@didcid/keymaster 0.1.3

package/dist/esm/keymaster.js

@@ -0,0 +1,2733 @@
+import { imageSize } from 'image-size';
+import { fileTypeFromBuffer } from 'file-type';
+import { InvalidDIDError, InvalidParameterError, KeymasterError, UnknownIDError } from '@didcid/common/errors';
+import { isWalletEncFile, isWalletFile } from './db/typeGuards.js';
+import { isValidDID } from '@didcid/ipfs/utils';
+import { decMnemonic, encMnemonic } from "./encryption.js";
+const DefaultSchema = {
+    "$schema": "http://json-schema.org/draft-07/schema#",
+    "type": "object",
+    "properties": {
+        "propertyName": {
+            "type": "string"
+        }
+    },
+    "required": [
+        "propertyName"
+    ]
+};
+export var DmailTags;
+(function (DmailTags) {
+    DmailTags["DMAIL"] = "dmail";
+    DmailTags["INBOX"] = "inbox";
+    DmailTags["DRAFT"] = "draft";
+    DmailTags["SENT"] = "sent";
+    DmailTags["ARCHIVED"] = "archived";
+    DmailTags["DELETED"] = "deleted";
+    DmailTags["UNREAD"] = "unread";
+})(DmailTags || (DmailTags = {}));
+export var NoticeTags;
+(function (NoticeTags) {
+    NoticeTags["DMAIL"] = "dmail";
+    NoticeTags["BALLOT"] = "ballot";
+    NoticeTags["POLL"] = "poll";
+    NoticeTags["CREDENTIAL"] = "credential";
+})(NoticeTags || (NoticeTags = {}));
+export default class Keymaster {
+    passphrase;
+    gatekeeper;
+    db;
+    cipher;
+    searchEngine;
+    defaultRegistry;
+    ephemeralRegistry;
+    maxNameLength;
+    maxDataLength;
+    _walletCache;
+    _hdkeyCache;
+    constructor(options) {
+        if (!options || !options.gatekeeper || !options.gatekeeper.createDID) {
+            throw new InvalidParameterError('options.gatekeeper');
+        }
+        if (!options.wallet || !options.wallet.loadWallet || !options.wallet.saveWallet) {
+            throw new InvalidParameterError('options.wallet');
+        }
+        if (!options.cipher || !options.cipher.verifySig) {
+            throw new InvalidParameterError('options.cipher');
+        }
+        if (options.search && !options.search.search) {
+            throw new InvalidParameterError('options.search');
+        }
+        if (!options.passphrase) {
+            throw new InvalidParameterError('options.passphrase');
+        }
+        this.passphrase = options.passphrase;
+        this.gatekeeper = options.gatekeeper;
+        this.db = options.wallet;
+        this.cipher = options.cipher;
+        this.searchEngine = options.search;
+        this.defaultRegistry = options.defaultRegistry || 'hyperswarm';
+        this.ephemeralRegistry = 'hyperswarm';
+        this.maxNameLength = options.maxNameLength || 32;
+        this.maxDataLength = 8 * 1024; // 8 KB max data to store in a JSON object
+    }
+    async listRegistries() {
+        return this.gatekeeper.listRegistries();
+    }
+    async mutateWallet(mutator) {
+        // Create wallet if none and make sure _walletCache is set
+        if (!this._walletCache) {
+            await this.loadWallet();
+        }
+        await this.db.updateWallet(async (stored) => {
+            const decrypted = this._walletCache;
+            const before = JSON.stringify(decrypted);
+            await mutator(decrypted);
+            const after = JSON.stringify(decrypted);
+            if (before === after) {
+                return;
+            }
+            const reenc = await this.encryptWalletForStorage(decrypted);
+            Object.assign(stored, reenc);
+            this._walletCache = decrypted;
+        });
+    }
+    async loadWallet() {
+        if (this._walletCache) {
+            return this._walletCache;
+        }
+        let stored = await this.db.loadWallet();
+        if (!stored) {
+            stored = await this.newWallet();
+        }
+        const upgraded = await this.upgradeWallet(stored);
+        this._walletCache = await this.decryptWallet(upgraded);
+        return this._walletCache;
+    }
+    async saveWallet(wallet, overwrite = true) {
+        let upgraded = await this.upgradeWallet(wallet);
+        // Decrypt if encrypted to verify passphrase and get decrypted form
+        const decrypted = await this.decryptWallet(upgraded);
+        let toStore = await this.encryptWalletForStorage(decrypted);
+        const ok = await this.db.saveWallet(toStore, overwrite);
+        if (ok) {
+            this._walletCache = decrypted;
+        }
+        return ok;
+    }
+    async newWallet(mnemonic, overwrite = false) {
+        try {
+            if (!mnemonic) {
+                mnemonic = this.cipher.generateMnemonic();
+            }
+            this._hdkeyCache = this.cipher.generateHDKey(mnemonic);
+        }
+        catch (error) {
+            throw new InvalidParameterError('mnemonic');
+        }
+        const mnemonicEnc = await encMnemonic(mnemonic, this.passphrase);
+        const wallet = {
+            version: 1,
+            seed: { mnemonicEnc },
+            counter: 0,
+            ids: {}
+        };
+        const ok = await this.saveWallet(wallet, overwrite);
+        if (!ok) {
+            throw new KeymasterError('save wallet failed');
+        }
+        return wallet;
+    }
+    async decryptMnemonic() {
+        const wallet = await this.loadWallet();
+        return this.getMnemonicForDerivation(wallet);
+    }
+    async getMnemonicForDerivation(wallet) {
+        return decMnemonic(wallet.seed.mnemonicEnc, this.passphrase);
+    }
+    async checkWallet() {
+        const wallet = await this.loadWallet();
+        let checked = 0;
+        let invalid = 0;
+        let deleted = 0;
+        // Validate keys
+        await this.resolveSeedBank();
+        for (const name of Object.keys(wallet.ids)) {
+            try {
+                const doc = await this.resolveDID(wallet.ids[name].did);
+                if (doc.didDocumentMetadata?.deactivated) {
+                    deleted += 1;
+                }
+            }
+            catch (error) {
+                invalid += 1;
+            }
+            checked += 1;
+        }
+        for (const id of Object.values(wallet.ids)) {
+            if (id.owned) {
+                for (const did of id.owned) {
+                    try {
+                        const doc = await this.resolveDID(did);
+                        if (doc.didDocumentMetadata?.deactivated) {
+                            deleted += 1;
+                        }
+                    }
+                    catch (error) {
+                        invalid += 1;
+                    }
+                    checked += 1;
+                }
+            }
+            if (id.held) {
+                for (const did of id.held) {
+                    try {
+                        const doc = await this.resolveDID(did);
+                        if (doc.didDocumentMetadata?.deactivated) {
+                            deleted += 1;
+                        }
+                    }
+                    catch (error) {
+                        invalid += 1;
+                    }
+                    checked += 1;
+                }
+            }
+        }
+        if (wallet.names) {
+            for (const name of Object.keys(wallet.names)) {
+                try {
+                    const doc = await this.resolveDID(wallet.names[name]);
+                    if (doc.didDocumentMetadata?.deactivated) {
+                        deleted += 1;
+                    }
+                }
+                catch (error) {
+                    invalid += 1;
+                }
+                checked += 1;
+            }
+        }
+        return { checked, invalid, deleted };
+    }
+    async fixWallet() {
+        let idsRemoved = 0;
+        let ownedRemoved = 0;
+        let heldRemoved = 0;
+        let namesRemoved = 0;
+        await this.mutateWallet(async (wallet) => {
+            for (const name of Object.keys(wallet.ids)) {
+                let remove = false;
+                try {
+                    const doc = await this.resolveDID(wallet.ids[name].did);
+                    if (doc.didDocumentMetadata?.deactivated) {
+                        remove = true;
+                    }
+                }
+                catch {
+                    remove = true;
+                }
+                if (remove) {
+                    delete wallet.ids[name];
+                    idsRemoved++;
+                }
+            }
+            for (const id of Object.values(wallet.ids)) {
+                if (id.owned) {
+                    for (let i = 0; i < id.owned.length; i++) {
+                        let remove = false;
+                        try {
+                            const doc = await this.resolveDID(id.owned[i]);
+                            if (doc.didDocumentMetadata?.deactivated) {
+                                remove = true;
+                            }
+                        }
+                        catch {
+                            remove = true;
+                        }
+                        if (remove) {
+                            id.owned.splice(i, 1);
+                            i--;
+                            ownedRemoved++;
+                        }
+                    }
+                }
+                if (id.held) {
+                    for (let i = 0; i < id.held.length; i++) {
+                        let remove = false;
+                        try {
+                            const doc = await this.resolveDID(id.held[i]);
+                            if (doc.didDocumentMetadata?.deactivated) {
+                                remove = true;
+                            }
+                        }
+                        catch {
+                            remove = true;
+                        }
+                        if (remove) {
+                            id.held.splice(i, 1);
+                            i--;
+                            heldRemoved++;
+                        }
+                    }
+                }
+            }
+            if (wallet.names) {
+                for (const name of Object.keys(wallet.names)) {
+                    let remove = false;
+                    try {
+                        const doc = await this.resolveDID(wallet.names[name]);
+                        if (doc.didDocumentMetadata?.deactivated) {
+                            remove = true;
+                        }
+                    }
+                    catch {
+                        remove = true;
+                    }
+                    if (remove) {
+                        delete wallet.names[name];
+                        namesRemoved++;
+                    }
+                }
+            }
+        });
+        return { idsRemoved, ownedRemoved, heldRemoved, namesRemoved };
+    }
+    async resolveSeedBank() {
+        const keypair = await this.hdKeyPair();
+        const operation = {
+            type: "create",
+            created: new Date(0).toISOString(),
+            registration: {
+                version: 1,
+                type: "agent",
+                registry: this.defaultRegistry,
+            },
+            publicJwk: keypair.publicJwk,
+        };
+        const msgHash = this.cipher.hashJSON(operation);
+        const signature = this.cipher.signHash(msgHash, keypair.privateJwk);
+        const signed = {
+            ...operation,
+            signature: {
+                signed: new Date(0).toISOString(),
+                hash: msgHash,
+                value: signature
+            }
+        };
+        const did = await this.gatekeeper.createDID(signed);
+        return this.gatekeeper.resolveDID(did);
+    }
+    async updateSeedBank(doc) {
+        const keypair = await this.hdKeyPair();
+        const did = doc.didDocument?.id;
+        if (!did) {
+            throw new InvalidParameterError('seed bank missing DID');
+        }
+        const current = await this.gatekeeper.resolveDID(did);
+        const previd = current.didDocumentMetadata?.versionId;
+        const operation = {
+            type: "update",
+            did,
+            previd,
+            doc,
+        };
+        const msgHash = this.cipher.hashJSON(operation);
+        const signature = this.cipher.signHash(msgHash, keypair.privateJwk);
+        const signed = {
+            ...operation,
+            signature: {
+                signer: did,
+                signed: new Date().toISOString(),
+                hash: msgHash,
+                value: signature,
+            }
+        };
+        return await this.gatekeeper.updateDID(signed);
+    }
+    async backupWallet(registry = this.defaultRegistry, wallet) {
+        if (!wallet) {
+            wallet = await this.loadWallet();
+        }
+        const keypair = await this.hdKeyPair();
+        const seedBank = await this.resolveSeedBank();
+        const msg = JSON.stringify(wallet);
+        const backup = this.cipher.encryptMessage(keypair.publicJwk, keypair.privateJwk, msg);
+        const operation = {
+            type: "create",
