@didcid/keymaster 0.1.3

package/dist/cjs/keymaster.cjs

@@ -0,0 +1,3787 @@
+'use strict';
+
+Object.defineProperty(exports, '__esModule', { value: true });
+
+var imageSize = require('image-size');
+var fileType = require('file-type');
+var db_typeGuards = require('./db/typeGuards.cjs');
+require('crypto');
+var encryption = require('./encryption.cjs');
+
+class ArchonError extends Error {
+    type;
+    detail;
+    constructor(type, detail) {
+        const message = detail ? `${type}: ${detail}` : type;
+        super(message);
+        this.type = type;
+        this.detail = detail;
+    }
+}
+class InvalidDIDError extends ArchonError {
+    static type = 'Invalid DID';
+    constructor(detail) {
+        super(InvalidDIDError.type, detail);
+    }
+}
+class InvalidParameterError extends ArchonError {
+    static type = 'Invalid parameter';
+    constructor(detail) {
+        super(InvalidParameterError.type, detail);
+    }
+}
+class KeymasterError extends ArchonError {
+    static type = 'Keymaster';
+    constructor(detail) {
+        super(KeymasterError.type, detail);
+    }
+}
+class UnknownIDError extends ArchonError {
+    static type = 'Unknown ID';
+    constructor(detail) {
+        super(UnknownIDError.type, detail);
+    }
+}
+
+function equals$1(aa, bb) {
+    if (aa === bb) {
+        return true;
+    }
+    if (aa.byteLength !== bb.byteLength) {
+        return false;
+    }
+    for (let ii = 0; ii < aa.byteLength; ii++) {
+        if (aa[ii] !== bb[ii]) {
+            return false;
+        }
+    }
+    return true;
+}
+function coerce(o) {
+    if (o instanceof Uint8Array && o.constructor.name === 'Uint8Array') {
+        return o;
+    }
+    if (o instanceof ArrayBuffer) {
+        return new Uint8Array(o);
+    }
+    if (ArrayBuffer.isView(o)) {
+        return new Uint8Array(o.buffer, o.byteOffset, o.byteLength);
+    }
+    throw new Error('Unknown type, must be binary type');
+}
+
+/* eslint-disable */
+// base-x encoding / decoding
+// Copyright (c) 2018 base-x contributors
+// Copyright (c) 2014-2018 The Bitcoin Core developers (base58.cpp)
+// Distributed under the MIT software license, see the accompanying
+// file LICENSE or http://www.opensource.org/licenses/mit-license.php.
+/**
+ * @param {string} ALPHABET
+ * @param {any} name
+ */
+function base(ALPHABET, name) {
+    if (ALPHABET.length >= 255) {
+        throw new TypeError('Alphabet too long');
+    }
+    var BASE_MAP = new Uint8Array(256);
+    for (var j = 0; j < BASE_MAP.length; j++) {
+        BASE_MAP[j] = 255;
+    }
+    for (var i = 0; i < ALPHABET.length; i++) {
+        var x = ALPHABET.charAt(i);
+        var xc = x.charCodeAt(0);
+        if (BASE_MAP[xc] !== 255) {
+            throw new TypeError(x + ' is ambiguous');
+        }
+        BASE_MAP[xc] = i;
+    }
+    var BASE = ALPHABET.length;
+    var LEADER = ALPHABET.charAt(0);
+    var FACTOR = Math.log(BASE) / Math.log(256); // log(BASE) / log(256), rounded up
+    var iFACTOR = Math.log(256) / Math.log(BASE); // log(256) / log(BASE), rounded up
+    /**
+     * @param {any[] | Iterable<number>} source
+     */
+    function encode(source) {
+        // @ts-ignore
+        if (source instanceof Uint8Array)
+            ;
+        else if (ArrayBuffer.isView(source)) {
+            source = new Uint8Array(source.buffer, source.byteOffset, source.byteLength);
+        }
+        else if (Array.isArray(source)) {
+            source = Uint8Array.from(source);
+        }
+        if (!(source instanceof Uint8Array)) {
+            throw new TypeError('Expected Uint8Array');
+        }
+        if (source.length === 0) {
+            return '';
+        }
+        // Skip & count leading zeroes.
+        var zeroes = 0;
+        var length = 0;
+        var pbegin = 0;
+        var pend = source.length;
+        while (pbegin !== pend && source[pbegin] === 0) {
+            pbegin++;
+            zeroes++;
+        }
+        // Allocate enough space in big-endian base58 representation.
+        var size = ((pend - pbegin) * iFACTOR + 1) >>> 0;
+        var b58 = new Uint8Array(size);
+        // Process the bytes.
+        while (pbegin !== pend) {
+            var carry = source[pbegin];
+            // Apply "b58 = b58 * 256 + ch".
+            var i = 0;
+            for (var it1 = size - 1; (carry !== 0 || i < length) && (it1 !== -1); it1--, i++) {
+                carry += (256 * b58[it1]) >>> 0;
+                b58[it1] = (carry % BASE) >>> 0;
+                carry = (carry / BASE) >>> 0;
+            }
+            if (carry !== 0) {
+                throw new Error('Non-zero carry');
+            }
+            length = i;
+            pbegin++;
+        }
+        // Skip leading zeroes in base58 result.
+        var it2 = size - length;
+        while (it2 !== size && b58[it2] === 0) {
+            it2++;
+        }
+        // Translate the result into a string.
+        var str = LEADER.repeat(zeroes);
+        for (; it2 < size; ++it2) {
+            str += ALPHABET.charAt(b58[it2]);
+        }
+        return str;
+    }
+    /**
+     * @param {string | string[]} source
+     */
+    function decodeUnsafe(source) {
+        if (typeof source !== 'string') {
+            throw new TypeError('Expected String');
+        }
+        if (source.length === 0) {
+            return new Uint8Array();
+        }
+        var psz = 0;
+        // Skip leading spaces.
+        if (source[psz] === ' ') {
+            return;
+        }
+        // Skip and count leading '1's.
+        var zeroes = 0;
+        var length = 0;
+        while (source[psz] === LEADER) {
+            zeroes++;
+            psz++;
+        }
+        // Allocate enough space in big-endian base256 representation.
+        var size = (((source.length - psz) * FACTOR) + 1) >>> 0; // log(58) / log(256), rounded up.
+        var b256 = new Uint8Array(size);
+        // Process the characters.
+        while (source[psz]) {
+            // Decode character
+            var carry = BASE_MAP[source.charCodeAt(psz)];
+            // Invalid character
+            if (carry === 255) {
+                return;
+            }
+            var i = 0;
+            for (var it3 = size - 1; (carry !== 0 || i < length) && (it3 !== -1); it3--, i++) {
+                carry += (BASE * b256[it3]) >>> 0;
+                b256[it3] = (carry % 256) >>> 0;
+                carry = (carry / 256) >>> 0;
+            }
+            if (carry !== 0) {
+                throw new Error('Non-zero carry');
+            }
+            length = i;
+            psz++;
+        }
+        // Skip trailing spaces.
+        if (source[psz] === ' ') {
+            return;
+        }
+        // Skip leading zeroes in b256.
+        var it4 = size - length;
+        while (it4 !== size && b256[it4] === 0) {
+            it4++;
+        }
+        var vch = new Uint8Array(zeroes + (size - it4));
+        var j = zeroes;
+        while (it4 !== size) {
+            vch[j++] = b256[it4++];
+        }
+        return vch;
+    }
+    /**
+     * @param {string | string[]} string
+     */
+    function decode(string) {
+        var buffer = decodeUnsafe(string);
+        if (buffer) {
+            return buffer;
+        }
+        throw new Error(`Non-${name} character`);
+    }
+    return {
+        encode: encode,
+        decodeUnsafe: decodeUnsafe,
+        decode: decode
+    };
+}
+var src = base;
+var _brrp__multiformats_scope_baseX = src;
+
+/**
+ * Class represents both BaseEncoder and MultibaseEncoder meaning it
+ * can be used to encode to multibase or base encode without multibase
+ * prefix.
+ */
+class Encoder {
+    name;
+    prefix;
+    baseEncode;
+    constructor(name, prefix, baseEncode) {
+        this.name = name;
+        this.prefix = prefix;
+        this.baseEncode = baseEncode;
+    }
+    encode(bytes) {
+        if (bytes instanceof Uint8Array) {
+            return `${this.prefix}${this.baseEncode(bytes)}`;
+        }
+        else {
+            throw Error('Unknown type, must be binary type');
+        }
+    }
+}
+/**
+ * Class represents both BaseDecoder and MultibaseDecoder so it could be used
+ * to decode multibases (with matching prefix) or just base decode strings
+ * with corresponding base encoding.
+ */
+class Decoder {
+    name;
+    prefix;
+    baseDecode;
+    prefixCodePoint;
+    constructor(name, prefix, baseDecode) {
+        this.name = name;
+        this.prefix = prefix;
+        const prefixCodePoint = prefix.codePointAt(0);
+        /* c8 ignore next 3 */
+        if (prefixCodePoint === undefined) {
+            throw new Error('Invalid prefix character');
+        }
+        this.prefixCodePoint = prefixCodePoint;
+        this.baseDecode = baseDecode;
+    }
+    decode(text) {
+        if (typeof text === 'string') {
+            if (text.codePointAt(0) !== this.prefixCodePoint) {
+                throw Error(`Unable to decode multibase string ${JSON.stringify(text)}, ${this.name} decoder only supports inputs prefixed with ${this.prefix}`);
+            }
+            return this.baseDecode(text.slice(this.prefix.length));
+        }
+        else {
+            throw Error('Can only multibase decode strings');
+        }
+    }
+    or(decoder) {
+        return or(this, decoder);
+    }
+}
+class ComposedDecoder {
+    decoders;
+    constructor(decoders) {
+        this.decoders = decoders;
+    }
+    or(decoder) {
+        return or(this, decoder);
+    }
+    decode(input) {
+        const prefix = input[0];
+        const decoder = this.decoders[prefix];
+        if (decoder != null) {
+            return decoder.decode(input);
+        }
+        else {
+            throw RangeError(`Unable to decode multibase string ${JSON.stringify(input)}, only inputs prefixed with ${Object.keys(this.decoders)} are supported`);
+        }
+    }
+}
+function or(left, right) {
+    return new ComposedDecoder({
+        ...(left.decoders ?? { [left.prefix]: left }),
+        ...(right.decoders ?? { [right.prefix]: right })
+    });
+}
+class Codec {
+    name;
+    prefix;
+    baseEncode;
+    baseDecode;
+    encoder;
+    decoder;
+    constructor(name, prefix, baseEncode, baseDecode) {
+        this.name = name;
+        this.prefix = prefix;
+        this.baseEncode = baseEncode;
+        this.baseDecode = baseDecode;
+        this.encoder = new Encoder(name, prefix, baseEncode);
+        this.decoder = new Decoder(name, prefix, baseDecode);
+    }
+    encode(input) {
+        return this.encoder.encode(input);
+    }
+    decode(input) {
+        return this.decoder.decode(input);
+    }
+}
+function from({ name, prefix, encode, decode }) {
+    return new Codec(name, prefix, encode, decode);
+}
+function baseX({ name, prefix, alphabet }) {
+    const { encode, decode } = _brrp__multiformats_scope_baseX(alphabet, name);
+    return from({
+        prefix,
+        name,
+        encode,
+        decode: (text) => coerce(decode(text))
+    });
+}
+function decode$3(string, alphabetIdx, bitsPerChar, name) {
+    // Count the padding bytes:
+    let end = string.length;
+    while (string[end - 1] === '=') {
+        --end;
+    }
+    // Allocate the output:
+    const out = new Uint8Array((end * bitsPerChar / 8) | 0);
+    // Parse the data:
+    let bits = 0; // Number of bits currently in the buffer
+    let buffer = 0; // Bits waiting to be written out, MSB first
+    let written = 0; // Next byte to write
+    for (let i = 0; i < end; ++i) {
+        // Read one character from the string:
+        const value = alphabetIdx[string[i]];
+        if (value === undefined) {
+            throw new SyntaxError(`Non-${name} character`);
+        }
+        // Append the bits to the buffer:
+        buffer = (buffer << bitsPerChar) | value;
+        bits += bitsPerChar;
+        // Write out some bits if the buffer has a byte's worth:
+        if (bits >= 8) {
+            bits -= 8;
+            out[written++] = 0xff & (buffer >> bits);
+        }
+    }
+    // Verify that we have received just enough bits:
+    if (bits >= bitsPerChar || (0xff & (buffer << (8 - bits))) !== 0) {
+        throw new SyntaxError('Unexpected end of data');
+    }
+    return out;
+}
+function encode$1(data, alphabet, bitsPerChar) {
+    const pad = alphabet[alphabet.length - 1] === '=';
+    const mask = (1 << bitsPerChar) - 1;
+    let out = '';
+    let bits = 0; // Number of bits currently in the buffer
+    let buffer = 0; // Bits waiting to be written out, MSB first
+    for (let i = 0; i < data.length; ++i) {
+        // Slurp data into the buffer:
+        buffer = (buffer << 8) | data[i];
+        bits += 8;
+        // Write out as much as we can:
+        while (bits > bitsPerChar) {
+            bits -= bitsPerChar;
+            out += alphabet[mask & (buffer >> bits)];
+        }
+    }
+    // Partial character:
+    if (bits !== 0) {
+        out += alphabet[mask & (buffer << (bitsPerChar - bits))];
+    }
+    // Add padding characters until we hit a byte boundary:
+    if (pad) {
+        while (((out.length * bitsPerChar) & 7) !== 0) {
+            out += '=';
+        }
+    }
+    return out;
+}
+function createAlphabetIdx(alphabet) {
+    // Build the character lookup table:
+    const alphabetIdx = {};
+    for (let i = 0; i < alphabet.length; ++i) {
+        alphabetIdx[alphabet[i]] = i;
+    }
+    return alphabetIdx;
+}
+/**
+ * RFC4648 Factory
+ */
+function rfc4648({ name, prefix, bitsPerChar, alphabet }) {
+    const alphabetIdx = createAlphabetIdx(alphabet);
+    return from({
+        prefix,
+        name,
+        encode(input) {
+            return encode$1(input, alphabet, bitsPerChar);
+        },
+        decode(input) {
+            return decode$3(input, alphabetIdx, bitsPerChar, name);
+        }
+    });
+}
+
+const base32 = rfc4648({
+    prefix: 'b',
+    name: 'base32',
+    alphabet: 'abcdefghijklmnopqrstuvwxyz234567',
+    bitsPerChar: 5
+});
+rfc4648({
+    prefix: 'B',
+    name: 'base32upper',
+    alphabet: 'ABCDEFGHIJKLMNOPQRSTUVWXYZ234567',
+    bitsPerChar: 5
+});
+rfc4648({
+    prefix: 'c',
+    name: 'base32pad',
+    alphabet: 'abcdefghijklmnopqrstuvwxyz234567=',
+    bitsPerChar: 5
+});
+rfc4648({
+    prefix: 'C',
+    name: 'base32padupper',
+    alphabet: 'ABCDEFGHIJKLMNOPQRSTUVWXYZ234567=',
+    bitsPerChar: 5
+});
+rfc4648({
+    prefix: 'v',
+    name: 'base32hex',
+    alphabet: '0123456789abcdefghijklmnopqrstuv',
+    bitsPerChar: 5
+});
+rfc4648({
+    prefix: 'V',
+    name: 'base32hexupper',
+    alphabet: '0123456789ABCDEFGHIJKLMNOPQRSTUV',
+    bitsPerChar: 5
+});
+rfc4648({
+    prefix: 't',
+    name: 'base32hexpad',
+    alphabet: '0123456789abcdefghijklmnopqrstuv=',
+    bitsPerChar: 5
+});
+rfc4648({
+    prefix: 'T',
+    name: 'base32hexpadupper',
+    alphabet: '0123456789ABCDEFGHIJKLMNOPQRSTUV=',
+    bitsPerChar: 5
+});
+rfc4648({
+    prefix: 'h',
+    name: 'base32z',
+    alphabet: 'ybndrfg8ejkmcpqxot1uwisza345h769',
+    bitsPerChar: 5
+});
+
+const base36 = baseX({
+    prefix: 'k',
+    name: 'base36',
+    alphabet: '0123456789abcdefghijklmnopqrstuvwxyz'
+});
+baseX({
+    prefix: 'K',
+    name: 'base36upper',
+    alphabet: '0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ'
+});
+
+const base58btc = baseX({
+    name: 'base58btc',
+    prefix: 'z',
+    alphabet: '123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz'
+});
+baseX({
+    name: 'base58flickr',
+    prefix: 'Z',
+    alphabet: '123456789abcdefghijkmnopqrstuvwxyzABCDEFGHJKLMNPQRSTUVWXYZ'
+});
+
+/* eslint-disable */
+var encode_1 = encode;
+var MSB = 0x80, MSBALL = -128, INT = Math.pow(2, 31);
+/**
+ * @param {number} num
+ * @param {number[]} out
+ * @param {number} offset
+ */
+function encode(num, out, offset) {
+    out = out || [];
+    offset = offset || 0;
+    var oldOffset = offset;
+    while (num >= INT) {
+        out[offset++] = (num & 0xFF) | MSB;
+        num /= 128;
+    }
+    while (num & MSBALL) {
+        out[offset++] = (num & 0xFF) | MSB;
+        num >>>= 7;
+    }
+    out[offset] = num | 0;
+    // @ts-ignore
+    encode.bytes = offset - oldOffset + 1;
+    return out;
+}
+var decode$2 = read;
+var MSB$1 = 0x80, REST$1 = 0x7F;
+/**
+ * @param {string | any[]} buf
+ * @param {number} offset
+ */
+function read(buf, offset) {
+    var res = 0, offset = offset || 0, shift = 0, counter = offset, b, l = buf.length;
+    do {
+        if (counter >= l) {
+            // @ts-ignore
+            read.bytes = 0;
+            throw new RangeError('Could not decode varint');
+        }
+        b = buf[counter++];
+        res += shift < 28
+            ? (b & REST$1) << shift
+            : (b & REST$1) * Math.pow(2, shift);
+        shift += 7;
+    } while (b >= MSB$1);
+    // @ts-ignore
+    read.bytes = counter - offset;
+    return res;
+}
+var N1 = Math.pow(2, 7);
+var N2 = Math.pow(2, 14);
+var N3 = Math.pow(2, 21);
+var N4 = Math.pow(2, 28);
+var N5 = Math.pow(2, 35);
+var N6 = Math.pow(2, 42);
+var N7 = Math.pow(2, 49);
+var N8 = Math.pow(2, 56);
+var N9 = Math.pow(2, 63);
+var length = function (/** @type {number} */ value) {
+    return (value < N1 ? 1
+        : value < N2 ? 2
+            : value < N3 ? 3
+                : value < N4 ? 4
+                    : value < N5 ? 5
+                        : value < N6 ? 6
+                            : value < N7 ? 7
+                                : value < N8 ? 8
+                                    : value < N9 ? 9
+                                        : 10);
+};
+var varint = {
+    encode: encode_1,
+    decode: decode$2,
+    encodingLength: length
+};
+var _brrp_varint = varint;
+
+function decode$1(data, offset = 0) {
+    const code = _brrp_varint.decode(data, offset);
+    return [code, _brrp_varint.decode.bytes];
+}
+function encodeTo(int, target, offset = 0) {
+    _brrp_varint.encode(int, target, offset);
+    return target;
+}
+function encodingLength(int) {
+    return _brrp_varint.encodingLength(int);
+}
+
+/**
+ * Creates a multihash digest.
