base64url'));
                             // instantiate dkg-threshold client, in which case lit-protocol is used
-                            const lit = await lit_protocol_js_1.LitProtocol.create({
+                            const lit = await v3_js_1.LitProtocol.create({
                                 chain: topArgs?.dkgOptions?.chain,
                                 litNetwork: topArgs?.dkgOptions?.network,
                             });
@@ -3031,7 +3093,7 @@ class Cheqd {
                                         await Promise.all(paymentConditions.map(async (condition) => {
                                             switch (condition.type) {
                                                 case exports.AccessControlConditionTypes.timelockPayment:
-                                                    return await lit_protocol_js_1.LitProtocol.generateCosmosAccessControlConditionInverseTimelock({
+                                                    return await v3_js_1.LitProtocol.generateCosmosAccessControlConditionInverseTimelock({
                                                         key: '$.tx_responses.*.timestamp',
                                                         comparator: '<=',
                                                         value: `${condition.intervalInSeconds}`,
@@ -3053,7 +3115,7 @@ class Cheqd {
                                         await Promise.all(topArgs.paymentConditions.map(async (condition) => {
                                             switch (condition.type) {
                                                 case exports.AccessControlConditionTypes.timelockPayment:
-                                                    return await lit_protocol_js_1.LitProtocol.generateCosmosAccessControlConditionInverseTimelock({
+                                                    return await v3_js_1.LitProtocol.generateCosmosAccessControlConditionInverseTimelock({
                                                         key: '$.tx_responses.*.timestamp',
                                                         comparator: '<=',
                                                         value: `${condition.intervalInSeconds}`,
@@ -3065,13 +3127,15 @@ class Cheqd {
                                         topArgs.paymentConditions,
                                     ];
                                 })();
-                            // encrypt bitstring
-                            const { encryptedString, encryptedSymmetricKey, symmetricKey } = await lit.encrypt(bitstring, unifiedAccessControlConditionsTuple[0], true);
+                            // encrypt bitstring - case: threshold
+                            const { encryptedString: thresholdEncryptionCiphertext, stringHash: thresholdEncryptionStringHash, } = await lit.encrypt((0, uint8arrays_1.fromString)(bitstring, 'base64url'), unifiedAccessControlConditionsTuple[0]);
+                            // construct encoded list
+                            const encodedList = `${await (0, helpers_js_1.blobToHexString)(symmetricEncryptionCiphertext)}-${(0, uint8arrays_1.toString)(thresholdEncryptionCiphertext, 'hex')}`;
                             // define status list content
                             const content = {
                                 StatusList2021: {
                                     statusPurpose: publishedList.StatusList2021.statusPurpose,
-                                    encodedList: await (0, helpers_js_1.blobToHexString)(encryptedString),
+                                    encodedList,
                                     validFrom: publishedList.StatusList2021.validFrom,
                                     validUntil: options?.publishOptions?.statusListValidUntil ||
                                         publishedList.StatusList2021.validUntil,
@@ -3080,7 +3144,11 @@ class Cheqd {
                                     type: publishedList.metadata.type,
                                     encrypted: true,
                                     encoding: options?.publishOptions?.statusListEncoding || publishedList.metadata.encoding,
-                                    encryptedSymmetricKey,
+                                    statusListHash: symmetricEncryptionStringHash === thresholdEncryptionStringHash
+                                        ? symmetricEncryptionStringHash
+                                        : (function () {
+                                            throw new Error('[did-provider-cheqd]: suspension: symmetricEncryptionStringHash and thresholdEncryptionStringHash do not match');
+                                        })(),
                                     paymentConditions: unifiedAccessControlConditionsTuple[1],
                                 },
                             };
@@ -3088,9 +3156,10 @@ class Cheqd {
                             return [
                                 await Cheqd.publishStatusList2021((0, uint8arrays_1.fromString)(JSON.stringify(content), 'utf-8'), statusListMetadata, options?.publishOptions),
                                 {
-                                    encryptedString,
-                                    encryptedSymmetricKey,
-                                    symmetricKey: (0, uint8arrays_1.toString)(symmetricKey, 'hex'),
+                                    symmetricEncryptionCiphertext,
+                                    thresholdEncryptionCiphertext,
+                                    stringHash: symmetricEncryptionStringHash,
+                                    symmetricKey,
                                 },
                             ];
                         })()
@@ -3154,7 +3223,7 @@ class Cheqd {
                     ? (await Cheqd.fetchStatusList2021(credentials[0]))
                     : undefined,
                 symmetricKey: topArgs?.returnSymmetricKey
-                    ? published?.[1]?.symmetricKey
+                    ? (0, uint8arrays_1.toString)(published?.[1]?.symmetricKey, 'hex')
                     : undefined,