+            created: new Date().toISOString(),
+            registration: {
+                version: 1,
+                type: "asset",
+                registry: registry,
+            },
+            controller: seedBank.didDocument?.id,
+            data: { backup: backup },
+        };
+        const msgHash = this.cipher.hashJSON(operation);
+        const signature = this.cipher.signHash(msgHash, keypair.privateJwk);
+        const signed = {
+            ...operation,
+            signature: {
+                signer: seedBank.didDocument?.id,
+                signed: new Date().toISOString(),
+                hash: msgHash,
+                value: signature,
+            }
+        };
+        const backupDID = await this.gatekeeper.createDID(signed);
+        if (seedBank.didDocumentData && typeof seedBank.didDocumentData === 'object' && !Array.isArray(seedBank.didDocumentData)) {
+            const data = seedBank.didDocumentData;
+            data.wallet = backupDID;
+            await this.updateSeedBank(seedBank);
+        }
+        return backupDID;
+    }
+    async recoverWallet(did) {
+        try {
+            if (!did) {
+                const seedBank = await this.resolveSeedBank();
+                if (seedBank.didDocumentData && typeof seedBank.didDocumentData === 'object' && !Array.isArray(seedBank.didDocumentData)) {
+                    const data = seedBank.didDocumentData;
+                    did = data.wallet;
+                }
+                if (!did) {
+                    throw new InvalidParameterError('No backup DID found');
+                }
+            }
+            const keypair = await this.hdKeyPair();
+            const data = await this.resolveAsset(did);
+            if (!data) {
+                throw new InvalidParameterError('No asset data found');
+            }
+            const castData = data;
+            if (typeof castData.backup !== 'string') {
+                throw new InvalidParameterError('Asset "backup" is missing or not a string');
+            }
+            const backup = this.cipher.decryptMessage(keypair.publicJwk, keypair.privateJwk, castData.backup);
+            let wallet = JSON.parse(backup);
+            if (isWalletFile(wallet)) {
+                const mnemonic = await this.decryptMnemonic();
+                // Backup might have a different mnemonic passphase so re-encrypt
+                wallet.seed.mnemonicEnc = await encMnemonic(mnemonic, this.passphrase);
+            }
+            await this.mutateWallet(async (current) => {
+                // Clear all existing properties from the current wallet
+                // This ensures a clean slate before restoring the recovered wallet
+                for (const k in current) {
+                    delete current[k];
+                }
+                // Upgrade the recovered wallet to the latest version if needed
+                wallet = await this.upgradeWallet(wallet);
+                // Decrypt the wallet if needed
+                wallet = isWalletEncFile(wallet) ? await this.decryptWalletFromStorage(wallet) : wallet;
+                // Copy all properties from the recovered wallet into the cleared current wallet
+                // This effectively replaces the current wallet with the recovered one
+                Object.assign(current, wallet);
+            });
+            return this.loadWallet();
+        }
+        catch (error) {
+            // If we can't recover the wallet, just return the current one
+            return this.loadWallet();
+        }
+    }
+    async listIds() {
+        const wallet = await this.loadWallet();
+        return Object.keys(wallet.ids);
+    }
+    async getCurrentId() {
+        const wallet = await this.loadWallet();
+        return wallet.current;
+    }
+    async setCurrentId(name) {
+        await this.mutateWallet((wallet) => {
+            if (!(name in wallet.ids)) {
+                throw new UnknownIDError();
+            }
+            wallet.current = name;
+        });
+        return true;
+    }
+    didMatch(did1, did2) {
+        const suffix1 = did1.split(':').pop();
+        const suffix2 = did2.split(':').pop();
+        return (suffix1 === suffix2);
+    }
+    async fetchIdInfo(id, wallet) {
+        // Callers should pass in the wallet if they are going to modify and save it later
+        if (!wallet) {
+            wallet = await this.loadWallet();
+        }
+        let idInfo = null;
+        if (id) {
+            if (id.startsWith('did')) {
+                for (const name of Object.keys(wallet.ids)) {
+                    const info = wallet.ids[name];
+                    if (this.didMatch(id, info.did)) {
+                        idInfo = info;
+                        break;
+                    }
+                }
+            }
+            else {
+                idInfo = wallet.ids[id];
+            }
+        }
+        else {
+            if (!wallet.current) {
+                throw new KeymasterError('No current ID');
+            }
+            idInfo = wallet.ids[wallet.current];
+        }
+        if (!idInfo) {
+            throw new UnknownIDError();
+        }
+        return idInfo;
+    }
+    async hdKeyPair() {
+        const wallet = await this.loadWallet();
+        const hdkey = await this.getHDKeyFromCacheOrMnemonic(wallet);
+        return this.cipher.generateJwk(hdkey.privateKey);
+    }
+    getPublicKeyJwk(doc) {
+        // TBD Return the right public key, not just the first one
+        if (!doc.didDocument) {
+            throw new KeymasterError('Missing didDocument.');
+        }
+        const verificationMethods = doc.didDocument.verificationMethod;
+        if (!verificationMethods || verificationMethods.length === 0) {
+            throw new KeymasterError('The DID document does not contain any verification methods.');
+        }
+        const publicKeyJwk = verificationMethods[0].publicKeyJwk;
+        if (!publicKeyJwk) {
+            throw new KeymasterError('The publicKeyJwk is missing in the first verification method.');
+        }
+        return publicKeyJwk;
+    }
+    async fetchKeyPair(name) {
+        const wallet = await this.loadWallet();
+        const id = await this.fetchIdInfo(name);
+        const hdkey = await this.getHDKeyFromCacheOrMnemonic(wallet);
+        const doc = await this.resolveDID(id.did, { confirm: true });
+        const confirmedPublicKeyJwk = this.getPublicKeyJwk(doc);
+        for (let i = id.index; i >= 0; i--) {
+            const path = `m/44'/0'/${id.account}'/0/${i}`;
+            const didkey = hdkey.derive(path);
+            const keypair = this.cipher.generateJwk(didkey.privateKey);
+            if (keypair.publicJwk.x === confirmedPublicKeyJwk.x &&
+                keypair.publicJwk.y === confirmedPublicKeyJwk.y) {
+                return keypair;
+            }
+        }
+        return null;
+    }
+    async createAsset(data, options = {}) {
+        let { registry = this.defaultRegistry, controller, validUntil, name } = options;
+        if (validUntil) {
+            const validate = new Date(validUntil);
+            if (isNaN(validate.getTime())) {
+                throw new InvalidParameterError('options.validUntil');
+            }
+        }
+        if (name) {
+            const wallet = await this.loadWallet();
+            this.validateName(name, wallet);
+        }
+        if (!data) {
+            throw new InvalidParameterError('data');
+        }
+        const id = await this.fetchIdInfo(controller);
+        const block = await this.gatekeeper.getBlock(registry);
+        const blockid = block?.hash;
+        const operation = {
+            type: "create",
+            created: new Date().toISOString(),
+            blockid,
+            registration: {
+                version: 1,
+                type: "asset",
+                registry,
+                validUntil
+            },
+            controller: id.did,
+            data,
+        };
+        const signed = await this.addSignature(operation, controller);
+        const did = await this.gatekeeper.createDID(signed);
+        // Keep assets that will be garbage-collected out of the owned list
+        if (!validUntil) {
+            await this.addToOwned(did);
+        }
+        if (name) {
+            await this.addName(name, did);
+        }
+        return did;
+    }
+    async cloneAsset(id, options = {}) {
+        const assetDoc = await this.resolveDID(id);
+        if (assetDoc.didDocumentRegistration?.type !== 'asset') {
+            throw new InvalidParameterError('id');
+        }
+        const assetData = assetDoc.didDocumentData || {};
+        const cloneData = { ...assetData, cloned: assetDoc.didDocument.id };
+        return this.createAsset(cloneData, options);
+    }
+    async generateImageAsset(buffer) {
+        let metadata;
+        try {
+            metadata = imageSize(buffer);
+        }
+        catch (error) {
+            throw new InvalidParameterError('buffer');
+        }
+        const cid = await this.gatekeeper.addData(buffer);
+        const image = {
+            cid,
+            bytes: buffer.length,
+            ...metadata,
+            type: `image/${metadata.type}`
+        };
+        return image;
+    }
+    async createImage(buffer, options = {}) {
+        const image = await this.generateImageAsset(buffer);
+        return this.createAsset({ image }, options);
+    }
+    async updateImage(id, buffer) {
+        const image = await this.generateImageAsset(buffer);
+        return this.updateAsset(id, { image });
+    }
+    async getImage(id) {
+        const asset = await this.resolveAsset(id);
+        const image = asset.image;
+        if (!image || !image.cid) {
+            return null;
+        }
+        const buffer = await this.gatekeeper.getData(image.cid);
+        if (buffer) {
+            image.data = buffer;
+        }
+        return image;
+    }
+    async testImage(id) {
+        try {
+            const image = await this.getImage(id);
+            return image !== null;
+        }
+        catch (error) {
+            return false;
+        }
+    }
+    async getMimeType(buffer) {
+        // Try magic number detection
+        const result = await fileTypeFromBuffer(buffer);
+        if (result)
+            return result.mime;
+        // Convert to UTF-8 string if decodable
+        const text = buffer.toString('utf8');
+        // Check for JSON
+        try {
+            JSON.parse(text);
+            return 'application/json';
+        }
+        catch { }
+        // Default to plain text if printable ASCII
+        // eslint-disable-next-line
+        if (/^[\x09\x0A\x0D\x20-\x7E]*$/.test(text.replace(/\n/g, ''))) {
+            return 'text/plain';
+        }
+        // Fallback
+        return 'application/octet-stream';
+    }
+    async generateFileAsset(filename, buffer) {
+        const cid = await this.gatekeeper.addData(buffer);
+        const type = await this.getMimeType(buffer);
+        const file = {
+            cid,
+            filename,
+            type,
+            bytes: buffer.length,
+        };
+        return file;
+    }
+    async createDocument(buffer, options = {}) {
+        const filename = options.filename || 'document';
+        const document = await this.generateFileAsset(filename, buffer);
+        return this.createAsset({ document }, options);
+    }
+    async updateDocument(id, buffer, options = {}) {
+        const filename = options.filename || 'document';
+        const document = await this.generateFileAsset(filename, buffer);
+        return this.updateAsset(id, { document });
+    }
+    async getDocument(id) {
+        const asset = await this.resolveAsset(id);
+        return asset.document ?? null;
+    }
+    async testDocument(id) {
+        try {
+            const document = await this.getDocument(id);
+            return document !== null;
+        }
+        catch (error) {
+            return false;
+        }
+    }
+    async encryptMessage(msg, receiver, options = {}) {
+        const { encryptForSender = true, includeHash = false, } = options;
+        const id = await this.fetchIdInfo();
+        const senderKeypair = await this.fetchKeyPair();
+        if (!senderKeypair) {
+            throw new KeymasterError('No valid sender keypair');
+        }
+        const doc = await this.resolveDID(receiver, { confirm: true });
+        const receivePublicJwk = this.getPublicKeyJwk(doc);
+        const cipher_sender = encryptForSender ? this.cipher.encryptMessage(senderKeypair.publicJwk, senderKeypair.privateJwk, msg) : null;
+        const cipher_receiver = this.cipher.encryptMessage(receivePublicJwk, senderKeypair.privateJwk, msg);
+        const cipher_hash = includeHash ? this.cipher.hashMessage(msg) : null;
+        const encrypted = {
+            sender: id.did,
+            created: new Date().toISOString(),
+            cipher_hash,
+            cipher_sender,
+            cipher_receiver,
