@did-btcr2/method 0.13.1

package/src/btcr2/crud/update.ts

@@ -0,0 +1,277 @@
+import {
+  BTCR2_DID_UPDATE_PAYLOAD_CONTEXT,
+  Btcr2Error,
+  DidUpdateInvocation,
+  DidUpdatePayload,
+  INVALID_DID_DOCUMENT,
+  INVALID_DID_UPDATE,
+  INVALID_PUBLIC_KEY_TYPE,
+  Logger,
+  NOT_FOUND,
+  PatchOperation,
+  ProofOptions
+} from '@did-btcr2/common';
+import { SchnorrMultikey } from '@did-btcr2/cryptosuite';
+import { SchnorrKeyPair, SecretKey } from '@did-btcr2/keypair';
+import type { DidService } from '@web5/dids';
+import { BeaconService } from '../../interfaces/ibeacon.js';
+import { SignalsMetadata } from '../../types/crud.js';
+import { Btc1Appendix } from '../../utils/appendix.js';
+import { Btc1DidDocument, Btc1VerificationMethod } from '../../utils/did-document.js';
+import { BeaconFactory } from '../beacon/factory.js';
+import { Btc1KeyManager } from '../key-manager/index.js';
+
+export type InvokePayloadParams = {
+  identifier: string;
+  didUpdatePayload: DidUpdatePayload;
+  verificationMethod: Btc1VerificationMethod;
+}
+
+/**
+ * Implements {@link https://dcdpr.github.io/did-btcr2/#update | 4.3 Update}.
+ *
+ * An update to a did:btcr2 document is an invoked capability using the ZCAP-LD
+ * data format, signed by a verificationMethod that has the authority to make
+ * the update as specified in the previous DID document. Capability invocations
+ * for updates MUST be authorized using Data Integrity following the
+ * bip340-jcs-2025 cryptosuite with a proofPurpose of capabilityInvocation.
+ *
+ * @class Btc1Update
+ * @type {Btc1Update}
+ */
+export class Btc1Update {
+  /**
+   * Implements {@link https://dcdpr.github.io/did-btcr2/#construct-did-update-payload | 4.3.1 Construct DID Update Payload}.
+   *
+   * The Construct DID Update Payload algorithm applies the documentPatch to the sourceDocument and verifies the
+   * resulting targetDocument is a conformant DID document. It takes in a btc1Identifier, sourceDocument,
+   * sourceVersionId, and documentPatch objects. It returns an unsigned DID Update Payload.
+   *
+   * @param {ConstructPayloadParams} params See  {@link ConstructPayloadParams} for more details.
+   * @param {string} params.identifier The did-btcr2 identifier to use for verification.
+   * @param {Btc1DidDocument} params.sourceDocument The source document to be updated.
+   * @param {string} params.sourceVersionId The versionId of the source document.
+   * @param {DidDocumentPatch} params.patch The JSON patch to be applied to the source document.
+   * @returns {Promise<DidUpdatePayload>} The constructed DidUpdatePayload object.
+   * @throws {Btcr2Error} InvalidDid if sourceDocument.id does not match identifier.
+   */
+  public static async construct({
+    identifier,
+    sourceDocument,
+    sourceVersionId,
+    patch,
+  }: {
+    identifier: string;
+    sourceDocument: Btc1DidDocument;
+    sourceVersionId: number;
+    patch: PatchOperation[];
+  }): Promise<DidUpdatePayload> {
+
+    // 1. Check that sourceDocument.id equals identifier else MUST raise invalidDIDUpdate error.
+    if (sourceDocument.id !== identifier) {
+      throw new Btcr2Error(
+        INVALID_DID_UPDATE,
+        'Source document id does not match identifier',
+        { sourceDocument, identifier}
+      );
+    }
+
+    // 2. Initialize didUpdatePayload to an empty object.
+    const didUpdatePayload: DidUpdatePayload = {
+    // 3. Set didUpdatePayload.@context to the following list
+      '@context'      : BTCR2_DID_UPDATE_PAYLOAD_CONTEXT,
+      // 4. Set didUpdatePayload.patch to documentPatch.
