@didcid/keymaster 0.2.0 → 0.3.0

package/dist/cjs/keymaster.cjs

@@ -8,41 +8,6 @@ var db_typeGuards = require('./db/typeGuards.cjs');
 require('crypto');
 var encryption = require('./encryption.cjs');
 
-class ArchonError extends Error {
-    type;
-    detail;
-    constructor(type, detail) {
-        const message = detail ? `${type}: ${detail}` : type;
-        super(message);
-        this.type = type;
-        this.detail = detail;
-    }
-}
-class InvalidDIDError extends ArchonError {
-    static type = 'Invalid DID';
-    constructor(detail) {
-        super(InvalidDIDError.type, detail);
-    }
-}
-class InvalidParameterError extends ArchonError {
-    static type = 'Invalid parameter';
-    constructor(detail) {
-        super(InvalidParameterError.type, detail);
-    }
-}
-class KeymasterError extends ArchonError {
-    static type = 'Keymaster';
-    constructor(detail) {
-        super(KeymasterError.type, detail);
-    }
-}
-class UnknownIDError extends ArchonError {
-    static type = 'Unknown ID';
-    constructor(detail) {
-        super(UnknownIDError.type, detail);
-    }
-}
-
 function equals$1(aa, bb) {
     if (aa === bb) {
         return true;
@@ -443,6 +408,66 @@ function rfc4648({ name, prefix, bitsPerChar, alphabet }) {
     });
 }
 
+rfc4648({
+    prefix: 'm',
+    name: 'base64',
+    alphabet: 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/',
+    bitsPerChar: 6
+});
+rfc4648({
+    prefix: 'M',
+    name: 'base64pad',
+    alphabet: 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=',
+    bitsPerChar: 6
+});
+const base64url = rfc4648({
+    prefix: 'u',
+    name: 'base64url',
+    alphabet: 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_',
+    bitsPerChar: 6
+});
+rfc4648({
+    prefix: 'U',
+    name: 'base64urlpad',
+    alphabet: 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_=',
+    bitsPerChar: 6
+});
+
+class ArchonError extends Error {
+    type;
+    detail;
+    constructor(type, detail) {
+        const message = detail ? `${type}: ${detail}` : type;
+        super(message);
+        this.type = type;
+        this.detail = detail;
+    }
+}
+class InvalidDIDError extends ArchonError {
+    static type = 'Invalid DID';
+    constructor(detail) {
+        super(InvalidDIDError.type, detail);
+    }
+}
+class InvalidParameterError extends ArchonError {
+    static type = 'Invalid parameter';
+    constructor(detail) {
+        super(InvalidParameterError.type, detail);
+    }
+}
+class KeymasterError extends ArchonError {
+    static type = 'Keymaster';
+    constructor(detail) {
+        super(KeymasterError.type, detail);
+    }
+}
+class UnknownIDError extends ArchonError {
+    static type = 'Unknown ID';
+    constructor(detail) {
+        super(UnknownIDError.type, detail);
+    }
+}
+
 const base32 = rfc4648({
     prefix: 'b',
     name: 'base32',
@@ -1057,6 +1082,14 @@ function isValidDID(did) {
     return isValidCID(suffix);
 }
 
+function hexToBase64url(hex) {
+    const bytes = Buffer.from(hex, 'hex');
+    return base64url.baseEncode(bytes);
+}
+function base64urlToHex(b64) {
+    const bytes = base64url.baseDecode(b64);
+    return Buffer.from(bytes).toString('hex');
+}
 const DefaultSchema = {
     "$schema": "http://json-schema.org/draft-07/schema#",
     "type": "object",
@@ -1354,13 +1387,15 @@ class Keymaster {
             publicJwk: keypair.publicJwk,
         };
         const msgHash = this.cipher.hashJSON(operation);
-        const signature = this.cipher.signHash(msgHash, keypair.privateJwk);
+        const signatureHex = this.cipher.signHash(msgHash, keypair.privateJwk);
         const signed = {
             ...operation,
-            signature: {
-                signed: new Date(0).toISOString(),
-                hash: msgHash,
-                value: signature
+            proof: {
+                type: "EcdsaSecp256k1Signature2019",
+                created: new Date(0).toISOString(),
+                verificationMethod: "#key-1",
+                proofPurpose: "authentication",
+                proofValue: hexToBase64url(signatureHex),
             }
         };
         const did = await this.gatekeeper.createDID(signed);
@@ -1381,14 +1416,15 @@ class Keymaster {
             doc,
         };
         const msgHash = this.cipher.hashJSON(operation);
-        const signature = this.cipher.signHash(msgHash, keypair.privateJwk);
+        const signatureHex = this.cipher.signHash(msgHash, keypair.privateJwk);
         const signed = {
             ...operation,
-            signature: {
-                signer: did,
-                signed: new Date().toISOString(),
-                hash: msgHash,
-                value: signature,
+            proof: {
+                type: "EcdsaSecp256k1Signature2019",
+                created: new Date().toISOString(),
+                verificationMethod: `${did}#key-1`,