+        };
+        return await this.createAsset({ encrypted }, options);
+    }
+    async decryptWithDerivedKeys(wallet, id, senderPublicJwk, ciphertext) {
+        const hdkey = await this.getHDKeyFromCacheOrMnemonic(wallet);
+        // Try all private keys for this ID, starting with the most recent and working backward
+        let index = id.index;
+        while (index >= 0) {
+            const path = `m/44'/0'/${id.account}'/0/${index}`;
+            const didkey = hdkey.derive(path);
+            const receiverKeypair = this.cipher.generateJwk(didkey.privateKey);
+            try {
+                return this.cipher.decryptMessage(senderPublicJwk, receiverKeypair.privateJwk, ciphertext);
+            }
+            catch (error) {
+                index -= 1;
+            }
+        }
+        throw new KeymasterError("ID can't decrypt ciphertext");
+    }
+    async decryptMessage(did) {
+        const wallet = await this.loadWallet();
+        const id = await this.fetchIdInfo();
+        const asset = await this.resolveAsset(did);
+        if (!asset) {
+            throw new InvalidParameterError('did not encrypted');
+        }
+        const castAsset = asset;
+        if (!castAsset.encrypted && !castAsset.cipher_hash) {
+            throw new InvalidParameterError('did not encrypted');
+        }
+        const crypt = (castAsset.encrypted ? castAsset.encrypted : castAsset);
+        const doc = await this.resolveDID(crypt.sender, { confirm: true, versionTime: crypt.created });
+        const senderPublicJwk = this.getPublicKeyJwk(doc);
+        const ciphertext = (crypt.sender === id.did && crypt.cipher_sender) ? crypt.cipher_sender : crypt.cipher_receiver;
+        return await this.decryptWithDerivedKeys(wallet, id, senderPublicJwk, ciphertext);
+    }
+    async encryptJSON(json, did, options = {}) {
+        const plaintext = JSON.stringify(json);
+        return this.encryptMessage(plaintext, did, options);
+    }
+    async decryptJSON(did) {
+        const plaintext = await this.decryptMessage(did);
+        try {
+            return JSON.parse(plaintext);
+        }
+        catch (error) {
+            throw new InvalidParameterError('did not encrypted JSON');
+        }
+    }
+    async addSignature(obj, controller) {
+        if (obj == null) {
+            throw new InvalidParameterError('obj');
+        }
+        // Fetches current ID if name is missing
+        const id = await this.fetchIdInfo(controller);
+        const keypair = await this.fetchKeyPair(controller);
+        if (!keypair) {
+            throw new KeymasterError('addSignature: no keypair');
+        }
+        try {
+            const msgHash = this.cipher.hashJSON(obj);
+            const signature = this.cipher.signHash(msgHash, keypair.privateJwk);
+            return {
+                ...obj,
+                signature: {
+                    signer: id.did,
+                    signed: new Date().toISOString(),
+                    hash: msgHash,
+                    value: signature,
+                }
+            };
+        }
+        catch (error) {
+            throw new InvalidParameterError('obj');
+        }
+    }
+    async verifySignature(obj) {
+        if (!obj?.signature) {
+            return false;
+        }
+        const { signature } = obj;
+        if (!signature.signer) {
+            return false;
+        }
+        const jsonCopy = JSON.parse(JSON.stringify(obj));
+        delete jsonCopy.signature;
+        const msgHash = this.cipher.hashJSON(jsonCopy);
+        if (signature.hash && signature.hash !== msgHash) {
+            return false;
+        }
+        const doc = await this.resolveDID(signature.signer, { versionTime: signature.signed });
+        const publicJwk = this.getPublicKeyJwk(doc);
+        try {
+            return this.cipher.verifySig(msgHash, signature.value, publicJwk);
+        }
+        catch (error) {
+            return false;
+        }
+    }
+    async updateDID(id, doc) {
+        const did = await this.lookupDID(id);
+        const current = await this.resolveDID(did);
+        const previd = current.didDocumentMetadata?.versionId;
+        // Strip metadata fields from the update doc
+        delete doc.didDocumentMetadata;
+        delete doc.didResolutionMetadata;
+        const block = await this.gatekeeper.getBlock(current.didDocumentRegistration.registry);
+        const blockid = block?.hash;
+        const operation = {
+            type: "update",
+            did,
+            previd,
+            blockid,
+            doc,
+        };
+        let controller;
+        if (current.didDocumentRegistration?.type === 'agent') {
+            controller = current.didDocument?.id;
+        }
+        else if (current.didDocumentRegistration?.type === 'asset') {
+            controller = current.didDocument?.controller;
+        }
+        const signed = await this.addSignature(operation, controller);
+        return this.gatekeeper.updateDID(signed);
+    }
+    async revokeDID(id) {
+        const did = await this.lookupDID(id);
+        const current = await this.resolveDID(did);
+        const previd = current.didDocumentMetadata?.versionId;
+        const block = await this.gatekeeper.getBlock(current.didDocumentRegistration.registry);
+        const blockid = block?.hash;
+        const operation = {
+            type: "delete",
+            did,
+            previd,
+            blockid
+        };
+        let controller;
+        if (current.didDocumentRegistration?.type === 'agent') {
+            controller = current.didDocument?.id;
+        }
+        else if (current.didDocumentRegistration?.type === 'asset') {
+            controller = current.didDocument?.controller;
+        }
+        const signed = await this.addSignature(operation, controller);
+        const ok = await this.gatekeeper.deleteDID(signed);
+        if (ok && current.didDocument?.controller) {
+            await this.removeFromOwned(did, current.didDocument.controller);
+        }
+        return ok;
+    }
+    async addToOwned(did, owner) {
+        await this.mutateWallet(async (wallet) => {
+            const id = await this.fetchIdInfo(owner, wallet);
+            const owned = new Set(id.owned);
+            owned.add(did);
+            id.owned = Array.from(owned);
+        });
+        return true;
+    }
+    async removeFromOwned(did, owner) {
+        let ownerFound = false;
+        await this.mutateWallet(async (wallet) => {
+            const id = await this.fetchIdInfo(owner, wallet);
+            if (!id.owned) {
+                return;
+            }
+            ownerFound = true;
+            id.owned = id.owned.filter(item => item !== did);
+        });
+        return ownerFound;
+    }
+    async addToHeld(did) {
+        await this.mutateWallet((wallet) => {
+            const id = wallet.ids[wallet.current];
+            const held = new Set(id.held);
+            held.add(did);
+            id.held = Array.from(held);
+        });
+        return true;
+    }
+    async removeFromHeld(did) {
+        let changed = false;
+        await this.mutateWallet((wallet) => {
+            const id = wallet.ids[wallet.current];
+            const held = new Set(id.held);
+            if (held.delete(did)) {
+                id.held = Array.from(held);
+                changed = true;
+            }
+        });
+        return changed;
+    }
+    async lookupDID(name) {
+        try {
+            if (name.startsWith('did:')) {
+                return name;
+            }
+        }
+        catch {
+            throw new InvalidDIDError();
+        }
+        const wallet = await this.loadWallet();
+        if (wallet.names && name in wallet.names) {
+            return wallet.names[name];
+        }
+        if (wallet.ids && name in wallet.ids) {
+            return wallet.ids[name].did;
+        }
+        throw new UnknownIDError();
+    }
+    async resolveDID(did, options) {
+        const actualDid = await this.lookupDID(did);
+        const docs = await this.gatekeeper.resolveDID(actualDid, options);
+        if (docs.didResolutionMetadata?.error) {
+            if (docs.didResolutionMetadata.error === 'notFound') {
+                throw new InvalidDIDError('unknown');
+            }
+            if (docs.didResolutionMetadata.error === 'invalidDid') {
+                throw new InvalidDIDError('bad format');
+            }
+        }
+        const controller = docs.didDocument?.controller || docs.didDocument?.id;
+        const isOwned = await this.idInWallet(controller);
+        // Augment the DID document metadata with the DID ownership status
+        docs.didDocumentMetadata = {
+            ...docs.didDocumentMetadata,
+            isOwned,
+        };
+        return docs;
+    }
+    async idInWallet(did) {
+        try {
+            await this.fetchIdInfo(did);
+            return true;
+        }
+        catch (error) {
+            return false;
+        }
+    }
+    async resolveAsset(did, options) {
+        const doc = await this.resolveDID(did, options);
+        if (!doc?.didDocument?.controller || !doc?.didDocumentData || doc.didDocumentMetadata?.deactivated) {
+            return {};
+        }
+        return doc.didDocumentData;
+    }
+    async updateAsset(did, data) {
+        const doc = await this.resolveDID(did);
+        const currentData = doc.didDocumentData || {};
+        const updatedData = {
+            ...currentData,
+            ...data
+        };
+        return this.updateDID(did, { didDocumentData: updatedData });
+    }
+    async transferAsset(id, controller) {
+        const assetDoc = await this.resolveDID(id);
+        if (assetDoc.didDocumentRegistration?.type !== 'asset') {
+            throw new InvalidParameterError('id');
+        }
+        if (assetDoc.didDocument.controller === controller) {
+            return true;
+        }
+        const agentDoc = await this.resolveDID(controller);
+        if (agentDoc.didDocumentRegistration?.type !== 'agent') {
+            throw new InvalidParameterError('controller');
+        }
+        const assetDID = assetDoc.didDocument.id;
+        const prevOwner = assetDoc.didDocument.controller;
+        const updatedDidDocument = {
+            ...assetDoc.didDocument,
+            controller: agentDoc.didDocument.id,
+        };
+        const ok = await this.updateDID(id, { didDocument: updatedDidDocument });
+        if (ok && assetDID && prevOwner) {
+            await this.removeFromOwned(assetDID, prevOwner);
+            try {
+                await this.addToOwned(assetDID, controller);
+            }
+            catch (error) {
+                // New controller is not in our wallet
+            }
+        }
+        return ok;
+    }
+    async listAssets(owner) {
+        const id = await this.fetchIdInfo(owner);
+        return id.owned || [];
+    }
+    validateName(name, wallet) {
+        if (typeof name !== 'string' || !name.trim()) {
+            throw new InvalidParameterError('name must be a non-empty string');
+        }
+        name = name.trim(); // Remove leading/trailing whitespace
+        if (name.length > this.maxNameLength) {
+            throw new InvalidParameterError(`name too long`);
+        }
+        if (/[^\P{Cc}]/u.test(name)) {
+            throw new InvalidParameterError('name contains unprintable characters');
+        }
+        const alreadyUsedError = 'name already used';
+        if (wallet && wallet.names && name in wallet.names) {
+            throw new InvalidParameterError(alreadyUsedError);
+        }
+        if (wallet && wallet.ids && name in wallet.ids) {
+            throw new InvalidParameterError(alreadyUsedError);
+        }
+        return name;
+    }
+    async createId(name, options = {}) {
+        let did = '';
+        await this.mutateWallet(async (wallet) => {
+            const account = wallet.counter;
+            const index = 0;
+            const signed = await this.createIdOperation(name, account, options);
+            did = await this.gatekeeper.createDID(signed);
+            wallet.ids[name] = { did, account, index };
+            wallet.counter += 1;
+            wallet.current = name;
+        });
+        return did;
+    }
+    async createIdOperation(name, account = 0, options = {}) {
+        const { registry = this.defaultRegistry } = options;
+        const wallet = await this.loadWallet();
+        name = this.validateName(name, wallet);
+        const hdkey = await this.getHDKeyFromCacheOrMnemonic(wallet);
+        const path = `m/44'/0'/${account}'/0/0`;
+        const didkey = hdkey.derive(path);
+        const keypair = this.cipher.generateJwk(didkey.privateKey);
+        const block = await this.gatekeeper.getBlock(registry);
+        const blockid = block?.hash;
+        const operation = {
+            type: 'create',
+            created: new Date().toISOString(),
+            blockid,
+            registration: {
+                version: 1,