+ */
+function create(code, digest) {
+    const size = digest.byteLength;
+    const sizeOffset = encodingLength(code);
+    const digestOffset = sizeOffset + encodingLength(size);
+    const bytes = new Uint8Array(digestOffset + size);
+    encodeTo(code, bytes, 0);
+    encodeTo(size, bytes, sizeOffset);
+    bytes.set(digest, digestOffset);
+    return new Digest(code, size, digest, bytes);
+}
+/**
+ * Turns bytes representation of multihash digest into an instance.
+ */
+function decode(multihash) {
+    const bytes = coerce(multihash);
+    const [code, sizeOffset] = decode$1(bytes);
+    const [size, digestOffset] = decode$1(bytes.subarray(sizeOffset));
+    const digest = bytes.subarray(sizeOffset + digestOffset);
+    if (digest.byteLength !== size) {
+        throw new Error('Incorrect length');
+    }
+    return new Digest(code, size, digest, bytes);
+}
+function equals(a, b) {
+    if (a === b) {
+        return true;
+    }
+    else {
+        const data = b;
+        return (a.code === data.code &&
+            a.size === data.size &&
+            data.bytes instanceof Uint8Array &&
+            equals$1(a.bytes, data.bytes));
+    }
+}
+/**
+ * Represents a multihash digest which carries information about the
+ * hashing algorithm and an actual hash digest.
+ */
+class Digest {
+    code;
+    size;
+    digest;
+    bytes;
+    /**
+     * Creates a multihash digest.
+     */
+    constructor(code, size, digest, bytes) {
+        this.code = code;
+        this.size = size;
+        this.digest = digest;
+        this.bytes = bytes;
+    }
+}
+
+function format(link, base) {
+    const { bytes, version } = link;
+    switch (version) {
+        case 0:
+            return toStringV0(bytes, baseCache(link), base ?? base58btc.encoder);
+        default:
+            return toStringV1(bytes, baseCache(link), (base ?? base32.encoder));
+    }
+}
+const cache = new WeakMap();
+function baseCache(cid) {
+    const baseCache = cache.get(cid);
+    if (baseCache == null) {
+        const baseCache = new Map();
+        cache.set(cid, baseCache);
+        return baseCache;
+    }
+    return baseCache;
+}
+class CID {
+    code;
+    version;
+    multihash;
+    bytes;
+    '/';
+    /**
+     * @param version - Version of the CID
+     * @param code - Code of the codec content is encoded in, see https://github.com/multiformats/multicodec/blob/master/table.csv
+     * @param multihash - (Multi)hash of the of the content.
+     */
+    constructor(version, code, multihash, bytes) {
+        this.code = code;
+        this.version = version;
+        this.multihash = multihash;
+        this.bytes = bytes;
+        // flag to serializers that this is a CID and
+        // should be treated specially
+        this['/'] = bytes;
+    }
+    /**
+     * Signalling `cid.asCID === cid` has been replaced with `cid['/'] === cid.bytes`
+     * please either use `CID.asCID(cid)` or switch to new signalling mechanism
+     *
+     * @deprecated
+     */
+    get asCID() {
+        return this;
+    }
+    // ArrayBufferView
+    get byteOffset() {
+        return this.bytes.byteOffset;
+    }
+    // ArrayBufferView
+    get byteLength() {
+        return this.bytes.byteLength;
+    }
+    toV0() {
+        switch (this.version) {
+            case 0: {
+                return this;
+            }
+            case 1: {
+                const { code, multihash } = this;
+                if (code !== DAG_PB_CODE) {
+                    throw new Error('Cannot convert a non dag-pb CID to CIDv0');
+                }
+                // sha2-256
+                if (multihash.code !== SHA_256_CODE) {
+                    throw new Error('Cannot convert non sha2-256 multihash CID to CIDv0');
+                }
+                return (CID.createV0(multihash));
+            }
+            default: {
+                throw Error(`Can not convert CID version ${this.version} to version 0. This is a bug please report`);
+            }
+        }
+    }
+    toV1() {
+        switch (this.version) {
+            case 0: {
+                const { code, digest } = this.multihash;
+                const multihash = create(code, digest);
+                return (CID.createV1(this.code, multihash));
+            }
+            case 1: {
+                return this;
+            }
+            default: {
+                throw Error(`Can not convert CID version ${this.version} to version 1. This is a bug please report`);
+            }
+        }
+    }
+    equals(other) {
+        return CID.equals(this, other);
+    }
+    static equals(self, other) {
+        const unknown = other;
+        return (unknown != null &&
+            self.code === unknown.code &&
+            self.version === unknown.version &&
+            equals(self.multihash, unknown.multihash));
+    }
+    toString(base) {
+        return format(this, base);
+    }
+    toJSON() {
+        return { '/': format(this) };
+    }
+    link() {
+        return this;
+    }
+    [Symbol.toStringTag] = 'CID';
+    // Legacy
+    [Symbol.for('nodejs.util.inspect.custom')]() {
+        return `CID(${this.toString()})`;
+    }
+    /**
+     * Takes any input `value` and returns a `CID` instance if it was
+     * a `CID` otherwise returns `null`. If `value` is instanceof `CID`
+     * it will return value back. If `value` is not instance of this CID
+     * class, but is compatible CID it will return new instance of this
+     * `CID` class. Otherwise returns null.
+     *
+     * This allows two different incompatible versions of CID library to
+     * co-exist and interop as long as binary interface is compatible.
+     */
+    static asCID(input) {
+        if (input == null) {
+            return null;
+        }
+        const value = input;
+        if (value instanceof CID) {
+            // If value is instance of CID then we're all set.
+            return value;
+        }
+        else if ((value['/'] != null && value['/'] === value.bytes) || value.asCID === value) {
+            // If value isn't instance of this CID class but `this.asCID === this` or
+            // `value['/'] === value.bytes` is true it is CID instance coming from a
+            // different implementation (diff version or duplicate). In that case we
+            // rebase it to this `CID` implementation so caller is guaranteed to get
+            // instance with expected API.
+            const { version, code, multihash, bytes } = value;
+            return new CID(version, code, multihash, bytes ?? encodeCID(version, code, multihash.bytes));
+        }
+        else if (value[cidSymbol] === true) {
+            // If value is a CID from older implementation that used to be tagged via
+            // symbol we still rebase it to the this `CID` implementation by
+            // delegating that to a constructor.
+            const { version, multihash, code } = value;
+            const digest = decode(multihash);
+            return CID.create(version, code, digest);
+        }
+        else {
+            // Otherwise value is not a CID (or an incompatible version of it) in
+            // which case we return `null`.
+            return null;
+        }
+    }
+    /**
+     * @param version - Version of the CID
+     * @param code - Code of the codec content is encoded in, see https://github.com/multiformats/multicodec/blob/master/table.csv
+     * @param digest - (Multi)hash of the of the content.
+     */
+    static create(version, code, digest) {
+        if (typeof code !== 'number') {
+            throw new Error('String codecs are no longer supported');
+        }
+        if (!(digest.bytes instanceof Uint8Array)) {
+            throw new Error('Invalid digest');
+        }
+        switch (version) {
+            case 0: {
+                if (code !== DAG_PB_CODE) {
+                    throw new Error(`Version 0 CID must use dag-pb (code: ${DAG_PB_CODE}) block encoding`);
+                }
+                else {
+                    return new CID(version, code, digest, digest.bytes);
+                }
+            }
+            case 1: {
+                const bytes = encodeCID(version, code, digest.bytes);
+                return new CID(version, code, digest, bytes);
+            }
+            default: {
+                throw new Error('Invalid version');
+            }
+        }
+    }
+    /**
+     * Simplified version of `create` for CIDv0.
+     */
+    static createV0(digest) {
+        return CID.create(0, DAG_PB_CODE, digest);
+    }
+    /**
+     * Simplified version of `create` for CIDv1.
+     *
+     * @param code - Content encoding format code.
+     * @param digest - Multihash of the content.
+     */
+    static createV1(code, digest) {
+        return CID.create(1, code, digest);
+    }
+    /**
+     * Decoded a CID from its binary representation. The byte array must contain
+     * only the CID with no additional bytes.
+     *
+     * An error will be thrown if the bytes provided do not contain a valid
+     * binary representation of a CID.
+     */
+    static decode(bytes) {
+        const [cid, remainder] = CID.decodeFirst(bytes);
+        if (remainder.length !== 0) {
+            throw new Error('Incorrect length');
+        }
+        return cid;
+    }
+    /**
+     * Decoded a CID from its binary representation at the beginning of a byte
+     * array.
+     *
+     * Returns an array with the first element containing the CID and the second
+     * element containing the remainder of the original byte array. The remainder
+     * will be a zero-length byte array if the provided bytes only contained a
+     * binary CID representation.
+     */
+    static decodeFirst(bytes) {
+        const specs = CID.inspectBytes(bytes);
+        const prefixSize = specs.size - specs.multihashSize;
+        const multihashBytes = coerce(bytes.subarray(prefixSize, prefixSize + specs.multihashSize));
+        if (multihashBytes.byteLength !== specs.multihashSize) {
+            throw new Error('Incorrect length');
+        }
+        const digestBytes = multihashBytes.subarray(specs.multihashSize - specs.digestSize);
+        const digest = new Digest(specs.multihashCode, specs.digestSize, digestBytes, multihashBytes);
+        const cid = specs.version === 0
+            ? CID.createV0(digest)
+            : CID.createV1(specs.codec, digest);
+        return [cid, bytes.subarray(specs.size)];
+    }
+    /**
+     * Inspect the initial bytes of a CID to determine its properties.
+     *
+     * Involves decoding up to 4 varints. Typically this will require only 4 to 6
+     * bytes but for larger multicodec code values and larger multihash digest
+     * lengths these varints can be quite large. It is recommended that at least
+     * 10 bytes be made available in the `initialBytes` argument for a complete
+     * inspection.
+     */
+    static inspectBytes(initialBytes) {
+        let offset = 0;
+        const next = () => {
+            const [i, length] = decode$1(initialBytes.subarray(offset));
+            offset += length;
+            return i;
+        };
+        let version = next();
+        let codec = DAG_PB_CODE;
+        if (version === 18) {
+            // CIDv0
+            version = 0;
+            offset = 0;
+        }
+        else {
+            codec = next();
+        }
+        if (version !== 0 && version !== 1) {
+            throw new RangeError(`Invalid CID version ${version}`);
+        }
+        const prefixSize = offset;
+        const multihashCode = next(); // multihash code
+        const digestSize = next(); // multihash length
+        const size = offset + digestSize;
+        const multihashSize = size - prefixSize;
+        return { version, codec, multihashCode, digestSize, multihashSize, size };
+    }
+    /**
+     * Takes cid in a string representation and creates an instance. If `base`
+     * decoder is not provided will use a default from the configuration. It will
+     * throw an error if encoding of the CID is not compatible with supplied (or
+     * a default decoder).