                 resourceMetadata: topArgs?.returnStatusListMetadata
                     ? await Cheqd.fetchStatusList2021Metadata(credentials[0])
@@ -3170,7 +3239,7 @@ class Cheqd {
     static async unsuspendCredential(credential, options) {
         try {
             // validate status purpose
-            if (credential?.credentialStatus?.statusPurpose !== 'suspension')
+            if (credential?.credentialStatus?.statusPurpose !== cheqd_did_provider_js_1.DefaultStatusList2021StatusPurposeTypes.suspension)
                 throw new Error('[did-provider-cheqd]: unsuspension: Invalid status purpose');
             // fetch status list 2021
             const publishedList = (await Cheqd.fetchStatusList2021(credential));
@@ -3185,10 +3254,17 @@ class Cheqd {
                         return publishedList.metadata.encoding === 'base64url'
                             ? publishedList.StatusList2021.encodedList
                             : (0, uint8arrays_1.toString)((0, uint8arrays_1.fromString)(publishedList.StatusList2021.encodedList, publishedList.metadata.encoding), 'base64url');
+                    // decrypt + return bitstring, if qualified for migration
+                    if (publishedList.metadata.encryptedSymmetricKey)
+                        return await v2_js_1.LitProtocolV2.decryptDirect(await (0, helpers_js_1.toBlob)((0, uint8arrays_1.fromString)(publishedList.StatusList2021
+                            .encodedList, 'hex')), (0, uint8arrays_1.fromString)(options?.topArgs?.symmetricKey, 'hex'));
+                    // validate encoded list
+                    if (!(0, helpers_js_1.isEncodedList)(publishedList.StatusList2021.encodedList))
+                        throw new Error('[did-provider-cheqd]: unsuspension: Invalid encoded list');
                     // otherwise, decrypt and return raw bitstring
-                    const scopedRawBlob = await (0, helpers_js_1.toBlob)((0, uint8arrays_1.fromString)(publishedList.StatusList2021.encodedList, 'hex'));
+                    const scopedRawBlob = await (0, helpers_js_1.toBlob)((0, uint8arrays_1.fromString)((0, helpers_js_1.getEncodedList)(publishedList.StatusList2021.encodedList, false)[0], 'hex'));
                     // decrypt
-                    return await lit_protocol_js_1.LitProtocol.decryptDirect(scopedRawBlob, (0, uint8arrays_1.fromString)(options?.topArgs?.symmetricKey, 'hex'));
+                    return (0, uint8arrays_1.toString)(await v3_js_1.LitProtocol.decryptDirect(scopedRawBlob, await (0, helpers_js_1.safeDeserialise)(options?.topArgs?.symmetricKey, uint8arrays_1.fromString, ['hex'], 'Invalid symmetric key')), 'base64url');
                 })()
                 : await (async function () {
                     // transcode to base64url, if needed
@@ -3212,7 +3288,7 @@ class Cheqd {
                         // otherwise, decrypt and return bitstring
                         const scopedRawBlob = await (0, helpers_js_1.toBlob)(await Cheqd.getFile(options.statusListFile));
                         // decrypt
-                        const decrypted = await lit_protocol_js_1.LitProtocol.decryptDirect(scopedRawBlob, (0, uint8arrays_1.fromString)(options?.topArgs?.symmetricKey, 'hex'));
+                        const decrypted = (0, uint8arrays_1.toString)(await v3_js_1.LitProtocol.decryptDirect(scopedRawBlob, await (0, helpers_js_1.safeDeserialise)(options?.topArgs?.symmetricKey, uint8arrays_1.fromString, ['hex'], 'Invalid symmetric key')), 'base64url');
                         // validate against published list
                         if (decrypted !== publishedListTranscoded)
                             throw new Error('[did-provider-cheqd]: unsuspension: statusListFile does not match published status list 2021');
@@ -3293,8 +3369,10 @@ class Cheqd {
                                 !topArgs?.dkgOptions?.network) {
                                 throw new Error('[did-provider-cheqd]: dkgOptions is required');
                             }
+                            // encrypt bitstring - case: symmetric
+                            const { encryptedString: symmetricEncryptionCiphertext, stringHash: symmetricEncryptionStringHash, symmetricKey, } = await v3_js_1.LitProtocol.encryptDirect((0, uint8arrays_1.fromString)(bitstring, 'base64url'));
                             // instantiate dkg-threshold client, in which case lit-protocol is used
-                            const lit = await lit_protocol_js_1.LitProtocol.create({
+                            const lit = await v3_js_1.LitProtocol.create({
                                 chain: topArgs?.dkgOptions?.chain,
                                 litNetwork: topArgs?.dkgOptions?.network,
                             });
@@ -3309,7 +3387,7 @@ class Cheqd {
                                         await Promise.all(paymentConditions.map(async (condition) => {
                                             switch (condition.type) {
                                                 case exports.AccessControlConditionTypes.timelockPayment:
-                                                    return await lit_protocol_js_1.LitProtocol.generateCosmosAccessControlConditionInverseTimelock({
+                                                    return await v3_js_1.LitProtocol.generateCosmosAccessControlConditionInverseTimelock({
                                                         key: '$.tx_responses.*.timestamp',
                                                         comparator: '<=',
                                                         value: `${condition.intervalInSeconds}`,
@@ -3331,7 +3409,7 @@ class Cheqd {
                                         await Promise.all(topArgs.paymentConditions.map(async (condition) => {
                                             switch (condition.type) {
                                                 case exports.AccessControlConditionTypes.timelockPayment:
-                                                    return await lit_protocol_js_1.LitProtocol.generateCosmosAccessControlConditionInverseTimelock({