+                proofPurpose: "authentication",
+                proofValue: hexToBase64url(signatureHex),
             }
         };
         return await this.gatekeeper.updateDID(signed);
@@ -1413,14 +1449,15 @@ class Keymaster {
             data: { backup: backup },
         };
         const msgHash = this.cipher.hashJSON(operation);
-        const signature = this.cipher.signHash(msgHash, keypair.privateJwk);
+        const signatureHex = this.cipher.signHash(msgHash, keypair.privateJwk);
         const signed = {
             ...operation,
-            signature: {
-                signer: seedBank.didDocument?.id,
-                signed: new Date().toISOString(),
-                hash: msgHash,
-                value: signature,
+            proof: {
+                type: "EcdsaSecp256k1Signature2019",
+                created: new Date().toISOString(),
+                verificationMethod: `${seedBank.didDocument?.id}#key-1`,
+                proofPurpose: "authentication",
+                proofValue: hexToBase64url(signatureHex),
             }
         };
         const backupDID = await this.gatekeeper.createDID(signed);
@@ -1601,7 +1638,7 @@ class Keymaster {
             controller: id.did,
             data,
         };
-        const signed = await this.addSignature(operation, controller);
+        const signed = await this.addProof(operation, controller, "authentication");
         const did = await this.gatekeeper.createDID(signed);
         // Keep assets that will be garbage-collected out of the owned list
         if (!validUntil) {
@@ -1790,7 +1827,7 @@ class Keymaster {
             throw new InvalidParameterError('did not encrypted JSON');
         }
     }
-    async addSignature(obj, controller) {
+    async addProof(obj, controller, proofPurpose = "assertionMethod") {
         if (obj == null) {
             throw new InvalidParameterError('obj');
         }
@@ -1798,18 +1835,23 @@ class Keymaster {
         const id = await this.fetchIdInfo(controller);
         const keypair = await this.fetchKeyPair(controller);
         if (!keypair) {
-            throw new KeymasterError('addSignature: no keypair');
+            throw new KeymasterError('addProof: no keypair');
         }
+        // Get the key fragment from the DID document
+        const doc = await this.resolveDID(id.did, { confirm: true });
+        const keyFragment = doc.didDocument?.verificationMethod?.[0]?.id || '#key-1';
         try {
             const msgHash = this.cipher.hashJSON(obj);
-            const signature = this.cipher.signHash(msgHash, keypair.privateJwk);
+            const signatureHex = this.cipher.signHash(msgHash, keypair.privateJwk);
+            const proofValue = hexToBase64url(signatureHex);
             return {
                 ...obj,
-                signature: {
-                    signer: id.did,
-                    signed: new Date().toISOString(),
-                    hash: msgHash,
-                    value: signature,
+                proof: {
+                    type: "EcdsaSecp256k1Signature2019",
+                    created: new Date().toISOString(),
+                    verificationMethod: `${id.did}${keyFragment}`,
+                    proofPurpose,
+                    proofValue,
                 }
             };
         }
@@ -1817,24 +1859,27 @@ class Keymaster {
             throw new InvalidParameterError('obj');
         }
     }
-    async verifySignature(obj) {
-        if (!obj?.signature) {
+    async verifyProof(obj) {
+        if (!obj?.proof) {
             return false;
         }
-        const { signature } = obj;
-        if (!signature.signer) {
+        const { proof } = obj;
+        if (proof.type !== "EcdsaSecp256k1Signature2019") {
             return false;
         }
-        const jsonCopy = JSON.parse(JSON.stringify(obj));
-        delete jsonCopy.signature;
-        const msgHash = this.cipher.hashJSON(jsonCopy);
-        if (signature.hash && signature.hash !== msgHash) {
+        if (!proof.verificationMethod) {
             return false;
         }
-        const doc = await this.resolveDID(signature.signer, { versionTime: signature.signed });
+        // Extract DID from verificationMethod
+        const [signerDid] = proof.verificationMethod.split('#');
+        const jsonCopy = JSON.parse(JSON.stringify(obj));
+        delete jsonCopy.proof;
+        const msgHash = this.cipher.hashJSON(jsonCopy);
+        const doc = await this.resolveDID(signerDid, { versionTime: proof.created });
         const publicJwk = this.getPublicKeyJwk(doc);
         try {
-            return this.cipher.verifySig(msgHash, signature.value, publicJwk);
+            const signatureHex = base64urlToHex(proof.proofValue);
+            return this.cipher.verifySig(msgHash, signatureHex, publicJwk);
         }