+     */
+    static parse(source, base) {
+        const [prefix, bytes] = parseCIDtoBytes(source, base);
+        const cid = CID.decode(bytes);
+        if (cid.version === 0 && source[0] !== 'Q') {
+            throw Error('Version 0 CID string must not include multibase prefix');
+        }
+        // Cache string representation to avoid computing it on `this.toString()`
+        baseCache(cid).set(prefix, source);
+        return cid;
+    }
+}
+function parseCIDtoBytes(source, base) {
+    switch (source[0]) {
+        // CIDv0 is parsed differently
+        case 'Q': {
+            const decoder = base ?? base58btc;
+            return [
+                base58btc.prefix,
+                decoder.decode(`${base58btc.prefix}${source}`)
+            ];
+        }
+        case base58btc.prefix: {
+            const decoder = base ?? base58btc;
+            return [base58btc.prefix, decoder.decode(source)];
+        }
+        case base32.prefix: {
+            const decoder = base ?? base32;
+            return [base32.prefix, decoder.decode(source)];
+        }
+        case base36.prefix: {
+            const decoder = base ?? base36;
+            return [base36.prefix, decoder.decode(source)];
+        }
+        default: {
+            if (base == null) {
+                throw Error('To parse non base32, base36 or base58btc encoded CID multibase decoder must be provided');
+            }
+            return [source[0], base.decode(source)];
+        }
+    }
+}
+function toStringV0(bytes, cache, base) {
+    const { prefix } = base;
+    if (prefix !== base58btc.prefix) {
+        throw Error(`Cannot string encode V0 in ${base.name} encoding`);
+    }
+    const cid = cache.get(prefix);
+    if (cid == null) {
+        const cid = base.encode(bytes).slice(1);
+        cache.set(prefix, cid);
+        return cid;
+    }
+    else {
+        return cid;
+    }
+}
+function toStringV1(bytes, cache, base) {
+    const { prefix } = base;
+    const cid = cache.get(prefix);
+    if (cid == null) {
+        const cid = base.encode(bytes);
+        cache.set(prefix, cid);
+        return cid;
+    }
+    else {
+        return cid;
+    }
+}
+const DAG_PB_CODE = 0x70;
+const SHA_256_CODE = 0x12;
+function encodeCID(version, code, multihash) {
+    const codeOffset = encodingLength(version);
+    const hashOffset = codeOffset + encodingLength(code);
+    const bytes = new Uint8Array(hashOffset + multihash.byteLength);
+    encodeTo(version, bytes, 0);
+    encodeTo(code, bytes, codeOffset);
+    bytes.set(multihash, hashOffset);
+    return bytes;
+}
+const cidSymbol = Symbol.for('@ipld/js-cid/CID');
+
+new TextEncoder();
+new TextDecoder();
+
+function isValidCID(cid) {
+    try {
+        CID.parse(cid);
+        return true;
+    }
+    catch (error) {
+        return false;
+    }
+}
+function isValidDID(did) {
+    if (typeof did !== 'string') {
+        return false;
+    }
+    if (!did.startsWith('did:')) {
+        return false;
+    }
+    const parts = did.split(':');
+    if (parts.length < 3) {
+        return false;
+    }
+    const suffix = parts.pop();
+    return isValidCID(suffix);
+}
+
+const DefaultSchema = {
+    "$schema": "http://json-schema.org/draft-07/schema#",
+    "type": "object",
+    "properties": {
+        "propertyName": {
+            "type": "string"
+        }
+    },
+    "required": [
+        "propertyName"
+    ]
+};
+exports.DmailTags = void 0;
+(function (DmailTags) {
+    DmailTags["DMAIL"] = "dmail";
+    DmailTags["INBOX"] = "inbox";
+    DmailTags["DRAFT"] = "draft";
+    DmailTags["SENT"] = "sent";
+    DmailTags["ARCHIVED"] = "archived";
+    DmailTags["DELETED"] = "deleted";
+    DmailTags["UNREAD"] = "unread";
+})(exports.DmailTags || (exports.DmailTags = {}));
+exports.NoticeTags = void 0;
+(function (NoticeTags) {
+    NoticeTags["DMAIL"] = "dmail";
+    NoticeTags["BALLOT"] = "ballot";
+    NoticeTags["POLL"] = "poll";
+    NoticeTags["CREDENTIAL"] = "credential";
+})(exports.NoticeTags || (exports.NoticeTags = {}));
+class Keymaster {
+    passphrase;
+    gatekeeper;
+    db;
+    cipher;
+    searchEngine;
+    defaultRegistry;
+    ephemeralRegistry;
+    maxNameLength;
+    maxDataLength;
+    _walletCache;
+    _hdkeyCache;
+    constructor(options) {
+        if (!options || !options.gatekeeper || !options.gatekeeper.createDID) {
+            throw new InvalidParameterError('options.gatekeeper');
+        }
+        if (!options.wallet || !options.wallet.loadWallet || !options.wallet.saveWallet) {
+            throw new InvalidParameterError('options.wallet');
+        }
+        if (!options.cipher || !options.cipher.verifySig) {
+            throw new InvalidParameterError('options.cipher');
+        }
+        if (options.search && !options.search.search) {
+            throw new InvalidParameterError('options.search');
+        }
+        if (!options.passphrase) {
+            throw new InvalidParameterError('options.passphrase');
+        }
+        this.passphrase = options.passphrase;
+        this.gatekeeper = options.gatekeeper;
+        this.db = options.wallet;
+        this.cipher = options.cipher;
+        this.searchEngine = options.search;
+        this.defaultRegistry = options.defaultRegistry || 'hyperswarm';
+        this.ephemeralRegistry = 'hyperswarm';
+        this.maxNameLength = options.maxNameLength || 32;
+        this.maxDataLength = 8 * 1024; // 8 KB max data to store in a JSON object
+    }
+    async listRegistries() {
+        return this.gatekeeper.listRegistries();
+    }
+    async mutateWallet(mutator) {
+        // Create wallet if none and make sure _walletCache is set
+        if (!this._walletCache) {
+            await this.loadWallet();
+        }
+        await this.db.updateWallet(async (stored) => {
+            const decrypted = this._walletCache;
+            const before = JSON.stringify(decrypted);
+            await mutator(decrypted);
+            const after = JSON.stringify(decrypted);
+            if (before === after) {
+                return;
+            }
+            const reenc = await this.encryptWalletForStorage(decrypted);
+            Object.assign(stored, reenc);
+            this._walletCache = decrypted;
+        });
+    }
+    async loadWallet() {
+        if (this._walletCache) {
+            return this._walletCache;
+        }
+        let stored = await this.db.loadWallet();
+        if (!stored) {
+            stored = await this.newWallet();
+        }
+        const upgraded = await this.upgradeWallet(stored);
+        this._walletCache = await this.decryptWallet(upgraded);
+        return this._walletCache;
+    }
+    async saveWallet(wallet, overwrite = true) {
+        let upgraded = await this.upgradeWallet(wallet);
+        // Decrypt if encrypted to verify passphrase and get decrypted form
+        const decrypted = await this.decryptWallet(upgraded);
+        let toStore = await this.encryptWalletForStorage(decrypted);
+        const ok = await this.db.saveWallet(toStore, overwrite);
+        if (ok) {
+            this._walletCache = decrypted;
+        }
+        return ok;
+    }
+    async newWallet(mnemonic, overwrite = false) {
+        try {
+            if (!mnemonic) {
+                mnemonic = this.cipher.generateMnemonic();
+            }
+            this._hdkeyCache = this.cipher.generateHDKey(mnemonic);
+        }
+        catch (error) {
+            throw new InvalidParameterError('mnemonic');
+        }
+        const mnemonicEnc = await encryption.encMnemonic(mnemonic, this.passphrase);
+        const wallet = {
+            version: 1,
+            seed: { mnemonicEnc },
+            counter: 0,
+            ids: {}
+        };
+        const ok = await this.saveWallet(wallet, overwrite);
+        if (!ok) {
+            throw new KeymasterError('save wallet failed');
+        }
+        return wallet;
+    }
+    async decryptMnemonic() {
+        const wallet = await this.loadWallet();
+        return this.getMnemonicForDerivation(wallet);
+    }
+    async getMnemonicForDerivation(wallet) {
+        return encryption.decMnemonic(wallet.seed.mnemonicEnc, this.passphrase);
+    }
+    async checkWallet() {
+        const wallet = await this.loadWallet();
+        let checked = 0;
+        let invalid = 0;
+        let deleted = 0;
+        // Validate keys
+        await this.resolveSeedBank();
+        for (const name of Object.keys(wallet.ids)) {
+            try {
+                const doc = await this.resolveDID(wallet.ids[name].did);
+                if (doc.didDocumentMetadata?.deactivated) {
+                    deleted += 1;
+                }
+            }
+            catch (error) {
+                invalid += 1;
+            }
+            checked += 1;
+        }
+        for (const id of Object.values(wallet.ids)) {
+            if (id.owned) {
+                for (const did of id.owned) {
+                    try {
+                        const doc = await this.resolveDID(did);
+                        if (doc.didDocumentMetadata?.deactivated) {
+                            deleted += 1;
+                        }
+                    }
+                    catch (error) {
+                        invalid += 1;
+                    }
+                    checked += 1;
+                }
+            }
+            if (id.held) {
+                for (const did of id.held) {
+                    try {
+                        const doc = await this.resolveDID(did);
+                        if (doc.didDocumentMetadata?.deactivated) {
+                            deleted += 1;
+                        }
+                    }
+                    catch (error) {
+                        invalid += 1;
+                    }
+                    checked += 1;
+                }
+            }
+        }
+        if (wallet.names) {
+            for (const name of Object.keys(wallet.names)) {
+                try {
+                    const doc = await this.resolveDID(wallet.names[name]);
+                    if (doc.didDocumentMetadata?.deactivated) {
+                        deleted += 1;
+                    }
+                }
+                catch (error) {
+                    invalid += 1;
+                }
+                checked += 1;
+            }
+        }
+        return { checked, invalid, deleted };
+    }
+    async fixWallet() {
+        let idsRemoved = 0;
+        let ownedRemoved = 0;
+        let heldRemoved = 0;
+        let namesRemoved = 0;
+        await this.mutateWallet(async (wallet) => {
+            for (const name of Object.keys(wallet.ids)) {
+                let remove = false;
+                try {
+                    const doc = await this.resolveDID(wallet.ids[name].did);
+                    if (doc.didDocumentMetadata?.deactivated) {
+                        remove = true;
+                    }
+                }
+                catch {
+                    remove = true;
+                }
+                if (remove) {
+                    delete wallet.ids[name];
+                    idsRemoved++;
+                }
+            }
+            for (const id of Object.values(wallet.ids)) {
+                if (id.owned) {
+                    for (let i = 0; i < id.owned.length; i++) {
+                        let remove = false;
+                        try {
+                            const doc = await this.resolveDID(id.owned[i]);
+                            if (doc.didDocumentMetadata?.deactivated) {
+                                remove = true;
+                            }
+                        }
+                        catch {
+                            remove = true;
+                        }
+                        if (remove) {
+                            id.owned.splice(i, 1);
+                            i--;
+                            ownedRemoved++;
+                        }
+                    }
+                }
+                if (id.held) {
+                    for (let i = 0; i < id.held.length; i++) {
+                        let remove = false;
+                        try {
+                            const doc = await this.resolveDID(id.held[i]);
+                            if (doc.didDocumentMetadata?.deactivated) {
+                                remove = true;
+                            }
+                        }
+                        catch {
+                            remove = true;
+                        }
+                        if (remove) {
+                            id.held.splice(i, 1);
+                            i--;
+                            heldRemoved++;
+                        }
+                    }
+                }
+            }
+            if (wallet.names) {
+                for (const name of Object.keys(wallet.names)) {
+                    let remove = false;
+                    try {
+                        const doc = await this.resolveDID(wallet.names[name]);
+                        if (doc.didDocumentMetadata?.deactivated) {
+                            remove = true;
+                        }
+                    }
+                    catch {
+                        remove = true;
+                    }
+                    if (remove) {
+                        delete wallet.names[name];
+                        namesRemoved++;
+                    }
+                }
+            }
+        });
+        return { idsRemoved, ownedRemoved, heldRemoved, namesRemoved };
+    }
+    async resolveSeedBank() {
+        const keypair = await this.hdKeyPair();
+        const operation = {
+            type: "create",
+            created: new Date(0).toISOString(),
+            registration: {
+                version: 1,
+                type: "agent",
+                registry: this.defaultRegistry,
+            },
+            publicJwk: keypair.publicJwk,
+        };
+        const msgHash = this.cipher.hashJSON(operation);
+        const signature = this.cipher.signHash(msgHash, keypair.privateJwk);
+        const signed = {
+            ...operation,
+            signature: {
+                signed: new Date(0).toISOString(),
+                hash: msgHash,
+                value: signature
+            }
+        };
+        const did = await this.gatekeeper.createDID(signed);
+        return this.gatekeeper.resolveDID(did);
+    }
+    async updateSeedBank(doc) {
+        const keypair = await this.hdKeyPair();
+        const did = doc.didDocument?.id;
+        if (!did) {
+            throw new InvalidParameterError('seed bank missing DID');
+        }
+        const current = await this.gatekeeper.resolveDID(did);
+        const previd = current.didDocumentMetadata?.versionId;
+        const operation = {
+            type: "update",
+            did,
+            previd,
+            doc,
+        };
+        const msgHash = this.cipher.hashJSON(operation);
+        const signature = this.cipher.signHash(msgHash, keypair.privateJwk);
+        const signed = {
+            ...operation,
+            signature: {
+                signer: did,
+                signed: new Date().toISOString(),
+                hash: msgHash,
+                value: signature,
+            }
+        };
+        return await this.gatekeeper.updateDID(signed);
+    }
+    async backupWallet(registry = this.defaultRegistry, wallet) {
+        if (!wallet) {
+            wallet = await this.loadWallet();
+        }
+        const keypair = await this.hdKeyPair();
+        const seedBank = await this.resolveSeedBank();
+        const msg = JSON.stringify(wallet);
+        const backup = this.cipher.encryptMessage(keypair.publicJwk, keypair.privateJwk, msg);
+        const operation = {
+            type: "create",
+            created: new Date().toISOString(),
+            registration: {
+                version: 1,
+                type: "asset",
+                registry: registry,
+            },
+            controller: seedBank.didDocument?.id,
+            data: { backup: backup },
+        };
+        const msgHash = this.cipher.hashJSON(operation);
+        const signature = this.cipher.signHash(msgHash, keypair.privateJwk);
+        const signed = {
+            ...operation,
+            signature: {
+                signer: seedBank.didDocument?.id,
+                signed: new Date().toISOString(),
+                hash: msgHash,
+                value: signature,
+            }
+        };
+        const backupDID = await this.gatekeeper.createDID(signed);
+        if (seedBank.didDocumentData && typeof seedBank.didDocumentData === 'object' && !Array.isArray(seedBank.didDocumentData)) {
+            const data = seedBank.didDocumentData;
+            data.wallet = backupDID;
+            await this.updateSeedBank(seedBank);
+        }
+        return backupDID;
+    }
+    async recoverWallet(did) {
+        try {
+            if (!did) {
+                const seedBank = await this.resolveSeedBank();
+                if (seedBank.didDocumentData && typeof seedBank.didDocumentData === 'object' && !Array.isArray(seedBank.didDocumentData)) {
+                    const data = seedBank.didDocumentData;
+                    did = data.wallet;
+                }
+                if (!did) {
+                    throw new InvalidParameterError('No backup DID found');
+                }
+            }
+            const keypair = await this.hdKeyPair();
+            const data = await this.resolveAsset(did);
+            if (!data) {
+                throw new InvalidParameterError('No asset data found');
+            }
+            const castData = data;
+            if (typeof castData.backup !== 'string') {
+                throw new InvalidParameterError('Asset "backup" is missing or not a string');
+            }
+            const backup = this.cipher.decryptMessage(keypair.publicJwk, keypair.privateJwk, castData.backup);
+            let wallet = JSON.parse(backup);
+            if (db_typeGuards.isWalletFile(wallet)) {
+                const mnemonic = await this.decryptMnemonic();
+                // Backup might have a different mnemonic passphase so re-encrypt
+                wallet.seed.mnemonicEnc = await encryption.encMnemonic(mnemonic, this.passphrase);
+            }
+            await this.mutateWallet(async (current) => {
+                // Clear all existing properties from the current wallet
+                // This ensures a clean slate before restoring the recovered wallet
+                for (const k in current) {
+                    delete current[k];
+                }
+                // Upgrade the recovered wallet to the latest version if needed
+                wallet = await this.upgradeWallet(wallet);
+                // Decrypt the wallet if needed
+                wallet = db_typeGuards.isWalletEncFile(wallet) ? await this.decryptWalletFromStorage(wallet) : wallet;
+                // Copy all properties from the recovered wallet into the cleared current wallet
+                // This effectively replaces the current wallet with the recovered one
+                Object.assign(current, wallet);
+            });
+            return this.loadWallet();
+        }
+        catch (error) {
+            // If we can't recover the wallet, just return the current one
+            return this.loadWallet();
+        }
+    }
+    async listIds() {
+        const wallet = await this.loadWallet();
+        return Object.keys(wallet.ids);
+    }
+    async getCurrentId() {
+        const wallet = await this.loadWallet();
+        return wallet.current;
+    }
+    async setCurrentId(name) {
+        await this.mutateWallet((wallet) => {
+            if (!(name in wallet.ids)) {
+                throw new UnknownIDError();
+            }
+            wallet.current = name;