+                                                    return await v3_js_1.LitProtocol.generateCosmosAccessControlConditionInverseTimelock({
                                                         key: '$.tx_responses.*.timestamp',
                                                         comparator: '<=',
                                                         value: `${condition.intervalInSeconds}`,
@@ -3343,13 +3421,15 @@ class Cheqd {
                                         topArgs.paymentConditions,
                                     ];
                                 })();
-                            // encrypt bitstring
-                            const { encryptedString, encryptedSymmetricKey, symmetricKey } = await lit.encrypt(bitstring, unifiedAccessControlConditionsTuple[0], true);
+                            // encrypt bitstring - case: threshold
+                            const { encryptedString: thresholdEncryptionCiphertext, stringHash: thresholdEncryptionStringHash, } = await lit.encrypt((0, uint8arrays_1.fromString)(bitstring, 'base64url'), unifiedAccessControlConditionsTuple[0]);
+                            // construct encoded list
+                            const encodedList = `${await (0, helpers_js_1.blobToHexString)(symmetricEncryptionCiphertext)}-${(0, uint8arrays_1.toString)(thresholdEncryptionCiphertext, 'hex')}`;
                             // define status list content
                             const content = {
                                 StatusList2021: {
                                     statusPurpose: publishedList.StatusList2021.statusPurpose,
-                                    encodedList: await (0, helpers_js_1.blobToHexString)(encryptedString),
+                                    encodedList,
                                     validFrom: publishedList.StatusList2021.validFrom,
                                     validUntil: options?.publishOptions?.statusListValidUntil ||
                                         publishedList.StatusList2021.validUntil,
@@ -3358,7 +3438,11 @@ class Cheqd {
                                     type: publishedList.metadata.type,
                                     encrypted: true,
                                     encoding: options?.publishOptions?.statusListEncoding || publishedList.metadata.encoding,
-                                    encryptedSymmetricKey,
+                                    statusListHash: symmetricEncryptionStringHash === thresholdEncryptionStringHash
+                                        ? symmetricEncryptionStringHash
+                                        : (function () {
+                                            throw new Error('[did-provider-cheqd]: unsuspension: symmetricEncryptionStringHash and thresholdEncryptionStringHash do not match');
+                                        })(),
                                     paymentConditions: unifiedAccessControlConditionsTuple[1],
                                 },
                             };
@@ -3366,9 +3450,10 @@ class Cheqd {
                             return [
                                 await Cheqd.publishStatusList2021((0, uint8arrays_1.fromString)(JSON.stringify(content), 'utf-8'), statusListMetadata, options?.publishOptions),
                                 {
-                                    encryptedString,
-                                    encryptedSymmetricKey,
-                                    symmetricKey: (0, uint8arrays_1.toString)(symmetricKey, 'hex'),
+                                    symmetricEncryptionCiphertext,
+                                    thresholdEncryptionCiphertext,
+                                    stringHash: symmetricEncryptionStringHash,
+                                    symmetricKey,
                                 },
                             ];
                         })()
@@ -3432,7 +3517,7 @@ class Cheqd {
                     ? (await Cheqd.fetchStatusList2021(credential))
                     : undefined,
                 symmetricKey: topArgs?.returnSymmetricKey
-                    ? published?.[1]?.symmetricKey
+                    ? (0, uint8arrays_1.toString)(published?.[1]?.symmetricKey, 'hex')
                     : undefined,
                 resourceMetadata: topArgs?.returnStatusListMetadata
                     ? await Cheqd.fetchStatusList2021Metadata(credential)
@@ -3464,7 +3549,7 @@ class Cheqd {
             .filter((value, index, self) => self.indexOf(value) !== index).length > 0)
             throw new Error('[did-provider-cheqd]: unsuspension: Credentials must have unique status list index');
         // validate credentials - case: status purpose
-        if (!credentials.every((credential) => credential.credentialStatus?.statusPurpose === 'suspension'))
+        if (!credentials.every((credential) => credential.credentialStatus?.statusPurpose === cheqd_did_provider_js_1.DefaultStatusList2021StatusPurposeTypes.suspension))
             throw new Error('[did-provider-cheqd]: unsuspension: Invalid status purpose');
         // validate credentials - case: status list id
         const remote = credentials[0].credentialStatus?.id
@@ -3496,10 +3581,17 @@ class Cheqd {
                         return publishedList.metadata.encoding === 'base64url'
                             ? publishedList.StatusList2021.encodedList
                             : (0, uint8arrays_1.toString)((0, uint8arrays_1.fromString)(publishedList.StatusList2021.encodedList, publishedList.metadata.encoding), 'base64url');
+                    // decrypt + return bitstring, if qualified for migration
+                    if (publishedList.metadata.encryptedSymmetricKey)
+                        return await v2_js_1.LitProtocolV2.decryptDirect(await (0, helpers_js_1.toBlob)((0, uint8arrays_1.fromString)(publishedList.StatusList2021
+                            .encodedList, 'hex')), (0, uint8arrays_1.fromString)(options?.topArgs?.symmetricKey, 'hex'));
+                    // validate encoded list
+                    if (!(0, helpers_js_1.isEncodedList)(publishedList.StatusList2021.encodedList))