+      patch,
+      targetHash      : '',
+      targetVersionId : 0,
+      sourceHash      : '',
+    };
+    // TODO: Need to add btcr2 context. ["https://w3id.org/zcap/v1", "https://w3id.org/security/data-integrity/v2", "https://w3id.org/json-ld-patch/v1"]
+
+    // 5. Set targetDocument to the result of applying the documentPatch to the sourceDocument, following the JSON Patch
+    //    specification.
+    const targetDocument = JSON.patch.apply(sourceDocument, patch) as Btc1DidDocument;
+
+    // 6. Validate targetDocument is a conformant DID document, else MUST raise invalidDIDUpdate error.
+    Btc1DidDocument.validate(targetDocument);
+
+    // 7. Set sourceHashBytes to the result of passing sourceDocument into the JSON Canonicalization and Hash algorithm.
+    // 8. Set didUpdatePayload.sourceHash to the base58-btc Multibase encoding of sourceHashBytes.
+    didUpdatePayload.sourceHash = (await JSON.canonicalization.process(sourceDocument, 'base58')).slice(1);
+    // TODO: Question - is base58btc the correct encoding scheme?
+
+    // 9. Set targetHashBytes to the result of passing targetDocument into the JSON Canonicalization and Hash algorithm.
+    // 10. Set didUpdatePayload.targetHash to the base58-btc Multibase encoding of targetHashBytes.
+    didUpdatePayload.targetHash = (await JSON.canonicalization.process(targetDocument, 'base58')).slice(1);
+
+    // 11. Set didUpdatePayload.targetVersionId to sourceVersionId + 1.
+    didUpdatePayload.targetVersionId = sourceVersionId + 1;
+
+    // 12. Return updatePayload.
+    return didUpdatePayload;
+  }
+
+  /**
+   * {@link https://dcdpr.github.io/did-btcr2/#invoke-did-update-payload | 4.3.2 Invoke DID Update Payload}.
+   *
+   * The Invoke DID Update Payload algorithm takes in a btc1Identifier, an unsigned didUpdatePayload, and a
+   * verificationMethod. It retrieves the privateKeyBytes for the verificationMethod and adds a capability invocation in
+   * the form of a Data Integrity proof following the Authorization Capabilities (ZCAP-LD) and VC Data Integrity
+   * specifications. It returns the invoked DID Update Payload.
+   *
+   * @param {InvokePayloadParams} params Required params for calling the invokePayload method
+   * @param {string} params.identifier The did-btcr2 identifier to derive the root capability from
+   * @param {DidUpdatePayload} params.didUpdatePayload The updatePayload object to be signed
+   * @param {DidVerificationMethod} params.verificationMethod The verificationMethod object to be used for signing
+   * @returns {DidUpdateInvocation} Did update payload secured with a proof => DidUpdateInvocation
+   * @throws {Btcr2Error} if the privateKeyBytes are invalid
+   */
+  public static async invoke({
+    identifier,
+    didUpdatePayload,
+    verificationMethod
+  }: {
+    identifier: string;
+    didUpdatePayload: DidUpdatePayload;
+    verificationMethod: Btc1VerificationMethod;
+  }): Promise<DidUpdateInvocation> {
+    // Deconstruct the verificationMethod
+    const { id: fullId, controller, publicKeyMultibase, secretKeyMultibase } = verificationMethod;
+
+    // Validate the verificationMethod
+    if(!publicKeyMultibase) {
+      throw new Btcr2Error(
+        'Invalid publicKeyMultibase: cannot be undefined',
+        INVALID_PUBLIC_KEY_TYPE, verificationMethod
+      );
+    }
+
+    // 1. Set privateKeyBytes to the result of retrieving the private key bytes
+    // associated with the verificationMethod value.
+    const id = fullId.slice(fullId.indexOf('#'));
+    const multikey = !secretKeyMultibase
+    // 1.1 Compute the keyUri and check if the key is in the keystore
+      ? await Btc1KeyManager.getKeyPair(fullId)
+    // 1.2 If not, use the secretKeyMultibase from the verificationMethod
+      : SchnorrMultikey
+        .initialize({
+          id,
+          controller,
+          keys : new SchnorrKeyPair({
+            secretKey : SecretKey.decode(secretKeyMultibase)
+          })
+        });
+
+    // 1.3 If the privateKey is not found, throw an error
+    if (!multikey) {
+      throw new Btcr2Error(
+        'No privateKey found in kms or vm',
+        NOT_FOUND, verificationMethod
+      );
+    }
+
+    // 2. Set rootCapability to the result of passing btc1Identifier into the Derive Root Capability from did:btcr2
+    //    Identifier algorithm.