+        });
+        return true;
+    }
+    didMatch(did1, did2) {
+        const suffix1 = did1.split(':').pop();
+        const suffix2 = did2.split(':').pop();
+        return (suffix1 === suffix2);
+    }
+    async fetchIdInfo(id, wallet) {
+        // Callers should pass in the wallet if they are going to modify and save it later
+        if (!wallet) {
+            wallet = await this.loadWallet();
+        }
+        let idInfo = null;
+        if (id) {
+            if (id.startsWith('did')) {
+                for (const name of Object.keys(wallet.ids)) {
+                    const info = wallet.ids[name];
+                    if (this.didMatch(id, info.did)) {
+                        idInfo = info;
+                        break;
+                    }
+                }
+            }
+            else {
+                idInfo = wallet.ids[id];
+            }
+        }
+        else {
+            if (!wallet.current) {
+                throw new KeymasterError('No current ID');
+            }
+            idInfo = wallet.ids[wallet.current];
+        }
+        if (!idInfo) {
+            throw new UnknownIDError();
+        }
+        return idInfo;
+    }
+    async hdKeyPair() {
+        const wallet = await this.loadWallet();
+        const hdkey = await this.getHDKeyFromCacheOrMnemonic(wallet);
+        return this.cipher.generateJwk(hdkey.privateKey);
+    }
+    getPublicKeyJwk(doc) {
+        // TBD Return the right public key, not just the first one
+        if (!doc.didDocument) {
+            throw new KeymasterError('Missing didDocument.');
+        }
+        const verificationMethods = doc.didDocument.verificationMethod;
+        if (!verificationMethods || verificationMethods.length === 0) {
+            throw new KeymasterError('The DID document does not contain any verification methods.');
+        }
+        const publicKeyJwk = verificationMethods[0].publicKeyJwk;
+        if (!publicKeyJwk) {
+            throw new KeymasterError('The publicKeyJwk is missing in the first verification method.');
+        }
+        return publicKeyJwk;
+    }
+    async fetchKeyPair(name) {
+        const wallet = await this.loadWallet();
+        const id = await this.fetchIdInfo(name);
+        const hdkey = await this.getHDKeyFromCacheOrMnemonic(wallet);
+        const doc = await this.resolveDID(id.did, { confirm: true });
+        const confirmedPublicKeyJwk = this.getPublicKeyJwk(doc);
+        for (let i = id.index; i >= 0; i--) {
+            const path = `m/44'/0'/${id.account}'/0/${i}`;
+            const didkey = hdkey.derive(path);
+            const keypair = this.cipher.generateJwk(didkey.privateKey);
+            if (keypair.publicJwk.x === confirmedPublicKeyJwk.x &&
+                keypair.publicJwk.y === confirmedPublicKeyJwk.y) {
+                return keypair;
+            }
+        }
+        return null;
+    }
+    async createAsset(data, options = {}) {
+        let { registry = this.defaultRegistry, controller, validUntil, name } = options;
+        if (validUntil) {
+            const validate = new Date(validUntil);
+            if (isNaN(validate.getTime())) {
+                throw new InvalidParameterError('options.validUntil');
+            }
+        }
+        if (name) {
+            const wallet = await this.loadWallet();
+            this.validateName(name, wallet);
+        }
+        if (!data) {
+            throw new InvalidParameterError('data');
+        }
+        const id = await this.fetchIdInfo(controller);
+        const block = await this.gatekeeper.getBlock(registry);
+        const blockid = block?.hash;
+        const operation = {
+            type: "create",
+            created: new Date().toISOString(),
+            blockid,
+            registration: {
+                version: 1,
+                type: "asset",
+                registry,
+                validUntil
+            },
+            controller: id.did,
+            data,
+        };
+        const signed = await this.addSignature(operation, controller);
+        const did = await this.gatekeeper.createDID(signed);
+        // Keep assets that will be garbage-collected out of the owned list
+        if (!validUntil) {
+            await this.addToOwned(did);
+        }
+        if (name) {
+            await this.addName(name, did);
+        }
+        return did;
+    }
+    async cloneAsset(id, options = {}) {
+        const assetDoc = await this.resolveDID(id);
+        if (assetDoc.didDocumentRegistration?.type !== 'asset') {
+            throw new InvalidParameterError('id');
+        }
+        const assetData = assetDoc.didDocumentData || {};
+        const cloneData = { ...assetData, cloned: assetDoc.didDocument.id };
+        return this.createAsset(cloneData, options);
+    }
+    async generateImageAsset(buffer) {
+        let metadata;
+        try {
+            metadata = imageSize.imageSize(buffer);
+        }
+        catch (error) {
+            throw new InvalidParameterError('buffer');
+        }
+        const cid = await this.gatekeeper.addData(buffer);
+        const image = {
+            cid,
+            bytes: buffer.length,
+            ...metadata,
+            type: `image/${metadata.type}`
+        };
+        return image;
+    }
+    async createImage(buffer, options = {}) {
+        const image = await this.generateImageAsset(buffer);
+        return this.createAsset({ image }, options);
+    }
+    async updateImage(id, buffer) {
+        const image = await this.generateImageAsset(buffer);
+        return this.updateAsset(id, { image });
+    }
+    async getImage(id) {
+        const asset = await this.resolveAsset(id);
+        const image = asset.image;
+        if (!image || !image.cid) {
+            return null;
+        }
+        const buffer = await this.gatekeeper.getData(image.cid);
+        if (buffer) {
+            image.data = buffer;
+        }
+        return image;
+    }
+    async testImage(id) {
+        try {
+            const image = await this.getImage(id);
+            return image !== null;
+        }
+        catch (error) {
+            return false;
+        }
+    }
+    async getMimeType(buffer) {
+        // Try magic number detection
+        const result = await fileType.fileTypeFromBuffer(buffer);
+        if (result)
+            return result.mime;
+        // Convert to UTF-8 string if decodable
+        const text = buffer.toString('utf8');
+        // Check for JSON
+        try {
+            JSON.parse(text);
+            return 'application/json';
+        }
+        catch { }
+        // Default to plain text if printable ASCII
+        // eslint-disable-next-line
+        if (/^[\x09\x0A\x0D\x20-\x7E]*$/.test(text.replace(/\n/g, ''))) {
+            return 'text/plain';
+        }
+        // Fallback
+        return 'application/octet-stream';
+    }
+    async generateFileAsset(filename, buffer) {
+        const cid = await this.gatekeeper.addData(buffer);
+        const type = await this.getMimeType(buffer);
+        const file = {
+            cid,
+            filename,
+            type,
+            bytes: buffer.length,
+        };
+        return file;
+    }
+    async createDocument(buffer, options = {}) {
+        const filename = options.filename || 'document';
+        const document = await this.generateFileAsset(filename, buffer);
+        return this.createAsset({ document }, options);
+    }
+    async updateDocument(id, buffer, options = {}) {
+        const filename = options.filename || 'document';
+        const document = await this.generateFileAsset(filename, buffer);
+        return this.updateAsset(id, { document });
+    }
+    async getDocument(id) {
+        const asset = await this.resolveAsset(id);
+        return asset.document ?? null;
+    }
+    async testDocument(id) {
+        try {
+            const document = await this.getDocument(id);
+            return document !== null;
+        }
+        catch (error) {
+            return false;
+        }
+    }
+    async encryptMessage(msg, receiver, options = {}) {
+        const { encryptForSender = true, includeHash = false, } = options;
+        const id = await this.fetchIdInfo();
+        const senderKeypair = await this.fetchKeyPair();
+        if (!senderKeypair) {
+            throw new KeymasterError('No valid sender keypair');
+        }
+        const doc = await this.resolveDID(receiver, { confirm: true });
+        const receivePublicJwk = this.getPublicKeyJwk(doc);
+        const cipher_sender = encryptForSender ? this.cipher.encryptMessage(senderKeypair.publicJwk, senderKeypair.privateJwk, msg) : null;
+        const cipher_receiver = this.cipher.encryptMessage(receivePublicJwk, senderKeypair.privateJwk, msg);
+        const cipher_hash = includeHash ? this.cipher.hashMessage(msg) : null;
+        const encrypted = {
+            sender: id.did,
+            created: new Date().toISOString(),
+            cipher_hash,
+            cipher_sender,
+            cipher_receiver,
+        };
+        return await this.createAsset({ encrypted }, options);
+    }
+    async decryptWithDerivedKeys(wallet, id, senderPublicJwk, ciphertext) {
+        const hdkey = await this.getHDKeyFromCacheOrMnemonic(wallet);
+        // Try all private keys for this ID, starting with the most recent and working backward
+        let index = id.index;
+        while (index >= 0) {
+            const path = `m/44'/0'/${id.account}'/0/${index}`;
+            const didkey = hdkey.derive(path);
+            const receiverKeypair = this.cipher.generateJwk(didkey.privateKey);
+            try {
+                return this.cipher.decryptMessage(senderPublicJwk, receiverKeypair.privateJwk, ciphertext);
+            }
+            catch (error) {
+                index -= 1;
+            }
+        }
+        throw new KeymasterError("ID can't decrypt ciphertext");
+    }
+    async decryptMessage(did) {
+        const wallet = await this.loadWallet();
+        const id = await this.fetchIdInfo();
+        const asset = await this.resolveAsset(did);
+        if (!asset) {
+            throw new InvalidParameterError('did not encrypted');
+        }
+        const castAsset = asset;
+        if (!castAsset.encrypted && !castAsset.cipher_hash) {
+            throw new InvalidParameterError('did not encrypted');
+        }
+        const crypt = (castAsset.encrypted ? castAsset.encrypted : castAsset);
+        const doc = await this.resolveDID(crypt.sender, { confirm: true, versionTime: crypt.created });
+        const senderPublicJwk = this.getPublicKeyJwk(doc);
+        const ciphertext = (crypt.sender === id.did && crypt.cipher_sender) ? crypt.cipher_sender : crypt.cipher_receiver;
+        return await this.decryptWithDerivedKeys(wallet, id, senderPublicJwk, ciphertext);
+    }
+    async encryptJSON(json, did, options = {}) {
+        const plaintext = JSON.stringify(json);
+        return this.encryptMessage(plaintext, did, options);
+    }
+    async decryptJSON(did) {
+        const plaintext = await this.decryptMessage(did);
+        try {
+            return JSON.parse(plaintext);
+        }
+        catch (error) {
+            throw new InvalidParameterError('did not encrypted JSON');
+        }
+    }
+    async addSignature(obj, controller) {
+        if (obj == null) {
+            throw new InvalidParameterError('obj');
+        }
+        // Fetches current ID if name is missing
+        const id = await this.fetchIdInfo(controller);
+        const keypair = await this.fetchKeyPair(controller);
+        if (!keypair) {
+            throw new KeymasterError('addSignature: no keypair');
+        }
+        try {
+            const msgHash = this.cipher.hashJSON(obj);
+            const signature = this.cipher.signHash(msgHash, keypair.privateJwk);
+            return {
+                ...obj,
+                signature: {
+                    signer: id.did,
+                    signed: new Date().toISOString(),
+                    hash: msgHash,
+                    value: signature,
+                }
+            };
+        }
+        catch (error) {
+            throw new InvalidParameterError('obj');
+        }
+    }
+    async verifySignature(obj) {
+        if (!obj?.signature) {
+            return false;
+        }
+        const { signature } = obj;
+        if (!signature.signer) {
+            return false;
+        }
+        const jsonCopy = JSON.parse(JSON.stringify(obj));
+        delete jsonCopy.signature;
+        const msgHash = this.cipher.hashJSON(jsonCopy);
+        if (signature.hash && signature.hash !== msgHash) {
+            return false;
+        }
+        const doc = await this.resolveDID(signature.signer, { versionTime: signature.signed });
+        const publicJwk = this.getPublicKeyJwk(doc);
+        try {
+            return this.cipher.verifySig(msgHash, signature.value, publicJwk);
+        }
+        catch (error) {
+            return false;
+        }
+    }
+    async updateDID(id, doc) {
+        const did = await this.lookupDID(id);
+        const current = await this.resolveDID(did);
+        const previd = current.didDocumentMetadata?.versionId;
+        // Strip metadata fields from the update doc
+        delete doc.didDocumentMetadata;
+        delete doc.didResolutionMetadata;
+        const block = await this.gatekeeper.getBlock(current.didDocumentRegistration.registry);
+        const blockid = block?.hash;
+        const operation = {
+            type: "update",
+            did,
+            previd,
+            blockid,
+            doc,
+        };
+        let controller;
+        if (current.didDocumentRegistration?.type === 'agent') {
+            controller = current.didDocument?.id;
+        }
+        else if (current.didDocumentRegistration?.type === 'asset') {
+            controller = current.didDocument?.controller;
+        }
+        const signed = await this.addSignature(operation, controller);
+        return this.gatekeeper.updateDID(signed);
+    }
+    async revokeDID(id) {
+        const did = await this.lookupDID(id);
+        const current = await this.resolveDID(did);
+        const previd = current.didDocumentMetadata?.versionId;
+        const block = await this.gatekeeper.getBlock(current.didDocumentRegistration.registry);
+        const blockid = block?.hash;
+        const operation = {
+            type: "delete",
+            did,
+            previd,
+            blockid
+        };
+        let controller;
+        if (current.didDocumentRegistration?.type === 'agent') {
+            controller = current.didDocument?.id;
+        }
+        else if (current.didDocumentRegistration?.type === 'asset') {
+            controller = current.didDocument?.controller;
+        }
+        const signed = await this.addSignature(operation, controller);
+        const ok = await this.gatekeeper.deleteDID(signed);
+        if (ok && current.didDocument?.controller) {
+            await this.removeFromOwned(did, current.didDocument.controller);
+        }
+        return ok;
+    }
+    async addToOwned(did, owner) {
+        await this.mutateWallet(async (wallet) => {
+            const id = await this.fetchIdInfo(owner, wallet);
+            const owned = new Set(id.owned);
+            owned.add(did);
+            id.owned = Array.from(owned);
+        });
+        return true;
+    }
+    async removeFromOwned(did, owner) {
+        let ownerFound = false;
+        await this.mutateWallet(async (wallet) => {
+            const id = await this.fetchIdInfo(owner, wallet);
+            if (!id.owned) {
+                return;
+            }
+            ownerFound = true;
+            id.owned = id.owned.filter(item => item !== did);
+        });
+        return ownerFound;
+    }
+    async addToHeld(did) {
+        await this.mutateWallet((wallet) => {
+            const id = wallet.ids[wallet.current];
+            const held = new Set(id.held);
+            held.add(did);
+            id.held = Array.from(held);
+        });
+        return true;
+    }
+    async removeFromHeld(did) {
+        let changed = false;
+        await this.mutateWallet((wallet) => {
+            const id = wallet.ids[wallet.current];
+            const held = new Set(id.held);
+            if (held.delete(did)) {
+                id.held = Array.from(held);
+                changed = true;
+            }
+        });
+        return changed;
+    }
+    async lookupDID(name) {
+        try {
+            if (name.startsWith('did:')) {
+                return name;
+            }
+        }
+        catch {
+            throw new InvalidDIDError();
+        }
+        const wallet = await this.loadWallet();
+        if (wallet.names && name in wallet.names) {
+            return wallet.names[name];
+        }
+        if (wallet.ids && name in wallet.ids) {
+            return wallet.ids[name].did;
+        }
+        throw new UnknownIDError();
+    }
+    async resolveDID(did, options) {
+        const actualDid = await this.lookupDID(did);
+        const docs = await this.gatekeeper.resolveDID(actualDid, options);
+        if (docs.didResolutionMetadata?.error) {
+            if (docs.didResolutionMetadata.error === 'notFound') {
+                throw new InvalidDIDError('unknown');
+            }
+            if (docs.didResolutionMetadata.error === 'invalidDid') {
+                throw new InvalidDIDError('bad format');
+            }
+        }
+        const controller = docs.didDocument?.controller || docs.didDocument?.id;
+        const isOwned = await this.idInWallet(controller);
+        // Augment the DID document metadata with the DID ownership status
+        docs.didDocumentMetadata = {
+            ...docs.didDocumentMetadata,
+            isOwned,
+        };
+        return docs;
+    }
+    async idInWallet(did) {
+        try {
+            await this.fetchIdInfo(did);
+            return true;
+        }
+        catch (error) {
+            return false;
+        }
+    }
+    async resolveAsset(did, options) {
+        const doc = await this.resolveDID(did, options);
+        if (!doc?.didDocument?.controller || !doc?.didDocumentData || doc.didDocumentMetadata?.deactivated) {
+            return {};
+        }
+        return doc.didDocumentData;
+    }
+    async updateAsset(did, data) {
+        const doc = await this.resolveDID(did);
+        const currentData = doc.didDocumentData || {};
+        const updatedData = {
+            ...currentData,
+            ...data
+        };
+        return this.updateDID(did, { didDocumentData: updatedData });
+    }
+    async transferAsset(id, controller) {
+        const assetDoc = await this.resolveDID(id);
+        if (assetDoc.didDocumentRegistration?.type !== 'asset') {
+            throw new InvalidParameterError('id');
+        }
+        if (assetDoc.didDocument.controller === controller) {
+            return true;
+        }
+        const agentDoc = await this.resolveDID(controller);
+        if (agentDoc.didDocumentRegistration?.type !== 'agent') {
+            throw new InvalidParameterError('controller');
+        }
+        const assetDID = assetDoc.didDocument.id;
+        const prevOwner = assetDoc.didDocument.controller;
+        const updatedDidDocument = {
+            ...assetDoc.didDocument,
+            controller: agentDoc.didDocument.id,
+        };
+        const ok = await this.updateDID(id, { didDocument: updatedDidDocument });
+        if (ok && assetDID && prevOwner) {
+            await this.removeFromOwned(assetDID, prevOwner);
+            try {
+                await this.addToOwned(assetDID, controller);
+            }
+            catch (error) {
+                // New controller is not in our wallet
+            }
+        }
+        return ok;
+    }
+    async listAssets(owner) {
