@icure/api 6.4.0 → 7.0.0-beta.1

package/icc-x-api/icc-crypto-x-api.js

@@ -10,148 +10,224 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.IccCryptoXApi = void 0;
-const AES_1 = require("./crypto/AES");
-const RSA_1 = require("./crypto/RSA");
-const shamir_1 = require("./crypto/shamir");
 const _ = require("lodash");
-const models_1 = require("../icc-api/model/models");
 const binary_utils_1 = require("./utils/binary-utils");
 const utils_1 = require("./utils");
 class IccCryptoXApi {
+    get primitives() {
+        return this.cryptoPrimitives;
+    }
+    /**
+     * @internal this method is for internal use only and may be changed without notice.
+     */
+    get exchangeKeys() {
+        return this.exchangeKeysManager;
+    }
+    /**
+     * @deprecated replace with {@link CryptoPrimitives.crypto} at {@link primitives}.
+     */
     get crypto() {
-        return this._crypto;
+        return this.cryptoPrimitives.crypto;
     }
+    /**
+     * @deprecated replace with {@link CryptoPrimitives.shamir} at {@link primitives}.
+     */
     get shamir() {
-        return this._shamir;
+        return this.cryptoPrimitives.shamir;
     }
+    /**
+     * @deprecated replace with {@link CryptoPrimitives.RSA} at {@link primitives}.
+     */
     get RSA() {
-        return this._RSA;
+        return this.cryptoPrimitives.RSA;
     }
+    /**
+     * @deprecated replace with {@link CryptoPrimitives.AES} at {@link primitives}.
+     */
     get AES() {
-        return this._AES;
+        return this.cryptoPrimitives.AES;
     }
+    /**
+     * @internal this is for internal use only and may be changed without notice.
+     */
     get keyStorage() {
         return this._keyStorage;
     }
+    /**
+     * @internal this is for internal use only and may be changed without notice.
+     */
     get storage() {
         return this._storage;
     }
-    emptyHcpCache(hcpartyId) {
-        delete this.hcPartyKeysRequestsCache[hcpartyId];
-        delete this.dataOwnerCache[hcpartyId];
+    /**
+     * @internal this is for internal use only and may be changed without notice.
+     */
+    get entities() {
+        return this.entitiesEncrypiton;
     }
     /**
-     * Gets all delegate encrypted HcParty keys of the delegate with the given `delegateHcPartyId`, and for each key the delegator id
-     * If the keys are not cached, they are retrieved from the backend.
-     *
-     * @param delegateHcPartyId The Health Care Party id
-     * @returns  \{delegatorId: delegateEncryptedHcPartyKey\}
+     * @internal this is for internal use only and may be changed without notice.
+     */
+    get confidential() {
+        return this.confidentialEntities;
+    }
+    /**
+     * @internal this is for internal use only and may be changed without notice.
      */
-    getEncryptedAesExchangeKeysForDelegate(delegateHcPartyId) {
-        return (this.hcPartyKeysRequestsCache[delegateHcPartyId] ||
-            (this.hcPartyKeysRequestsCache[delegateHcPartyId] = this.forceGetEncryptedAesExchangeKeysForDelegate(delegateHcPartyId)));
+    get userKeysManager() {
+        return this.keyManager;
     }
-    forceGetEncryptedAesExchangeKeysForDelegate(delegateHcPartyId) {
-        return Promise.all([
-            this.patientBaseApi.getPatientAesExchangeKeysForDelegate(delegateHcPartyId).catch(() => { }),
-            this.hcpartyBaseApi.getAesExchangeKeysForDelegate(delegateHcPartyId).catch(() => { }),
-            this.deviceBaseApi.getDeviceAesExchangeKeysForDelegate(delegateHcPartyId).catch(() => { }),
-        ]).then(([a, b, c]) => (Object.assign(Object.assign(Object.assign({}, a), b), c)));
+    /**
+     * @internal this is for internal use only and may be changed without notice.
+     */
+    get shamirKeysManager() {
+        return this.shamirManager;
     }
-    constructor(host, headers, hcpartyBaseApi, //Init with a hcparty x api for better performances
-    patientBaseApi, deviceBaseApi, crypto = typeof window !== 'undefined' ? window.crypto : typeof self !== 'undefined' ? self.crypto : {}, storage, keyStorage) {
-        this.hcPartyKeysCache = {};
-        //[delegateId][delegatorId] = delegateEncryptedHcPartyKey
-        //for each delegate, it stores the list of delegators and the corresponding delegateEncryptedHcPartyKey (shared HcPartyKey, from delegator to delegate, encrypted with the RSA key of the delegate)
-        this.hcPartyKeysRequestsCache = {};
-        this.cacheLastDeletionTimestamp = undefined;
-        this.dataOwnerCache = {};
+    /**
+     * @internal
+     */
+    constructor(exchangeKeysManager, cryptoPrimitives, keyManager, dataOwnerApi, entitiesEncrypiton, shamirManager, storage, keyStorage, icureStorageFacade, hcPartyBaseApi, confidentialEntities) {
         this.keychainLocalStoreIdPrefix = 'org.taktik.icure.ehealth.keychain.';
         this.keychainValidityDateLocalStoreIdPrefix = 'org.taktik.icure.ehealth.keychain-date.';
         this.hcpPreferenceKeyEhealthCert = 'eHealthCRTCrypt';
         this.hcpPreferenceKeyEhealthCertDate = 'eHealthCRTDate';
         this.rsaLocalStoreIdPrefix = 'org.taktik.icure.rsa.';
-        this.rsaKeyPairs = {};
-        this.hcpartyBaseApi = hcpartyBaseApi;
-        this.patientBaseApi = patientBaseApi;
-        this.deviceBaseApi = deviceBaseApi;
-        this._crypto = crypto;
-        this.generateKeyConcurrencyMap = {};
-        this._AES = new AES_1.AESUtils(crypto);
-        this._RSA = new RSA_1.RSAUtils(crypto);
-        this._shamir = new shamir_1.ShamirClass(crypto);
+        this.exchangeKeysManager = exchangeKeysManager;
+        this.cryptoPrimitives = cryptoPrimitives;
+        this.keyManager = keyManager;
+        this.dataOwnerApi = dataOwnerApi;
+        this.entitiesEncrypiton = entitiesEncrypiton;
+        this.shamirManager = shamirManager;
         this._storage = storage;
         this._keyStorage = keyStorage;
+        this.icureStorage = icureStorageFacade;
+        this.hcpartyBaseApi = hcPartyBaseApi;
+        this.confidentialEntities = confidentialEntities;
     }
-    loadAllKeysFromLocalStorage(dataOwnerId) {
+    /**
+     * Deletes values cached by the crypto api, to allow to detect changes in stored key pairs, exchange keys and/or current data owner details.
+     * This method may be useful in cases where a user is logged in from multiple devices or in cases where other users have just shared some data with
+     * the current user for the first time.
+     */
+    forceReload() {
         return __awaiter(this, void 0, void 0, function* () {
-            const pubKeys = yield this.getDataOwnerHexPublicKeys((yield this.getDataOwner(dataOwnerId)).dataOwner);
-            for (const pk of pubKeys) {
-                const fingerprint = pk.slice(-32);
-                if (!this.rsaKeyPairs[fingerprint]) {
-                    yield this.cacheKeyPair(yield this.loadKeyPairNotImported(dataOwnerId, fingerprint));
-                }
-            }
+            this.exchangeKeysManager.clearCache(true);
+            this.dataOwnerApi.clearCurrentDataOwnerIdsCache();
+            yield this.keyManager.reloadKeys();
         });
     }
-    getCachedRsaKeyPairForFingerprint(dataOwnerId, pubKeyOrFingerprint) {
-        var _a;
+    /**
+     * Get a key pair with the provided fingerprint if present.