         catch (error) {
             return false;
@@ -1863,7 +1908,7 @@ class Keymaster {
         else if (current.didDocumentRegistration?.type === 'asset') {
             controller = current.didDocument?.controller;
         }
-        const signed = await this.addSignature(operation, controller);
+        const signed = await this.addProof(operation, controller, "authentication");
         return this.gatekeeper.updateDID(signed);
     }
     async revokeDID(id) {
@@ -1885,7 +1930,7 @@ class Keymaster {
         else if (current.didDocumentRegistration?.type === 'asset') {
             controller = current.didDocument?.controller;
         }
-        const signed = await this.addSignature(operation, controller);
+        const signed = await this.addProof(operation, controller, "authentication");
         const ok = await this.gatekeeper.deleteDID(signed);
         if (ok && current.didDocument?.controller) {
             await this.removeFromOwned(did, current.didDocument.controller);
@@ -1965,9 +2010,13 @@ class Keymaster {
         }
         const controller = docs.didDocument?.controller || docs.didDocument?.id;
         const isOwned = await this.idInWallet(controller);
-        // Augment the DID document metadata with the DID ownership status
+        // Convert versionSequence string to numeric version
+        const versionSequence = docs.didDocumentMetadata?.versionSequence;
+        const version = versionSequence ? parseInt(versionSequence, 10) : undefined;
+        // Augment the DID document metadata with the DID ownership status and numeric version
         docs.didDocumentMetadata = {
             ...docs.didDocumentMetadata,
+            version,
             isOwned,
         };
         return docs;
@@ -2086,13 +2135,15 @@ class Keymaster {
             publicJwk: keypair.publicJwk,
         };
         const msgHash = this.cipher.hashJSON(operation);
-        const signature = this.cipher.signHash(msgHash, keypair.privateJwk);
+        const signatureHex = this.cipher.signHash(msgHash, keypair.privateJwk);
         const signed = {
             ...operation,
-            signature: {
-                signed: new Date().toISOString(),
-                hash: msgHash,
-                value: signature
+            proof: {
+                type: "EcdsaSecp256k1Signature2019",
+                created: new Date().toISOString(),
+                verificationMethod: "#key-1",
+                proofPurpose: "authentication",
+                proofValue: hexToBase64url(signatureHex),
             },
         };
         return signed;
@@ -2146,10 +2197,10 @@ class Keymaster {
         if (!registry) {
             throw new InvalidParameterError('no registry found for agent DID');
         }
-        const vaultDid = await this.createAsset({ backup: backup }, { registry, controller: name });
+        const backupStoreDid = await this.createAsset({ backup: backup }, { registry, controller: name });
         if (doc.didDocumentData) {
             const currentData = doc.didDocumentData;
-            const updatedData = { ...currentData, vault: vaultDid };
+            const updatedData = { ...currentData, backupStore: backupStoreDid };
             return this.updateDID(name, { didDocumentData: updatedData });
         }
         return false;
@@ -2159,14 +2210,14 @@ class Keymaster {
             const keypair = await this.hdKeyPair();
             const doc = await this.resolveDID(did);
             const docData = doc.didDocumentData;
-            if (!docData.vault) {
-                throw new InvalidDIDError('didDocumentData missing vault');
+            if (!docData.backupStore) {
+                throw new InvalidDIDError('didDocumentData missing backupStore');
             }
-            const vault = await this.resolveAsset(docData.vault);
-            if (typeof vault.backup !== 'string') {
-                throw new InvalidDIDError('backup not found in vault');
+            const backupStore = await this.resolveAsset(docData.backupStore);
+            if (typeof backupStore.backup !== 'string') {
+                throw new InvalidDIDError('backup not found in backupStore');
             }
-            const backup = this.cipher.decryptMessage(keypair.publicJwk, keypair.privateJwk, vault.backup);
+            const backup = this.cipher.decryptMessage(keypair.publicJwk, keypair.privateJwk, backupStore.backup);
             const data = JSON.parse(backup);
             await this.mutateWallet((wallet) => {
                 if (wallet.ids[data.name]) {
@@ -2210,6 +2261,7 @@ class Keymaster {
                 ...doc.didDocument,
                 verificationMethod: [vmethod],
                 authentication: [vmethod.id],
+                assertionMethod: [vmethod.id],
             };
             ok = await this.updateDID(id.did, { didDocument: updatedDidDocument });