+        const id = await this.fetchIdInfo(owner);
+        return id.owned || [];
+    }
+    validateName(name, wallet) {
+        if (typeof name !== 'string' || !name.trim()) {
+            throw new InvalidParameterError('name must be a non-empty string');
+        }
+        name = name.trim(); // Remove leading/trailing whitespace
+        if (name.length > this.maxNameLength) {
+            throw new InvalidParameterError(`name too long`);
+        }
+        if (/[^\P{Cc}]/u.test(name)) {
+            throw new InvalidParameterError('name contains unprintable characters');
+        }
+        const alreadyUsedError = 'name already used';
+        if (wallet && wallet.names && name in wallet.names) {
+            throw new InvalidParameterError(alreadyUsedError);
+        }
+        if (wallet && wallet.ids && name in wallet.ids) {
+            throw new InvalidParameterError(alreadyUsedError);
+        }
+        return name;
+    }
+    async createId(name, options = {}) {
+        let did = '';
+        await this.mutateWallet(async (wallet) => {
+            const account = wallet.counter;
+            const index = 0;
+            const signed = await this.createIdOperation(name, account, options);
+            did = await this.gatekeeper.createDID(signed);
+            wallet.ids[name] = { did, account, index };
+            wallet.counter += 1;
+            wallet.current = name;
+        });
+        return did;
+    }
+    async createIdOperation(name, account = 0, options = {}) {
+        const { registry = this.defaultRegistry } = options;
+        const wallet = await this.loadWallet();
+        name = this.validateName(name, wallet);
+        const hdkey = await this.getHDKeyFromCacheOrMnemonic(wallet);
+        const path = `m/44'/0'/${account}'/0/0`;
+        const didkey = hdkey.derive(path);
+        const keypair = this.cipher.generateJwk(didkey.privateKey);
+        const block = await this.gatekeeper.getBlock(registry);
+        const blockid = block?.hash;
+        const operation = {
+            type: 'create',
+            created: new Date().toISOString(),
+            blockid,
+            registration: {
+                version: 1,
+                type: 'agent',
+                registry
+            },
+            publicJwk: keypair.publicJwk,
+        };
+        const msgHash = this.cipher.hashJSON(operation);
+        const signature = this.cipher.signHash(msgHash, keypair.privateJwk);
+        const signed = {
+            ...operation,
+            signature: {
+                signed: new Date().toISOString(),
+                hash: msgHash,
+                value: signature
+            },
+        };
+        return signed;
+    }
+    async removeId(name) {
+        await this.mutateWallet((wallet) => {
+            if (!(name in wallet.ids)) {
+                throw new UnknownIDError();
+            }
+            delete wallet.ids[name];
+            if (wallet.current === name) {
+                wallet.current = Object.keys(wallet.ids)[0] || '';
+            }
+        });
+        return true;
+    }
+    async renameId(id, name) {
+        await this.mutateWallet((wallet) => {
+            name = this.validateName(name);
+            if (!(id in wallet.ids)) {
+                throw new UnknownIDError();
+            }
+            if (name in wallet.ids) {
+                throw new InvalidParameterError('name already used');
+            }
+            wallet.ids[name] = wallet.ids[id];
+            delete wallet.ids[id];
+            if (wallet.current && wallet.current === id) {
+                wallet.current = name;
+            }
+        });
+        return true;
+    }
+    async backupId(id) {
+        // Backs up current ID if id is not provided
+        const wallet = await this.loadWallet();
+        const name = id || wallet.current;
+        if (!name) {
+            throw new InvalidParameterError('no current ID');
+        }
+        const idInfo = await this.fetchIdInfo(name, wallet);
+        const keypair = await this.hdKeyPair();
+        const data = {
+            name: name,
+            id: idInfo,
+        };
+        const msg = JSON.stringify(data);
+        const backup = this.cipher.encryptMessage(keypair.publicJwk, keypair.privateJwk, msg);
+        const doc = await this.resolveDID(idInfo.did);
+        const registry = doc.didDocumentRegistration?.registry;
+        if (!registry) {
+            throw new InvalidParameterError('no registry found for agent DID');
+        }
+        const vaultDid = await this.createAsset({ backup: backup }, { registry, controller: name });
+        if (doc.didDocumentData) {
+            const currentData = doc.didDocumentData;
+            const updatedData = { ...currentData, vault: vaultDid };
+            return this.updateDID(name, { didDocumentData: updatedData });
+        }
+        return false;
+    }
+    async recoverId(did) {
+        try {
+            const keypair = await this.hdKeyPair();
+            const doc = await this.resolveDID(did);
+            const docData = doc.didDocumentData;
+            if (!docData.vault) {
+                throw new InvalidDIDError('didDocumentData missing vault');
+            }
+            const vault = await this.resolveAsset(docData.vault);
+            if (typeof vault.backup !== 'string') {
+                throw new InvalidDIDError('backup not found in vault');
+            }
+            const backup = this.cipher.decryptMessage(keypair.publicJwk, keypair.privateJwk, vault.backup);
+            const data = JSON.parse(backup);
+            await this.mutateWallet((wallet) => {
+                if (wallet.ids[data.name]) {
+                    throw new KeymasterError(`${data.name} already exists in wallet`);
+                }
+                wallet.ids[data.name] = data.id;
+                wallet.current = data.name;
+                wallet.counter += 1;
+            });
+            return data.name;
+        }
+        catch (error) {
+            if (error.type === 'Keymaster') {
+                throw error;
+            }
+            else {
+                throw new InvalidDIDError();
+            }
+        }
+    }
+    async rotateKeys() {
+        let ok = false;
+        await this.mutateWallet(async (wallet) => {
+            const id = wallet.ids[wallet.current];
+            const nextIndex = id.index + 1;
+            const hdkey = await this.getHDKeyFromCacheOrMnemonic(wallet);
+            const path = `m/44'/0'/${id.account}'/0/${nextIndex}`;
+            const didkey = hdkey.derive(path);
+            const keypair = this.cipher.generateJwk(didkey.privateKey);
+            const doc = await this.resolveDID(id.did);
+            if (!doc.didDocumentMetadata?.confirmed) {
+                throw new KeymasterError('Cannot rotate keys');
+            }
+            if (!doc.didDocument?.verificationMethod) {
+                throw new KeymasterError('DID Document missing verificationMethod');
+            }
+            const vmethod = { ...doc.didDocument.verificationMethod[0] };
+            vmethod.id = `#key-${nextIndex + 1}`;
+            vmethod.publicKeyJwk = keypair.publicJwk;
+            const updatedDidDocument = {
+                ...doc.didDocument,
+                verificationMethod: [vmethod],
+                authentication: [vmethod.id],
+            };
+            ok = await this.updateDID(id.did, { didDocument: updatedDidDocument });
+            if (!ok) {
+                throw new KeymasterError('Cannot rotate keys');
+            }
+            id.index = nextIndex; // persist in same mutation
+        });
+        return ok;
+    }
+    async listNames(options = {}) {
+        const { includeIDs = false } = options;
+        const wallet = await this.loadWallet();
+        const names = wallet.names || {};
+        if (includeIDs) {
+            for (const [name, id] of Object.entries(wallet.ids || {})) {
+                names[name] = id.did;
+            }
+        }
+        return names;
+    }
+    async addName(name, did) {
+        await this.mutateWallet((wallet) => {
+            if (!wallet.names) {
+                wallet.names = {};
+            }
+            name = this.validateName(name, wallet);
+            wallet.names[name] = did;
+        });
+        return true;
+    }
+    async getName(name) {
+        const wallet = await this.loadWallet();
+        if (wallet.names && name in wallet.names) {
+            return wallet.names[name];
+        }
+        return null;
+    }
+    async removeName(name) {
+        await this.mutateWallet((wallet) => {
+            if (!wallet.names || !(name in wallet.names)) {
+                return;
+            }
+            delete wallet.names[name];
+        });
+        return true;
+    }
+    async testAgent(id) {
+        const doc = await this.resolveDID(id);
+        return doc.didDocumentRegistration?.type === 'agent';
+    }
+    async bindCredential(schemaId, subjectId, options = {}) {
+        let { validFrom, validUntil, credential } = options;
+        if (!validFrom) {
+            validFrom = new Date().toISOString();
+        }
+        const id = await this.fetchIdInfo();
+        const type = await this.lookupDID(schemaId);
+        const subjectDID = await this.lookupDID(subjectId);
+        if (!credential) {
+            const schema = await this.getSchema(type);
+            credential = this.generateSchema(schema);
+        }
+        return {
+            "@context": [
+                "https://www.w3.org/ns/credentials/v2",
+                "https://www.w3.org/ns/credentials/examples/v2"
+            ],
+            type: ["VerifiableCredential", type],
+            issuer: id.did,
+            validFrom,
+            validUntil,
+            credentialSubject: {
+                id: subjectDID,
+            },
+            credential,
+        };
+    }
+    async issueCredential(credential, options = {}) {
+        const id = await this.fetchIdInfo();
+        if (options.schema && options.subject) {
+            credential = await this.bindCredential(options.schema, options.subject, { credential, ...options });
+        }
+        if (credential.issuer !== id.did) {
+            throw new InvalidParameterError('credential.issuer');
+        }
+        const signed = await this.addSignature(credential);
+        return this.encryptJSON(signed, credential.credentialSubject.id, { ...options, includeHash: true });
+    }
+    async sendCredential(did, options = {}) {
+        const vc = await this.getCredential(did);
+        if (!vc) {
+            return null;
+        }
+        const registry = this.ephemeralRegistry;
+        const validUntil = new Date(Date.now() + 7 * 24 * 60 * 60 * 1000).toISOString(); // Default to 7 days
+        const message = {
+            to: [vc.credentialSubject.id],
+            dids: [did],
+        };
+        return this.createNotice(message, { registry, validUntil, ...options });
+    }
+    isVerifiableCredential(obj) {
+        if (typeof obj !== 'object' || !obj) {
+            return false;
+        }
+        const vc = obj;
+        return !(!Array.isArray(vc["@context"]) || !Array.isArray(vc.type) || !vc.issuer || !vc.credentialSubject);
+    }
+    async updateCredential(did, credential) {
+        did = await this.lookupDID(did);
+        const originalVC = await this.decryptJSON(did);
+        if (!this.isVerifiableCredential(originalVC)) {
+            throw new InvalidParameterError("did is not a credential");
+        }
+        if (!credential ||
+            !credential.credential ||
+            !credential.credentialSubject ||
+            !credential.credentialSubject.id) {
+            throw new InvalidParameterError('credential');
+        }
+        delete credential.signature;
+        const signed = await this.addSignature(credential);
+        const msg = JSON.stringify(signed);
+        const id = await this.fetchIdInfo();
+        const senderKeypair = await this.fetchKeyPair();
+        if (!senderKeypair) {
+            throw new KeymasterError('No valid sender keypair');
+        }
+        const holder = credential.credentialSubject.id;
+        const holderDoc = await this.resolveDID(holder, { confirm: true });
+        const receivePublicJwk = this.getPublicKeyJwk(holderDoc);
+        const cipher_sender = this.cipher.encryptMessage(senderKeypair.publicJwk, senderKeypair.privateJwk, msg);
+        const cipher_receiver = this.cipher.encryptMessage(receivePublicJwk, senderKeypair.privateJwk, msg);
+        const msgHash = this.cipher.hashMessage(msg);
+        const encrypted = {
+            sender: id.did,
+            created: new Date().toISOString(),
+            cipher_hash: msgHash,
+            cipher_sender: cipher_sender,
+            cipher_receiver: cipher_receiver,
+        };
+        return this.updateDID(did, { didDocumentData: { encrypted } });
+    }
+    async revokeCredential(credential) {
+        const did = await this.lookupDID(credential);
+        return this.revokeDID(did);
+    }
+    async listIssued(issuer) {
+        const id = await this.fetchIdInfo(issuer);
+        const issued = [];
+        if (id.owned) {
+            for (const did of id.owned) {
+                try {
+                    const credential = await this.decryptJSON(did);
+                    if (this.isVerifiableCredential(credential) &&
+                        credential.issuer === id.did) {
+                        issued.push(did);
+                    }
+                }
+                catch (error) { }
+            }
+        }
+        return issued;
+    }
+    async acceptCredential(did) {
+        try {
+            const id = await this.fetchIdInfo();
+            const credential = await this.lookupDID(did);
+            const vc = await this.decryptJSON(credential);
+            if (this.isVerifiableCredential(vc) &&
+                vc.credentialSubject?.id !== id.did) {
+                return false;
+            }
+            return this.addToHeld(credential);
+        }
+        catch (error) {
+            return false;
+        }
+    }
+    async getCredential(id) {
+        const did = await this.lookupDID(id);
+        const vc = await this.decryptJSON(did);
+        if (!this.isVerifiableCredential(vc)) {
+            return null;
+        }
+        return vc;
+    }
+    async removeCredential(id) {
+        const did = await this.lookupDID(id);
+        return this.removeFromHeld(did);
+    }
+    async listCredentials(id) {
+        const idInfo = await this.fetchIdInfo(id);
+        return idInfo.held || [];
+    }
+    async publishCredential(did, options = {}) {
+        const { reveal = false } = options;
+        const id = await this.fetchIdInfo();
+        const credential = await this.lookupDID(did);
+        const vc = await this.decryptJSON(credential);
+        if (!this.isVerifiableCredential(vc)) {
+            throw new InvalidParameterError("did is not a credential");
+        }
+        if (vc.credentialSubject?.id !== id.did) {
+            throw new InvalidParameterError('only subject can publish a credential');
+        }
+        const doc = await this.resolveDID(id.did);
+        if (!doc.didDocumentData) {
+            doc.didDocumentData = {};
+        }
+        const data = doc.didDocumentData;
+        if (!data.manifest) {
+            data.manifest = {};
+        }
+        if (!reveal) {
+            // Remove the credential values
+            vc.credential = null;
+        }
+        data.manifest[credential] = vc;
+        const ok = await this.updateDID(id.did, { didDocumentData: doc.didDocumentData });
+        if (ok) {
+            return vc;
+        }
+        throw new KeymasterError('update DID failed');
+    }
+    async unpublishCredential(did) {
+        const id = await this.fetchIdInfo();
+        const doc = await this.resolveDID(id.did);
+        const credential = await this.lookupDID(did);
+        const data = doc.didDocumentData;
+        if (credential && data.manifest && credential in data.manifest) {
+            delete data.manifest[credential];
+            await this.updateDID(id.did, { didDocumentData: doc.didDocumentData });
+            return `OK credential ${did} removed from manifest`;
+        }
+        throw new InvalidParameterError('did');
+    }
+    async createChallenge(challenge = {}, options = {}) {
+        if (!challenge || typeof challenge !== 'object' || Array.isArray(challenge)) {
+            throw new InvalidParameterError('challenge');
+        }
+        if (challenge.credentials && !Array.isArray(challenge.credentials)) {
+            throw new InvalidParameterError('challenge.credentials');
+            // TBD validate each credential spec
+        }
+        if (!options.registry) {
+            options.registry = this.ephemeralRegistry;
+        }
+        if (!options.validUntil) {
+            const expires = new Date();
+            expires.setHours(expires.getHours() + 1); // Add 1 hour
+            options.validUntil = expires.toISOString();
+        }
+        return this.createAsset({ challenge }, options);
+    }
+    async findMatchingCredential(credential) {
+        const id = await this.fetchIdInfo();
+        if (!id.held) {
+            return;
+        }
+        for (let did of id.held) {
+            try {
+                const doc = await this.decryptJSON(did);
+                if (!this.isVerifiableCredential(doc)) {
+                    continue;
+                }
+                if (doc.credentialSubject?.id !== id.did) {
+                    // This VC is issued by the ID, not held
+                    continue;
+                }
+                if (credential.issuers && !credential.issuers.includes(doc.issuer)) {
+                    // Attestor not trusted by Verifier
+                    continue;
+                }
+                if (doc.type && !doc.type.includes(credential.schema)) {
+                    // Wrong type
+                    continue;
+                }
+                // TBD test for VC expiry too
+                return did;
+            }
+            catch (error) {
+                // Not encrypted, so can't be a VC
+            }
+        }
+    }
+    async createResponse(challengeDID, options = {}) {
+        let { retries = 0, delay = 1000 } = options;
+        if (!options.registry) {
+            options.registry = this.ephemeralRegistry;
+        }
+        if (!options.validUntil) {
+            const expires = new Date();
+            expires.setHours(expires.getHours() + 1); // Add 1 hour
+            options.validUntil = expires.toISOString();
+        }
+        let doc;
+        while (retries >= 0) {
+            try {
+                doc = await this.resolveDID(challengeDID);
+                break;
+            }
+            catch (error) {
+                if (retries === 0)
+                    throw error; // If no retries left, throw the error
+                retries--; // Decrease the retry count
+                await new Promise(resolve => setTimeout(resolve, delay)); // Wait for delay milleseconds
+            }
+        }
+        if (!doc) {
+            throw new InvalidParameterError('challengeDID does not resolve');
+        }
+        const result = await this.resolveAsset(challengeDID);
+        if (!result) {
+            throw new InvalidParameterError('challengeDID');
+        }
+        const challenge = result.challenge;
+        if (!challenge) {
+            throw new InvalidParameterError('challengeDID');
+        }
+        const requestor = doc.didDocument?.controller;
+        if (!requestor) {
+            throw new InvalidParameterError('requestor undefined');
+        }
+        // TBD check challenge isValid for expired?