+    const rootCapability = Btc1Appendix.deriveRootCapability(identifier);
+    const cryptosuite = 'bip340-jcs-2025';
+    // 3. Initialize proofOptions to an empty object.
+    // 4. Set proofOptions.type to DataIntegrityProof.
+    // 5. Set proofOptions.cryptosuite to schnorr-secp256k1-jcs-2025.
+    // 6. Set proofOptions.verificationMethod to verificationMethod.id.
+    // 7. Set proofOptions.proofPurpose to capabilityInvocation.
+    // 8. Set proofOptions.capability to rootCapability.id.
+    // 9. Set proofOptions.capabilityAction to Write.
+    // TODO: Wonder if we actually need this. Arent we always writing?
+    const options: ProofOptions = {
+      cryptosuite,
+      type               : 'DataIntegrityProof',
+      verificationMethod : fullId,
+      proofPurpose       : 'capabilityInvocation',
+      capability         : rootCapability.id,
+      capabilityAction   : 'Write',
+    };
+
+    // 10. Set cryptosuite to the result of executing the Cryptosuite Instantiation algorithm from the BIP340 Data
+    //     Integrity specification passing in proofOptions.
+    const diproof = multikey.toCryptosuite(cryptosuite).toDataIntegrityProof();
+
+    // TODO: 11. need to set up the proof instantiation such that it can resolve / dereference the root capability. This is deterministic from the DID.
+
+    // 12. Set didUpdateInvocation to the result of executing the Add Proof algorithm from VC Data Integrity passing
+    //     didUpdatePayload as the input document, cryptosuite, and the set of proofOptions.
+    // 13. Return didUpdateInvocation.
+    return await diproof.addProof({ document: didUpdatePayload, options });
+  }
+
+  /**
+   * Implements {@link https://dcdpr.github.io/did-btcr2/#announce-did-update | 4.3.3 Announce DID Update}.
+   *
+   * The Announce DID Update algorithm retrieves beaconServices from the sourceDocument and calls the Broadcast DID
+   * Update algorithm corresponding to the type of the Beacon. It takes in a btc1Identifier, sourceDocument, an array of
+   * beaconIds, and a didUpdateInvocation. It returns an array of signalsMetadata, containing the necessary
+   * data to validate the Beacon Signal against the didUpdateInvocation.
+   *
+   * @param {AnnounceUpdatePayloadParams} params Required params for calling the announcePayload method
+   * @param {Btc1DidDocument} params.sourceDocument The did-btcr2 did document to derive the root capability from
+   * @param {string[]} params.beaconIds The didUpdatePayload object to be signed
+   * @param {DidUpdateInvocation} params.didUpdatePayload The verificationMethod object to be used for signing
+   * @returns {SignalsMetadata} The signalsMetadata object containing data to validate the Beacon Signal
+   * @throws {Btcr2Error} if the beaconService type is invalid
+   */
+  public static async announce({
+    sourceDocument,
+    beaconIds,
+    didUpdateInvocation
+  }: {
+    sourceDocument: Btc1DidDocument;
+    beaconIds: string[];
+    didUpdateInvocation: DidUpdateInvocation;
+  }): Promise<SignalsMetadata> {
+    // 1. Set beaconServices to an empty array.
+    const beaconServices: BeaconService[] = [];
+
+    // 2. signalMetadata to an empty array.
+    let signalsMetadata;
+
+    // 3. For beaconId in beaconIds:
+    for (const beaconId of beaconIds) {
+      //    3.1 Find the beacon services in the sourceDocument
+      const beaconService = sourceDocument.service.find((s: DidService) => s.id === beaconId);
+
+      //    3.2 If no beaconService MUST throw beaconNotFound error.
+      if (!beaconService) {
+        throw new Btcr2Error('Not found: sourceDocument does not contain beaconId', INVALID_DID_DOCUMENT, { beaconId });
+      }
+
+      //    3.3 Push beaconService to beaconServices.