             if (!ok) {
@@ -2222,7 +2274,7 @@ class Keymaster {
     async listNames(options = {}) {
         const { includeIDs = false } = options;
         const wallet = await this.loadWallet();
-        const names = wallet.names || {};
+        const names = { ...(wallet.names || {}) };
         if (includeIDs) {
             for (const [name, id] of Object.entries(wallet.ids || {})) {
                 names[name] = id.did;
@@ -2260,42 +2312,60 @@ class Keymaster {
         const doc = await this.resolveDID(id);
         return doc.didDocumentRegistration?.type === 'agent';
     }
-    async bindCredential(schemaId, subjectId, options = {}) {
-        let { validFrom, validUntil, credential } = options;
+    async bindCredential(subjectId, options = {}) {
+        let { schema, validFrom, validUntil, claims, types } = options;
         if (!validFrom) {
             validFrom = new Date().toISOString();
         }
         const id = await this.fetchIdInfo();
-        const type = await this.lookupDID(schemaId);
         const subjectDID = await this.lookupDID(subjectId);
-        if (!credential) {
-            const schema = await this.getSchema(type);
-            credential = this.generateSchema(schema);
-        }
-        return {
+        const vc = {
             "@context": [
                 "https://www.w3.org/ns/credentials/v2",
                 "https://www.w3.org/ns/credentials/examples/v2"
             ],
-            type: ["VerifiableCredential", type],
+            type: ["VerifiableCredential", ...(types || [])],
             issuer: id.did,
             validFrom,
             validUntil,
             credentialSubject: {
                 id: subjectDID,
             },
-            credential,
         };
+        // If schema provided, add credentialSchema and generate claims from schema
+        if (schema) {
+            const schemaDID = await this.lookupDID(schema);
+            const schemaDoc = await this.getSchema(schemaDID);
+            if (!claims && schemaDoc) {
+                claims = this.generateSchema(schemaDoc);
+            }
+            // If schema has $credentialTypes, add them to credential types (avoiding duplicates)
+            if (schemaDoc?.$credentialTypes) {
+                const newTypes = schemaDoc.$credentialTypes.filter(t => !vc.type.includes(t));
+                vc.type.push(...newTypes);
+            }
+            vc.credentialSchema = {
+                id: schemaDID,
+                type: "JsonSchema",
+            };
+        }
+        if (claims) {
+            vc.credentialSubject = {
+                id: subjectDID,
+                ...claims,
+            };
+        }
+        return vc;
     }
     async issueCredential(credential, options = {}) {
         const id = await this.fetchIdInfo();
         if (options.schema && options.subject) {
-            credential = await this.bindCredential(options.schema, options.subject, { credential, ...options });
+            credential = await this.bindCredential(options.subject, { schema: options.schema, claims: options.claims, ...options });
         }
         if (credential.issuer !== id.did) {
             throw new InvalidParameterError('credential.issuer');
         }
-        const signed = await this.addSignature(credential);
+        const signed = await this.addProof(credential);
         return this.encryptJSON(signed, credential.credentialSubject.id, { ...options, includeHash: true });
     }
     async sendCredential(did, options = {}) {
@@ -2325,13 +2395,12 @@ class Keymaster {
             throw new InvalidParameterError("did is not a credential");
         }
         if (!credential ||
-            !credential.credential ||
             !credential.credentialSubject ||
             !credential.credentialSubject.id) {
             throw new InvalidParameterError('credential');
         }
-        delete credential.signature;
-        const signed = await this.addSignature(credential);
+        delete credential.proof;
+        const signed = await this.addProof(credential);
         const msg = JSON.stringify(signed);
         const id = await this.fetchIdInfo();
         const senderKeypair = await this.fetchKeyPair();
@@ -2425,8 +2494,8 @@ class Keymaster {
             data.manifest = {};
         }
         if (!reveal) {
-            // Remove the credential values
-            vc.credential = null;
+            // Remove the claim values, keep only the subject id
+            vc.credentialSubject = { id: vc.credentialSubject.id };
         }
         data.manifest[credential] = vc;
         const ok = await this.updateDID(id.did, { didDocumentData: doc.didDocumentData });
@@ -2484,8 +2553,8 @@ class Keymaster {
                     // Attestor not trusted by Verifier
                     continue;
                 }