+        const matches = [];
+        if (challenge.credentials) {
+            for (let credential of challenge.credentials) {
+                const vc = await this.findMatchingCredential(credential);
+                if (vc) {
+                    matches.push(vc);
+                }
+            }
+        }
+        const pairs = [];
+        for (let vcDid of matches) {
+            const plaintext = await this.decryptMessage(vcDid);
+            const vpDid = await this.encryptMessage(plaintext, requestor, { ...options, includeHash: true });
+            pairs.push({ vc: vcDid, vp: vpDid });
+        }
+        const requested = challenge.credentials?.length ?? 0;
+        const fulfilled = matches.length;
+        const match = (requested === fulfilled);
+        const response = {
+            challenge: challengeDID,
+            credentials: pairs,
+            requested: requested,
+            fulfilled: fulfilled,
+            match: match
+        };
+        return await this.encryptJSON({ response }, requestor, options);
+    }
+    async verifyResponse(responseDID, options = {}) {
+        let { retries = 0, delay = 1000 } = options;
+        let responseDoc;
+        while (retries >= 0) {
+            try {
+                responseDoc = await this.resolveDID(responseDID);
+                break;
+            }
+            catch (error) {
+                if (retries === 0)
+                    throw error; // If no retries left, throw the error
+                retries--; // Decrease the retry count
+                await new Promise(resolve => setTimeout(resolve, delay)); // Wait for delay milliseconds
+            }
+        }
+        if (!responseDoc) {
+            throw new InvalidParameterError('responseDID does not resolve');
+        }
+        const wrapper = await this.decryptJSON(responseDID);
+        if (typeof wrapper !== 'object' || !wrapper || !('response' in wrapper)) {
+            throw new InvalidParameterError('responseDID not a valid challenge response');
+        }
+        const { response } = wrapper;
+        const result = await this.resolveAsset(response.challenge);
+        if (!result) {
+            throw new InvalidParameterError('challenge not found');
+        }
+        const challenge = result.challenge;
+        if (!challenge) {
+            throw new InvalidParameterError('challengeDID');
+        }
+        const vps = [];
+        for (let credential of response.credentials) {
+            const vcData = await this.resolveAsset(credential.vc);
+            const vpData = await this.resolveAsset(credential.vp);
+            const castVCData = vcData;
+            const castVPData = vpData;
+            if (!vcData || !vpData || !castVCData.encrypted || !castVPData.encrypted) {
+                // VC revoked
+                continue;
+            }
+            const vcHash = castVCData.encrypted;
+            const vpHash = castVPData.encrypted;
+            if (vcHash.cipher_hash !== vpHash.cipher_hash) {
+                // can't verify that the contents of VP match the VC
+                continue;
+            }
+            const vp = await this.decryptJSON(credential.vp);
+            const isValid = await this.verifySignature(vp);
+            if (!isValid) {
+                continue;
+            }
+            if (!vp.type || !Array.isArray(vp.type)) {
+                continue;
+            }
+            // Check VP against VCs specified in challenge
+            if (vp.type.length >= 2 && vp.type[1].startsWith('did:')) {
+                const schema = vp.type[1];
+                const credential = challenge.credentials?.find(item => item.schema === schema);
+                if (!credential) {
+                    continue;
+                }
+                // Check if issuer of VP is in the trusted issuer list
+                if (credential.issuers && credential.issuers.length > 0 && !credential.issuers.includes(vp.issuer)) {
+                    continue;
+                }
+            }
+            vps.push(vp);
+        }
+        response.vps = vps;
+        response.match = vps.length === (challenge.credentials?.length ?? 0);
+        response.responder = responseDoc.didDocument?.controller;
+        return response;
+    }
+    async createGroup(name, options = {}) {
+        const group = {
+            name: name,
+            members: []
+        };
+        return this.createAsset({ group }, options);
+    }
+    async getGroup(id) {
+        const asset = await this.resolveAsset(id);
+        if (!asset) {
+            return null;
+        }
+        // TEMP during did:cid, return old version groups
+        const castOldAsset = asset;
+        if (castOldAsset.members) {
+            return castOldAsset;
+        }
+        const castAsset = asset;
+        if (!castAsset.group) {
+            return null;
+        }
+        return castAsset.group;
+    }
+    async addGroupMember(groupId, memberId) {
+        const groupDID = await this.lookupDID(groupId);
+        const memberDID = await this.lookupDID(memberId);
+        // Can't add a group to itself
+        if (memberDID === groupDID) {
+            throw new InvalidParameterError("can't add a group to itself");
+        }
+        try {
+            // test for valid member DID
+            await this.resolveDID(memberDID);
+        }
+        catch {
+            throw new InvalidParameterError('memberId');
+        }
+        const group = await this.getGroup(groupId);
+        if (!group?.members) {
+            throw new InvalidParameterError('groupId');
+        }
+        // If already a member, return immediately
+        if (group.members.includes(memberDID)) {
+            return true;
+        }
+        // Can't add a mutual membership relation
+        const isMember = await this.testGroup(memberId, groupId);
+        if (isMember) {
+            throw new InvalidParameterError("can't create mutual membership");
+        }
+        const members = new Set(group.members);
+        members.add(memberDID);
+        group.members = Array.from(members);
+        return this.updateAsset(groupDID, { group });
+    }
+    async removeGroupMember(groupId, memberId) {
+        const groupDID = await this.lookupDID(groupId);
+        const memberDID = await this.lookupDID(memberId);
+        const group = await this.getGroup(groupDID);
+        if (!group?.members) {
+            throw new InvalidParameterError('groupId');
+        }
+        try {
+            // test for valid member DID
+            await this.resolveDID(memberDID);
+        }
+        catch {
+            throw new InvalidParameterError('memberId');
+        }
+        // If not already a member, return immediately
+        if (!group.members.includes(memberDID)) {
+            return true;
+        }
+        const members = new Set(group.members);
+        members.delete(memberDID);
+        group.members = Array.from(members);
+        return this.updateAsset(groupDID, { group });
+    }
+    async testGroup(groupId, memberId) {
+        try {
+            const group = await this.getGroup(groupId);
+            if (!group) {
+                return false;
+            }
+            if (!memberId) {
+                return true;
+            }
+            const didMember = await this.lookupDID(memberId);
+            let isMember = group.members.includes(didMember);
+            if (!isMember) {
+                for (const did of group.members) {
+                    isMember = await this.testGroup(did, didMember);
+                    if (isMember) {
+                        break;
+                    }
+                }
+            }
+            return isMember;
+        }
+        catch (error) {
+            return false;
+        }
+    }
+    async listGroups(owner) {
+        const assets = await this.listAssets(owner);
+        const groups = [];
+        for (const did of assets) {
+            const isGroup = await this.testGroup(did);
+            if (isGroup) {
+                groups.push(did);
+            }
+        }
+        return groups;
+    }
+    validateSchema(schema) {
+        try {
+            // Attempt to instantiate the schema
+            this.generateSchema(schema);
+            return true;
+        }
+        catch (error) {
+            return false;
+        }
+    }
+    generateSchema(schema) {
+        if (typeof schema !== 'object' ||
+            !schema ||
+            !('$schema' in schema) ||
+            !('properties' in schema)) {
+            throw new InvalidParameterError('schema');
+        }
+        const template = {};
+        const props = schema.properties;
+        for (const property of Object.keys(props)) {
+            template[property] = "TBD";
+        }
+        return template;
+    }
+    async createSchema(schema, options = {}) {
+        if (!schema) {
+            schema = DefaultSchema;
+        }
+        if (!this.validateSchema(schema)) {
+            throw new InvalidParameterError('schema');
+        }
+        return this.createAsset({ schema }, options);
+    }
+    async getSchema(id) {
+        const asset = await this.resolveAsset(id);
+        if (!asset) {
+            return null;
+        }
+        // TEMP during did:cid, return old version schemas
+        const castOldAsset = asset;
+        if (castOldAsset.properties) {
+            return asset;
+        }
+        const castAsset = asset;
+        if (!castAsset.schema) {
+            return null;
+        }
+        return castAsset.schema;
+    }
+    async setSchema(id, schema) {
+        if (!this.validateSchema(schema)) {
+            throw new InvalidParameterError('schema');
+        }
+        return this.updateAsset(id, { schema });
+    }
+    // TBD add optional 2nd parameter that will validate JSON against the schema
+    async testSchema(id) {
+        try {
+            const schema = await this.getSchema(id);
+            // TBD Need a better way because any random object with keys can be a valid schema
+            if (!schema || Object.keys(schema).length === 0) {
+                return false;
+            }
+            return this.validateSchema(schema);
+        }
+        catch (error) {
+            return false;
+        }
+    }
+    async listSchemas(owner) {
+        const assets = await this.listAssets(owner);
+        const schemas = [];
+        for (const did of assets) {
+            const isSchema = await this.testSchema(did);
+            if (isSchema) {
+                schemas.push(did);
+            }
+        }
+        return schemas;
+    }
+    async createTemplate(schemaId) {
+        const isSchema = await this.testSchema(schemaId);
+        if (!isSchema) {
+            throw new InvalidParameterError('schemaId');
+        }
+        const schemaDID = await this.lookupDID(schemaId);
+        const schema = await this.getSchema(schemaDID);
+        const template = this.generateSchema(schema);
+        template['$schema'] = schemaDID;
+        return template;
+    }
+    async pollTemplate() {
+        const now = new Date();
+        const nextWeek = new Date();
+        nextWeek.setDate(now.getDate() + 7);
+        return {
+            type: 'poll',
+            version: 1,
+            description: 'What is this poll about?',
+            roster: 'DID of the eligible voter group',
+            options: ['yes', 'no', 'abstain'],
+            deadline: nextWeek.toISOString(),
+        };
+    }
+    async createPoll(poll, options = {}) {
+        if (poll.type !== 'poll') {
+            throw new InvalidParameterError('poll');
+        }
+        if (poll.version !== 1) {
+            throw new InvalidParameterError('poll.version');
+        }
+        if (!poll.description) {
+            throw new InvalidParameterError('poll.description');
+        }
+        if (!poll.options || !Array.isArray(poll.options) || poll.options.length < 2 || poll.options.length > 10) {
+            throw new InvalidParameterError('poll.options');
+        }
+        if (!poll.roster) {
+            // eslint-disable-next-line
+            throw new InvalidParameterError('poll.roster');
+        }
+        try {
+            const isValidGroup = await this.testGroup(poll.roster);
+            if (!isValidGroup) {
+                throw new InvalidParameterError('poll.roster');
+            }
+        }
+        catch {
+            throw new InvalidParameterError('poll.roster');
+        }
+        if (!poll.deadline) {
+            // eslint-disable-next-line
+            throw new InvalidParameterError('poll.deadline');
+        }
+        const deadline = new Date(poll.deadline);
+        if (isNaN(deadline.getTime())) {
+            throw new InvalidParameterError('poll.deadline');
+        }
+        if (deadline < new Date()) {
+            throw new InvalidParameterError('poll.deadline');
+        }
+        return this.createAsset({ poll }, options);
+    }
+    async getPoll(id) {
+        const asset = await this.resolveAsset(id);
+        // TEMP during did:cid, return old version poll
+        const castOldAsset = asset;
+        if (castOldAsset.options) {
+            return castOldAsset;
+        }
+        const castAsset = asset;
+        if (!castAsset.poll) {
+            return null;
+        }
+        return castAsset.poll;
+    }
+    async testPoll(id) {
+        try {
+            const poll = await this.getPoll(id);
+            return poll !== null;
+        }
+        catch (error) {
+            return false;
+        }
+    }
+    async listPolls(owner) {
+        const assets = await this.listAssets(owner);
+        const polls = [];
+        for (const did of assets) {
+            const isPoll = await this.testPoll(did);
+            if (isPoll) {
+                polls.push(did);
+            }
+        }
+        return polls;
+    }
+    async viewPoll(pollId) {
+        const id = await this.fetchIdInfo();
+        const poll = await this.getPoll(pollId);
+        if (!poll) {
+            throw new InvalidParameterError('pollId');
+        }
+        let hasVoted = false;
+        if (poll.ballots) {
+            hasVoted = !!poll.ballots[id.did];
+        }
+        const voteExpired = Date.now() > new Date(poll.deadline).getTime();
+        const isEligible = await this.testGroup(poll.roster, id.did);
+        const doc = await this.resolveDID(pollId);
+        const view = {
+            description: poll.description,
+            options: poll.options,
+            deadline: poll.deadline,
+            isOwner: (doc.didDocument?.controller === id.did),
+            isEligible: isEligible,
+            voteExpired: voteExpired,
+            hasVoted: hasVoted,
+        };
+        if (id.did === doc.didDocument?.controller) {
+            let voted = 0;
+            const results = {
+                tally: [],
+                ballots: [],
+            };
+            results.tally.push({
+                vote: 0,
+                option: 'spoil',
+                count: 0,
+            });
+            for (let i = 0; i < poll.options.length; i++) {
+                results.tally.push({
+                    vote: i + 1,
+                    option: poll.options[i],
+                    count: 0,
+                });
+            }
+            for (let voter in poll.ballots) {
+                const ballot = poll.ballots[voter];
+                const decrypted = await this.decryptJSON(ballot.ballot);
+                const vote = decrypted.vote;
+                if (results.ballots) {
+                    results.ballots.push({
+                        ...ballot,
+                        voter,
+                        vote,
+                        option: poll.options[vote - 1],
+                    });
+                }
+                voted += 1;
+                results.tally[vote].count += 1;