+     * @param fingerprint a key-pair/public-key fingerprint
+     * @return the pair associated to the fingerprint and a boolean indicating if the pair is verified, if present, else undefined
+     */
+    getKeyPairForFingerprint(fingerprint) {
+        return this.keyManager.getKeyPairForFingerprint(fingerprint);
+    }
+    /**
+     * Get the public keys of available key pairs for the current user and his parents in hex-encoded spki representation (uses cached keys: no request
+     * is done to the server).
+     * Note that this will also include unverified keys.
+     * @return the spki representation of public keys of available keypairs for the current user.
+     */
+    getCurrentUserHierarchyAvailablePublicKeysHex() {
         return __awaiter(this, void 0, void 0, function* () {
-            const fingerprint = pubKeyOrFingerprint.slice(-32);
-            return (_a = this.rsaKeyPairs[fingerprint]) !== null && _a !== void 0 ? _a : (yield this.cacheKeyPair(yield this.loadKeyPairNotImported(dataOwnerId, fingerprint)));
+            return this.keyManager.getCurrentUserHierarchyAvailablePublicKeysHex();
         });
     }
-    getPublicKeys() {
+    /**
+     * Get the public keys of available key pairs for the current user in hex-encoded spki representation (uses cached keys: no request is done to the
+     * server).
+     * By setting {@link verifiedOnly} to true only the public keys for verified key pairs will be returned: these will include only key pairs created
+     * on this device or which have been verified using {@link CryptoStrategies} on this device.
+     * @param verifiedOnly if true only the verified public keys will be returned.
+     * @return the spki representation of public keys of available keypairs for the current user.
+     */
+    getCurrentUserAvailablePublicKeysHex(verifiedOnly) {
         return __awaiter(this, void 0, void 0, function* () {
-            return yield Object.values(this.rsaKeyPairs).reduce((p, rsa) => __awaiter(this, void 0, void 0, function* () {
-                return (yield p).concat([(0, utils_1.jwk2spki)(yield this.RSA.exportKey(rsa.publicKey, 'jwk'))]);
-            }), Promise.resolve([]));
+            return this.keyManager.getCurrentUserAvailablePublicKeysHex(verifiedOnly);
         });
     }
-    getPublicKeysAsSpki() {
+    /**
+     * @deprecated depending on your use case you should delete the calls to this method or call {@link forceReload}:
+     * - Replace with `forceReload()` if one of the following parts of the current data owner may have been modified from a different api instance:
+     *   - Hcp hierarchy
+     *   - Key recovery data (transfer keys or shamir)
+     *   - Exchange keys (formerly hcp keys)
+     * - Remove the call if the main goal was to force reload the data owner: data owner are not cached anymore.
+     */
+    emptyHcpCache(hcpartyId) {
+        this.exchangeKeysManager.clearCache(false);
+    }
+    /**
+     * @deprecated you should not need this method anymore to deal with the encryption of iCure entities because everything related to entities
+     * encryption should be done either through the entity-specific extended api or through the extended apis.
+     * Note that keys returned by the current implementation of this method may not be safe for encryption/sharing.
+     * If instead you are using this method to retrieve key pairs for other purposes, for example because you want to reuse the user keys in iCure for
+     * other services consider the following alternatives:
+     * - If you want to use all iCure facilities including key recovery and key verification you can use {@link getKeyPairForFingerprint}.
+     *   Note that this solution can only give access to keys for the data owner of the instantiated api and his parents.
+     * - Alternatively you can use directly your choice of {@link KeyStorageFacade} and {@link StorageEntryKeysFactory}: if these are the same you use
+     *   for the iCure API client the keys will be shared with it. Note however that the iCure api client uses
+     *   {@link StorageEntryKeysFactory.cachedRecoveredKeypairOfDataOwner} to cache recovered keys of a data owner which may not have originated from
+     *   this device, so you should only use {@link StorageEntryKeysFactory.deviceKeypairOfDataOwner} if you want to make sure the keys you use are safe
+     *   for encryption.
+     */
+    getCachedRsaKeyPairForFingerprint(dataOwnerId, pubKeyOrFingerprint) {
         return __awaiter(this, void 0, void 0, function* () {
-            return yield Object.values(this.rsaKeyPairs).reduce((p, rsa) => __awaiter(this, void 0, void 0, function* () {
-                return (yield p).concat([(0, binary_utils_1.ua2hex)(yield this.RSA.exportKey(rsa.publicKey, 'spki'))]);
-            }), Promise.resolve([]));
+            const fingerprint = pubKeyOrFingerprint.slice(-32);
+            const res = this.keyManager.getDecryptionKeys()[fingerprint];
+            if (!res)
+                console.warn(`Could not find any keypair for fingerprint ${fingerprint}`);
+            return res;
         });
     }
+    /**
+     * @deprecated You do not need this method to encrypt/decrypt data of iCure, but if you want to reuse the iCure keys for the user for other purposes
+     * you have different options to replace this method, depending on what you actually need. All options return the hex-encoded spki representation of
+     * the public keys.
+     * - If you want only the public keys for which we have a private key available
+     *   - you can replicate the current behaviour using {@link getCurrentUserHierarchyAvailablePublicKeysHex}. This includes keys for the current user
+     *   and his parents.
+     *   - use {@link getCurrentUserAvailablePublicKeysHex} to get public keys only for the current data owner, ignoring any keys of the
+     *     parent hierarchy. In this case you can also apply a filter to only get verified keys (safe for encryption).
+     * - If you need all public keys for the data owner, including those for which there is no corresponding private key available on the device use
+     *   {@link IccDataOwnerXApi.getHexPublicKeysOf} with the current data owner. If you don't have it available you may get it from
+     *   {@link IccDataOwnerXApi.getCurrentDataOwner}, but this will require to do a request to the iCure server (other options use only cached data).
+     */
+    getPublicKeys() {
+        return __awaiter(this, void 0, void 0, function* () {
+            return this.userKeysManager.getCurrentUserHierarchyAvailablePublicKeysHex();
+        });
+    }
+    /**
+     * @deprecated replace with {@link CryptoPrimitives.randomUuid} at {@link primitives}.
+     */
     randomUuid() {
-        return ((1e7).toString() + -1e3 + -4e3 + -8e3 + -1e11).replace(/[018]/g, (c) => (Number(c) ^ (this._crypto.getRandomValues(new Uint8Array(1))[0] & (15 >> (Number(c) / 4)))).toString(16) //Keep that inlined or you will loose the random
-        );
+        return this.primitives.randomUuid();
     }
+    /**
+     * @deprecated replace with {@link CryptoPrimitives.sha256} at {@link primitives}.
+     */
     sha256(data) {
-        return this._crypto.subtle.digest('SHA-256', data);
+        return this.primitives.sha256(data);
     }
+    /**
+     * @deprecated Use {@link ShamirKeysManager.updateSelfSplits} from {@link shamirKeysManager} instead. Note that the new method completely replaces
+     * all current values if a split for the provided key already exists.