+                        throw new Error('[did-provider-cheqd]: unsuspension: Invalid encoded list');
                     // otherwise, decrypt and return raw bitstring
-                    const scopedRawBlob = await (0, helpers_js_1.toBlob)((0, uint8arrays_1.fromString)(publishedList.StatusList2021.encodedList, 'hex'));
+                    const scopedRawBlob = await (0, helpers_js_1.toBlob)((0, uint8arrays_1.fromString)((0, helpers_js_1.getEncodedList)(publishedList.StatusList2021.encodedList, false)[0], 'hex'));
                     // decrypt
-                    return await lit_protocol_js_1.LitProtocol.decryptDirect(scopedRawBlob, (0, uint8arrays_1.fromString)(options?.topArgs?.symmetricKey, 'hex'));
+                    return (0, uint8arrays_1.toString)(await v3_js_1.LitProtocol.decryptDirect(scopedRawBlob, await (0, helpers_js_1.safeDeserialise)(options?.topArgs?.symmetricKey, uint8arrays_1.fromString, ['hex'], 'Invalid symmetric key')), 'base64url');
                 })()
                 : await (async function () {
                     // transcode to base64url, if needed
@@ -3523,7 +3615,7 @@ class Cheqd {
                         // otherwise, decrypt and return bitstring
                         const scopedRawBlob = await (0, helpers_js_1.toBlob)(await Cheqd.getFile(options.statusListFile));
                         // decrypt
-                        const decrypted = await lit_protocol_js_1.LitProtocol.decryptDirect(scopedRawBlob, (0, uint8arrays_1.fromString)(options?.topArgs?.symmetricKey, 'hex'));
+                        const decrypted = (0, uint8arrays_1.toString)(await v3_js_1.LitProtocol.decryptDirect(scopedRawBlob, await (0, helpers_js_1.safeDeserialise)(options?.topArgs?.symmetricKey, uint8arrays_1.fromString, ['hex'], 'Invalid symmetric key')), 'base64url');
                         // validate against published list
                         if (decrypted !== publishedListTranscoded)
                             throw new Error('[did-provider-cheqd]: unsuspension: statusListFile does not match published status list 2021');
@@ -3619,8 +3711,10 @@ class Cheqd {
                                 !topArgs?.dkgOptions?.network) {
                                 throw new Error('[did-provider-cheqd]: dkgOptions is required');
                             }
+                            // encrypt bitstring - case: symmetric
+                            const { encryptedString: symmetricEncryptionCiphertext, stringHash: symmetricEncryptionStringHash, symmetricKey, } = await v3_js_1.LitProtocol.encryptDirect((0, uint8arrays_1.fromString)(bitstring, 'base64url'));
                             // instantiate dkg-threshold client, in which case lit-protocol is used
-                            const lit = await lit_protocol_js_1.LitProtocol.create({
+                            const lit = await v3_js_1.LitProtocol.create({
                                 chain: topArgs?.dkgOptions?.chain,
                                 litNetwork: topArgs?.dkgOptions?.network,
                             });
@@ -3635,7 +3729,7 @@ class Cheqd {
                                         await Promise.all(paymentConditions.map(async (condition) => {
                                             switch (condition.type) {
                                                 case exports.AccessControlConditionTypes.timelockPayment:
-                                                    return await lit_protocol_js_1.LitProtocol.generateCosmosAccessControlConditionInverseTimelock({
+                                                    return await v3_js_1.LitProtocol.generateCosmosAccessControlConditionInverseTimelock({
                                                         key: '$.tx_responses.*.timestamp',
                                                         comparator: '<=',
                                                         value: `${condition.intervalInSeconds}`,
@@ -3657,7 +3751,7 @@ class Cheqd {
                                         await Promise.all(topArgs.paymentConditions.map(async (condition) => {
                                             switch (condition.type) {
                                                 case exports.AccessControlConditionTypes.timelockPayment:
-                                                    return await lit_protocol_js_1.LitProtocol.generateCosmosAccessControlConditionInverseTimelock({
+                                                    return await v3_js_1.LitProtocol.generateCosmosAccessControlConditionInverseTimelock({
                                                         key: '$.tx_responses.*.timestamp',
                                                         comparator: '<=',
                                                         value: `${condition.intervalInSeconds}`,
@@ -3669,13 +3763,15 @@ class Cheqd {
                                         topArgs.paymentConditions,
                                     ];
                                 })();
-                            // encrypt bitstring
-                            const { encryptedString, encryptedSymmetricKey, symmetricKey } = await lit.encrypt(bitstring, unifiedAccessControlConditionsTuple[0], true);
+                            // encrypt bitstring - case: threshold
+                            const { encryptedString: thresholdEncryptionCiphertext, stringHash: thresholdEncryptionStringHash, } = await lit.encrypt((0, uint8arrays_1.fromString)(bitstring, 'base64url'), unifiedAccessControlConditionsTuple[0]);
+                            // construct encoded list
+                            const encodedList = `${await (0, helpers_js_1.blobToHexString)(symmetricEncryptionCiphertext)}-${(0, uint8arrays_1.toString)(thresholdEncryptionCiphertext, 'hex')}`;
                             // define status list content
                             const content = {
                                 StatusList2021: {
                                     statusPurpose: publishedList.StatusList2021.statusPurpose,
-                                    encodedList: await (0, helpers_js_1.blobToHexString)(encryptedString),