+            }
+            const roster = await this.getGroup(poll.roster);
+            const total = roster.members.length;
+            results.votes = {
+                eligible: total,
+                received: voted,
+                pending: total - voted,
+            };
+            results.final = voteExpired || (voted === total);
+            view.results = results;
+        }
+        return view;
+    }
+    async votePoll(pollId, vote, options = {}) {
+        const { spoil = false } = options;
+        const id = await this.fetchIdInfo();
+        const didPoll = await this.lookupDID(pollId);
+        const doc = await this.resolveDID(didPoll);
+        const poll = await this.getPoll(pollId);
+        if (!poll) {
+            throw new InvalidParameterError('pollId');
+        }
+        const eligible = await this.testGroup(poll.roster, id.did);
+        const expired = Date.now() > new Date(poll.deadline).getTime();
+        const owner = doc.didDocument?.controller;
+        if (!owner) {
+            throw new KeymasterError('owner mising from poll');
+        }
+        if (!eligible) {
+            throw new InvalidParameterError('voter not in roster');
+        }
+        if (expired) {
+            throw new InvalidParameterError('poll has expired');
+        }
+        let ballot;
+        if (spoil) {
+            ballot = {
+                poll: didPoll,
+                vote: 0,
+            };
+        }
+        else {
+            const max = poll.options.length;
+            if (!Number.isInteger(vote) || vote < 1 || vote > max) {
+                throw new InvalidParameterError('vote');
+            }
+            ballot = {
+                poll: didPoll,
+                vote: vote,
+            };
+        }
+        // Encrypt for receiver only
+        return await this.encryptJSON(ballot, owner, { ...options, encryptForSender: false });
+    }
+    async updatePoll(ballot) {
+        const id = await this.fetchIdInfo();
+        const didBallot = await this.lookupDID(ballot);
+        const docBallot = await this.resolveDID(ballot);
+        const didVoter = docBallot.didDocument.controller;
+        let dataBallot;
+        try {
+            dataBallot = await this.decryptJSON(didBallot);
+            if (!dataBallot.poll || !dataBallot.vote) {
+                throw new InvalidParameterError('ballot');
+            }
+        }
+        catch {
+            throw new InvalidParameterError('ballot');
+        }
+        const didPoll = dataBallot.poll;
+        const docPoll = await this.resolveDID(didPoll);
+        const didOwner = docPoll.didDocument.controller;
+        const poll = await this.getPoll(didPoll);
+        if (!poll) {
+            throw new KeymasterError('Cannot find poll related to ballot');
+        }
+        if (id.did !== didOwner) {
+            throw new InvalidParameterError('only owner can update a poll');
+        }
+        const eligible = await this.testGroup(poll.roster, didVoter);
+        if (!eligible) {
+            throw new InvalidParameterError('voter not in roster');
+        }
+        const expired = Date.now() > new Date(poll.deadline).getTime();
+        if (expired) {
+            throw new InvalidParameterError('poll has expired');
+        }
+        const max = poll.options.length;
+        const vote = dataBallot.vote;
+        if (!vote || vote < 0 || vote > max) {
+            throw new InvalidParameterError('ballot.vote');
+        }
+        if (!poll.ballots) {
+            poll.ballots = {};
+        }
+        poll.ballots[didVoter] = {
+            ballot: didBallot,
+            received: new Date().toISOString(),
+        };
+        return this.updateAsset(didPoll, { poll });
+    }
+    async publishPoll(pollId, options = {}) {
+        const { reveal = false } = options;
+        const id = await this.fetchIdInfo();
+        const doc = await this.resolveDID(pollId);
+        const owner = doc.didDocument?.controller;
+        if (id.did !== owner) {
+            throw new InvalidParameterError('only owner can publish a poll');
+        }
+        const view = await this.viewPoll(pollId);
+        if (!view.results?.final) {
+            throw new InvalidParameterError('poll not final');
+        }
+        if (!reveal && view.results.ballots) {
+            delete view.results.ballots;
+        }
+        const poll = await this.getPoll(pollId);
+        if (!poll) {
+            throw new InvalidParameterError(pollId);
+        }
+        poll.results = view.results;
+        return this.updateAsset(pollId, { poll });
+    }
+    async unpublishPoll(pollId) {
+        const id = await this.fetchIdInfo();
+        const doc = await this.resolveDID(pollId);
+        const owner = doc.didDocument?.controller;
+        if (id.did !== owner) {
+            throw new InvalidParameterError(pollId);
+        }
+        const poll = await this.getPoll(pollId);
+        if (!poll) {
+            throw new InvalidParameterError(pollId);
+        }
+        delete poll.results;
+        return this.updateAsset(pollId, { poll });
+    }
+    async createGroupVault(options = {}) {
+        const id = await this.fetchIdInfo();
+        const idKeypair = await this.fetchKeyPair();
+        // version defaults to 1. To make version undefined (unit testing), set options.version to 0
+        const version = typeof options.version === 'undefined'
+            ? 1
+            : (typeof options.version === 'number' && options.version === 1 ? options.version : undefined);
+        const salt = this.cipher.generateRandomSalt();
+        const vaultKeypair = this.cipher.generateRandomJwk();
+        const keys = {};
+        const config = this.cipher.encryptMessage(idKeypair.publicJwk, vaultKeypair.privateJwk, JSON.stringify(options));
+        const publicJwk = options.secretMembers ? idKeypair.publicJwk : vaultKeypair.publicJwk; // If secret, encrypt for the owner only
+        const members = this.cipher.encryptMessage(publicJwk, vaultKeypair.privateJwk, JSON.stringify({}));
+        const items = this.cipher.encryptMessage(vaultKeypair.publicJwk, vaultKeypair.privateJwk, JSON.stringify({}));
+        const sha256 = this.cipher.hashJSON({});
+        const groupVault = {
+            version,
+            publicJwk: vaultKeypair.publicJwk,
+            salt,
+            config,
+            members,
+            keys,
+            items,
+            sha256,
+        };
+        await this.addMemberKey(groupVault, id.did, vaultKeypair.privateJwk);
+        return this.createAsset({ groupVault }, options);
+    }
+    async getGroupVault(groupVaultId, options) {
+        const asset = await this.resolveAsset(groupVaultId, options);
+        if (!asset.groupVault) {
+            throw new InvalidParameterError('groupVaultId');
+        }
+        return asset.groupVault;
+    }
+    async testGroupVault(id, options) {
+        try {
+            const groupVault = await this.getGroupVault(id, options);
+            return groupVault !== null;
+        }
+        catch (error) {
+            return false;
+        }
+    }
+    generateSaltedId(groupVault, memberDID) {
+        if (!groupVault.version) {
+            return this.cipher.hashMessage(groupVault.salt + memberDID);
+        }
+        const suffix = memberDID.split(':').pop();
+        return this.cipher.hashMessage(groupVault.salt + suffix);
+    }
+    async decryptGroupVault(groupVault) {
+        const wallet = await this.loadWallet();
+        const id = await this.fetchIdInfo();
+        const myMemberId = this.generateSaltedId(groupVault, id.did);
+        const myVaultKey = groupVault.keys[myMemberId];
+        if (!myVaultKey) {
+            throw new KeymasterError('No access to group vault');
+        }
+        const privKeyJSON = await this.decryptWithDerivedKeys(wallet, id, groupVault.publicJwk, myVaultKey);
+        const privateJwk = JSON.parse(privKeyJSON);
+        let config = {};
+        let isOwner = false;
+        try {
+            const configJSON = await this.decryptWithDerivedKeys(wallet, id, groupVault.publicJwk, groupVault.config);
+            config = JSON.parse(configJSON);
+            isOwner = true;
+        }
+        catch (error) {
+            // Can't decrypt config if not the owner
+        }
+        let members = {};
+        if (config.secretMembers) {
+            try {
+                const membersJSON = await this.decryptWithDerivedKeys(wallet, id, groupVault.publicJwk, groupVault.members);
+                members = JSON.parse(membersJSON);
+            }
+            catch (error) {
+            }
+        }
+        else {
+            try {
+                const membersJSON = this.cipher.decryptMessage(groupVault.publicJwk, privateJwk, groupVault.members);
+                members = JSON.parse(membersJSON);
+            }
+            catch (error) {
+            }
+        }
+        const itemsJSON = this.cipher.decryptMessage(groupVault.publicJwk, privateJwk, groupVault.items);
+        const items = JSON.parse(itemsJSON);
+        return {
+            isOwner,
+            privateJwk,
+            config,
+            members,
+            items,
+        };
+    }
+    async checkGroupVaultOwner(vaultId) {
+        const id = await this.fetchIdInfo();
+        const vaultDoc = await this.resolveDID(vaultId);
+        const controller = vaultDoc.didDocument?.controller;
+        if (controller !== id.did) {
+            throw new KeymasterError('Only vault owner can modify the vault');
+        }
+        return controller;
+    }
+    async addMemberKey(groupVault, memberDID, privateJwk) {
+        const memberDoc = await this.resolveDID(memberDID, { confirm: true });
+        const memberPublicJwk = this.getPublicKeyJwk(memberDoc);
+        const memberKey = this.cipher.encryptMessage(memberPublicJwk, privateJwk, JSON.stringify(privateJwk));
+        const memberKeyId = this.generateSaltedId(groupVault, memberDID);
+        groupVault.keys[memberKeyId] = memberKey;
+    }
+    async checkVaultVersion(vaultId, groupVault) {
+        if (groupVault.version === 1) {
+            return;
+        }
+        if (!groupVault.version) {
+            const id = await this.fetchIdInfo();
+            const { privateJwk, members } = await this.decryptGroupVault(groupVault);
+            groupVault.version = 1;
+            groupVault.keys = {};
+            await this.addMemberKey(groupVault, id.did, privateJwk);
+            for (const memberDID of Object.keys(members)) {
+                await this.addMemberKey(groupVault, memberDID, privateJwk);
+            }
+            await this.updateAsset(vaultId, { groupVault });
+            return;
+        }
+        throw new KeymasterError('Unsupported group vault version');
+    }
+    getAgentDID(doc) {
+        if (doc.didDocumentRegistration?.type !== 'agent') {
+            throw new KeymasterError('Document is not an agent');
+        }
+        const did = doc.didDocument?.id;
+        if (!did) {
+            throw new KeymasterError('Agent document does not have a DID');
+        }
+        return did;
+    }
+    async addGroupVaultMember(vaultId, memberId) {
+        const owner = await this.checkGroupVaultOwner(vaultId);
+        const idKeypair = await this.fetchKeyPair();
+        const groupVault = await this.getGroupVault(vaultId);
+        const { privateJwk, config, members } = await this.decryptGroupVault(groupVault);
+        const memberDoc = await this.resolveDID(memberId, { confirm: true });
+        const memberDID = this.getAgentDID(memberDoc);
+        // Don't allow adding the vault owner
+        if (owner === memberDID) {
+            return false;
+        }
+        members[memberDID] = { added: new Date().toISOString() };
+        const publicJwk = config.secretMembers ? idKeypair.publicJwk : groupVault.publicJwk;
+        groupVault.members = this.cipher.encryptMessage(publicJwk, privateJwk, JSON.stringify(members));
+        await this.addMemberKey(groupVault, memberDID, privateJwk);
+        return this.updateAsset(vaultId, { groupVault });
+    }
+    async removeGroupVaultMember(vaultId, memberId) {
+        const owner = await this.checkGroupVaultOwner(vaultId);
+        const idKeypair = await this.fetchKeyPair();
+        const groupVault = await this.getGroupVault(vaultId);
+        const { privateJwk, config, members } = await this.decryptGroupVault(groupVault);
+        const memberDoc = await this.resolveDID(memberId, { confirm: true });
+        const memberDID = this.getAgentDID(memberDoc);
+        // Don't allow removing the vault owner
+        if (owner === memberDID) {
+            return false;
+        }
+        delete members[memberDID];
+        const publicJwk = config.secretMembers ? idKeypair.publicJwk : groupVault.publicJwk;
+        groupVault.members = this.cipher.encryptMessage(publicJwk, privateJwk, JSON.stringify(members));
+        const memberKeyId = this.generateSaltedId(groupVault, memberDID);
+        delete groupVault.keys[memberKeyId];
+        return this.updateAsset(vaultId, { groupVault });
+    }
+    async listGroupVaultMembers(vaultId) {
+        const groupVault = await this.getGroupVault(vaultId);
+        const { members, isOwner } = await this.decryptGroupVault(groupVault);
+        if (isOwner) {
+            await this.checkVaultVersion(vaultId, groupVault);
+        }
+        return members;
+    }
+    async addGroupVaultItem(vaultId, name, buffer) {
+        await this.checkGroupVaultOwner(vaultId);
+        const groupVault = await this.getGroupVault(vaultId);
+        const { privateJwk, items } = await this.decryptGroupVault(groupVault);
+        const validName = this.validateName(name);
+        const encryptedData = this.cipher.encryptBytes(groupVault.publicJwk, privateJwk, buffer);
+        const cid = await this.gatekeeper.addText(encryptedData);
+        const sha256 = this.cipher.hashMessage(buffer);
+        const type = await this.getMimeType(buffer);
+        const data = encryptedData.length < this.maxDataLength ? encryptedData : undefined;
+        items[validName] = {
+            cid,
+            sha256,
+            bytes: buffer.length,
+            type,
+            added: new Date().toISOString(),
+            data,
+        };
+        groupVault.items = this.cipher.encryptMessage(groupVault.publicJwk, privateJwk, JSON.stringify(items));
+        groupVault.sha256 = this.cipher.hashJSON(items);
+        return this.updateAsset(vaultId, { groupVault });
+    }
+    async removeGroupVaultItem(vaultId, name) {
+        await this.checkGroupVaultOwner(vaultId);
+        const groupVault = await this.getGroupVault(vaultId);
+        const { privateJwk, items } = await this.decryptGroupVault(groupVault);
+        delete items[name];
+        groupVault.items = this.cipher.encryptMessage(groupVault.publicJwk, privateJwk, JSON.stringify(items));
+        groupVault.sha256 = this.cipher.hashJSON(items);
+        return this.updateAsset(vaultId, { groupVault });
+    }
+    async listGroupVaultItems(vaultId, options) {
+        const groupVault = await this.getGroupVault(vaultId, options);
+        const { items } = await this.decryptGroupVault(groupVault);
+        return items;
+    }
+    async getGroupVaultItem(vaultId, name, options) {
+        try {
+            const groupVault = await this.getGroupVault(vaultId, options);
+            const { privateJwk, items } = await this.decryptGroupVault(groupVault);
+            if (items[name]) {
+                const encryptedData = items[name].data || await this.gatekeeper.getText(items[name].cid);
+                if (encryptedData) {
+                    const bytes = this.cipher.decryptBytes(groupVault.publicJwk, privateJwk, encryptedData);
+                    return Buffer.from(bytes);
+                }