+     */
     encryptShamirRSAKey(hcp, notaries, threshold) {
-        return this.loadKeyPairImported(hcp.id).then((keyPair) => this._RSA.exportKey(keyPair.privateKey, 'pkcs8').then((exportedKey) => __awaiter(this, void 0, void 0, function* () {
-            const privateKey = exportedKey;
-            const nLen = notaries.length;
-            const shares = nLen == 1 ? [privateKey] : this._shamir.share((0, binary_utils_1.ua2hex)(privateKey), nLen, threshold || nLen).map((share) => (0, binary_utils_1.hex2ua)(share));
-            const publicKeys = yield this.getPublicKeys();
-            return _.reduce(notaries, (queue, notary, idx) => {
-                return queue.then((hcp) => __awaiter(this, void 0, void 0, function* () {
-                    const { owner: hcParty, aesExchangeKeys } = yield this.getOrCreateHcPartyKeys(hcp, notary.id);
-                    const [publicKeyIdentifier, hcPartyKeys] = Object.entries(aesExchangeKeys)[0];
-                    try {
-                        const importedAESHcPartyKey = yield this.decryptHcPartyKey(notary.id, hcParty.id, notary.id, publicKeyIdentifier, hcPartyKeys, publicKeys);
-                        const encryptedShamirPartition = yield this.AES.encrypt(importedAESHcPartyKey.key, shares[idx]);
-                        hcParty.privateKeyShamirPartitions = hcParty.privateKeyShamirPartitions || {};
-                        hcParty.privateKeyShamirPartitions[notary.id] = (0, binary_utils_1.ua2hex)(encryptedShamirPartition);
-                    }
-                    catch (e) {
-                        console.log('Error during encryptedShamirRSAKey', notary.id, e);
-                    }
-                    return hcParty;
-                }));
-            }, Promise.resolve(hcp));
-        })));
+        var _a;
+        return __awaiter(this, void 0, void 0, function* () {
+            const legacyKeyFp = (_a = hcp.publicKey) === null || _a === void 0 ? void 0 : _a.slice(-32);
+            if (!legacyKeyFp)
+                throw new Error(`No legacy/default key for hcp ${hcp.id}`);
+            return (yield this.shamirKeysManager.updateSelfSplits({ [legacyKeyFp]: { notariesIds: notaries.map((x) => x.id), minShares: threshold !== null && threshold !== void 0 ? threshold : notaries.length } }, [])).dataOwner;
+        });
     }
-    /* Reconstructs the hcp's private key from the notaries' shamir shares and stores it in localstorage.
-    The retrieval procedure of the shares is not designed or implemented yet.  Therefore, it currently only
-    works if the private key of the notaries are stored in local storage (e.g. notaries = [hcp parent]).
-     * @param hcp : the hcp whose key we want to reconstruct
-     * @param notaries : holders of the shamir shares
-    **/
+    /**
+     * @deprecated You should not need this method anymore because the api will automatically try to recover the available shamir keys on startup.
+     */
     decryptShamirRSAKey(hcp, notaries) {
         return __awaiter(this, void 0, void 0, function* () {
             try {
@@ -169,7 +245,7 @@ class IccCryptoXApi {
                     const decryptedShares = yield _.reduce(notaries, (queue, notary) => {
                         return queue.then((shares) => __awaiter(this, void 0, void 0, function* () {
                             try {
-                                // TODO: now, we get the encrypted shares in db and decrypt them. This assumes that the
+                                // now, we get the encrypted shares in db and decrypt them. This assumes that the
                                 // the notaries' private keys are in localstorage. We should implement a way for the notaries to
                                 // give hcp the decrypted shares without having to also share their private keys.
                                 const encryptedAesKeyMap = yield this.getEncryptedAesExchangeKeys(hcp, notary.id);
@@ -184,11 +260,11 @@ class IccCryptoXApi {
                             return shares;
                         }));
                     }, Promise.resolve([]));
-                    decryptedPrivatedKey = this._shamir.combine(decryptedShares);
+                    decryptedPrivatedKey = this.primitives.shamir.combine(decryptedShares);
                 }
-                const importedPrivateKey = yield this._RSA.importKey('pkcs8', (0, binary_utils_1.hex2ua)(decryptedPrivatedKey), ['decrypt']);
-                const importedPublicKey = yield this._RSA.importKey('spki', (0, binary_utils_1.hex2ua)(hcp.publicKey), ['encrypt']);
-                const exportedKeyPair = yield this._RSA.exportKeys({ publicKey: importedPublicKey, privateKey: importedPrivateKey }, 'jwk', 'jwk');
+                const importedPrivateKey = yield this.primitives.RSA.importKey('pkcs8', (0, binary_utils_1.hex2ua)(decryptedPrivatedKey), ['decrypt']);
+                const importedPublicKey = yield this.primitives.RSA.importKey('spki', (0, binary_utils_1.hex2ua)(hcp.publicKey), ['encrypt']);
+                const exportedKeyPair = yield this.primitives.RSA.exportKeys({ publicKey: importedPublicKey, privateKey: importedPrivateKey }, 'jwk', 'jwk');
                 yield this._keyStorage.storeKeyPair(`${this.rsaLocalStoreIdPrefix}${hcp.id}`, exportedKeyPair);
             }
             catch (e) {
@@ -197,415 +273,107 @@ class IccCryptoXApi {
         });
     }
     /**
-     * Gets the decryptedHcPartyKey for the given `encryptedHcPartyKey`
-     *
-     * If the decrypted key exists in the cache, retrieves it from there.
-     * Otherwise, decrypts it using the RSA key of the delegator or delegate (depending on the value of `encryptedForDelegator`)
-     *
-     * @param loggedHcPartyId The logged DataOwner id or the id of his parent
-     * @param delegatorId The id of Delegator eg, the DataOwner where this AES exchange key is stored
-     * @param delegateHcPartyId The id of the delegate : the data owner for whom this aes exchange key has been created
-     * @param publicKey The public key of the delegator : A unique aes exchange key is created for each public key of the delegator. This is the public key corresponding to the encryptedHcPartyKeys
-     * @param encryptedHcPartyKeys The encryptedHcPartyKeys to be decrypted
-     * @param publicKeys The public keys for which we might have a private key
-     *
-     * @returns - **delegatorId** the input param  `delegatorId`
-     * - **key** the decrypted `encryptedHcPartyKey`
+     * @deprecated you should not need this method anymore because everything related to entities encryption should be done either through the
+     * entity-specific extended api.
+     * Note that currently this method does not cache results anymore (but the updated methods do).
      */
     decryptHcPartyKey(loggedHcPartyId, delegatorId, delegateHcPartyId, publicKey, encryptedHcPartyKeys, publicKeys) {
-        var _a;
         return __awaiter(this, void 0, void 0, function* () {
             if (!publicKeys.length) {
                 const reason = `Cannot decrypt RSA encrypted AES HcPartyKey from ${delegatorId} to ${delegateHcPartyId}: no public key`;
                 console.warn(reason);
                 throw new Error(reason);
             }
-            const cacheKey = `${delegateHcPartyId}|${publicKey.slice(-32)}|${delegatorId}`;
-            const res = this.hcPartyKeysCache[cacheKey];
-            if (res) {
-                return res;
-            }
-            const result = yield publicKeys.reduce((res, pk) => __awaiter(this, void 0, void 0, function* () {
-                var _b, _c, _d;
-                const delegatorAndKeys = yield res;
-                if (delegatorAndKeys) {
-                    return delegatorAndKeys;
-                }
-                const fingerprint = pk.slice(-32);
-                const keyPair = (_b = this.rsaKeyPairs[fingerprint]) !== null && _b !== void 0 ? _b : (yield this.cacheKeyPair(yield this.loadKeyPairNotImported(loggedHcPartyId, fingerprint)));
-                if (!keyPair) {
-                    return;
-                }
-                // Due to past bugs the encryptedHcPartyKeys may contain the full key instead of just the fingerprint.