+                type: 'agent',
+                registry
+            },
+            publicJwk: keypair.publicJwk,
+        };
+        const msgHash = this.cipher.hashJSON(operation);
+        const signature = this.cipher.signHash(msgHash, keypair.privateJwk);
+        const signed = {
+            ...operation,
+            signature: {
+                signed: new Date().toISOString(),
+                hash: msgHash,
+                value: signature
+            },
+        };
+        return signed;
+    }
+    async removeId(name) {
+        await this.mutateWallet((wallet) => {
+            if (!(name in wallet.ids)) {
+                throw new UnknownIDError();
+            }
+            delete wallet.ids[name];
+            if (wallet.current === name) {
+                wallet.current = Object.keys(wallet.ids)[0] || '';
+            }
+        });
+        return true;
+    }
+    async renameId(id, name) {
+        await this.mutateWallet((wallet) => {
+            name = this.validateName(name);
+            if (!(id in wallet.ids)) {
+                throw new UnknownIDError();
+            }
+            if (name in wallet.ids) {
+                throw new InvalidParameterError('name already used');
+            }
+            wallet.ids[name] = wallet.ids[id];
+            delete wallet.ids[id];
+            if (wallet.current && wallet.current === id) {
+                wallet.current = name;
+            }
+        });
+        return true;
+    }
+    async backupId(id) {
+        // Backs up current ID if id is not provided
+        const wallet = await this.loadWallet();
+        const name = id || wallet.current;
+        if (!name) {
+            throw new InvalidParameterError('no current ID');
+        }
+        const idInfo = await this.fetchIdInfo(name, wallet);
+        const keypair = await this.hdKeyPair();
+        const data = {
+            name: name,
+            id: idInfo,
+        };
+        const msg = JSON.stringify(data);
+        const backup = this.cipher.encryptMessage(keypair.publicJwk, keypair.privateJwk, msg);
+        const doc = await this.resolveDID(idInfo.did);
+        const registry = doc.didDocumentRegistration?.registry;
+        if (!registry) {
+            throw new InvalidParameterError('no registry found for agent DID');
+        }
+        const vaultDid = await this.createAsset({ backup: backup }, { registry, controller: name });
+        if (doc.didDocumentData) {
+            const currentData = doc.didDocumentData;
+            const updatedData = { ...currentData, vault: vaultDid };
+            return this.updateDID(name, { didDocumentData: updatedData });
+        }
+        return false;
+    }
+    async recoverId(did) {
+        try {
+            const keypair = await this.hdKeyPair();
+            const doc = await this.resolveDID(did);
+            const docData = doc.didDocumentData;
+            if (!docData.vault) {
+                throw new InvalidDIDError('didDocumentData missing vault');
+            }
+            const vault = await this.resolveAsset(docData.vault);
+            if (typeof vault.backup !== 'string') {
+                throw new InvalidDIDError('backup not found in vault');
+            }
+            const backup = this.cipher.decryptMessage(keypair.publicJwk, keypair.privateJwk, vault.backup);
+            const data = JSON.parse(backup);
+            await this.mutateWallet((wallet) => {
+                if (wallet.ids[data.name]) {
+                    throw new KeymasterError(`${data.name} already exists in wallet`);
+                }
+                wallet.ids[data.name] = data.id;
+                wallet.current = data.name;
+                wallet.counter += 1;
+            });
+            return data.name;
+        }
+        catch (error) {
+            if (error.type === 'Keymaster') {
+                throw error;
+            }
+            else {
+                throw new InvalidDIDError();
+            }
+        }
+    }
+    async rotateKeys() {
+        let ok = false;
+        await this.mutateWallet(async (wallet) => {
+            const id = wallet.ids[wallet.current];
+            const nextIndex = id.index + 1;
+            const hdkey = await this.getHDKeyFromCacheOrMnemonic(wallet);
+            const path = `m/44'/0'/${id.account}'/0/${nextIndex}`;
+            const didkey = hdkey.derive(path);
+            const keypair = this.cipher.generateJwk(didkey.privateKey);
+            const doc = await this.resolveDID(id.did);
+            if (!doc.didDocumentMetadata?.confirmed) {
+                throw new KeymasterError('Cannot rotate keys');
+            }
+            if (!doc.didDocument?.verificationMethod) {
+                throw new KeymasterError('DID Document missing verificationMethod');
+            }
+            const vmethod = { ...doc.didDocument.verificationMethod[0] };
+            vmethod.id = `#key-${nextIndex + 1}`;
+            vmethod.publicKeyJwk = keypair.publicJwk;
+            const updatedDidDocument = {
+                ...doc.didDocument,
+                verificationMethod: [vmethod],
+                authentication: [vmethod.id],
+            };
+            ok = await this.updateDID(id.did, { didDocument: updatedDidDocument });
+            if (!ok) {
+                throw new KeymasterError('Cannot rotate keys');
+            }
+            id.index = nextIndex; // persist in same mutation
+        });
+        return ok;
+    }
+    async listNames(options = {}) {
+        const { includeIDs = false } = options;
+        const wallet = await this.loadWallet();
+        const names = wallet.names || {};
+        if (includeIDs) {
+            for (const [name, id] of Object.entries(wallet.ids || {})) {
+                names[name] = id.did;
+            }
+        }
+        return names;
+    }
+    async addName(name, did) {
+        await this.mutateWallet((wallet) => {
+            if (!wallet.names) {
+                wallet.names = {};
+            }
+            name = this.validateName(name, wallet);
+            wallet.names[name] = did;
+        });
+        return true;
+    }
+    async getName(name) {
+        const wallet = await this.loadWallet();
+        if (wallet.names && name in wallet.names) {
+            return wallet.names[name];
+        }
+        return null;
+    }
+    async removeName(name) {
+        await this.mutateWallet((wallet) => {
+            if (!wallet.names || !(name in wallet.names)) {
+                return;
+            }
+            delete wallet.names[name];
+        });
+        return true;
+    }
+    async testAgent(id) {
+        const doc = await this.resolveDID(id);
+        return doc.didDocumentRegistration?.type === 'agent';
+    }
+    async bindCredential(schemaId, subjectId, options = {}) {
+        let { validFrom, validUntil, credential } = options;
+        if (!validFrom) {
+            validFrom = new Date().toISOString();
+        }
+        const id = await this.fetchIdInfo();
+        const type = await this.lookupDID(schemaId);
+        const subjectDID = await this.lookupDID(subjectId);
+        if (!credential) {
+            const schema = await this.getSchema(type);
+            credential = this.generateSchema(schema);
+        }
+        return {
+            "@context": [
+                "https://www.w3.org/ns/credentials/v2",
+                "https://www.w3.org/ns/credentials/examples/v2"
+            ],
+            type: ["VerifiableCredential", type],
+            issuer: id.did,
+            validFrom,
+            validUntil,
+            credentialSubject: {
+                id: subjectDID,
+            },
+            credential,
+        };
+    }
+    async issueCredential(credential, options = {}) {
+        const id = await this.fetchIdInfo();
+        if (options.schema && options.subject) {
+            credential = await this.bindCredential(options.schema, options.subject, { credential, ...options });
+        }
+        if (credential.issuer !== id.did) {
+            throw new InvalidParameterError('credential.issuer');
+        }
+        const signed = await this.addSignature(credential);
+        return this.encryptJSON(signed, credential.credentialSubject.id, { ...options, includeHash: true });
+    }
+    async sendCredential(did, options = {}) {
+        const vc = await this.getCredential(did);
+        if (!vc) {
+            return null;
+        }
+        const registry = this.ephemeralRegistry;
+        const validUntil = new Date(Date.now() + 7 * 24 * 60 * 60 * 1000).toISOString(); // Default to 7 days
+        const message = {
+            to: [vc.credentialSubject.id],
+            dids: [did],
+        };
+        return this.createNotice(message, { registry, validUntil, ...options });
+    }
+    isVerifiableCredential(obj) {
+        if (typeof obj !== 'object' || !obj) {
+            return false;
+        }
+        const vc = obj;
+        return !(!Array.isArray(vc["@context"]) || !Array.isArray(vc.type) || !vc.issuer || !vc.credentialSubject);
+    }
+    async updateCredential(did, credential) {
+        did = await this.lookupDID(did);
+        const originalVC = await this.decryptJSON(did);
+        if (!this.isVerifiableCredential(originalVC)) {
+            throw new InvalidParameterError("did is not a credential");
+        }
+        if (!credential ||
+            !credential.credential ||
+            !credential.credentialSubject ||
+            !credential.credentialSubject.id) {
+            throw new InvalidParameterError('credential');
+        }
+        delete credential.signature;
+        const signed = await this.addSignature(credential);
+        const msg = JSON.stringify(signed);
+        const id = await this.fetchIdInfo();
+        const senderKeypair = await this.fetchKeyPair();
+        if (!senderKeypair) {
+            throw new KeymasterError('No valid sender keypair');
+        }
+        const holder = credential.credentialSubject.id;
+        const holderDoc = await this.resolveDID(holder, { confirm: true });
+        const receivePublicJwk = this.getPublicKeyJwk(holderDoc);
+        const cipher_sender = this.cipher.encryptMessage(senderKeypair.publicJwk, senderKeypair.privateJwk, msg);
+        const cipher_receiver = this.cipher.encryptMessage(receivePublicJwk, senderKeypair.privateJwk, msg);
+        const msgHash = this.cipher.hashMessage(msg);
+        const encrypted = {
+            sender: id.did,
+            created: new Date().toISOString(),
+            cipher_hash: msgHash,
+            cipher_sender: cipher_sender,
+            cipher_receiver: cipher_receiver,
+        };
+        return this.updateDID(did, { didDocumentData: { encrypted } });
+    }
+    async revokeCredential(credential) {
+        const did = await this.lookupDID(credential);
+        return this.revokeDID(did);
+    }
+    async listIssued(issuer) {
+        const id = await this.fetchIdInfo(issuer);
+        const issued = [];
+        if (id.owned) {
+            for (const did of id.owned) {
+                try {
+                    const credential = await this.decryptJSON(did);
+                    if (this.isVerifiableCredential(credential) &&
+                        credential.issuer === id.did) {
+                        issued.push(did);
+                    }
+                }
+                catch (error) { }
+            }
+        }
+        return issued;
+    }
+    async acceptCredential(did) {
+        try {
+            const id = await this.fetchIdInfo();
+            const credential = await this.lookupDID(did);
+            const vc = await this.decryptJSON(credential);
+            if (this.isVerifiableCredential(vc) &&
+                vc.credentialSubject?.id !== id.did) {
+                return false;
+            }
+            return this.addToHeld(credential);
+        }
+        catch (error) {
+            return false;
+        }
+    }
+    async getCredential(id) {
+        const did = await this.lookupDID(id);
+        const vc = await this.decryptJSON(did);
+        if (!this.isVerifiableCredential(vc)) {
+            return null;
+        }
+        return vc;
+    }
+    async removeCredential(id) {
+        const did = await this.lookupDID(id);
+        return this.removeFromHeld(did);
+    }
+    async listCredentials(id) {
+        const idInfo = await this.fetchIdInfo(id);
+        return idInfo.held || [];
+    }
+    async publishCredential(did, options = {}) {
+        const { reveal = false } = options;
+        const id = await this.fetchIdInfo();
+        const credential = await this.lookupDID(did);
+        const vc = await this.decryptJSON(credential);
+        if (!this.isVerifiableCredential(vc)) {
+            throw new InvalidParameterError("did is not a credential");
+        }
+        if (vc.credentialSubject?.id !== id.did) {
+            throw new InvalidParameterError('only subject can publish a credential');
+        }
+        const doc = await this.resolveDID(id.did);