-                if (doc.type && !doc.type.includes(credential.schema)) {
-                    // Wrong type
+                if (doc.credentialSchema?.id !== credential.schema) {
+                    // Wrong schema
                     continue;
                 }
                 // TBD test for VC expiry too
@@ -2610,7 +2679,7 @@ class Keymaster {
                 continue;
             }
             const vp = await this.decryptJSON(credential.vp);
-            const isValid = await this.verifySignature(vp);
+            const isValid = await this.verifyProof(vp);
             if (!isValid) {
                 continue;
             }
@@ -2618,8 +2687,8 @@ class Keymaster {
                 continue;
             }
             // Check VP against VCs specified in challenge
-            if (vp.type.length >= 2 && vp.type[1].startsWith('did:')) {
-                const schema = vp.type[1];
+            if (vp.credentialSchema?.id) {
+                const schema = vp.credentialSchema.id;
                 const credential = challenge.credentials?.find(item => item.schema === schema);
                 if (!credential) {
                     continue;
@@ -3117,7 +3186,7 @@ class Keymaster {
         delete poll.results;
         return this.updateAsset(pollId, { poll });
     }
-    async createGroupVault(options = {}) {
+    async createVault(options = {}) {
         const id = await this.fetchIdInfo();
         const idKeypair = await this.fetchKeyPair();
         // version defaults to 1. To make version undefined (unit testing), set options.version to 0
@@ -3132,7 +3201,7 @@ class Keymaster {
         const members = this.cipher.encryptMessage(publicJwk, vaultKeypair.privateJwk, JSON.stringify({}));
         const items = this.cipher.encryptMessage(vaultKeypair.publicJwk, vaultKeypair.privateJwk, JSON.stringify({}));
         const sha256 = this.cipher.hashJSON({});
-        const groupVault = {
+        const vault = {
             version,
             publicJwk: vaultKeypair.publicJwk,
             salt,
@@ -3142,46 +3211,46 @@ class Keymaster {
             items,
             sha256,
         };
-        await this.addMemberKey(groupVault, id.did, vaultKeypair.privateJwk);
-        return this.createAsset({ groupVault }, options);
+        await this.addMemberKey(vault, id.did, vaultKeypair.privateJwk);
+        return this.createAsset({ vault }, options);
     }
-    async getGroupVault(groupVaultId, options) {
-        const asset = await this.resolveAsset(groupVaultId, options);
-        if (!asset.groupVault) {
-            throw new InvalidParameterError('groupVaultId');
+    async getVault(vaultId, options) {
+        const asset = await this.resolveAsset(vaultId, options);
+        if (!asset.vault) {
+            throw new InvalidParameterError('vaultId');
         }
-        return asset.groupVault;
+        return asset.vault;
     }
-    async testGroupVault(id, options) {
+    async testVault(id, options) {
         try {
-            const groupVault = await this.getGroupVault(id, options);
-            return groupVault !== null;
+            const vault = await this.getVault(id, options);
+            return vault !== null;
         }
         catch (error) {
             return false;
         }
     }
-    generateSaltedId(groupVault, memberDID) {
-        if (!groupVault.version) {
-            return this.cipher.hashMessage(groupVault.salt + memberDID);
+    generateSaltedId(vault, memberDID) {
+        if (!vault.version) {
+            return this.cipher.hashMessage(vault.salt + memberDID);
         }
         const suffix = memberDID.split(':').pop();
-        return this.cipher.hashMessage(groupVault.salt + suffix);
+        return this.cipher.hashMessage(vault.salt + suffix);
     }
-    async decryptGroupVault(groupVault) {
+    async decryptVault(vault) {
         const wallet = await this.loadWallet();
         const id = await this.fetchIdInfo();
-        const myMemberId = this.generateSaltedId(groupVault, id.did);
-        const myVaultKey = groupVault.keys[myMemberId];
+        const myMemberId = this.generateSaltedId(vault, id.did);
+        const myVaultKey = vault.keys[myMemberId];
         if (!myVaultKey) {
-            throw new KeymasterError('No access to group vault');
+            throw new KeymasterError('No access to vault');
         }
-        const privKeyJSON = await this.decryptWithDerivedKeys(wallet, id, groupVault.publicJwk, myVaultKey);
+        const privKeyJSON = await this.decryptWithDerivedKeys(wallet, id, vault.publicJwk, myVaultKey);
         const privateJwk = JSON.parse(privKeyJSON);
         let config = {};
         let isOwner = false;
         try {
-            const configJSON = await this.decryptWithDerivedKeys(wallet, id, groupVault.publicJwk, groupVault.config);
+            const configJSON = await this.decryptWithDerivedKeys(wallet, id, vault.publicJwk, vault.config);