-                let encryptedHcPartyKey = (_c = encryptedHcPartyKeys[fingerprint]) !== null && _c !== void 0 ? _c : encryptedHcPartyKeys[pk];
-                if (!encryptedHcPartyKey) {
-                    const delegate = yield this.getDataOwner(delegateHcPartyId, false); //it is faster to just try to decrypt if not in cache
-                    if (!(delegate === null || delegate === void 0 ? void 0 : delegate.dataOwner) || ((_d = delegate.dataOwner.publicKey) === null || _d === void 0 ? void 0 : _d.endsWith(fingerprint))) {
-                        encryptedHcPartyKey = encryptedHcPartyKeys[''];
-                    }
-                    else {
-                        return;
-                    }
-                }
-                try {
-                    const decryptedAesExchangeKey = yield this._RSA.decrypt(keyPair.privateKey, (0, binary_utils_1.hex2ua)(encryptedHcPartyKey));
-                    const importedAesExchangeKey = yield this._AES.importKey('raw', decryptedAesExchangeKey);
-                    return (this.hcPartyKeysCache[cacheKey] = {
-                        delegatorId: delegatorId,
-                        key: importedAesExchangeKey,
-                        rawKey: (0, binary_utils_1.ua2hex)(new Uint8Array(decryptedAesExchangeKey)),
-                    });
-                }
-                catch (e) {
-                    const reason = `Cannot decrypt RSA encrypted AES HcPartyKey from ${delegatorId} to ${delegateHcPartyId} for pubKey ${fingerprint}: impossible to decrypt`;
-                    console.log(reason);
-                }
-            }), Promise.resolve(undefined));
-            const availablePublicKeys = publicKeys.filter((pk) => this.rsaKeyPairs[pk.slice(-32)]);
-            if (!result) {
-                //Try to find another key from the transfer keys
-                const hcp = (yield this.getDataOwner(loggedHcPartyId));
-                const candidates = Object.entries((_a = hcp.dataOwner.transferKeys) !== null && _a !== void 0 ? _a : {})
-                    .filter(([fp, _]) => availablePublicKeys.some((pk) => pk.slice(-32) === fp.slice(-32))) // only keep keys that we will be able to decrypt
-                    .flatMap(([pk, keys]) => Object.entries(keys).map(([k, v]) => [pk, k, v]))
-                    .filter(([_, k]) => !publicKeys.some((apk) => apk.slice(-32) === k.slice(-32)));
-                if (candidates.length) {
-                    const newPublicKeys = yield candidates.reduce((p, [decryptionKeyFingerprint, privateKeyFingerprint, encryptedPrivateKey]) => __awaiter(this, void 0, void 0, function* () {
-                        var _e, _f;
-                        const newKeys = yield p;
-                        const aesExchangeKeys = (_e = Object.entries(hcp.dataOwner.aesExchangeKeys).find(([fp, _]) => fp.slice(-32) === privateKeyFingerprint.slice(-32))) === null || _e === void 0 ? void 0 : _e[1][loggedHcPartyId];
-                        if (aesExchangeKeys) {
-                            const encryptedAesExchangeKey = (_f = Object.entries(aesExchangeKeys).find(([fp, _]) => fp.slice(-32) === decryptionKeyFingerprint.slice(-32))) === null || _f === void 0 ? void 0 : _f[1];
-                            if (encryptedAesExchangeKey) {
-                                const keyPair = this.rsaKeyPairs[decryptionKeyFingerprint.slice(-32)];
-                                if (!keyPair) {
-                                    return newKeys;
-                                }
-                                const decryptedAesExchangeKey = yield this._RSA.decrypt(keyPair.privateKey, (0, binary_utils_1.hex2ua)(encryptedAesExchangeKey));
-                                const importedAesExchangeKey = yield this._AES.importKey('raw', decryptedAesExchangeKey);
-                                const decryptedPrivateKey = yield this._AES.decrypt(importedAesExchangeKey, (0, binary_utils_1.hex2ua)(encryptedPrivateKey));
-                                const newPublicKey = Object.keys(hcp.dataOwner.aesExchangeKeys).find((fp) => fp.slice(-32) === privateKeyFingerprint.slice(-32));
-                                yield this.cacheKeyPair({
-                                    publicKey: (0, utils_1.spkiToJwk)((0, binary_utils_1.hex2ua)(newPublicKey)),
-                                    privateKey: (0, utils_1.pkcs8ToJwk)(decryptedPrivateKey),
-                                });
-                                return newKeys.concat([newPublicKey]);
-                            }
-                        }
-                        return newKeys;
-                    }), Promise.resolve([]));
-                    if (newPublicKeys.length) {
-                        return yield this.decryptHcPartyKey(loggedHcPartyId, delegatorId, delegateHcPartyId, publicKey, encryptedHcPartyKeys, newPublicKeys);
-                    }
-                }
-                const reason = `Cannot decrypt RSA encrypted AES HcPartyKey from ${delegatorId} to ${delegateHcPartyId}: impossible to decrypt. No private key was found or could be used to decrypt the aes exchange keys`;
-                console.log(reason);
-                throw new Error(reason);
+            const keysFpSet = new Set(publicKeys.map((x) => x.slice(-32)));
+            const filteredKeys = Object.fromEntries(Object.entries(this.keyManager.getDecryptionKeys()).filter(([fp]) => keysFpSet.has(fp)));
+            const decrypted = yield this.exchangeKeysManager.base.tryDecryptExchangeKeys([encryptedHcPartyKeys], filteredKeys);
+            const res = decrypted.successfulDecryptions[0];
+            if (!res) {
+                const error = `Cannot decrypt RSA encrypted AES HcPartyKey from ${delegatorId} to ${delegateHcPartyId}: impossible to decrypt. ` +
+                    'No private key was found or could be used to decrypt the aes exchange keys`';
+                console.warn(error);
+                throw new Error(error);
             }
-            return result;
-        });
-    }
-    /**
-     * Cache the RSA private/public key pair for the HcP with the given id `hcPartyKeyOwner`
-     */
-    cacheKeyPair(keyPairInJwk) {
-        return this._RSA.importKeyPair('jwk', keyPairInJwk.privateKey, 'jwk', keyPairInJwk.publicKey).then((importedKeyPair) => {
-            const pk = (0, utils_1.jwk2spki)(keyPairInJwk.publicKey);
-            return (this.rsaKeyPairs[pk.slice(-32)] = importedKeyPair);
-        });
-    }
-    /**
-     * Gets the secret ID (SFKs) that should be used in the prescribed context (confidential or not) from decrypted SPKs of the given `parent`, decrypted by the HcP with the given `hcpartyId` AND by its HcP parents
-     * @param parent :the object of which delegations (SPKs) to decrypt
-     * @param hcpartyId :the id of the delegate HcP
-     * @param confidential :weather the key is going to be used for a confidential piece or data or not
-     * @returns - **extractedKeys** array containing secret IDs (SFKs) from decrypted SPKs, from both given HcP and its parents ; can contain duplicates
-     * - **hcpartyId** the given `hcpartyId` OR, if a parent exist, the HcP id of the top parent in the hierarchy  (even if that parent has no delegations)
-     */
-    extractPreferredSfk(parent, hcpartyId, confidential) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const secretForeignKeys = yield this.extractSFKsHierarchyFromDelegations(parent, hcpartyId);
-            const keys = secretForeignKeys
-                .filter(({ extractedKeys }) => extractedKeys.length > 0)
-                .filter((x, idx) => (confidential ? x.hcpartyId === hcpartyId : idx === 0))[0];
-            return ((keys &&
-                (confidential
-                    ? keys.extractedKeys.find((k) => !secretForeignKeys.some(({ extractedKeys, hcpartyId: parentHcpId }) => hcpartyId !== parentHcpId && extractedKeys.includes(k)))
-                    : keys.extractedKeys[0])) ||
-                undefined);
+            return {
+                delegatorId,
+                key: res,
+                rawKey: (0, binary_utils_1.ua2hex)(yield this.primitives.AES.exportKey(res, 'raw')),
+            };
         });
     }
     /**
-     * Gets an array of decrypted HcPartyKeys, shared between the delegate with ID `delegateHcPartyId` and the delegators in `delegatorsHcPartyIdsSet`
+     * @deprecated you should not need this method anymore. The new API will automatically load on startup all keys available through the key storage
+     * facade and/or recoverable through transfer keys or shamir split. If no verified key (safe for encryption) can be found during the instantiation
+     * of the API, depending on the parameters passed to the factory one of two scenarios will happen:
+     * - A new key will be automatically created on the device and stored using the key storage facade.
+     * - The api instantiation fails with an exception. This is ideal if you want to try to recover an existing key pair before creating a new one.
      *
-     * 1. Get the keys for the delegateHealthCareParty (cache/backend).