+        if (!doc.didDocumentData) {
+            doc.didDocumentData = {};
+        }
+        const data = doc.didDocumentData;
+        if (!data.manifest) {
+            data.manifest = {};
+        }
+        if (!reveal) {
+            // Remove the credential values
+            vc.credential = null;
+        }
+        data.manifest[credential] = vc;
+        const ok = await this.updateDID(id.did, { didDocumentData: doc.didDocumentData });
+        if (ok) {
+            return vc;
+        }
+        throw new KeymasterError('update DID failed');
+    }
+    async unpublishCredential(did) {
+        const id = await this.fetchIdInfo();
+        const doc = await this.resolveDID(id.did);
+        const credential = await this.lookupDID(did);
+        const data = doc.didDocumentData;
+        if (credential && data.manifest && credential in data.manifest) {
+            delete data.manifest[credential];
+            await this.updateDID(id.did, { didDocumentData: doc.didDocumentData });
+            return `OK credential ${did} removed from manifest`;
+        }
+        throw new InvalidParameterError('did');
+    }
+    async createChallenge(challenge = {}, options = {}) {
+        if (!challenge || typeof challenge !== 'object' || Array.isArray(challenge)) {
+            throw new InvalidParameterError('challenge');
+        }
+        if (challenge.credentials && !Array.isArray(challenge.credentials)) {
+            throw new InvalidParameterError('challenge.credentials');
+            // TBD validate each credential spec
+        }
+        if (!options.registry) {
+            options.registry = this.ephemeralRegistry;
+        }
+        if (!options.validUntil) {
+            const expires = new Date();
+            expires.setHours(expires.getHours() + 1); // Add 1 hour
+            options.validUntil = expires.toISOString();
+        }
+        return this.createAsset({ challenge }, options);
+    }
+    async findMatchingCredential(credential) {
+        const id = await this.fetchIdInfo();
+        if (!id.held) {
+            return;
+        }
+        for (let did of id.held) {
+            try {
+                const doc = await this.decryptJSON(did);
+                if (!this.isVerifiableCredential(doc)) {
+                    continue;
+                }
+                if (doc.credentialSubject?.id !== id.did) {
+                    // This VC is issued by the ID, not held
+                    continue;
+                }
+                if (credential.issuers && !credential.issuers.includes(doc.issuer)) {
+                    // Attestor not trusted by Verifier
+                    continue;
+                }
+                if (doc.type && !doc.type.includes(credential.schema)) {
+                    // Wrong type
+                    continue;
+                }
+                // TBD test for VC expiry too
+                return did;
+            }
+            catch (error) {
+                // Not encrypted, so can't be a VC
+            }
+        }
+    }
+    async createResponse(challengeDID, options = {}) {
+        let { retries = 0, delay = 1000 } = options;
+        if (!options.registry) {
+            options.registry = this.ephemeralRegistry;
+        }
+        if (!options.validUntil) {
+            const expires = new Date();
+            expires.setHours(expires.getHours() + 1); // Add 1 hour
+            options.validUntil = expires.toISOString();
+        }
+        let doc;
+        while (retries >= 0) {
+            try {
+                doc = await this.resolveDID(challengeDID);
+                break;
+            }
+            catch (error) {
+                if (retries === 0)
+                    throw error; // If no retries left, throw the error
+                retries--; // Decrease the retry count
+                await new Promise(resolve => setTimeout(resolve, delay)); // Wait for delay milleseconds
+            }
+        }
+        if (!doc) {
+            throw new InvalidParameterError('challengeDID does not resolve');
+        }
+        const result = await this.resolveAsset(challengeDID);
+        if (!result) {
+            throw new InvalidParameterError('challengeDID');
+        }
+        const challenge = result.challenge;
+        if (!challenge) {
+            throw new InvalidParameterError('challengeDID');
+        }
+        const requestor = doc.didDocument?.controller;
+        if (!requestor) {
+            throw new InvalidParameterError('requestor undefined');
+        }
+        // TBD check challenge isValid for expired?
+        const matches = [];
+        if (challenge.credentials) {
+            for (let credential of challenge.credentials) {
+                const vc = await this.findMatchingCredential(credential);
+                if (vc) {
+                    matches.push(vc);
+                }
+            }
+        }
+        const pairs = [];
+        for (let vcDid of matches) {
+            const plaintext = await this.decryptMessage(vcDid);
+            const vpDid = await this.encryptMessage(plaintext, requestor, { ...options, includeHash: true });
+            pairs.push({ vc: vcDid, vp: vpDid });
+        }
+        const requested = challenge.credentials?.length ?? 0;
+        const fulfilled = matches.length;
+        const match = (requested === fulfilled);
+        const response = {
+            challenge: challengeDID,
+            credentials: pairs,
+            requested: requested,
+            fulfilled: fulfilled,
+            match: match
+        };
+        return await this.encryptJSON({ response }, requestor, options);
+    }
+    async verifyResponse(responseDID, options = {}) {
+        let { retries = 0, delay = 1000 } = options;
+        let responseDoc;
+        while (retries >= 0) {
+            try {
+                responseDoc = await this.resolveDID(responseDID);
+                break;
+            }
+            catch (error) {
+                if (retries === 0)
+                    throw error; // If no retries left, throw the error
+                retries--; // Decrease the retry count
+                await new Promise(resolve => setTimeout(resolve, delay)); // Wait for delay milliseconds
+            }
+        }
+        if (!responseDoc) {
+            throw new InvalidParameterError('responseDID does not resolve');
+        }
+        const wrapper = await this.decryptJSON(responseDID);
+        if (typeof wrapper !== 'object' || !wrapper || !('response' in wrapper)) {
+            throw new InvalidParameterError('responseDID not a valid challenge response');
+        }
+        const { response } = wrapper;
+        const result = await this.resolveAsset(response.challenge);
+        if (!result) {
+            throw new InvalidParameterError('challenge not found');
+        }
+        const challenge = result.challenge;
+        if (!challenge) {
+            throw new InvalidParameterError('challengeDID');
+        }
+        const vps = [];
+        for (let credential of response.credentials) {
+            const vcData = await this.resolveAsset(credential.vc);
+            const vpData = await this.resolveAsset(credential.vp);
+            const castVCData = vcData;
+            const castVPData = vpData;
+            if (!vcData || !vpData || !castVCData.encrypted || !castVPData.encrypted) {
+                // VC revoked
+                continue;
+            }
+            const vcHash = castVCData.encrypted;
+            const vpHash = castVPData.encrypted;
+            if (vcHash.cipher_hash !== vpHash.cipher_hash) {
+                // can't verify that the contents of VP match the VC
+                continue;
+            }
+            const vp = await this.decryptJSON(credential.vp);
+            const isValid = await this.verifySignature(vp);
+            if (!isValid) {
+                continue;
+            }
+            if (!vp.type || !Array.isArray(vp.type)) {
+                continue;
+            }
+            // Check VP against VCs specified in challenge
+            if (vp.type.length >= 2 && vp.type[1].startsWith('did:')) {
+                const schema = vp.type[1];
+                const credential = challenge.credentials?.find(item => item.schema === schema);
+                if (!credential) {
+                    continue;
+                }
+                // Check if issuer of VP is in the trusted issuer list
+                if (credential.issuers && credential.issuers.length > 0 && !credential.issuers.includes(vp.issuer)) {
+                    continue;
+                }
+            }
+            vps.push(vp);
+        }
+        response.vps = vps;
+        response.match = vps.length === (challenge.credentials?.length ?? 0);
+        response.responder = responseDoc.didDocument?.controller;
+        return response;
+    }
+    async createGroup(name, options = {}) {
+        const group = {
+            name: name,
+            members: []
+        };
+        return this.createAsset({ group }, options);
+    }
+    async getGroup(id) {
+        const asset = await this.resolveAsset(id);
+        if (!asset) {
+            return null;
+        }
+        // TEMP during did:cid, return old version groups
+        const castOldAsset = asset;
+        if (castOldAsset.members) {
+            return castOldAsset;
+        }
+        const castAsset = asset;
+        if (!castAsset.group) {
+            return null;
+        }
+        return castAsset.group;
+    }
+    async addGroupMember(groupId, memberId) {
+        const groupDID = await this.lookupDID(groupId);
+        const memberDID = await this.lookupDID(memberId);
+        // Can't add a group to itself
+        if (memberDID === groupDID) {
+            throw new InvalidParameterError("can't add a group to itself");
+        }
+        try {
+            // test for valid member DID
+            await this.resolveDID(memberDID);
+        }
+        catch {
+            throw new InvalidParameterError('memberId');
+        }
+        const group = await this.getGroup(groupId);
+        if (!group?.members) {
+            throw new InvalidParameterError('groupId');
+        }
+        // If already a member, return immediately
+        if (group.members.includes(memberDID)) {
+            return true;
+        }
+        // Can't add a mutual membership relation
+        const isMember = await this.testGroup(memberId, groupId);
+        if (isMember) {
+            throw new InvalidParameterError("can't create mutual membership");
+        }
+        const members = new Set(group.members);
+        members.add(memberDID);
+        group.members = Array.from(members);
+        return this.updateAsset(groupDID, { group });
+    }
+    async removeGroupMember(groupId, memberId) {
+        const groupDID = await this.lookupDID(groupId);
+        const memberDID = await this.lookupDID(memberId);
+        const group = await this.getGroup(groupDID);
+        if (!group?.members) {
+            throw new InvalidParameterError('groupId');
+        }
+        try {
+            // test for valid member DID
+            await this.resolveDID(memberDID);
+        }
+        catch {
+            throw new InvalidParameterError('memberId');
+        }
+        // If not already a member, return immediately
+        if (!group.members.includes(memberDID)) {
+            return true;
+        }
+        const members = new Set(group.members);
+        members.delete(memberDID);
+        group.members = Array.from(members);
+        return this.updateAsset(groupDID, { group });
+    }
+    async testGroup(groupId, memberId) {
+        try {
+            const group = await this.getGroup(groupId);
+            if (!group) {
+                return false;
+            }
+            if (!memberId) {
+                return true;
+            }
+            const didMember = await this.lookupDID(memberId);
+            let isMember = group.members.includes(didMember);
+            if (!isMember) {
+                for (const did of group.members) {
+                    isMember = await this.testGroup(did, didMember);
+                    if (isMember) {
+                        break;
+                    }
+                }
+            }
+            return isMember;
+        }
+        catch (error) {
+            return false;
+        }
+    }
+    async listGroups(owner) {
+        const assets = await this.listAssets(owner);
+        const groups = [];
+        for (const did of assets) {
+            const isGroup = await this.testGroup(did);
+            if (isGroup) {
+                groups.push(did);
+            }
+        }
+        return groups;
+    }
+    validateSchema(schema) {
+        try {
+            // Attempt to instantiate the schema
+            this.generateSchema(schema);
+            return true;
+        }
+        catch (error) {
+            return false;
+        }
+    }
+    generateSchema(schema) {