+            }
+            return null;
+        }
+        catch (error) {
+            return null;
+        }
+    }
+    async listDmail() {
+        const wallet = await this.loadWallet();
+        const id = await this.fetchIdInfo(undefined, wallet);
+        const list = id.dmail || {};
+        const dmailList = {};
+        const nameList = await this.listNames({ includeIDs: true });
+        const didToName = Object.entries(nameList).reduce((acc, [name, did]) => {
+            acc[did] = name;
+            return acc;
+        }, {});
+        for (const did of Object.keys(list)) {
+            const message = await this.getDmailMessage(did);
+            if (!message) {
+                continue; // Skip if no dmail found for this DID
+            }
+            const tags = list[did].tags ?? [];
+            const docs = await this.resolveDID(did);
+            const controller = docs.didDocument?.controller ?? '';
+            const sender = didToName[controller] ?? controller;
+            const date = docs.didDocumentMetadata?.updated ?? '';
+            const to = message.to.map(did => didToName[did] ?? did);
+            const cc = message.cc.map(did => didToName[did] ?? did);
+            const attachments = await this.listDmailAttachments(did);
+            dmailList[did] = {
+                message,
+                to,
+                cc,
+                tags,
+                sender,
+                date,
+                attachments,
+                docs,
+            };
+        }
+        return dmailList;
+    }
+    verifyTagList(tags) {
+        if (!Array.isArray(tags)) {
+            throw new InvalidParameterError('tags');
+        }
+        const tagSet = new Set();
+        for (const tag of tags) {
+            try {
+                tagSet.add(this.validateName(tag));
+            }
+            catch (error) {
+                throw new InvalidParameterError(`Invalid tag: '${tag}'`);
+            }
+        }
+        return tagSet.size > 0 ? Array.from(tagSet) : [];
+    }
+    async fileDmail(did, tags) {
+        const verifiedTags = this.verifyTagList(tags);
+        await this.mutateWallet(async (wallet) => {
+            const id = await this.fetchIdInfo(undefined, wallet);
+            if (!id.dmail) {
+                id.dmail = {};
+            }
+            id.dmail[did] = { tags: verifiedTags };
+        });
+        return true;
+    }
+    async removeDmail(did) {
+        await this.mutateWallet(async (wallet) => {
+            const id = await this.fetchIdInfo(undefined, wallet);
+            if (!id.dmail || !id.dmail[did]) {
+                return;
+            }
+            delete id.dmail[did];
+        });
+        return true;
+    }
+    async verifyRecipientList(list) {
+        if (!Array.isArray(list)) {
+            throw new InvalidParameterError('list');
+        }
+        const nameList = await this.listNames({ includeIDs: true });
+        let newList = [];
+        for (const id of list) {
+            if (typeof id !== 'string') {
+                throw new InvalidParameterError(`Invalid recipient type: ${typeof id}`);
+            }
+            if (id in nameList) {
+                const did = nameList[id];
+                const isAgent = await this.testAgent(did);
+                if (isAgent) {
+                    newList.push(did);
+                    continue;
+                }
+                throw new InvalidParameterError(`Invalid recipient: ${id}`);
+            }
+            if (isValidDID(id)) {
+                newList.push(id);
+                continue;
+            }
+            throw new InvalidParameterError(`Invalid recipient: ${id}`);
+        }
+        return newList;
+    }
+    async verifyDmail(message) {
+        const to = await this.verifyRecipientList(message.to);
+        const cc = await this.verifyRecipientList(message.cc);
+        if (to.length === 0) {
+            throw new InvalidParameterError('dmail.to');
+        }
+        if (!message.subject || typeof message.subject !== 'string' || message.subject.trim() === '') {
+            throw new InvalidParameterError('dmail.subject');
+        }
+        if (!message.body || typeof message.body !== 'string' || message.body.trim() === '') {
+            throw new InvalidParameterError('dmail.body');
+        }
+        return {
+            ...message,
+            to,
+            cc,
+        };
+    }
+    async createDmail(message, options = {}) {
+        const dmail = await this.verifyDmail(message);
+        const did = await this.createGroupVault(options);
+        for (const toDID of dmail.to) {
+            await this.addGroupVaultMember(did, toDID);
+        }
+        for (const ccDID of dmail.cc) {
+            await this.addGroupVaultMember(did, ccDID);
+        }
+        const buffer = Buffer.from(JSON.stringify({ dmail }), 'utf-8');
+        await this.addGroupVaultItem(did, exports.DmailTags.DMAIL, buffer);
+        await this.fileDmail(did, [exports.DmailTags.DRAFT]);
+        return did;
+    }
+    async updateDmail(did, message) {
+        const dmail = await this.verifyDmail(message);
+        for (const toDID of dmail.to) {
+            await this.addGroupVaultMember(did, toDID);
+        }
+        for (const ccDID of dmail.cc) {
+            await this.addGroupVaultMember(did, ccDID);
+        }
+        const buffer = Buffer.from(JSON.stringify({ dmail }), 'utf-8');
+        return this.addGroupVaultItem(did, exports.DmailTags.DMAIL, buffer);
+    }
+    async sendDmail(did) {
+        const dmail = await this.getDmailMessage(did);
+        if (!dmail) {
+            return null;
+        }
+        const registry = this.ephemeralRegistry;
+        const validUntil = new Date(Date.now() + 7 * 24 * 60 * 60 * 1000).toISOString(); // Default to 7 days
+        const message = {
+            to: [...dmail.to, ...dmail.cc],
+            dids: [did],
+        };
+        const notice = await this.createNotice(message, { registry, validUntil });
+        if (notice) {
+            await this.fileDmail(did, [exports.DmailTags.SENT]);
+        }
+        return notice;
+    }
+    async getDmailMessage(did, options) {
+        const isGroupVault = await this.testGroupVault(did, options);
+        if (!isGroupVault) {
+            return null;
+        }
+        const buffer = await this.getGroupVaultItem(did, exports.DmailTags.DMAIL, options);
+        if (!buffer) {
+            return null;
+        }
+        try {
+            const data = JSON.parse(buffer.toString('utf-8'));
+            return data.dmail;
+        }
+        catch (error) {
+            return null;
+        }
+    }
+    async listDmailAttachments(did, options) {
+        let items = await this.listGroupVaultItems(did, options);
+        delete items[exports.DmailTags.DMAIL]; // Remove the dmail item itself from attachments
+        return items;
+    }
+    async addDmailAttachment(did, name, buffer) {
+        if (name === exports.DmailTags.DMAIL) {
+            throw new InvalidParameterError('Cannot add attachment with reserved name "dmail"');
+        }
+        return this.addGroupVaultItem(did, name, buffer);
+    }
+    async removeDmailAttachment(did, name) {
+        if (name === exports.DmailTags.DMAIL) {
+            throw new InvalidParameterError('Cannot remove attachment with reserved name "dmail"');
+        }
+        return this.removeGroupVaultItem(did, name);
+    }
+    async getDmailAttachment(did, name) {
+        return this.getGroupVaultItem(did, name);
+    }
+    async importDmail(did) {
+        const dmail = await this.getDmailMessage(did);
+        if (!dmail) {
+            return false;
+        }
+        return this.fileDmail(did, [exports.DmailTags.INBOX, exports.DmailTags.UNREAD]);
+    }
+    async verifyDIDList(didList) {
+        if (!Array.isArray(didList)) {
+            throw new InvalidParameterError('didList');
+        }
+        for (const did of didList) {
+            if (!isValidDID(did)) {
+                throw new InvalidParameterError(`Invalid DID: ${did}`);
+            }
+        }
+        return didList;
+    }
+    async verifyNotice(notice) {
+        const to = await this.verifyRecipientList(notice.to);
+        const dids = await this.verifyDIDList(notice.dids);
+        if (to.length === 0) {
+            throw new InvalidParameterError('notice.to');
+        }
+        if (dids.length === 0) {
+            throw new InvalidParameterError('notice.dids');
+        }
+        return { to, dids };
+    }
+    async createNotice(message, options = {}) {
+        const notice = await this.verifyNotice(message);
+        return this.createAsset({ notice }, options);
+    }
+    async updateNotice(id, message) {
+        const notice = await this.verifyNotice(message);
+        return this.updateAsset(id, { notice });
+    }
+    async addToNotices(did, tags) {
+        const verifiedTags = this.verifyTagList(tags);
+        await this.mutateWallet(async (wallet) => {
+            const id = await this.fetchIdInfo(undefined, wallet);
+            if (!id.notices)
+                id.notices = {};
+            id.notices[did] = { tags: verifiedTags };
+        });
+        return true;
+    }
+    async importNotice(did) {
+        const wallet = await this.loadWallet();
+        const id = await this.fetchIdInfo(undefined, wallet);
+        if (id.notices && id.notices[did]) {
+            return true; // Already imported
+        }
+        const asset = await this.resolveAsset(did);
+        if (!asset || !asset.notice) {
+            return false; // Not a notice
+        }
+        if (!asset.notice.to.includes(id.did)) {
+            return false; // Not for this user
+        }
+        for (const noticeDID of asset.notice.dids) {
+            const dmail = await this.getDmailMessage(noticeDID);
+            if (dmail) {
+                const imported = await this.importDmail(noticeDID);
+                if (imported) {
+                    await this.addToNotices(did, [exports.NoticeTags.DMAIL]);
+                }
+                continue;
+            }
+            const isBallot = await this.isBallot(noticeDID);
+            if (isBallot) {
+                let imported = false;
+                try {
+                    imported = await this.updatePoll(noticeDID);
+                }
+                catch { }
+                if (imported) {
+                    await this.addToNotices(did, [exports.NoticeTags.BALLOT]);
+                }
+                continue;
+            }
+            const poll = await this.getPoll(noticeDID);
+            if (poll) {
+                const names = await this.listNames();
+                if (!Object.values(names).includes(noticeDID)) {
+                    await this.addUnnamedPoll(noticeDID);
+                }
+                await this.addToNotices(did, [exports.NoticeTags.POLL]);
+                continue;
+            }
+            const isCredential = await this.acceptCredential(noticeDID);
+            if (isCredential) {
+                await this.addToNotices(did, [exports.NoticeTags.CREDENTIAL]);
+                continue;
+            }
+            return false;
+        }
+        return true;
+    }
+    async searchNotices() {
+        if (!this.searchEngine) {
+            return false; // Search engine not available
+        }
+        const id = await this.fetchIdInfo();
+        if (!id.notices) {
+            id.notices = {};
+        }
+        // Search for all notice DIDs sent to the current ID
+        const where = {
+            "didDocumentData.notice.to[*]": {
+                "$in": [id.did]
+            }
+        };
+        let notices;
+        try {
+            // TBD search engine should not return expired notices
+            notices = await this.searchEngine.search({ where });
+        }
+        catch (error) {
+            throw new KeymasterError('Failed to search for notices');
+        }
+        for (const notice of notices) {
+            if (notice in id.notices) {
+                continue; // Already imported
+            }
+            try {
+                await this.importNotice(notice);
+            }
+            catch (error) {
+                continue; // Skip if notice is expired or invalid
+            }
+        }
+        return true;
+    }
+    async cleanupNotices() {
+        await this.mutateWallet(async (wallet) => {
+            const id = await this.fetchIdInfo(undefined, wallet);
+            if (!id.notices) {
+                return;
+            }
+            for (const nDid of Object.keys(id.notices)) {
+                try {
+                    const asset = await this.resolveAsset(nDid);
+                    if (!asset || !asset.notice) {
+                        delete id.notices[nDid]; // revoked or invalid
+                    }
+                }
+                catch {
+                    delete id.notices[nDid]; // expired/unresolvable
+                }
+            }
+        });
+        return true;
+    }
+    async refreshNotices() {
+        await this.searchNotices();
+        return this.cleanupNotices();
+    }
+    async exportEncryptedWallet() {
+        const wallet = await this.loadWallet();
+        return this.encryptWalletForStorage(wallet);
+    }
+    async isBallot(ballotDid) {
+        let payload;
+        try {
+            payload = await this.decryptJSON(ballotDid);
+        }
+        catch {
+            return false;
+        }
+        return payload && typeof payload.poll === "string" && typeof payload.vote === "number";
+    }
+    async addUnnamedPoll(did) {
+        const fallbackName = did.slice(-32);
+        try {
+            await this.addName(fallbackName, did);
+        }
+        catch { }
+    }
+    async getHDKeyFromCacheOrMnemonic(wallet) {
+        if (this._hdkeyCache) {
+            return this._hdkeyCache;
+        }
+        const mnemonic = await this.getMnemonicForDerivation(wallet);
+        this._hdkeyCache = this.cipher.generateHDKey(mnemonic);
+        return this._hdkeyCache;
+    }
+    async encryptWalletForStorage(decrypted) {
+        const { version, seed, ...rest } = decrypted;
+        const safeSeed = { mnemonicEnc: seed.mnemonicEnc };
+        const hdkey = await this.getHDKeyFromCacheOrMnemonic(decrypted);
+        const { publicJwk, privateJwk } = this.cipher.generateJwk(hdkey.privateKey);
+        const plaintext = JSON.stringify(rest);
+        const enc = this.cipher.encryptMessage(publicJwk, privateJwk, plaintext);
+        return { version: version, seed: safeSeed, enc };
+    }
+    async decryptWalletFromStorage(stored) {
+        let mnemonic;
+        try {
+            mnemonic = await encryption.decMnemonic(stored.seed.mnemonicEnc, this.passphrase);
+        }
+        catch {
+            throw new KeymasterError('Incorrect passphrase.');
+        }
+        this._hdkeyCache = this.cipher.generateHDKey(mnemonic);
+        const { publicJwk, privateJwk } = this.cipher.generateJwk(this._hdkeyCache.privateKey);
+        const plaintext = this.cipher.decryptMessage(publicJwk, privateJwk, stored.enc);
+        const data = JSON.parse(plaintext);
+        const wallet = { version: stored.version, seed: stored.seed, ...data };
+        return wallet;
+    }
+    async decryptWallet(wallet) {
+        if (db_typeGuards.isWalletEncFile(wallet)) {
+            wallet = await this.decryptWalletFromStorage(wallet);
+        }
+        if (!db_typeGuards.isWalletFile(wallet)) {
+            throw new KeymasterError("Unsupported wallet version.");
+        }
+        return wallet;
+    }
+    async upgradeWallet(wallet) {
+        if (wallet.version !== 1) {
+            throw new KeymasterError("Unsupported wallet version.");
+        }
+        return wallet;
+    }
+}
+
+exports.default = Keymaster;