+                                    encodedList,
                                     validFrom: publishedList.StatusList2021.validFrom,
                                     validUntil: options?.publishOptions?.statusListValidUntil ||
                                         publishedList.StatusList2021.validUntil,
@@ -3684,7 +3780,11 @@ class Cheqd {
                                     type: publishedList.metadata.type,
                                     encrypted: true,
                                     encoding: options?.publishOptions?.statusListEncoding || publishedList.metadata.encoding,
-                                    encryptedSymmetricKey,
+                                    statusListHash: symmetricEncryptionStringHash === thresholdEncryptionStringHash
+                                        ? symmetricEncryptionStringHash
+                                        : (function () {
+                                            throw new Error('[did-provider-cheqd]: unsuspension: symmetricEncryptionStringHash and thresholdEncryptionStringHash do not match');
+                                        })(),
                                     paymentConditions: unifiedAccessControlConditionsTuple[1],
                                 },
                             };
@@ -3692,9 +3792,10 @@ class Cheqd {
                             return [
                                 await Cheqd.publishStatusList2021((0, uint8arrays_1.fromString)(JSON.stringify(content), 'utf-8'), statusListMetadata, options?.publishOptions),
                                 {
-                                    encryptedString,
-                                    encryptedSymmetricKey,
-                                    symmetricKey: (0, uint8arrays_1.toString)(symmetricKey, 'hex'),
+                                    symmetricEncryptionCiphertext,
+                                    thresholdEncryptionCiphertext,
+                                    stringHash: symmetricEncryptionStringHash,
+                                    symmetricKey,
                                 },
                             ];
                         })()
@@ -3758,7 +3859,7 @@ class Cheqd {
                     ? (await Cheqd.fetchStatusList2021(credentials[0]))
                     : undefined,
                 symmetricKey: topArgs?.returnSymmetricKey
-                    ? published?.[1]?.symmetricKey
+                    ? (0, uint8arrays_1.toString)(published?.[1]?.symmetricKey, 'hex')
                     : undefined,
                 resourceMetadata: topArgs?.returnStatusListMetadata
                     ? await Cheqd.fetchStatusList2021Metadata(credentials[0])
@@ -3773,11 +3874,14 @@ class Cheqd {
     }
     static async checkRevoked(credential, options = { fetchList: true }) {
         // validate status purpose
-        if (credential.credentialStatus?.statusPurpose !== 'revocation') {
+        if (credential.credentialStatus?.statusPurpose !== cheqd_did_provider_js_1.DefaultStatusList2021StatusPurposeTypes.revocation) {
             throw new Error(`[did-provider-cheqd]: check: revocation: Unsupported status purpose: ${credential.credentialStatus?.statusPurpose}`);
         }
         // fetch status list 2021
         const publishedList = (await Cheqd.fetchStatusList2021(credential));
+        // route to non-migrated action, if applicable
+        if (publishedList.metadata.encryptedSymmetricKey)
+            return await this.checkRevokedNonMigrated(credential, publishedList, options);
         // fetch status list 2021 inscribed in credential
         const statusList2021 = options?.topArgs?.fetchList
             ? await (async function () {
@@ -3786,10 +3890,13 @@ class Cheqd {
                     return publishedList.metadata.encoding === 'base64url'
                         ? publishedList.StatusList2021.encodedList
                         : (0, uint8arrays_1.toString)((0, uint8arrays_1.fromString)(publishedList.StatusList2021.encodedList, publishedList.metadata.encoding), 'base64url');
+                // validate encoded list
+                if (!(0, helpers_js_1.isEncodedList)(publishedList.StatusList2021.encodedList))
+                    throw new Error('[did-provider-cheqd]: check: revocation: Invalid encoded list');
                 // otherwise, decrypt and return raw bitstring
-                const scopedRawBlob = await (0, helpers_js_1.toBlob)((0, uint8arrays_1.fromString)(publishedList.StatusList2021.encodedList, 'hex'));
+                const thresholdEncryptionCiphertext = (0, helpers_js_1.getEncodedList)(publishedList.StatusList2021.encodedList, false)[1];
                 // instantiate dkg-threshold client, in which case lit-protocol is used
-                const lit = await lit_protocol_js_1.LitProtocol.create({
+                const lit = await v3_js_1.LitProtocol.create({
                     chain: options?.topArgs?.dkgOptions?.chain,
                     litNetwork: options?.topArgs?.dkgOptions?.network,
                 });
@@ -3797,7 +3904,7 @@ class Cheqd {
                 const unifiedAccessControlConditions = await Promise.all(publishedList.metadata.paymentConditions.map(async (condition) => {
                     switch (condition.type) {
                         case exports.AccessControlConditionTypes.timelockPayment:
-                            return await lit_protocol_js_1.LitProtocol.generateCosmosAccessControlConditionInverseTimelock({
+                            return await v3_js_1.LitProtocol.generateCosmosAccessControlConditionInverseTimelock({
                                 key: '$.tx_responses.*.timestamp',
                                 comparator: '<=',
                                 value: `${condition.intervalInSeconds}`,
@@ -3807,7 +3914,7 @@ class Cheqd {
                     }
                 }));
                 // decrypt
-                return await lit.decrypt(scopedRawBlob, publishedList.metadata.encryptedSymmetricKey, unifiedAccessControlConditions);