+        if (typeof schema !== 'object' ||
+            !schema ||
+            !('$schema' in schema) ||
+            !('properties' in schema)) {
+            throw new InvalidParameterError('schema');
+        }
+        const template = {};
+        const props = schema.properties;
+        for (const property of Object.keys(props)) {
+            template[property] = "TBD";
+        }
+        return template;
+    }
+    async createSchema(schema, options = {}) {
+        if (!schema) {
+            schema = DefaultSchema;
+        }
+        if (!this.validateSchema(schema)) {
+            throw new InvalidParameterError('schema');
+        }
+        return this.createAsset({ schema }, options);
+    }
+    async getSchema(id) {
+        const asset = await this.resolveAsset(id);
+        if (!asset) {
+            return null;
+        }
+        // TEMP during did:cid, return old version schemas
+        const castOldAsset = asset;
+        if (castOldAsset.properties) {
+            return asset;
+        }
+        const castAsset = asset;
+        if (!castAsset.schema) {
+            return null;
+        }
+        return castAsset.schema;
+    }
+    async setSchema(id, schema) {
+        if (!this.validateSchema(schema)) {
+            throw new InvalidParameterError('schema');
+        }
+        return this.updateAsset(id, { schema });
+    }
+    // TBD add optional 2nd parameter that will validate JSON against the schema
+    async testSchema(id) {
+        try {
+            const schema = await this.getSchema(id);
+            // TBD Need a better way because any random object with keys can be a valid schema
+            if (!schema || Object.keys(schema).length === 0) {
+                return false;
+            }
+            return this.validateSchema(schema);
+        }
+        catch (error) {
+            return false;
+        }
+    }
+    async listSchemas(owner) {
+        const assets = await this.listAssets(owner);
+        const schemas = [];
+        for (const did of assets) {
+            const isSchema = await this.testSchema(did);
+            if (isSchema) {
+                schemas.push(did);
+            }
+        }
+        return schemas;
+    }
+    async createTemplate(schemaId) {
+        const isSchema = await this.testSchema(schemaId);
+        if (!isSchema) {
+            throw new InvalidParameterError('schemaId');
+        }
+        const schemaDID = await this.lookupDID(schemaId);
+        const schema = await this.getSchema(schemaDID);
+        const template = this.generateSchema(schema);
+        template['$schema'] = schemaDID;
+        return template;
+    }
+    async pollTemplate() {
+        const now = new Date();
+        const nextWeek = new Date();
+        nextWeek.setDate(now.getDate() + 7);
+        return {
+            type: 'poll',
+            version: 1,
+            description: 'What is this poll about?',
+            roster: 'DID of the eligible voter group',
+            options: ['yes', 'no', 'abstain'],
+            deadline: nextWeek.toISOString(),
+        };
+    }
+    async createPoll(poll, options = {}) {
+        if (poll.type !== 'poll') {
+            throw new InvalidParameterError('poll');
+        }
+        if (poll.version !== 1) {
+            throw new InvalidParameterError('poll.version');
+        }
+        if (!poll.description) {
+            throw new InvalidParameterError('poll.description');
+        }
+        if (!poll.options || !Array.isArray(poll.options) || poll.options.length < 2 || poll.options.length > 10) {
+            throw new InvalidParameterError('poll.options');
+        }
+        if (!poll.roster) {
+            // eslint-disable-next-line
+            throw new InvalidParameterError('poll.roster');
+        }
+        try {
+            const isValidGroup = await this.testGroup(poll.roster);
+            if (!isValidGroup) {
+                throw new InvalidParameterError('poll.roster');
+            }
+        }
+        catch {
+            throw new InvalidParameterError('poll.roster');
+        }
+        if (!poll.deadline) {
+            // eslint-disable-next-line
+            throw new InvalidParameterError('poll.deadline');
+        }
+        const deadline = new Date(poll.deadline);
+        if (isNaN(deadline.getTime())) {
+            throw new InvalidParameterError('poll.deadline');
+        }
+        if (deadline < new Date()) {
+            throw new InvalidParameterError('poll.deadline');
+        }
+        return this.createAsset({ poll }, options);
+    }
+    async getPoll(id) {
+        const asset = await this.resolveAsset(id);
+        // TEMP during did:cid, return old version poll
+        const castOldAsset = asset;
+        if (castOldAsset.options) {
+            return castOldAsset;
+        }
+        const castAsset = asset;
+        if (!castAsset.poll) {
+            return null;
+        }
+        return castAsset.poll;
+    }
+    async testPoll(id) {
+        try {
+            const poll = await this.getPoll(id);
+            return poll !== null;
+        }
+        catch (error) {
+            return false;
+        }
+    }
+    async listPolls(owner) {
+        const assets = await this.listAssets(owner);
+        const polls = [];
+        for (const did of assets) {
+            const isPoll = await this.testPoll(did);
+            if (isPoll) {
+                polls.push(did);
+            }
+        }
+        return polls;
+    }
+    async viewPoll(pollId) {
+        const id = await this.fetchIdInfo();
+        const poll = await this.getPoll(pollId);
+        if (!poll) {
+            throw new InvalidParameterError('pollId');
+        }
+        let hasVoted = false;
+        if (poll.ballots) {
+            hasVoted = !!poll.ballots[id.did];
+        }
+        const voteExpired = Date.now() > new Date(poll.deadline).getTime();
+        const isEligible = await this.testGroup(poll.roster, id.did);
+        const doc = await this.resolveDID(pollId);
+        const view = {
+            description: poll.description,
+            options: poll.options,
+            deadline: poll.deadline,
+            isOwner: (doc.didDocument?.controller === id.did),
+            isEligible: isEligible,
+            voteExpired: voteExpired,
+            hasVoted: hasVoted,
+        };
+        if (id.did === doc.didDocument?.controller) {
+            let voted = 0;
+            const results = {
+                tally: [],
+                ballots: [],
+            };
+            results.tally.push({
+                vote: 0,
+                option: 'spoil',
+                count: 0,
+            });
+            for (let i = 0; i < poll.options.length; i++) {
+                results.tally.push({
+                    vote: i + 1,
+                    option: poll.options[i],
+                    count: 0,
+                });
+            }
+            for (let voter in poll.ballots) {
+                const ballot = poll.ballots[voter];
+                const decrypted = await this.decryptJSON(ballot.ballot);
+                const vote = decrypted.vote;
+                if (results.ballots) {
+                    results.ballots.push({
+                        ...ballot,
+                        voter,
+                        vote,
+                        option: poll.options[vote - 1],
+                    });
+                }
+                voted += 1;
+                results.tally[vote].count += 1;
+            }
+            const roster = await this.getGroup(poll.roster);
+            const total = roster.members.length;
+            results.votes = {
+                eligible: total,
+                received: voted,
+                pending: total - voted,
+            };
+            results.final = voteExpired || (voted === total);
+            view.results = results;
+        }
+        return view;
+    }
+    async votePoll(pollId, vote, options = {}) {
+        const { spoil = false } = options;
+        const id = await this.fetchIdInfo();
+        const didPoll = await this.lookupDID(pollId);
+        const doc = await this.resolveDID(didPoll);
+        const poll = await this.getPoll(pollId);
+        if (!poll) {
+            throw new InvalidParameterError('pollId');
+        }
+        const eligible = await this.testGroup(poll.roster, id.did);
+        const expired = Date.now() > new Date(poll.deadline).getTime();
+        const owner = doc.didDocument?.controller;
+        if (!owner) {
+            throw new KeymasterError('owner mising from poll');
+        }
+        if (!eligible) {
+            throw new InvalidParameterError('voter not in roster');
+        }
+        if (expired) {
+            throw new InvalidParameterError('poll has expired');
+        }
+        let ballot;
+        if (spoil) {
+            ballot = {
+                poll: didPoll,
+                vote: 0,
+            };
+        }
+        else {
+            const max = poll.options.length;
+            if (!Number.isInteger(vote) || vote < 1 || vote > max) {
+                throw new InvalidParameterError('vote');
+            }
+            ballot = {
+                poll: didPoll,
+                vote: vote,
+            };
+        }
+        // Encrypt for receiver only
+        return await this.encryptJSON(ballot, owner, { ...options, encryptForSender: false });
+    }
+    async updatePoll(ballot) {
+        const id = await this.fetchIdInfo();
+        const didBallot = await this.lookupDID(ballot);
+        const docBallot = await this.resolveDID(ballot);
+        const didVoter = docBallot.didDocument.controller;
+        let dataBallot;
+        try {
+            dataBallot = await this.decryptJSON(didBallot);
+            if (!dataBallot.poll || !dataBallot.vote) {
+                throw new InvalidParameterError('ballot');
+            }
+        }
+        catch {
+            throw new InvalidParameterError('ballot');
+        }
+        const didPoll = dataBallot.poll;
+        const docPoll = await this.resolveDID(didPoll);
+        const didOwner = docPoll.didDocument.controller;
+        const poll = await this.getPoll(didPoll);
+        if (!poll) {
+            throw new KeymasterError('Cannot find poll related to ballot');
+        }
+        if (id.did !== didOwner) {
+            throw new InvalidParameterError('only owner can update a poll');
+        }
+        const eligible = await this.testGroup(poll.roster, didVoter);
+        if (!eligible) {
+            throw new InvalidParameterError('voter not in roster');
+        }
+        const expired = Date.now() > new Date(poll.deadline).getTime();
+        if (expired) {
+            throw new InvalidParameterError('poll has expired');
+        }
+        const max = poll.options.length;
+        const vote = dataBallot.vote;
+        if (!vote || vote < 0 || vote > max) {
+            throw new InvalidParameterError('ballot.vote');
+        }
+        if (!poll.ballots) {
+            poll.ballots = {};
+        }
+        poll.ballots[didVoter] = {
+            ballot: didBallot,
+            received: new Date().toISOString(),
+        };
+        return this.updateAsset(didPoll, { poll });
+    }
+    async publishPoll(pollId, options = {}) {
+        const { reveal = false } = options;
+        const id = await this.fetchIdInfo();
+        const doc = await this.resolveDID(pollId);
+        const owner = doc.didDocument?.controller;
+        if (id.did !== owner) {
+            throw new InvalidParameterError('only owner can publish a poll');
+        }
+        const view = await this.viewPoll(pollId);
+        if (!view.results?.final) {
+            throw new InvalidParameterError('poll not final');
+        }
+        if (!reveal && view.results.ballots) {
+            delete view.results.ballots;
+        }
+        const poll = await this.getPoll(pollId);
+        if (!poll) {
+            throw new InvalidParameterError(pollId);
+        }
+        poll.results = view.results;
+        return this.updateAsset(pollId, { poll });
+    }
+    async unpublishPoll(pollId) {
+        const id = await this.fetchIdInfo();
+        const doc = await this.resolveDID(pollId);
+        const owner = doc.didDocument?.controller;
+        if (id.did !== owner) {
+            throw new InvalidParameterError(pollId);
+        }
+        const poll = await this.getPoll(pollId);
+        if (!poll) {
+            throw new InvalidParameterError(pollId);
+        }
+        delete poll.results;
+        return this.updateAsset(pollId, { poll });
+    }
+    async createGroupVault(options = {}) {
+        const id = await this.fetchIdInfo();
+        const idKeypair = await this.fetchKeyPair();
+        // version defaults to 1. To make version undefined (unit testing), set options.version to 0
+        const version = typeof options.version === 'undefined'
+            ? 1
+            : (typeof options.version === 'number' && options.version === 1 ? options.version : undefined);