-     * 2. For each key in the delegators, decrypt it with the delegate's private key
-     * 3. Filter out undefined keys and return them
-     *
-     * @param delegatorsHcPartyIdsSet array of delegator HcP IDs that could have delegated something to the HcP with ID `delegateHcPartyId`
-     * @param delegateHcPartyId the HcP for which the HcPs with IDs in `delegatorsHcPartyIdsSet` could have delegated something
-     * @param minCacheDurationInSeconds The minimum cache duration
-     * @returns - **delegatorId** : the id of the delegator HcP that shares the **key** with the `delegateHcPartyId`
-     *  - **key** the decrypted HcPartyKey, shared between **delegatorId** and `delegateHcPartyId`
+     * If you were using this method to allow the user to recover an existing key that is not available in the storage facade nor recoverable through
+     * transfer keys or shamir split (for example by scanning a qr code, or by loading a file from the computer to the web browser's local storage)
+     * you will have to move that logic in your implementation of CryptoStrategies.
+     * It is currently not allowed to create new key pairs if a verified key pair is already available on the device, as this would be wasteful.
+     * If you want to convert a `JsonWebKey` pair to a `CryptoKey` pair you should use directly the method in `primitives.RSA`.
      */
-    decryptAndImportAesHcPartyKeysForDelegators(delegatorsHcPartyIdsSet, delegateHcPartyId, minCacheDurationInSeconds = 60) {
+    cacheKeyPair(keyPairInJwk) {
         return __awaiter(this, void 0, void 0, function* () {
-            const aesExchangeKeys = yield this.getEncryptedAesExchangeKeysForDelegate(delegateHcPartyId).then((delegatorIdsWithDelegateEncryptedHcPartyKeys) => __awaiter(this, void 0, void 0, function* () {
-                // [key: delegatorId] = delegateEncryptedHcPartyKey
-                // For each delegatorId, obtain the AES key (decrypted HcParty Key) shared with the delegate, decrypted by the delegate
-                return (yield Promise.all(delegatorsHcPartyIdsSet.map((delegatorId) => __awaiter(this, void 0, void 0, function* () {
-                    const encryptedHcPartyKeysForPubKeyFingerprint = delegatorIdsWithDelegateEncryptedHcPartyKeys[delegatorId];
-                    if (!encryptedHcPartyKeysForPubKeyFingerprint) {
-                        return [];
-                    }
-                    const decryptedKeys = yield Promise.all(Object.entries(encryptedHcPartyKeysForPubKeyFingerprint).map(([delegatorPubKeyFinerprint, encryptedAesExchangeKeys]) => __awaiter(this, void 0, void 0, function* () {
-                        try {
-                            return yield this.decryptHcPartyKey(delegateHcPartyId, delegatorId, delegateHcPartyId, delegatorPubKeyFinerprint, encryptedAesExchangeKeys, Object.keys(this.rsaKeyPairs));
-                        }
-                        catch (e) {
-                            console.log(`failed to decrypt hcPartyKey from ${delegatorId} to ${delegateHcPartyId}`);
-                            return;
-                        }
-                    })));
-                    return decryptedKeys.filter((x) => !!x);
-                })))).reduce((acc, x) => [...acc, ...x], []);
-            }));
-            if (aesExchangeKeys.length > 0) {
-                return aesExchangeKeys;
-            }
-            const nowTimestamp = +new Date();
-            if (!this.cacheLastDeletionTimestamp || (nowTimestamp - this.cacheLastDeletionTimestamp) / 1000 >= minCacheDurationInSeconds) {
-                delete this.hcPartyKeysRequestsCache[delegateHcPartyId];
-                this.cacheLastDeletionTimestamp = nowTimestamp;
-                return this.decryptAndImportAesHcPartyKeysForDelegators(delegatorsHcPartyIdsSet, delegateHcPartyId, minCacheDurationInSeconds);
+            const cryptoKeyPair = yield this.primitives.RSA.importKeyPair('jwk', keyPairInJwk.privateKey, 'jwk', keyPairInJwk.publicKey);
+            const pubHex = (0, binary_utils_1.ua2hex)(yield this.primitives.RSA.exportKey(cryptoKeyPair.publicKey, 'spki'));
+            const fingerprint = pubHex.slice(-32);
+            if (!this.keyManager.getDecryptionKeys()[fingerprint]) {
+                const selfId = yield this.dataOwnerApi.getCurrentDataOwnerId();
+                const selfKeys = this.dataOwnerApi.getHexPublicKeysOf((yield this.dataOwnerApi.getCurrentDataOwner()).dataOwner);
+                if (!selfKeys.has(pubHex))
+                    throw new Error(`Impossible to add key pair with fingerprint ${fingerprint} to data owner ${selfId}: the data owner has no matching public key`);
+                yield this.icureStorage.saveKey(selfId, fingerprint, keyPairInJwk, true);
+                // Force reload to check if more private keys can be recovered or more exchange keys become available.
+                yield this.forceReload();
             }
-            return [];
+            return cryptoKeyPair;
         });
     }
     /**
-     * Gets an array of decrypted HcPartyKeys from the given `delegations`, that are shared with / can be decrypted by the HcP with the given `healthcarePartyId` (or by its parents when `fallbackOnParent` is true)
-     *
-     * 1. Checks whether the delegations' object has a delegation for the
-     * given healthCarePartyId.
-     * 2. Enumerates all the delegators (delegation.owner) present in
-     * the delegations.
-     * 3. Decrypt's delegators' keys and returns them.
-     *
-     * @param dataOwnerId : the id of the delegate HCP
-     * @param delegations : delegations (can be SPKs, CFKs, EKs) for all delegates
-     * @param fallbackOnParent  default true; use parent's healthCarePartyId in case there's no delegation for the `healthcarePartyId`
-     * @returns  - **delegatorId** : the id of the delegator HcP that shares the **key** with the `healthcarePartyId`
-     *  - **key** the decrypted HcPartyKey, shared between **delegatorId** and `healthcarePartyId`
+     * @deprecated Usually you should not need this method, since the preferred sfk is automatically chosen by the extended entity apis when creating a
+     * new instance of the entity.
      */
-    getDecryptedAesExchangeKeysOfDelegateAndParentsFromGenericDelegations(dataOwnerId, delegations, fallbackOnParent = true) {
-        var _a;
+    extractPreferredSfk(parent, hcpartyId, confidential) {
         return __awaiter(this, void 0, void 0, function* () {
-            const delegationsArray = (_a = delegations[dataOwnerId]) !== null && _a !== void 0 ? _a : [];
-            if (!delegationsArray.length && fallbackOnParent) {
-                const { dataOwner: hcp } = yield this.getDataOwner(dataOwnerId);
-                return hcp.parentId
-                    ? yield this.getDecryptedAesExchangeKeysOfDelegateAndParentsFromGenericDelegations(hcp.parentId, delegations)
-                    : [];
-            }
-            else {
-                const delegatorIds = new Set();
-                delegationsArray.forEach((del) => delegatorIds.add(del.owner));
-                return this.decryptAndImportAesHcPartyKeysForDelegators(Array.from(delegatorIds), dataOwnerId);
-            }
+            return confidential ? this.confidential.getConfidentialSecretId(parent, hcpartyId) : this.confidential.getAnySecretIdSharedWithParents(parent);
         });
     }
     /**
-     * Retrieve the owner HealthCareParty key and use it to encrypt
-     * both the delegations (createdObject.id) and the cryptedForeignKeys
-     * (parentObject.id), and returns them in an object.
+     * @deprecated you should not need this method anymore because everything related to entities encryption should be done either through the
+     * entity-specific extended api.