+      beaconServices.push(beaconService);
+    }
+
+    // 4. For beaconService in beaconServices:
+    for (const beaconService of beaconServices) {
+      // 4.1 Set signalMetadata to null.
+      // 4.2 If beaconService.type == SingletonBeacon:
+      //    4.2.1 Set signalMetadata to the result of passing beaconService and didUpdateInvocation to the Broadcast
+      //          Singleton Beacon Signal algorithm.
+      // 4.3 Else If beaconService.type == CIDAggregateBeacon:
+      //    4.3.1 Set signalMetadata to the result of passing btc1Identifier, beaconService and didUpdateInvocation to
+      //          the Broadcast CIDAggregate Beacon Signal algorithm.
+      // 4.4 Else If beaconService.type == SMTAggregateBeacon:
+      //    4.4.1 Set signalMetadata to the result of passing btc1Identifier, beaconService and didUpdateInvocation to
+      //          the Broadcast SMTAggregate Beacon Signal algorithm.
+      // 4.5 Else:
+      //    4.5.1 MUST throw invalidBeacon error.
+      const beacon = BeaconFactory.establish(beaconService);
+      signalsMetadata = await beacon.broadcastSignal(didUpdateInvocation);
+    }
+    if(!signalsMetadata) {
+      throw new Btcr2Error(
+        'Invalid beacon: no signalsMetadata found',
+        INVALID_DID_DOCUMENT, { beaconServices }
+      );
+    }
+    Logger.debug('signalsMetadata', signalsMetadata);
+    // Return the signalsMetadata
+    return signalsMetadata;
+  }
+}

package/src/btcr2/key-manager/index.ts

@@ -0,0 +1,364 @@
+import {
+  Btcr2KeyManagerError,
+  HashBytes,
+  Hex,
+  SchnorrKeyPairObject,
+  Logger,
+  MULTIBASE_URI_PREFIX,
+  KeyBytes,
+  SignatureBytes
+} from '@did-btcr2/common';
+import { SchnorrMultikey } from '@did-btcr2/cryptosuite';
+import { SchnorrKeyPair, PublicKey } from '@did-btcr2/keypair';
+import { sha256 } from '@noble/hashes/sha2';
+import { KeyValueStore, MemoryStore } from '@web5/common';
+import { KeyIdentifier } from '@web5/crypto';
+import { Did } from '@web5/dids';
+import { Multibase } from 'multiformats';
+import { AvailableNetworks } from '../../bitcoin/index.js';
+import { BitcoinSigner, Btc1KeyManagerOptions, CryptoSigner, KeyManager, KeyManagerParams } from './interface.js';
+
+export interface Btc1Signer {
+  multikey: SchnorrMultikey;
+  network: keyof AvailableNetworks;
+};
+
+/**
+ * Class for managing cryptographic keys for the B DID method.
+ * @class Btc1KeyManager
+ * @type {Btc1KeyManager}
+ */
+export class Btc1KeyManager implements KeyManager, CryptoSigner, BitcoinSigner  {
+  /**
+   * Singleton instance of the Btc1KeyManager.
+   * @private
+   * @type {Btc1KeyManager}
+   */
+  static #instance?: Btc1KeyManager;
+
+  /**
+   * The `activeKeyUri` property is a string that represents the URI of the currently active key.
+   * It is used to identify the key that will be used for signing and verifying operations.
+   * This property is optional and can be set to a specific key URI when initializing the
+   * `Btc1KeyManager` instance. If not set, the key manager will use the default key URI.
+   * @type {KeyIdentifier}
+   */
+  public activeKeyUri?: KeyIdentifier;
+
+  /**
+   * The `_store` private variable in `Btc1KeyManager` is a `KeyValueStore` instance used for
+   * storing and managing cryptographic keys. It allows the `Btc1KeyManager` class to save,
+   * retrieve, and handle keys efficiently within the local Key Management System (KMS) context.
+   * This variable can be configured to use different storage backends, like in-memory storage or
+   * persistent storage, providing flexibility in key management according to the application's
+   * requirements.
+   * @private
+   * @readonly
+   * @type {KeyValueStore<KeyIdentifier, SchnorrKeyPair>} The key store for managing cryptographic keys.