+        const salt = this.cipher.generateRandomSalt();
+        const vaultKeypair = this.cipher.generateRandomJwk();
+        const keys = {};
+        const config = this.cipher.encryptMessage(idKeypair.publicJwk, vaultKeypair.privateJwk, JSON.stringify(options));
+        const publicJwk = options.secretMembers ? idKeypair.publicJwk : vaultKeypair.publicJwk; // If secret, encrypt for the owner only
+        const members = this.cipher.encryptMessage(publicJwk, vaultKeypair.privateJwk, JSON.stringify({}));
+        const items = this.cipher.encryptMessage(vaultKeypair.publicJwk, vaultKeypair.privateJwk, JSON.stringify({}));
+        const sha256 = this.cipher.hashJSON({});
+        const groupVault = {
+            version,
+            publicJwk: vaultKeypair.publicJwk,
+            salt,
+            config,
+            members,
+            keys,
+            items,
+            sha256,
+        };
+        await this.addMemberKey(groupVault, id.did, vaultKeypair.privateJwk);
+        return this.createAsset({ groupVault }, options);
+    }
+    async getGroupVault(groupVaultId, options) {
+        const asset = await this.resolveAsset(groupVaultId, options);
+        if (!asset.groupVault) {
+            throw new InvalidParameterError('groupVaultId');
+        }
+        return asset.groupVault;
+    }
+    async testGroupVault(id, options) {
+        try {
+            const groupVault = await this.getGroupVault(id, options);
+            return groupVault !== null;
+        }
+        catch (error) {
+            return false;
+        }
+    }
+    generateSaltedId(groupVault, memberDID) {
+        if (!groupVault.version) {
+            return this.cipher.hashMessage(groupVault.salt + memberDID);
+        }
+        const suffix = memberDID.split(':').pop();
+        return this.cipher.hashMessage(groupVault.salt + suffix);
+    }
+    async decryptGroupVault(groupVault) {
+        const wallet = await this.loadWallet();
+        const id = await this.fetchIdInfo();
+        const myMemberId = this.generateSaltedId(groupVault, id.did);
+        const myVaultKey = groupVault.keys[myMemberId];
+        if (!myVaultKey) {
+            throw new KeymasterError('No access to group vault');
+        }
+        const privKeyJSON = await this.decryptWithDerivedKeys(wallet, id, groupVault.publicJwk, myVaultKey);
+        const privateJwk = JSON.parse(privKeyJSON);
+        let config = {};
+        let isOwner = false;
+        try {
+            const configJSON = await this.decryptWithDerivedKeys(wallet, id, groupVault.publicJwk, groupVault.config);
+            config = JSON.parse(configJSON);
+            isOwner = true;
+        }
+        catch (error) {
+            // Can't decrypt config if not the owner
+        }
+        let members = {};
+        if (config.secretMembers) {
+            try {
+                const membersJSON = await this.decryptWithDerivedKeys(wallet, id, groupVault.publicJwk, groupVault.members);
+                members = JSON.parse(membersJSON);
+            }
+            catch (error) {
+            }
+        }
+        else {
+            try {
+                const membersJSON = this.cipher.decryptMessage(groupVault.publicJwk, privateJwk, groupVault.members);
+                members = JSON.parse(membersJSON);
+            }
+            catch (error) {
+            }
+        }
+        const itemsJSON = this.cipher.decryptMessage(groupVault.publicJwk, privateJwk, groupVault.items);
+        const items = JSON.parse(itemsJSON);
+        return {
+            isOwner,
+            privateJwk,
+            config,
+            members,
+            items,
+        };
+    }
+    async checkGroupVaultOwner(vaultId) {
+        const id = await this.fetchIdInfo();
+        const vaultDoc = await this.resolveDID(vaultId);
+        const controller = vaultDoc.didDocument?.controller;
+        if (controller !== id.did) {
+            throw new KeymasterError('Only vault owner can modify the vault');
+        }
+        return controller;
+    }
+    async addMemberKey(groupVault, memberDID, privateJwk) {
+        const memberDoc = await this.resolveDID(memberDID, { confirm: true });
+        const memberPublicJwk = this.getPublicKeyJwk(memberDoc);
+        const memberKey = this.cipher.encryptMessage(memberPublicJwk, privateJwk, JSON.stringify(privateJwk));
+        const memberKeyId = this.generateSaltedId(groupVault, memberDID);
+        groupVault.keys[memberKeyId] = memberKey;
+    }
+    async checkVaultVersion(vaultId, groupVault) {
+        if (groupVault.version === 1) {
+            return;
+        }
+        if (!groupVault.version) {
+            const id = await this.fetchIdInfo();
+            const { privateJwk, members } = await this.decryptGroupVault(groupVault);
+            groupVault.version = 1;
+            groupVault.keys = {};
+            await this.addMemberKey(groupVault, id.did, privateJwk);
+            for (const memberDID of Object.keys(members)) {
+                await this.addMemberKey(groupVault, memberDID, privateJwk);
+            }
+            await this.updateAsset(vaultId, { groupVault });
+            return;
+        }
+        throw new KeymasterError('Unsupported group vault version');
+    }
+    getAgentDID(doc) {
+        if (doc.didDocumentRegistration?.type !== 'agent') {
+            throw new KeymasterError('Document is not an agent');
+        }
+        const did = doc.didDocument?.id;
+        if (!did) {
+            throw new KeymasterError('Agent document does not have a DID');
+        }
+        return did;
+    }
+    async addGroupVaultMember(vaultId, memberId) {
+        const owner = await this.checkGroupVaultOwner(vaultId);
+        const idKeypair = await this.fetchKeyPair();
+        const groupVault = await this.getGroupVault(vaultId);
+        const { privateJwk, config, members } = await this.decryptGroupVault(groupVault);
+        const memberDoc = await this.resolveDID(memberId, { confirm: true });
+        const memberDID = this.getAgentDID(memberDoc);
+        // Don't allow adding the vault owner
+        if (owner === memberDID) {
+            return false;
+        }
+        members[memberDID] = { added: new Date().toISOString() };
+        const publicJwk = config.secretMembers ? idKeypair.publicJwk : groupVault.publicJwk;
+        groupVault.members = this.cipher.encryptMessage(publicJwk, privateJwk, JSON.stringify(members));
+        await this.addMemberKey(groupVault, memberDID, privateJwk);
+        return this.updateAsset(vaultId, { groupVault });
+    }
+    async removeGroupVaultMember(vaultId, memberId) {
+        const owner = await this.checkGroupVaultOwner(vaultId);
+        const idKeypair = await this.fetchKeyPair();
+        const groupVault = await this.getGroupVault(vaultId);
+        const { privateJwk, config, members } = await this.decryptGroupVault(groupVault);
+        const memberDoc = await this.resolveDID(memberId, { confirm: true });
+        const memberDID = this.getAgentDID(memberDoc);
+        // Don't allow removing the vault owner
+        if (owner === memberDID) {
+            return false;
+        }
+        delete members[memberDID];
+        const publicJwk = config.secretMembers ? idKeypair.publicJwk : groupVault.publicJwk;
+        groupVault.members = this.cipher.encryptMessage(publicJwk, privateJwk, JSON.stringify(members));
+        const memberKeyId = this.generateSaltedId(groupVault, memberDID);
+        delete groupVault.keys[memberKeyId];
+        return this.updateAsset(vaultId, { groupVault });
+    }
+    async listGroupVaultMembers(vaultId) {
+        const groupVault = await this.getGroupVault(vaultId);
+        const { members, isOwner } = await this.decryptGroupVault(groupVault);
+        if (isOwner) {
+            await this.checkVaultVersion(vaultId, groupVault);
+        }
+        return members;
+    }
+    async addGroupVaultItem(vaultId, name, buffer) {
+        await this.checkGroupVaultOwner(vaultId);
+        const groupVault = await this.getGroupVault(vaultId);
+        const { privateJwk, items } = await this.decryptGroupVault(groupVault);
+        const validName = this.validateName(name);
+        const encryptedData = this.cipher.encryptBytes(groupVault.publicJwk, privateJwk, buffer);
+        const cid = await this.gatekeeper.addText(encryptedData);
+        const sha256 = this.cipher.hashMessage(buffer);
+        const type = await this.getMimeType(buffer);
+        const data = encryptedData.length < this.maxDataLength ? encryptedData : undefined;
+        items[validName] = {
+            cid,
+            sha256,
+            bytes: buffer.length,
+            type,
+            added: new Date().toISOString(),
+            data,
+        };
+        groupVault.items = this.cipher.encryptMessage(groupVault.publicJwk, privateJwk, JSON.stringify(items));
+        groupVault.sha256 = this.cipher.hashJSON(items);
+        return this.updateAsset(vaultId, { groupVault });
+    }
+    async removeGroupVaultItem(vaultId, name) {
+        await this.checkGroupVaultOwner(vaultId);
+        const groupVault = await this.getGroupVault(vaultId);
+        const { privateJwk, items } = await this.decryptGroupVault(groupVault);
+        delete items[name];
+        groupVault.items = this.cipher.encryptMessage(groupVault.publicJwk, privateJwk, JSON.stringify(items));
+        groupVault.sha256 = this.cipher.hashJSON(items);
+        return this.updateAsset(vaultId, { groupVault });
+    }
+    async listGroupVaultItems(vaultId, options) {
+        const groupVault = await this.getGroupVault(vaultId, options);
+        const { items } = await this.decryptGroupVault(groupVault);
+        return items;
+    }
+    async getGroupVaultItem(vaultId, name, options) {
+        try {
+            const groupVault = await this.getGroupVault(vaultId, options);
+            const { privateJwk, items } = await this.decryptGroupVault(groupVault);
+            if (items[name]) {
+                const encryptedData = items[name].data || await this.gatekeeper.getText(items[name].cid);
+                if (encryptedData) {
+                    const bytes = this.cipher.decryptBytes(groupVault.publicJwk, privateJwk, encryptedData);
+                    return Buffer.from(bytes);
+                }
+            }
+            return null;
+        }
+        catch (error) {
+            return null;
+        }
+    }
+    async listDmail() {
+        const wallet = await this.loadWallet();
+        const id = await this.fetchIdInfo(undefined, wallet);
+        const list = id.dmail || {};
+        const dmailList = {};
+        const nameList = await this.listNames({ includeIDs: true });
+        const didToName = Object.entries(nameList).reduce((acc, [name, did]) => {
+            acc[did] = name;
+            return acc;
+        }, {});
+        for (const did of Object.keys(list)) {
+            const message = await this.getDmailMessage(did);
+            if (!message) {
+                continue; // Skip if no dmail found for this DID
+            }
+            const tags = list[did].tags ?? [];
+            const docs = await this.resolveDID(did);
+            const controller = docs.didDocument?.controller ?? '';
+            const sender = didToName[controller] ?? controller;
+            const date = docs.didDocumentMetadata?.updated ?? '';
+            const to = message.to.map(did => didToName[did] ?? did);
+            const cc = message.cc.map(did => didToName[did] ?? did);
+            const attachments = await this.listDmailAttachments(did);
+            dmailList[did] = {
+                message,
+                to,
+                cc,
+                tags,
+                sender,
+                date,
+                attachments,
+                docs,
+            };
+        }
+        return dmailList;
+    }
+    verifyTagList(tags) {
+        if (!Array.isArray(tags)) {
+            throw new InvalidParameterError('tags');
+        }
+        const tagSet = new Set();
+        for (const tag of tags) {
+            try {
+                tagSet.add(this.validateName(tag));
+            }
+            catch (error) {
+                throw new InvalidParameterError(`Invalid tag: '${tag}'`);
+            }
+        }
+        return tagSet.size > 0 ? Array.from(tagSet) : [];
+    }
+    async fileDmail(did, tags) {
+        const verifiedTags = this.verifyTagList(tags);
+        await this.mutateWallet(async (wallet) => {
+            const id = await this.fetchIdInfo(undefined, wallet);
+            if (!id.dmail) {
+                id.dmail = {};
+            }
+            id.dmail[did] = { tags: verifiedTags };
+        });
+        return true;
+    }
+    async removeDmail(did) {
+        await this.mutateWallet(async (wallet) => {
+            const id = await this.fetchIdInfo(undefined, wallet);
+            if (!id.dmail || !id.dmail[did]) {
+                return;
+            }
+            delete id.dmail[did];
+        });