             config = JSON.parse(configJSON);
             isOwner = true;
         }
@@ -3191,7 +3260,7 @@ class Keymaster {
         let members = {};
         if (config.secretMembers) {
             try {
-                const membersJSON = await this.decryptWithDerivedKeys(wallet, id, groupVault.publicJwk, groupVault.members);
+                const membersJSON = await this.decryptWithDerivedKeys(wallet, id, vault.publicJwk, vault.members);
                 members = JSON.parse(membersJSON);
             }
             catch (error) {
@@ -3199,13 +3268,13 @@ class Keymaster {
         }
         else {
             try {
-                const membersJSON = this.cipher.decryptMessage(groupVault.publicJwk, privateJwk, groupVault.members);
+                const membersJSON = this.cipher.decryptMessage(vault.publicJwk, privateJwk, vault.members);
                 members = JSON.parse(membersJSON);
             }
             catch (error) {
             }
         }
-        const itemsJSON = this.cipher.decryptMessage(groupVault.publicJwk, privateJwk, groupVault.items);
+        const itemsJSON = this.cipher.decryptMessage(vault.publicJwk, privateJwk, vault.items);
         const items = JSON.parse(itemsJSON);
         return {
             isOwner,
@@ -3215,7 +3284,7 @@ class Keymaster {
             items,
         };
     }
-    async checkGroupVaultOwner(vaultId) {
+    async checkVaultOwner(vaultId) {
         const id = await this.fetchIdInfo();
         const vaultDoc = await this.resolveDID(vaultId);
         const controller = vaultDoc.didDocument?.controller;
@@ -3224,30 +3293,30 @@ class Keymaster {
         }
         return controller;
     }
-    async addMemberKey(groupVault, memberDID, privateJwk) {
+    async addMemberKey(vault, memberDID, privateJwk) {
         const memberDoc = await this.resolveDID(memberDID, { confirm: true });
         const memberPublicJwk = this.getPublicKeyJwk(memberDoc);
         const memberKey = this.cipher.encryptMessage(memberPublicJwk, privateJwk, JSON.stringify(privateJwk));
-        const memberKeyId = this.generateSaltedId(groupVault, memberDID);
-        groupVault.keys[memberKeyId] = memberKey;
+        const memberKeyId = this.generateSaltedId(vault, memberDID);
+        vault.keys[memberKeyId] = memberKey;
     }
-    async checkVaultVersion(vaultId, groupVault) {
-        if (groupVault.version === 1) {
+    async checkVaultVersion(vaultId, vault) {
+        if (vault.version === 1) {
             return;
         }
-        if (!groupVault.version) {
+        if (!vault.version) {
             const id = await this.fetchIdInfo();
-            const { privateJwk, members } = await this.decryptGroupVault(groupVault);
-            groupVault.version = 1;
-            groupVault.keys = {};
-            await this.addMemberKey(groupVault, id.did, privateJwk);
+            const { privateJwk, members } = await this.decryptVault(vault);
+            vault.version = 1;
+            vault.keys = {};
+            await this.addMemberKey(vault, id.did, privateJwk);
             for (const memberDID of Object.keys(members)) {
-                await this.addMemberKey(groupVault, memberDID, privateJwk);
+                await this.addMemberKey(vault, memberDID, privateJwk);
             }
-            await this.updateAsset(vaultId, { groupVault });
+            await this.updateAsset(vaultId, { vault });
             return;
         }
-        throw new KeymasterError('Unsupported group vault version');
+        throw new KeymasterError('Unsupported vault version');
     }
     getAgentDID(doc) {
         if (doc.didDocumentRegistration?.type !== 'agent') {
@@ -3259,11 +3328,11 @@ class Keymaster {
         }
         return did;
     }
-    async addGroupVaultMember(vaultId, memberId) {
-        const owner = await this.checkGroupVaultOwner(vaultId);
+    async addVaultMember(vaultId, memberId) {
+        const owner = await this.checkVaultOwner(vaultId);
         const idKeypair = await this.fetchKeyPair();
-        const groupVault = await this.getGroupVault(vaultId);
-        const { privateJwk, config, members } = await this.decryptGroupVault(groupVault);
+        const vault = await this.getVault(vaultId);
+        const { privateJwk, config, members } = await this.decryptVault(vault);
         const memberDoc = await this.resolveDID(memberId, { confirm: true });
         const memberDID = this.getAgentDID(memberDoc);
         // Don't allow adding the vault owner
@@ -3271,16 +3340,16 @@ class Keymaster {
             return false;
         }
         members[memberDID] = { added: new Date().toISOString() };
-        const publicJwk = config.secretMembers ? idKeypair.publicJwk : groupVault.publicJwk;
-        groupVault.members = this.cipher.encryptMessage(publicJwk, privateJwk, JSON.stringify(members));