+   */
+  private readonly _store: KeyValueStore<KeyIdentifier, SchnorrMultikey>;
+
+  /**
+   * Creates an instance of Btc1KeyManager.
+   * @param {?KeyManagerParams} params The parameters to initialize the key manager.
+   * @param {KeyValueStore<KeyIdentifier, SchnorrMultikey>} params.store An optional property to specify a custom
+   * `KeyValueStore` instance for key management. If not provided, {@link Btc1KeyManager} uses a default `MemoryStore`
+   * instance. This store is responsible for managing cryptographic keys, allowing them to be retrieved, stored, and
+   * managed during cryptographic operations.
+   * @param {KeyIdentifier} params.keyUri An optional property to specify the active key URI for the key manager.
+   */
+  constructor({ store, keyUri, keys }: KeyManagerParams = {}) {
+    // Set the default key store to a MemoryStore instance
+    this._store = store ?? new MemoryStore<KeyIdentifier, SchnorrMultikey>();
+
+    // Import the keys into the key store
+    if (keyUri && keys) {
+      void this.importKey(keys, keyUri).then(() => {
+        this.activeKeyUri = keyUri;
+      });
+    }
+  }
+
+  /**
+   * Gets the singleton instance of the Btc1KeyManager.
+   * @returns {Btc1KeyManager} The singleton instance of the Btc1KeyManager.
+   */
+  public static get instance(): Btc1KeyManager {
+    // Check if the Btc1KeyManager instance is initialized
+    if (!Btc1KeyManager.#instance) {
+      throw new Btcr2KeyManagerError('Btc1KeyManager not initialized. Call initialize() first.', 'KEY_MANAGER_NOT_INITIALIZED');
+    }
+    // Return the singleton instance
+    const instance = Btc1KeyManager.#instance;
+    return instance;
+  }
+
+  /**
+   * Signs a transaction using the key associated with the key URI.
+   * @param {Hex} txHex The transaction hex to sign.
+   * @param {KeyIdentifier} keyUri The URI of the key to sign the transaction with.
+   * @returns {Promise<Hex>} A promise resolving to the signed transaction hex.
+   */
+  signTransaction(txHex: Hex, keyUri?: KeyIdentifier): Promise<Hex> {
+    throw new Error('Method not implemented.' + txHex + keyUri);
+  }
+
+  /**
+   * Gets the key pair from the key store and returns a PublicKey.
+   * @param {KeyIdentifier} keyUri The URI of the key to get the public key for.
+   * @returns {Promise<PublicKey>} The public key associated with the key URI.
+   */
+  public async getPublicKey(keyUri?: KeyIdentifier): Promise<PublicKey> {
+    // Use the active key URI if not provided
+    const key = await this.getKey(keyUri);
+
+    // Check if the key exists and has a public key
+    if (!key?.publicKey) {
+      throw new Btcr2KeyManagerError(`Key not found for URI: ${keyUri}`, 'KEY_NOT_FOUND');
+    }
+
+    // Return the public key
+    return key.publicKey;
+  }
+
+  /**
+   * Signs the given data using the key associated with the key URI.
+   * @param {Hex} data The data to sign.
+   * @param {?KeyIdentifier} keyUri The URI of the key to sign the data with.
+   * @returns {Promise<SignatureBytes>} A promise resolving to the signature of the data.
+   */
+  public async sign(data: Hex, keyUri?: KeyIdentifier): Promise<SignatureBytes> {
+    // Get the key from the store
+    const key = await this.getKey(keyUri);
+
+    // Check if the key exists
+    if (!key) {
+      throw new Btcr2KeyManagerError(`Key URI ${keyUri} not found`, 'KEY_NOT_FOUND');
+    }
+
+    // Check if the key can sign
+    if(!key.signer) {
+      throw new Btcr2KeyManagerError(`Key URI ${keyUri} is not a signer`, 'KEY_NOT_SIGNER');
+    }
+
+    // Sign the data using the key and return the signature
+    return key.sign(data);
+  }
+
+  /**
+   * Verifies a signature using the key associated with the key URI.
+   * @param {KeyIdentifier} keyUri The URI of the key to verify the signature with.
+   * @param {SignatureBytes} signature The signature to verify.
+   * @param {Hex} data The data to verify the signature with.