+        return true;
+    }
+    async verifyRecipientList(list) {
+        if (!Array.isArray(list)) {
+            throw new InvalidParameterError('list');
+        }
+        const nameList = await this.listNames({ includeIDs: true });
+        let newList = [];
+        for (const id of list) {
+            if (typeof id !== 'string') {
+                throw new InvalidParameterError(`Invalid recipient type: ${typeof id}`);
+            }
+            if (id in nameList) {
+                const did = nameList[id];
+                const isAgent = await this.testAgent(did);
+                if (isAgent) {
+                    newList.push(did);
+                    continue;
+                }
+                throw new InvalidParameterError(`Invalid recipient: ${id}`);
+            }
+            if (isValidDID(id)) {
+                newList.push(id);
+                continue;
+            }
+            throw new InvalidParameterError(`Invalid recipient: ${id}`);
+        }
+        return newList;
+    }
+    async verifyDmail(message) {
+        const to = await this.verifyRecipientList(message.to);
+        const cc = await this.verifyRecipientList(message.cc);
+        if (to.length === 0) {
+            throw new InvalidParameterError('dmail.to');
+        }
+        if (!message.subject || typeof message.subject !== 'string' || message.subject.trim() === '') {
+            throw new InvalidParameterError('dmail.subject');
+        }
+        if (!message.body || typeof message.body !== 'string' || message.body.trim() === '') {
+            throw new InvalidParameterError('dmail.body');
+        }
+        return {
+            ...message,
+            to,
+            cc,
+        };
+    }
+    async createDmail(message, options = {}) {
+        const dmail = await this.verifyDmail(message);
+        const did = await this.createGroupVault(options);
+        for (const toDID of dmail.to) {
+            await this.addGroupVaultMember(did, toDID);
+        }
+        for (const ccDID of dmail.cc) {
+            await this.addGroupVaultMember(did, ccDID);
+        }
+        const buffer = Buffer.from(JSON.stringify({ dmail }), 'utf-8');
+        await this.addGroupVaultItem(did, DmailTags.DMAIL, buffer);
+        await this.fileDmail(did, [DmailTags.DRAFT]);
+        return did;
+    }
+    async updateDmail(did, message) {
+        const dmail = await this.verifyDmail(message);
+        for (const toDID of dmail.to) {
+            await this.addGroupVaultMember(did, toDID);
+        }
+        for (const ccDID of dmail.cc) {
+            await this.addGroupVaultMember(did, ccDID);
+        }
+        const buffer = Buffer.from(JSON.stringify({ dmail }), 'utf-8');
+        return this.addGroupVaultItem(did, DmailTags.DMAIL, buffer);
+    }
+    async sendDmail(did) {
+        const dmail = await this.getDmailMessage(did);
+        if (!dmail) {
+            return null;
+        }
+        const registry = this.ephemeralRegistry;
+        const validUntil = new Date(Date.now() + 7 * 24 * 60 * 60 * 1000).toISOString(); // Default to 7 days
+        const message = {
+            to: [...dmail.to, ...dmail.cc],
+            dids: [did],
+        };
+        const notice = await this.createNotice(message, { registry, validUntil });
+        if (notice) {
+            await this.fileDmail(did, [DmailTags.SENT]);
+        }
+        return notice;
+    }
+    async getDmailMessage(did, options) {
+        const isGroupVault = await this.testGroupVault(did, options);
+        if (!isGroupVault) {
+            return null;
+        }
+        const buffer = await this.getGroupVaultItem(did, DmailTags.DMAIL, options);
+        if (!buffer) {
+            return null;
+        }
+        try {
+            const data = JSON.parse(buffer.toString('utf-8'));
+            return data.dmail;
+        }
+        catch (error) {
+            return null;
+        }
+    }
+    async listDmailAttachments(did, options) {
+        let items = await this.listGroupVaultItems(did, options);
+        delete items[DmailTags.DMAIL]; // Remove the dmail item itself from attachments
+        return items;
+    }
+    async addDmailAttachment(did, name, buffer) {
+        if (name === DmailTags.DMAIL) {
+            throw new InvalidParameterError('Cannot add attachment with reserved name "dmail"');
+        }
+        return this.addGroupVaultItem(did, name, buffer);
+    }
+    async removeDmailAttachment(did, name) {
+        if (name === DmailTags.DMAIL) {
+            throw new InvalidParameterError('Cannot remove attachment with reserved name "dmail"');
+        }
+        return this.removeGroupVaultItem(did, name);
+    }
+    async getDmailAttachment(did, name) {
+        return this.getGroupVaultItem(did, name);
+    }
+    async importDmail(did) {
+        const dmail = await this.getDmailMessage(did);
+        if (!dmail) {
+            return false;
+        }
+        return this.fileDmail(did, [DmailTags.INBOX, DmailTags.UNREAD]);
+    }
+    async verifyDIDList(didList) {
+        if (!Array.isArray(didList)) {
+            throw new InvalidParameterError('didList');
+        }
+        for (const did of didList) {
+            if (!isValidDID(did)) {
+                throw new InvalidParameterError(`Invalid DID: ${did}`);
+            }
+        }
+        return didList;
+    }
+    async verifyNotice(notice) {
+        const to = await this.verifyRecipientList(notice.to);
+        const dids = await this.verifyDIDList(notice.dids);
+        if (to.length === 0) {
+            throw new InvalidParameterError('notice.to');
+        }
+        if (dids.length === 0) {
+            throw new InvalidParameterError('notice.dids');
+        }
+        return { to, dids };
+    }
+    async createNotice(message, options = {}) {
+        const notice = await this.verifyNotice(message);
+        return this.createAsset({ notice }, options);
+    }
+    async updateNotice(id, message) {
+        const notice = await this.verifyNotice(message);
+        return this.updateAsset(id, { notice });
+    }
+    async addToNotices(did, tags) {
+        const verifiedTags = this.verifyTagList(tags);
+        await this.mutateWallet(async (wallet) => {
+            const id = await this.fetchIdInfo(undefined, wallet);
+            if (!id.notices)
+                id.notices = {};
+            id.notices[did] = { tags: verifiedTags };
+        });
+        return true;
+    }
+    async importNotice(did) {
+        const wallet = await this.loadWallet();
+        const id = await this.fetchIdInfo(undefined, wallet);
+        if (id.notices && id.notices[did]) {
+            return true; // Already imported
+        }
+        const asset = await this.resolveAsset(did);
+        if (!asset || !asset.notice) {
+            return false; // Not a notice
+        }
+        if (!asset.notice.to.includes(id.did)) {
+            return false; // Not for this user
+        }
+        for (const noticeDID of asset.notice.dids) {
+            const dmail = await this.getDmailMessage(noticeDID);
+            if (dmail) {
+                const imported = await this.importDmail(noticeDID);
+                if (imported) {
+                    await this.addToNotices(did, [NoticeTags.DMAIL]);
+                }
+                continue;
+            }
+            const isBallot = await this.isBallot(noticeDID);
+            if (isBallot) {
+                let imported = false;
+                try {
+                    imported = await this.updatePoll(noticeDID);
+                }
+                catch { }
+                if (imported) {
+                    await this.addToNotices(did, [NoticeTags.BALLOT]);
+                }
+                continue;
+            }
+            const poll = await this.getPoll(noticeDID);
+            if (poll) {
+                const names = await this.listNames();
+                if (!Object.values(names).includes(noticeDID)) {
+                    await this.addUnnamedPoll(noticeDID);
+                }
+                await this.addToNotices(did, [NoticeTags.POLL]);
+                continue;
+            }
+            const isCredential = await this.acceptCredential(noticeDID);
+            if (isCredential) {
+                await this.addToNotices(did, [NoticeTags.CREDENTIAL]);
+                continue;
+            }
+            return false;
+        }
+        return true;
+    }
+    async searchNotices() {
+        if (!this.searchEngine) {
+            return false; // Search engine not available
+        }
+        const id = await this.fetchIdInfo();
+        if (!id.notices) {
+            id.notices = {};
+        }
+        // Search for all notice DIDs sent to the current ID
+        const where = {
+            "didDocumentData.notice.to[*]": {
+                "$in": [id.did]
+            }
+        };
+        let notices;
+        try {
+            // TBD search engine should not return expired notices
+            notices = await this.searchEngine.search({ where });
+        }
+        catch (error) {
+            throw new KeymasterError('Failed to search for notices');
+        }
+        for (const notice of notices) {
+            if (notice in id.notices) {
+                continue; // Already imported
+            }
+            try {
+                await this.importNotice(notice);
+            }
+            catch (error) {
+                continue; // Skip if notice is expired or invalid
+            }
+        }
+        return true;
+    }
+    async cleanupNotices() {
+        await this.mutateWallet(async (wallet) => {
+            const id = await this.fetchIdInfo(undefined, wallet);
+            if (!id.notices) {
+                return;
+            }
+            for (const nDid of Object.keys(id.notices)) {
+                try {
+                    const asset = await this.resolveAsset(nDid);
+                    if (!asset || !asset.notice) {
+                        delete id.notices[nDid]; // revoked or invalid
+                    }
+                }
+                catch {
+                    delete id.notices[nDid]; // expired/unresolvable
+                }
+            }
+        });
+        return true;
+    }
+    async refreshNotices() {
+        await this.searchNotices();
+        return this.cleanupNotices();
+    }
+    async exportEncryptedWallet() {
+        const wallet = await this.loadWallet();
+        return this.encryptWalletForStorage(wallet);
+    }
+    async isBallot(ballotDid) {
+        let payload;
+        try {
+            payload = await this.decryptJSON(ballotDid);
+        }
+        catch {
+            return false;
+        }
+        return payload && typeof payload.poll === "string" && typeof payload.vote === "number";
+    }
+    async addUnnamedPoll(did) {
+        const fallbackName = did.slice(-32);
+        try {
+            await this.addName(fallbackName, did);
+        }
+        catch { }
+    }
+    async getHDKeyFromCacheOrMnemonic(wallet) {
+        if (this._hdkeyCache) {
+            return this._hdkeyCache;
+        }
+        const mnemonic = await this.getMnemonicForDerivation(wallet);
+        this._hdkeyCache = this.cipher.generateHDKey(mnemonic);
+        return this._hdkeyCache;
+    }
+    async encryptWalletForStorage(decrypted) {
+        const { version, seed, ...rest } = decrypted;
+        const safeSeed = { mnemonicEnc: seed.mnemonicEnc };
+        const hdkey = await this.getHDKeyFromCacheOrMnemonic(decrypted);
+        const { publicJwk, privateJwk } = this.cipher.generateJwk(hdkey.privateKey);
+        const plaintext = JSON.stringify(rest);
+        const enc = this.cipher.encryptMessage(publicJwk, privateJwk, plaintext);
+        return { version: version, seed: safeSeed, enc };
+    }
+    async decryptWalletFromStorage(stored) {
+        let mnemonic;
+        try {
+            mnemonic = await decMnemonic(stored.seed.mnemonicEnc, this.passphrase);
+        }
+        catch {
+            throw new KeymasterError('Incorrect passphrase.');
+        }
+        this._hdkeyCache = this.cipher.generateHDKey(mnemonic);
+        const { publicJwk, privateJwk } = this.cipher.generateJwk(this._hdkeyCache.privateKey);
+        const plaintext = this.cipher.decryptMessage(publicJwk, privateJwk, stored.enc);
+        const data = JSON.parse(plaintext);
+        const wallet = { version: stored.version, seed: stored.seed, ...data };
+        return wallet;
+    }
+    async decryptWallet(wallet) {
+        if (isWalletEncFile(wallet)) {
+            wallet = await this.decryptWalletFromStorage(wallet);
+        }
+        if (!isWalletFile(wallet)) {
+            throw new KeymasterError("Unsupported wallet version.");
+        }
+        return wallet;
+    }
+    async upgradeWallet(wallet) {
+        if (wallet.version !== 1) {
+            throw new KeymasterError("Unsupported wallet version.");
+        }
+        return wallet;
+    }
+}
+//# sourceMappingURL=keymaster.js.map