-        await this.addMemberKey(groupVault, memberDID, privateJwk);
-        return this.updateAsset(vaultId, { groupVault });
+        const publicJwk = config.secretMembers ? idKeypair.publicJwk : vault.publicJwk;
+        vault.members = this.cipher.encryptMessage(publicJwk, privateJwk, JSON.stringify(members));
+        await this.addMemberKey(vault, memberDID, privateJwk);
+        return this.updateAsset(vaultId, { vault });
     }
-    async removeGroupVaultMember(vaultId, memberId) {
-        const owner = await this.checkGroupVaultOwner(vaultId);
+    async removeVaultMember(vaultId, memberId) {
+        const owner = await this.checkVaultOwner(vaultId);
         const idKeypair = await this.fetchKeyPair();
-        const groupVault = await this.getGroupVault(vaultId);
-        const { privateJwk, config, members } = await this.decryptGroupVault(groupVault);
+        const vault = await this.getVault(vaultId);
+        const { privateJwk, config, members } = await this.decryptVault(vault);
         const memberDoc = await this.resolveDID(memberId, { confirm: true });
         const memberDID = this.getAgentDID(memberDoc);
         // Don't allow removing the vault owner
@@ -3288,26 +3357,26 @@ class Keymaster {
             return false;
         }
         delete members[memberDID];
-        const publicJwk = config.secretMembers ? idKeypair.publicJwk : groupVault.publicJwk;
-        groupVault.members = this.cipher.encryptMessage(publicJwk, privateJwk, JSON.stringify(members));
-        const memberKeyId = this.generateSaltedId(groupVault, memberDID);
-        delete groupVault.keys[memberKeyId];
-        return this.updateAsset(vaultId, { groupVault });
-    }
-    async listGroupVaultMembers(vaultId) {
-        const groupVault = await this.getGroupVault(vaultId);
-        const { members, isOwner } = await this.decryptGroupVault(groupVault);
+        const publicJwk = config.secretMembers ? idKeypair.publicJwk : vault.publicJwk;
+        vault.members = this.cipher.encryptMessage(publicJwk, privateJwk, JSON.stringify(members));
+        const memberKeyId = this.generateSaltedId(vault, memberDID);
+        delete vault.keys[memberKeyId];
+        return this.updateAsset(vaultId, { vault });
+    }
+    async listVaultMembers(vaultId) {
+        const vault = await this.getVault(vaultId);
+        const { members, isOwner } = await this.decryptVault(vault);
         if (isOwner) {
-            await this.checkVaultVersion(vaultId, groupVault);
+            await this.checkVaultVersion(vaultId, vault);
         }
         return members;
     }
-    async addGroupVaultItem(vaultId, name, buffer) {
-        await this.checkGroupVaultOwner(vaultId);
-        const groupVault = await this.getGroupVault(vaultId);
-        const { privateJwk, items } = await this.decryptGroupVault(groupVault);
+    async addVaultItem(vaultId, name, buffer) {
+        await this.checkVaultOwner(vaultId);
+        const vault = await this.getVault(vaultId);
+        const { privateJwk, items } = await this.decryptVault(vault);
         const validName = this.validateName(name);
-        const encryptedData = this.cipher.encryptBytes(groupVault.publicJwk, privateJwk, buffer);
+        const encryptedData = this.cipher.encryptBytes(vault.publicJwk, privateJwk, buffer);
         const cid = await this.gatekeeper.addText(encryptedData);
         const sha256 = this.cipher.hashMessage(buffer);
         const type = await this.getMimeType(buffer);
@@ -3320,32 +3389,32 @@ class Keymaster {
             added: new Date().toISOString(),
             data,
         };
-        groupVault.items = this.cipher.encryptMessage(groupVault.publicJwk, privateJwk, JSON.stringify(items));
-        groupVault.sha256 = this.cipher.hashJSON(items);
-        return this.updateAsset(vaultId, { groupVault });
-    }
-    async removeGroupVaultItem(vaultId, name) {
-        await this.checkGroupVaultOwner(vaultId);
-        const groupVault = await this.getGroupVault(vaultId);
-        const { privateJwk, items } = await this.decryptGroupVault(groupVault);
+        vault.items = this.cipher.encryptMessage(vault.publicJwk, privateJwk, JSON.stringify(items));
+        vault.sha256 = this.cipher.hashJSON(items);
+        return this.updateAsset(vaultId, { vault });
+    }
+    async removeVaultItem(vaultId, name) {
+        await this.checkVaultOwner(vaultId);
+        const vault = await this.getVault(vaultId);
+        const { privateJwk, items } = await this.decryptVault(vault);
         delete items[name];
-        groupVault.items = this.cipher.encryptMessage(groupVault.publicJwk, privateJwk, JSON.stringify(items));
-        groupVault.sha256 = this.cipher.hashJSON(items);
-        return this.updateAsset(vaultId, { groupVault });
+        vault.items = this.cipher.encryptMessage(vault.publicJwk, privateJwk, JSON.stringify(items));