+                return await lit.decrypt(thresholdEncryptionCiphertext, publishedList.metadata.statusListHash, unifiedAccessControlConditions);
             })()
             : await (async function () {
                 // transcode to base64url, if needed
@@ -3831,7 +3938,7 @@ class Cheqd {
                     // otherwise, decrypt and return bitstring
                     const scopedRawBlob = await (0, helpers_js_1.toBlob)(await Cheqd.getFile(options.statusListFile));
                     // decrypt
-                    const decrypted = await lit_protocol_js_1.LitProtocol.decryptDirect(scopedRawBlob, (0, uint8arrays_1.fromString)(options?.topArgs?.symmetricKey, 'hex'));
+                    const decrypted = (0, uint8arrays_1.toString)(await v3_js_1.LitProtocol.decryptDirect(scopedRawBlob, await (0, helpers_js_1.safeDeserialise)(options?.topArgs?.symmetricKey, uint8arrays_1.fromString, ['hex'], 'Invalid symmetric key')), 'base64url');
                     // validate against published list
                     if (decrypted !== publishedListTranscoded)
                         throw new Error('[did-provider-cheqd]: check: revocation: statusListFile does not match published status list 2021');
@@ -3857,11 +3964,14 @@ class Cheqd {
     }
     static async checkSuspended(credential, options = { fetchList: true }) {
         // validate status purpose
-        if (credential.credentialStatus?.statusPurpose !== 'suspension') {
+        if (credential.credentialStatus?.statusPurpose !== cheqd_did_provider_js_1.DefaultStatusList2021StatusPurposeTypes.suspension) {
             throw new Error(`[did-provider-cheqd]: check: suspension: Unsupported status purpose: ${credential.credentialStatus?.statusPurpose}`);
         }
         // fetch status list 2021
         const publishedList = (await Cheqd.fetchStatusList2021(credential));
+        // route to non-migrated action, if applicable
+        if (publishedList.metadata.encryptedSymmetricKey)
+            return await this.checkSuspendedNonMigrated(credential, publishedList, options);
         // fetch status list 2021 inscribed in credential
         const statusList2021 = options?.topArgs?.fetchList
             ? await (async function () {
@@ -3871,9 +3981,9 @@ class Cheqd {
                         ? publishedList.StatusList2021.encodedList
                         : (0, uint8arrays_1.toString)((0, uint8arrays_1.fromString)(publishedList.StatusList2021.encodedList, publishedList.metadata.encoding), 'base64url');
                 // otherwise, decrypt and return bitstring
-                const scopedRawBlob = await (0, helpers_js_1.toBlob)((0, uint8arrays_1.fromString)(publishedList.StatusList2021.encodedList, 'hex'));
+                const thresholdEncryptionCiphertext = (0, helpers_js_1.getEncodedList)(publishedList.StatusList2021.encodedList, false)[1];
                 // instantiate dkg-threshold client, in which case lit-protocol is used
-                const lit = await lit_protocol_js_1.LitProtocol.create({
+                const lit = await v3_js_1.LitProtocol.create({
                     chain: options?.topArgs?.dkgOptions?.chain,
                     litNetwork: options?.topArgs?.dkgOptions?.network,
                 });
@@ -3881,7 +3991,179 @@ class Cheqd {
                 const unifiedAccessControlConditions = await Promise.all(publishedList.metadata.paymentConditions.map(async (condition) => {
                     switch (condition.type) {
                         case exports.AccessControlConditionTypes.timelockPayment:
-                            return await lit_protocol_js_1.LitProtocol.generateCosmosAccessControlConditionInverseTimelock({
+                            return await v3_js_1.LitProtocol.generateCosmosAccessControlConditionInverseTimelock({
+                                key: '$.tx_responses.*.timestamp',
+                                comparator: '<=',
+                                value: `${condition.intervalInSeconds}`,
+                            }, condition.feePaymentAmount, condition.feePaymentAddress, condition?.blockHeight, options?.topArgs?.dkgOptions?.chain);
+                        default:
+                            throw new Error(`[did-provider-cheqd]: unsupported access control condition type ${condition.type}`);
+                    }
+                }));
+                // decrypt
+                return await lit.decrypt(thresholdEncryptionCiphertext, publishedList.metadata.statusListHash, unifiedAccessControlConditions);
+            })()
+            : await (async function () {
+                // transcode to base64url, if needed
+                const publishedListTranscoded = publishedList.metadata.encoding === 'base64url'
+                    ? publishedList.StatusList2021.encodedList
+                    : (0, uint8arrays_1.toString)((0, uint8arrays_1.fromString)(publishedList.StatusList2021.encodedList, publishedList.metadata.encoding), 'base64url');
+                // if status list 2021 is not fetched, read from file
+                if (options?.statusListFile) {
+                    // if not encrypted, return bitstring
+                    if (!publishedList.metadata.encrypted) {
+                        // construct encoded status list
+                        const encoded = new vc_status_list_1.StatusList({
+                            buffer: await Cheqd.getFile(options.statusListFile),
+                        }).encode();
+                        // validate against published list
+                        if (encoded !== publishedListTranscoded)
+                            throw new Error('[did-provider-cheqd]: check: suspension: statusListFile does not match published status list 2021');
+                        // return encoded
+                        return encoded;
+                    }
+                    // otherwise, decrypt and return bitstring
+                    const scopedRawBlob = await (0, helpers_js_1.toBlob)(await Cheqd.getFile(options.statusListFile));
+                    // decrypt