+   * @returns {Promise<boolean>} A promise resolving to a boolean indicating the verification result.
+   */
+  public async verify(signature: SignatureBytes, data: Hex, keyUri?: KeyIdentifier): Promise<boolean> {
+    // Get the key from the store
+    const key = await this.getKey(keyUri);
+
+    // Check if the key exists
+    if (!key) {
+      throw new Btcr2KeyManagerError(`Key not found for URI: ${keyUri}`, 'KEY_NOT_FOUND');
+    }
+
+    // Verify the signature using the multikey
+    return key.verify(signature, data);
+  }
+
+  /**
+   * Gets the key pair from the key store.
+   * @param {KeyIdentifier} keyUri The URI of the key to get.
+   * @returns {Promise<SchnorrKeyPair>} The key pair associated with the key URI.
+   * @throws {Btcr2KeyManagerError} If the key is not found in the key store.
+   */
+  private async getKey(keyUri?: KeyIdentifier): Promise<SchnorrMultikey | undefined> {
+    // Use the active key URI if not provided
+    const uri = keyUri ?? this.activeKeyUri;
+
+    // Throw an error if no key URI is provided or active
+    if (!uri) {
+      throw new Btcr2KeyManagerError('No active key uri set.', 'ACTIVE_KEY_URI_NOT_SET');
+    }
+
+    // Get the key pair from the key store
+    return await this._store.get(uri);
+  }
+
+  /**
+   * Exports the full multikeypair from the key store.
+   * @returns {Promise<SchnorrKeyPair>} The key pair associated with the key URI.
+   * @throws {Btcr2KeyManagerError} If the key is not found in the key store.
+   */
+  public async exportKey(keyUri?: KeyIdentifier): Promise<SchnorrMultikey | undefined> {
+    // Get the key from the key store and return it
+    return await this.getKey(keyUri);
+  }
+
+  /**
+   * Imports a keypair to the store.
+   * @param {SchnorrKeyPair} keys The keypair to import.
+   * @param {KeyIdentifier} keyUri The URI of the key to import.
+   * @param {Btc1KeyManagerOptions} options Relevant import options.
+   * @param {boolean} options.active A flag to set the key as active (optional, default: false).
+   * @returns {Promise<KeyIdentifier>} A promise that resolves to the key identifier of the imported key.
+   */
+  public async importKey(keys: SchnorrKeyPair, keyUri: string, options: Btc1KeyManagerOptions = {}): Promise<KeyIdentifier> {
+    const parts = Did.parse(keyUri);
+    if(!parts) {
+      throw new Btcr2KeyManagerError(
+        'Invalid key URI: must be valid, parsable BTCR2 identifier',
+        'INVALID_KEY_URI',
+        { keyUri, parts }
+      );
+    }
+
+    if(!parts.id) {
+      throw new Btcr2KeyManagerError(
+        'Invalid key URI: missing id part',
+        'INVALID_KEY_URI',
+        { keyUri, parts }
+      );
+    }
+
+    if(!parts.fragment) {
+      throw new Btcr2KeyManagerError(
+        'Invalid key URI: missing fragment part',
+        'INVALID_KEY_URI',
+        { keyUri, parts }
+      );
+    }
+    // Instantiate a new SchnorrMultikey with the provided keys
+    const multikey = new SchnorrMultikey({ controller: parts.uri, id: `#${parts.fragment}`, keys });
+
+    // Store the keypair in the key store
+    await this._store.set(keyUri, multikey);
+
+    // Set the key as active if required
+    if (options.active) {
+      this.activeKeyUri = keyUri;
+    }
+
+    // Return the key URI
+    return keyUri;
+  }
+
+  /**
+   * Computes the hash of the given data.
+   * @param {Uint8Array} data The data to hash.
+   * @returns {HashBytes} The hash of the data.
+   */
+  public digest(data: Uint8Array): HashBytes {
+    return sha256(data);
+  }
+
+  /**
+   * Computes the key URI of a given keypair.
+   * @param {string} id The fragment identifier (e.g. 'key-1').
+   * @param {string} [controller] The DID controller (e.g. 'did:btcr2:xyz').