      */
-    initObjectDelegations(createdObject, parentObject, ownerId, secretForeignKeyOfParent) {
-        return __awaiter(this, arguments, void 0, function* () {
-            const publicKeys = yield this.getPublicKeys();
-            this.throwDetailedExceptionForInvalidParameter('createdObject.id', createdObject.id, 'initObjectDelegations', arguments);
-            if (parentObject)
-                this.throwDetailedExceptionForInvalidParameter('parentObject.id', parentObject.id, 'initObjectDelegations', arguments);
-            const secretId = this.randomUuid();
-            return this.getDataOwner(ownerId).then(({ dataOwner: owner }) => __awaiter(this, void 0, void 0, function* () {
-                var _a, _b;
-                const { owner: modifiedOwner, aesExchangeKeys } = yield this.getOrCreateHcPartyKeys(owner, ownerId);
-                const importedAESHcPartyKey = yield this.decryptAnyAesExchangeKeyForOwner(aesExchangeKeys, ownerId, ownerId, ownerId, publicKeys);
-                const encryptedDelegation = yield this._AES.encrypt(importedAESHcPartyKey.key, (0, binary_utils_1.string2ua)(createdObject.id + ':' + secretId).buffer, importedAESHcPartyKey.rawKey);
-                const encryptedSecretForeignKey = parentObject
-                    ? yield this._AES.encrypt(importedAESHcPartyKey.key, (0, binary_utils_1.string2ua)(createdObject.id + ':' + parentObject.id).buffer, importedAESHcPartyKey.rawKey)
-                    : undefined;
-                return {
-                    owner: modifiedOwner,
-                    delegations: Object.assign(Object.assign({}, ((_a = createdObject.delegations) !== null && _a !== void 0 ? _a : {})), { [ownerId]: [
-                            {
-                                owner: ownerId,
-                                delegatedTo: ownerId,
-                                key: (0, binary_utils_1.ua2hex)(encryptedDelegation),
-                            },
-                        ] }),
-                    cryptedForeignKeys: (encryptedSecretForeignKey
-                        ? Object.assign(Object.assign({}, ((_b = createdObject.cryptedForeignKeys) !== null && _b !== void 0 ? _b : {})), { [ownerId]: [
-                                {
-                                    owner: ownerId,
-                                    delegatedTo: ownerId,
-                                    key: (0, binary_utils_1.ua2hex)(encryptedSecretForeignKey),
-                                },
-                            ] }) : {}) || {},
-                    secretForeignKeys: secretForeignKeyOfParent ? [secretForeignKeyOfParent] : [],
-                    secretId: secretId,
-                };
-            }));
-        });
-    }
-    decryptAnyAesExchangeKeyForOwner(aesExchangeKeys, loggedHcPartyId, delegatorId, delegateHcPartyId, publicKeys) {
+    decryptAndImportAesHcPartyKeysForDelegators(delegatorsHcPartyIdsSet, delegateHcPartyId, minCacheDurationInSeconds = 60) {
         return __awaiter(this, void 0, void 0, function* () {
-            const importedAESHcPartyKey = yield Object.entries(aesExchangeKeys).reduce((acc, [publicKeyIdentifier, hcPartyKeys]) => __awaiter(this, void 0, void 0, function* () {
-                const accValue = yield acc;
-                if (accValue) {
-                    return accValue;
-                }
-                try {
-                    return yield this.decryptHcPartyKey(loggedHcPartyId, delegatorId, delegateHcPartyId, publicKeyIdentifier, hcPartyKeys, publicKeys);
-                }
-                catch (e) {
-                    return undefined;
-                }
-            }), Promise.resolve(undefined));
-            if (!importedAESHcPartyKey) {
-                throw new Error(`No hcParty key can be decrypted from ${delegatorId} to ${delegateHcPartyId} using currently available private keys`);
-            }
-            return importedAESHcPartyKey;
+            return yield delegatorsHcPartyIdsSet.reduce((acc, delegator) => __awaiter(this, void 0, void 0, function* () {
+                const awaitedAcc = yield acc;
+                const keys = yield this.exchangeKeysManager.getDecryptionExchangeKeysFor(delegator, delegateHcPartyId);
+                const keysForDelegator = yield keys.reduce((accForKey, cryptoKey) => __awaiter(this, void 0, void 0, function* () {
+                    const awaitedAccForKey = yield accForKey;
+                    const rawKey = (0, binary_utils_1.ua2hex)(yield this.primitives.RSA.exportKey(cryptoKey, 'spki'));
+                    return [
+                        ...awaitedAccForKey,
+                        {
+                            key: cryptoKey,
+                            delegatorId: delegator,
+                            rawKey: rawKey,
+                        },
+                    ];
+                }), Promise.resolve([]));
+                return [...awaitedAcc, ...keysForDelegator];
+            }), Promise.resolve([]));
         });
     }
     /**
-     * Gets updated instances of SPKs and CKFs for the child object `modifiedObject`.
-     * These updated SPKs and CKFs contain new SPKs/CFKs to provide delegation from delegator HcP with id `ownerId` to delegate HcP with id `delegateId`
-     *
-     * 1. if `secretIdOfModifiedObject` is not provided, the method will throw an exception; this `secretIdOfModifiedObject` is used to generate a new delegation (SPK) in step 3;
-     *  the `secretIdOfModifiedObject` is returned, unmodified, as `secretId`
-     * 2. if the owner (delegator) did not perform a delegation to the delegate, then this HcP delegation (creation of a new HcPKey) is performed now
-     * 3. creates a new delegation (Secret Primary Keys) on the `modifiedObject` encrypted with the HcPKey from owner to the delegate;
-     * 4. if `parentObject` != null, creates a new CFK on the `modifiedObject` encrypted with the HcPKey from owner to the delegate;
-     * 5. this new delegation (from step 3) is added to the list of existing delegations (Secret Primary Keys) on the `modifiedObject` for the delegate given by `delegateId`
-     * 6. if the CFK (from step 4) can be created, this new CFK is added to the list of existing CFKs on the `modifiedObject` for the delegate given by `delegateId`
-     * 7. then some duplicates delegations (SPKs) and CKFs are removed
-     *
-     * @param modifiedObject : the object of which SPKs and CFKs will be cloned, the clones will be modified and then used as returned values ; it's a 'child' of `parentObject`; will NOT be mutated
-     * @param parentObject : will NOT be mutated
-     * @param ownerId : the HcP id of the delegator
-     * @param delegateId : the HcP id of the delegate
-     * @param secretIdOfModifiedObject : the secret id used in the child object to generate its SPK
-     * @returns - **delegations**  existing delegations (SPKs) of the `modifiedObject`, appended with results from step 5
-     * - **cryptedForeignKeys** existing CFKs of the `modifiedObject`, appended with results from steps 6
-     * - **secretId** which is the given input parameter `secretIdOfModifiedObject`
+     * @deprecated you should not need this method anymore because everything related to entities encryption should be done either through the
+     * entity-specific extended api.
+     * Note that currently this method does not cache results anymore (but the updated methods do).