+                    const decrypted = (0, uint8arrays_1.toString)(await v3_js_1.LitProtocol.decryptDirect(scopedRawBlob, await (0, helpers_js_1.safeDeserialise)(options?.topArgs?.symmetricKey, uint8arrays_1.fromString, ['hex'], 'Invalid symmetric key')), 'base64url');
+                    // validate against published list
+                    if (decrypted !== publishedListTranscoded)
+                        throw new Error('[did-provider-cheqd]: check: suspension: statusListFile does not match published status list 2021');
+                    // return decrypted
+                    return decrypted;
+                }
+                if (!options?.statusListInlineBitstring)
+                    throw new Error('[did-provider-cheqd]: check: suspension: statusListInlineBitstring is required, if statusListFile is not provided');
+                // validate against published list
+                if (options?.statusListInlineBitstring !== publishedListTranscoded)
+                    throw new Error('[did-provider-cheqd]: check: suspension: statusListInlineBitstring does not match published status list 2021');
+                // otherwise, read from inline bitstring
+                return options?.statusListInlineBitstring;
+            })();
+        // parse status list 2021
+        const statusList = await vc_status_list_1.StatusList.decode({ encodedList: statusList2021 });
+        // get status by index
+        return !!statusList.getStatus(Number(credential.credentialStatus.statusListIndex));
+    }
+    static async checkRevokedNonMigrated(credential, associatedStatusList, options = { fetchList: true }) {
+        // validate status purpose
+        if (credential.credentialStatus?.statusPurpose !== cheqd_did_provider_js_1.DefaultStatusList2021StatusPurposeTypes.revocation) {
+            throw new Error(`[did-provider-cheqd]: check: revocation: Unsupported status purpose: ${credential.credentialStatus?.statusPurpose}`);
+        }
+        // fetch status list 2021
+        const publishedList = associatedStatusList ||
+            (await Cheqd.fetchStatusList2021(credential));
+        // validate migrated
+        if (!publishedList.metadata.encryptedSymmetricKey)
+            throw new Error('[did-provider-cheqd]: check: revocation: Invalid migrated status list');
+        // fetch status list 2021 inscribed in credential
+        const statusList2021 = options?.topArgs?.fetchList
+            ? await (async function () {
+                // if not encrypted, return bitstring
+                if (!publishedList.metadata.encrypted)
+                    return publishedList.metadata.encoding === 'base64url'
+                        ? publishedList.StatusList2021.encodedList
+                        : (0, uint8arrays_1.toString)((0, uint8arrays_1.fromString)(publishedList.StatusList2021.encodedList, publishedList.metadata.encoding), 'base64url');
+                // otherwise, decrypt and return raw bitstring
+                const scopedRawBlob = await (0, helpers_js_1.toBlob)((0, uint8arrays_1.fromString)(publishedList.StatusList2021.encodedList, 'hex'));
+                // instantiate dkg-threshold client, in which case lit-protocol is used
+                const lit = await v2_js_1.LitProtocolV2.create({
+                    chain: options?.topArgs?.dkgOptions?.chain,
+                    litNetwork: v2_js_1.LitNetworksV2.serrano,
+                });
+                // construct access control conditions
+                const unifiedAccessControlConditions = await Promise.all(publishedList.metadata.paymentConditions.map(async (condition) => {
+                    switch (condition.type) {
+                        case exports.AccessControlConditionTypes.timelockPayment:
+                            return await v3_js_1.LitProtocol.generateCosmosAccessControlConditionInverseTimelock({
+                                key: '$.tx_responses.*.timestamp',
+                                comparator: '<=',
+                                value: `${condition.intervalInSeconds}`,
+                            }, condition.feePaymentAmount, condition.feePaymentAddress, condition?.blockHeight, options?.topArgs?.dkgOptions?.chain);
+                        default:
+                            throw new Error(`[did-provider-cheqd]: unsupported access control condition type ${condition.type}`);
+                    }
+                }));
+                // decrypt
+                return await lit.decrypt(scopedRawBlob, publishedList.metadata.encryptedSymmetricKey, unifiedAccessControlConditions);
+            })()
+            : await (async function () {
+                // transcode to base64url, if needed
+                const publishedListTranscoded = publishedList.metadata.encoding === 'base64url'
+                    ? publishedList.StatusList2021.encodedList
+                    : (0, uint8arrays_1.toString)((0, uint8arrays_1.fromString)(publishedList.StatusList2021.encodedList, publishedList.metadata.encoding), 'base64url');
+                // if status list 2021 is not fetched, read from file
+                if (options?.statusListFile) {
+                    // if not encrypted, return bitstring
+                    if (!publishedList.metadata.encrypted) {
+                        // construct encoded status list
+                        const encoded = new vc_status_list_1.StatusList({
+                            buffer: await Cheqd.getFile(options.statusListFile),
+                        }).encode();
+                        // validate against published list
+                        if (encoded !== publishedListTranscoded)
+                            throw new Error('[did-provider-cheqd]: check: revocation: statusListFile does not match published status list 2021');
+                        // return encoded
+                        return encoded;
+                    }
+                    // otherwise, decrypt and return bitstring
+                    const scopedRawBlob = await (0, helpers_js_1.toBlob)(await Cheqd.getFile(options.statusListFile));
+                    // decrypt