+        vault.sha256 = this.cipher.hashJSON(items);
+        return this.updateAsset(vaultId, { vault });
     }
-    async listGroupVaultItems(vaultId, options) {
-        const groupVault = await this.getGroupVault(vaultId, options);
-        const { items } = await this.decryptGroupVault(groupVault);
+    async listVaultItems(vaultId, options) {
+        const vault = await this.getVault(vaultId, options);
+        const { items } = await this.decryptVault(vault);
         return items;
     }
-    async getGroupVaultItem(vaultId, name, options) {
+    async getVaultItem(vaultId, name, options) {
         try {
-            const groupVault = await this.getGroupVault(vaultId, options);
-            const { privateJwk, items } = await this.decryptGroupVault(groupVault);
+            const vault = await this.getVault(vaultId, options);
+            const { privateJwk, items } = await this.decryptVault(vault);
             if (items[name]) {
                 const encryptedData = items[name].data || await this.gatekeeper.getText(items[name].cid);
                 if (encryptedData) {
-                    const bytes = this.cipher.decryptBytes(groupVault.publicJwk, privateJwk, encryptedData);
+                    const bytes = this.cipher.decryptBytes(vault.publicJwk, privateJwk, encryptedData);
                     return Buffer.from(bytes);
                 }
             }
@@ -3474,28 +3543,28 @@ class Keymaster {
     }
     async createDmail(message, options = {}) {
         const dmail = await this.verifyDmail(message);
-        const did = await this.createGroupVault(options);
+        const did = await this.createVault(options);
         for (const toDID of dmail.to) {
-            await this.addGroupVaultMember(did, toDID);
+            await this.addVaultMember(did, toDID);
         }
         for (const ccDID of dmail.cc) {
-            await this.addGroupVaultMember(did, ccDID);
+            await this.addVaultMember(did, ccDID);
         }
         const buffer = Buffer.from(JSON.stringify({ dmail }), 'utf-8');
-        await this.addGroupVaultItem(did, exports.DmailTags.DMAIL, buffer);
+        await this.addVaultItem(did, exports.DmailTags.DMAIL, buffer);
         await this.fileDmail(did, [exports.DmailTags.DRAFT]);
         return did;
     }
     async updateDmail(did, message) {
         const dmail = await this.verifyDmail(message);
         for (const toDID of dmail.to) {
-            await this.addGroupVaultMember(did, toDID);
+            await this.addVaultMember(did, toDID);
         }
         for (const ccDID of dmail.cc) {
-            await this.addGroupVaultMember(did, ccDID);
+            await this.addVaultMember(did, ccDID);
         }
         const buffer = Buffer.from(JSON.stringify({ dmail }), 'utf-8');
-        return this.addGroupVaultItem(did, exports.DmailTags.DMAIL, buffer);
+        return this.addVaultItem(did, exports.DmailTags.DMAIL, buffer);
     }
     async sendDmail(did) {
         const dmail = await this.getDmailMessage(did);
@@ -3515,11 +3584,11 @@ class Keymaster {
         return notice;
     }
     async getDmailMessage(did, options) {
-        const isGroupVault = await this.testGroupVault(did, options);
-        if (!isGroupVault) {
+        const isVault = await this.testVault(did, options);
+        if (!isVault) {
             return null;
         }
-        const buffer = await this.getGroupVaultItem(did, exports.DmailTags.DMAIL, options);
+        const buffer = await this.getVaultItem(did, exports.DmailTags.DMAIL, options);
         if (!buffer) {
             return null;
         }
@@ -3532,7 +3601,7 @@ class Keymaster {
         }
     }
     async listDmailAttachments(did, options) {
-        let items = await this.listGroupVaultItems(did, options);
+        let items = await this.listVaultItems(did, options);
         delete items[exports.DmailTags.DMAIL]; // Remove the dmail item itself from attachments
         return items;
     }
@@ -3540,16 +3609,16 @@ class Keymaster {
         if (name === exports.DmailTags.DMAIL) {
             throw new InvalidParameterError('Cannot add attachment with reserved name "dmail"');
         }
-        return this.addGroupVaultItem(did, name, buffer);
+        return this.addVaultItem(did, name, buffer);
     }
     async removeDmailAttachment(did, name) {
         if (name === exports.DmailTags.DMAIL) {
             throw new InvalidParameterError('Cannot remove attachment with reserved name "dmail"');
         }
-        return this.removeGroupVaultItem(did, name);
+        return this.removeVaultItem(did, name);
     }
     async getDmailAttachment(did, name) {
-        return this.getGroupVaultItem(did, name);
+        return this.getVaultItem(did, name);
     }
     async importDmail(did) {
         const dmail = await this.getDmailMessage(did);