+   * @returns {KeyIdentifier} A full DID fragment URI (e.g. 'did:btcr2:xyz#key-1')
+   */
+  public static computeKeyUri(id: string, controller: string): KeyIdentifier {
+    // Concat the id to the controller and return
+    return `${controller}${id.startsWith('#') ? id : `#${id}`}`;
+  }
+
+  /**
+   * Computes a multibase-compliant URI from a key.
+   * @param key A SchnorrKeyPair, PublicKey, or multibase string
+   * @returns {string} A multibase URI (e.g. 'urn:mb:zQ3s...')
+   */
+  public static toMultibaseUri(data: SchnorrKeyPair | PublicKey | Multibase<'zQ3s'>): string {
+    const multibase = data instanceof SchnorrKeyPair
+      ? data.publicKey.multibase
+      : data instanceof PublicKey
+        ? data.multibase
+        : data;
+
+    return `${MULTIBASE_URI_PREFIX}${multibase}`;
+  }
+
+  /**
+   * Initializes a singleton Btc1KeyManager instance.
+   * @param {SchnorrKeyPair} keys The keypair used to initialize the key manager.
+   * @returns {void}
+   */
+  public static async initialize(keys: SchnorrKeyPair | SchnorrKeyPairObject, keyUri: string): Promise<Btc1KeyManager> {
+    if(!(keys instanceof SchnorrKeyPair)) {
+      keys = SchnorrKeyPair.fromJSON(keys);
+    }
+
+    // Check if the Btc1KeyManager instance is already initialized
+    if (Btc1KeyManager.#instance) {
+      Logger.warn('Btc1KeyManager global instance is already initialized.');
+      return Btc1KeyManager.#instance;
+    }
+
+    // Check if the keypair is provided
+    if(!keys) {
+      // Log a warning message if not provided
+      Logger.warn('keys not provided, generating ...');
+    }
+
+    // Generate a new keypair if not provided
+    keys ??= SchnorrKeyPair.generate();
+
+    // Initialize the singleton key manager with the keypair
+    Btc1KeyManager.#instance = new Btc1KeyManager({ keys });
+
+    // Import the keypair into the key store
+    await Btc1KeyManager.#instance.importKey(keys, keyUri, { active: true });
+
+    // Set the active key URI
+    Btc1KeyManager.#instance.activeKeyUri = keyUri;
+
+    // Log the active key URI
+    Logger.info(`KeyManager initialized with Active Key URI: ${Btc1KeyManager.#instance.activeKeyUri}`);
+
+    // Return the singleton instance
+    return Btc1KeyManager.#instance;
+  }
+
+  /**
+   * Retrieves a keypair from the key store using the provided key URI.
+   * @public
+   * @param {KeyIdentifier} keyUri The URI of the keypair to retrieve.
+   * @returns {Promise<SchnorrKeyPair | undefined>} The retrieved keypair, or undefined if not found.
+   */
+  public static async getKeyPair(keyUri?: KeyIdentifier): Promise<SchnorrMultikey | undefined> {
+    // Use the active key URI if not provided
+    keyUri ??= Btc1KeyManager.#instance?.activeKeyUri;
+    // Instantiate a new Btc1KeyManager with the default key store
+    return await Btc1KeyManager.#instance?.getKey(keyUri);
+  }
+
+  public async getKeySigner(keyUri: KeyIdentifier, network: keyof AvailableNetworks): Promise<Signer> {
+    const multikey = await this.getKey(keyUri);
+    if(!multikey) {
+      throw new Btcr2KeyManagerError(`Key not found for URI: ${keyUri}`, 'KEY_NOT_FOUND');
+    }
+    return new Signer({ multikey, network });
+  }
+}
+
+export class Signer {
+  public multikey: SchnorrMultikey;
+  public network: keyof AvailableNetworks;
+
+  constructor(params: Btc1Signer) {
+    this.multikey = params.multikey;
+    this.network = params.network;
+  }
+
+  get publicKey(): KeyBytes {
+    // Return the public key from the multikey
+    return this.multikey.publicKey.compressed;
+  }
+
+  public sign(hash: Hex): SignatureBytes {
+    return this.multikey.sign(hash, { scheme: 'ecdsa' });
+  };
+
+  public signSchnorr(hash: Hex): SignatureBytes {
+    return this.multikey.sign(hash);
+  }
+}