      */
-    extendedDelegationsAndCryptedForeignKeys(
-    //TODO: suggested name: getExtendedChildObjectSPKandCFKwithDelegationFromDelegatorToDelegate
-    modifiedObject, parentObject, ownerId, delegateId, secretIdOfModifiedObject) {
-        this.throwDetailedExceptionForInvalidParameter('modifiedObject.id', modifiedObject.id, 'extendedDelegationsAndCryptedForeignKeys', arguments); //modifiedObject should never be null
-        if (parentObject)
-            this.throwDetailedExceptionForInvalidParameter('parentObject.id', parentObject === null || parentObject === void 0 ? void 0 : parentObject.id, 'extendedDelegationsAndCryptedForeignKeys', arguments);
-        this.throwDetailedExceptionForInvalidParameter('secretIdOfModifiedObject', secretIdOfModifiedObject, 'extendedDelegationsAndCryptedForeignKeys', arguments);
-        return this.getDataOwner(ownerId)
-            .then(({ dataOwner: owner }) => __awaiter(this, void 0, void 0, function* () {
-            const publicKeys = yield this.getPublicKeys();
-            const { owner: modifiedOwner, aesExchangeKeys } = yield this.getOrCreateHcPartyKeys(owner, delegateId);
-            const importedAESHcPartyKey = yield this.decryptAnyAesExchangeKeyForOwner(aesExchangeKeys, ownerId, delegateId, ownerId, publicKeys);
-            modifiedObject = (modifiedObject === null || modifiedObject === void 0 ? void 0 : modifiedObject.id) === owner.id ? modifiedOwner : modifiedObject;
-            return {
-                previousDecryptedDelegations: yield Promise.all(((modifiedObject.delegations || {})[delegateId] || []).map((d) => (d.key &&
-                    d.owner === ownerId &&
-                    this._AES.decrypt(importedAESHcPartyKey.key, (0, binary_utils_1.hex2ua)(d.key), importedAESHcPartyKey.rawKey).catch(() => {
-                        console.log(`Cannot decrypt delegation from ${d.owner} to ${d.delegatedTo} for object with id ${modifiedObject.id}:`, modifiedObject);
-                        return Promise.resolve();
-                    })) ||
-                    Promise.resolve())),
-                previousDecryptedCryptedForeignKeys: yield Promise.all(((modifiedObject.cryptedForeignKeys || {})[delegateId] || []).map((d) => (d.key &&
-                    d.owner === ownerId &&
-                    this._AES.decrypt(importedAESHcPartyKey.key, (0, binary_utils_1.hex2ua)(d.key), importedAESHcPartyKey.rawKey).catch(() => {
-                        console.log(`Cannot decrypt cryptedForeignKeys from ${d.owner} to ${d.delegatedTo} for object with id ${modifiedObject.id}:`, modifiedObject);
-                        return Promise.resolve();
-                    })) ||
-                    Promise.resolve())),
-                cryptedDelegation: yield this._AES.encrypt(importedAESHcPartyKey.key, (0, binary_utils_1.string2ua)(modifiedObject.id + ':' + secretIdOfModifiedObject).buffer, importedAESHcPartyKey.rawKey),
-                cryptedForeignKey: parentObject
-                    ? yield this._AES.encrypt(importedAESHcPartyKey.key, (0, binary_utils_1.string2ua)(modifiedObject.id + ':' + parentObject.id).buffer, importedAESHcPartyKey.rawKey)
-                    : undefined,
-            };
-        }))
-            .then(({ previousDecryptedDelegations, previousDecryptedCryptedForeignKeys, cryptedDelegation, cryptedForeignKey }) => {
-            //try to limit the extent of the modifications to the delegations by preserving the redundant delegation already present and removing duplicates
-            //For delegate delegateId, we create:
-            // 1. an array of objects { d : {owner,delegatedTo,encrypted(key)}} with one object for each existing delegation and the new key concatenated
-            // 2. an array of objects { k : decrypted(key)} with one object for the existing delegations and the new key concatenated
-            // We merge them to get one array of objects: { d: {owner,delegatedTo,encrypted(key)}, k: decrypted(key)}
-            const delegationCryptedDecrypted = _.merge(((modifiedObject.delegations || {})[delegateId] || []).map((d) => ({
-                d,
-            })), (previousDecryptedDelegations || []).map((dd) => (dd ? (0, binary_utils_1.ua2string)(dd) : null)).map((k) => ({ k })))
-                .filter(({ d, k }) => !!k || d.owner !== ownerId) //Only keep the ones created by us that can still be decrypted
-                .map(({ d, k }) => ({
-                d,
-                k: k || this.randomUuid(),
-            })) // Use some unique id that ensures the delegation not created by us are going to be held
-                .concat([
-                {
-                    d: {
-                        owner: ownerId,
-                        delegatedTo: delegateId,
-                        key: (0, binary_utils_1.ua2hex)(cryptedDelegation),
-                    },
-                    k: modifiedObject.id + ':' + secretIdOfModifiedObject,
-                },
-            ]);
-            const allDelegations = _.cloneDeep(modifiedObject.delegations || {});
-            //Only keep one version of the decrypted key
-            allDelegations[delegateId] = _.uniqBy(delegationCryptedDecrypted, (x) => x.k).map((x) => x.d);
-            const cryptedForeignKeysCryptedDecrypted = _.merge(((modifiedObject.cryptedForeignKeys || {})[delegateId] || []).map((d) => ({
-                d,
-            })), (previousDecryptedCryptedForeignKeys || []).map((dd) => (dd ? (0, binary_utils_1.ua2string)(dd) : null)).map((k) => ({ k })))
-                .filter(({ d, k }) => !!k || d.owner !== ownerId) //Only keep the ones created by us that can still be decrypted
-                .map(({ d, k }) => ({
-                d,
-                k: k || this.randomUuid(),
-            })) // Use some unique id that ensures the delegation not created by us are going to be held
-                .concat(cryptedForeignKey
-                ? [
-                    {
-                        d: {
-                            owner: ownerId,
-                            delegatedTo: delegateId,
-                            key: (0, binary_utils_1.ua2hex)(cryptedForeignKey),
-                        },
-                        k: modifiedObject.id + ':' + (parentObject === null || parentObject === void 0 ? void 0 : parentObject.id),
-                    },
-                ]
-                : []);
-            const allCryptedForeignKeys = _.cloneDeep(modifiedObject.cryptedForeignKeys || {});
-            if (cryptedForeignKeysCryptedDecrypted.length > 0) {
-                allCryptedForeignKeys[delegateId] = _.uniqBy(cryptedForeignKeysCryptedDecrypted, (x) => x.k).map((x) => x.d);
-            }
-            return {
-                modifiedObject,
-                delegations: allDelegations,
-                cryptedForeignKeys: allCryptedForeignKeys,
-                secretId: secretIdOfModifiedObject,
-            };
-        });
-    }
-    // What we need is to find aes exchange keys on the owner ! Even just with whom he shared information, we don't care about aes exchange keys
-    _getDelegateIdsOf(owner) {
-        var _a;
-        return __awaiter(this, void 0, void 0, function* () {
-            const mapOfAesExchKeysDelegates = Object.entries((_a = owner.aesExchangeKeys) !== null && _a !== void 0 ? _a : {}).reduce((map, [, aesExchKeys]) => map.concat(Object.keys(aesExchKeys).filter((delegateId) => !map.includes(delegateId))), []);
-            return owner.hcPartyKeys
-                ? mapOfAesExchKeysDelegates.concat(Object.keys(owner.hcPartyKeys).filter((delegateId) => !mapOfAesExchKeysDelegates.includes(delegateId)))
-                : mapOfAesExchKeysDelegates;
-        });
-    }
     getEncryptedAesExchangeKeys(owner, delegateId) {
-        var _a, _b, _c;
+        var _a, _b;
         return __awaiter(this, void 0, void 0, function* () {
-            const publicKeys = yield this.getPublicKeys();
+            const publicKeys = Array.from(this.dataOwnerApi.getHexPublicKeysOf(owner));
             const mapOfAesExchangeKeys = Object.entries((_a = owner.aesExchangeKeys) !== null && _a !== void 0 ? _a : {})
                 .filter((e) => e[1][delegateId] && Object.keys(e[1][delegateId]).some((k1) => publicKeys.some((pk) => pk.endsWith(k1))))
                 .reduce((map, e) => {
@@ -616,9 +384,9 @@ class IccCryptoXApi {
             if (!owner.publicKey || mapOfAesExchangeKeys[owner.publicKey] || !((_b = owner.hcPartyKeys) === null || _b === void 0 ? void 0 : _b[delegateId])) {
                 return mapOfAesExchangeKeys;
             }
-            const delegate = (yield this.getDataOwner(delegateId)).dataOwner;
+            const delegate = (yield this.dataOwnerApi.getDataOwner(delegateId)).dataOwner;
             if (delegate.publicKey && publicKeys.includes(delegate.publicKey)) {
-                return Object.assign(Object.assign({}, mapOfAesExchangeKeys), { [owner.publicKey]: { [(_c = (yield this.getDataOwner(delegateId)).dataOwner.publicKey) === null || _c === void 0 ? void 0 : _c.slice(-32)]: owner.hcPartyKeys[delegateId][1] } });
+                return Object.assign(Object.assign({}, mapOfAesExchangeKeys), { [owner.publicKey]: { [delegate.publicKey.slice(-32)]: owner.hcPartyKeys[delegateId][1] } });
             }
             else if (publicKeys.includes(owner.publicKey)) {
                 return Object.assign(Object.assign({}, mapOfAesExchangeKeys), { [owner.publicKey]: { [owner.publicKey.slice(-32)]: owner.hcPartyKeys[delegateId][0] } });
@@ -626,455 +394,144 @@ class IccCryptoXApi {
             return mapOfAesExchangeKeys;
         });
     }
-    getOrCreateHcPartyKeys(owner, delegateId) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const aesExchangeKeys = yield this.getEncryptedAesExchangeKeys(owner, delegateId);
-            if (Object.keys(aesExchangeKeys).length) {
-                return { owner, aesExchangeKeys };
-            }
-            const modifiedOwner = yield this.generateKeyForDelegate(owner.id, delegateId);
-            return { owner: modifiedOwner, aesExchangeKeys: yield this.getEncryptedAesExchangeKeys(modifiedOwner, delegateId) };
-        });
-    }
     /**
-     * Retrieve the owners HealthCareParty key, decrypt it, and
-     * use it to encrypt & initialize the "encryptionKeys" object
-     * and return it.