+                    const decrypted = await v2_js_1.LitProtocolV2.decryptDirect(scopedRawBlob, (0, uint8arrays_1.fromString)(options?.topArgs?.symmetricKey, 'hex'));
+                    // validate against published list
+                    if (decrypted !== publishedListTranscoded)
+                        throw new Error('[did-provider-cheqd]: check: revocation: statusListFile does not match published status list 2021');
+                    // return decrypted
+                    return decrypted;
+                }
+                if (!options?.statusListInlineBitstring)
+                    throw new Error('[did-provider-cheqd]: check: revocation: statusListInlineBitstring is required, if statusListFile is not provided');
+                // validate against published list
+                if (options?.statusListInlineBitstring !== publishedListTranscoded)
+                    throw new Error('[did-provider-cheqd]: check: revocation: statusListInlineBitstring does not match published status list 2021');
+                // otherwise, read from inline bitstring
+                return options?.statusListInlineBitstring;
+            })();
+        // transcode, if needed
+        const transcodedStatusList2021 = publishedList.metadata.encoding === 'base64url'
+            ? statusList2021
+            : (0, uint8arrays_1.toString)((0, uint8arrays_1.fromString)(statusList2021, publishedList.metadata.encoding), 'base64url');
+        // parse status list 2021
+        const statusList = await vc_status_list_1.StatusList.decode({ encodedList: transcodedStatusList2021 });
+        // get status by index
+        return !!statusList.getStatus(Number(credential.credentialStatus.statusListIndex));
+    }
+    static async checkSuspendedNonMigrated(credential, associatedStatusList, options = { fetchList: true }) {
+        // validate status purpose
+        if (credential.credentialStatus?.statusPurpose !== cheqd_did_provider_js_1.DefaultStatusList2021StatusPurposeTypes.suspension) {
+            throw new Error(`[did-provider-cheqd]: check: suspension: Unsupported status purpose: ${credential.credentialStatus?.statusPurpose}`);
+        }
+        // fetch status list 2021
+        const publishedList = associatedStatusList ||
+            (await Cheqd.fetchStatusList2021(credential));
+        // validate migrated
+        if (!publishedList.metadata.encryptedSymmetricKey)
+            throw new Error('[did-provider-cheqd]: check: suspension: Invalid migrated status list');
+        // fetch status list 2021 inscribed in credential
+        const statusList2021 = options?.topArgs?.fetchList
+            ? await (async function () {
+                // if not encrypted, return bitstring
+                if (!publishedList.metadata.encrypted)
+                    return publishedList.metadata.encoding === 'base64url'
+                        ? publishedList.StatusList2021.encodedList
+                        : (0, uint8arrays_1.toString)((0, uint8arrays_1.fromString)(publishedList.StatusList2021.encodedList, publishedList.metadata.encoding), 'base64url');
+                // otherwise, decrypt and return raw bitstring
+                const scopedRawBlob = await (0, helpers_js_1.toBlob)((0, uint8arrays_1.fromString)(publishedList.StatusList2021.encodedList, 'hex'));
+                // instantiate dkg-threshold client, in which case lit-protocol is used
+                const lit = await v2_js_1.LitProtocolV2.create({
+                    chain: options?.topArgs?.dkgOptions?.chain,
+                    litNetwork: v2_js_1.LitNetworksV2.serrano,
+                });
+                // construct access control conditions
+                const unifiedAccessControlConditions = await Promise.all(publishedList.metadata.paymentConditions.map(async (condition) => {
+                    switch (condition.type) {
+                        case exports.AccessControlConditionTypes.timelockPayment:
+                            return await v3_js_1.LitProtocol.generateCosmosAccessControlConditionInverseTimelock({
                                 key: '$.tx_responses.*.timestamp',
                                 comparator: '<=',
                                 value: `${condition.intervalInSeconds}`,
@@ -3915,7 +4197,7 @@ class Cheqd {
                     // otherwise, decrypt and return bitstring
                     const scopedRawBlob = await (0, helpers_js_1.toBlob)(await Cheqd.getFile(options.statusListFile));
                     // decrypt
-                    const decrypted = await lit_protocol_js_1.LitProtocol.decryptDirect(scopedRawBlob, (0, uint8arrays_1.fromString)(options?.topArgs?.symmetricKey, 'hex'));
+                    const decrypted = (0, uint8arrays_1.toString)(await v3_js_1.LitProtocol.decryptDirect(scopedRawBlob, await (0, helpers_js_1.safeDeserialise)(options?.topArgs?.symmetricKey, uint8arrays_1.fromString, ['hex'], 'Invalid symmetric key')), 'base64url');
                     // validate against published list
                     if (decrypted !== publishedListTranscoded)
                         throw new Error('[did-provider-cheqd]: check: suspension: statusListFile does not match published status list 2021');
@@ -3962,8 +4244,8 @@ class Cheqd {
         if (credential.credentialStatus.type !== 'StatusList2021Entry')
             throw new Error('[did-provider-cheqd]: fetch status list: Credential status type is not valid');
         // validate credential status list status purpose
-        if (credential.credentialStatus.statusPurpose !== 'revocation' &&
-            credential.credentialStatus.statusPurpose !== 'suspension')
+        if (credential.credentialStatus.statusPurpose !== cheqd_did_provider_js_1.DefaultStatusList2021StatusPurposeTypes.revocation &&
+            credential.credentialStatus.statusPurpose !== cheqd_did_provider_js_1.DefaultStatusList2021StatusPurposeTypes.suspension)
             throw new Error('[did-provider-cheqd]: fetch status list: Credential status purpose is not valid');
         // fetch status list 2021
         const content = (await (await fetch(credential.credentialStatus.id.split('#')[0])).json());