-     * @param createdObject
-     * @param ownerId
+     * @deprecated you should not use this method because initialisation of encrypted entities keys is done automatically by the entity-specific
+     * extended api. Also note that it is now forbidden to initialise an entity as a data owner which is not the current data owner: you should instead
+     * create the entity as the current data owner then create a delegation to the other data owner.
      */
     initEncryptionKeys(createdObject, ownerId) {
-        this.throwDetailedExceptionForInvalidParameter('createdObject.id', createdObject.id, 'initEncryptionKeys', arguments);
-        const secretId = this.randomUuid();
-        return this.getDataOwner(ownerId).then(({ dataOwner: owner }) => __awaiter(this, void 0, void 0, function* () {
-            const publicKeys = yield this.getPublicKeys();
-            const { owner: modifiedOwner, aesExchangeKeys } = yield this.getOrCreateHcPartyKeys(owner, ownerId);
-            const importedAESHcPartyKey = yield this.decryptAnyAesExchangeKeyForOwner(aesExchangeKeys, ownerId, ownerId, ownerId, publicKeys);
-            const encryptedEncryptionKeys = yield this._AES.encrypt(importedAESHcPartyKey.key, (0, binary_utils_1.string2ua)(createdObject.id + ':' + secretId), importedAESHcPartyKey.rawKey);
+        return __awaiter(this, void 0, void 0, function* () {
+            if (ownerId !== (yield this.dataOwnerApi.getCurrentDataOwnerId())) {
+                throw new Error('Impossible to initialise keys as a data owner which is not the current data owner');
+            }
+            const { updatedEntity, rawEncryptionKey } = yield this.entities.entityWithInitialisedEncryptedMetadata(Object.assign(Object.assign({}, createdObject), { delegations: undefined, encryptionKeys: undefined, cryptedForeignKeys: undefined, secretForeignKeys: undefined }), undefined, undefined, true);
             return {
-                encryptionKeys: _.fromPairs([
-                    [
-                        ownerId,
-                        [
-                            {
-                                owner: ownerId,
-                                delegatedTo: ownerId,
-                                key: (0, binary_utils_1.ua2hex)(encryptedEncryptionKeys),
-                            },
-                        ],
-                    ],
-                ]),
-                secretId: secretId,
-                modifiedOwner
+                encryptionKeys: updatedEntity.encryptionKeys,
+                secretId: rawEncryptionKey,
             };
-        }));
+        });
     }
     /**
-     * Gets an updated instance of the EKs of `modifiedObject`.
-     * The updated EKs contain a new EK to provide delegation from delegator HcP with id `ownerId` to delegate HcP with id `delegateId`.
-     * @param modifiedObject : the object of which EKs will be cloned, the clone will be used to append the new EK, and then used as return value; will NOT be mutated
-     * @param ownerId : delegator HcP id
-     * @param delegateId : delegate HcP id
-     * @param secretEncryptionKeyOfObject : secret Id for the EK (Content Encryption Key)
-     * @returns
-     *   - **encryptionKeys** existing EKs of the `modifiedObject`, appended with a new EK item (owner: `ownerId`, delegatedTo: `delegateId`, encrypted key with secretId:
-     *     `secretEncryptionKeyOfObject` )
-     *   - **secretId** which is the given input parameter `secretEncryptionKeyOfObject`
+     * @deprecated You should use:
+     * - {@link IccPatientXApi.decryptSecretIdsOf} or {@link IccMessageXApi.decryptSecretIdsOf} to get the delegation sfks (now caleld secret ids).
+     * - {@link IccDataOwnerXApi.getCurrentDataOwnerHierarchyIds} to get the full hierarchy for the current data owner (cached). The first element is
+     *   the id of the topmost parent, while the last is the current data owner.
+     * Note that the behaviour of this method has some subtle changes compared to the past:
+     * - throws an error if the provided hcpartyId is not part of the current data owner hierarchy.
+     * - does not provide any guarantees on the ordering of the extracted keys
+     * - deduplicates extracted keys
      */
-    appendEncryptionKeys(
-    //TODO: suggested name: getExtendedEKwithDelegationFromDelegatorToDelegate
-    modifiedObject, ownerId, delegateId, secretEncryptionKeyOfObject) {
-        return __awaiter(this, arguments, void 0, function* () {
-            this.throwDetailedExceptionForInvalidParameter('modifiedObject.id', modifiedObject.id, 'appendEncryptionKeys', arguments); //modifiedObject should never be null
-            this.throwDetailedExceptionForInvalidParameter('secretEncryptionKeyOfObject', secretEncryptionKeyOfObject, 'appendEncryptionKeys', arguments);
-            const owner = (yield this.getDataOwner(ownerId)).dataOwner;
-            const publicKeys = yield this.getPublicKeys();
-            const { owner: modifiedOwner, aesExchangeKeys } = yield this.getOrCreateHcPartyKeys(owner, delegateId);
-            modifiedObject = (modifiedObject === null || modifiedObject === void 0 ? void 0 : modifiedObject.id) === owner.id ? modifiedOwner : modifiedObject;
-            const importedAESHcPartyKey = yield this.decryptAnyAesExchangeKeyForOwner(aesExchangeKeys, ownerId, ownerId, delegateId, publicKeys);
-            const previousDecryptedEncryptionKeys = yield Promise.all(((modifiedObject.encryptionKeys || {})[delegateId] || []).map((d) => (d.key &&
-                d.owner === ownerId &&
-                this._AES.decrypt(importedAESHcPartyKey.key, (0, binary_utils_1.hex2ua)(d.key), importedAESHcPartyKey.rawKey).catch(() => {
-                    console.log(`Cannot decrypt encryption key from ${d.owner} to ${d.delegatedTo} for object with id ${modifiedObject.id}:`, modifiedObject);
-                    return Promise.resolve();
-                })) ||
-                Promise.resolve()));
-            const encryptedEncryptionKey = yield this._AES.encrypt(importedAESHcPartyKey.key, (0, binary_utils_1.string2ua)(modifiedObject.id + ':' + secretEncryptionKeyOfObject));
-            //try to limit the extent of the modifications to the delegations by preserving the redundant encryption keys already present and removing duplicates
-            //For delegate delegateId, we create:
-            // 1. an array of objects { d : {owner,delegatedTo,encrypted(key)}} with one object for the existing encryption keys and the new key concatenated
-            // 2. an array of objects { k : decrypted(key)} with one object for the existing delegations and the new key concatenated
-            // We merge them to get one array of objects: { d: {owner,delegatedTo,encrypted(key)}, k: decrypted(key)}
-            const encryptionKeysCryptedDecrypted = _.merge(((modifiedObject.encryptionKeys || {})[delegateId] || []).map((d) => ({
-                d,
-            })), (previousDecryptedEncryptionKeys || []).map((dd) => (dd ? (0, binary_utils_1.ua2string)(dd) : null)).map((k) => ({ k })))
-                .filter(({ d, k }) => !!k || d.owner !== ownerId) //Only keep the ones created by us that can still be decrypted
-                .map(({ d, k }) => ({ d, k: k || this.randomUuid() }))
-                .concat([
-                {
-                    d: {
-                        owner: ownerId,
-                        delegatedTo: delegateId,
-                        key: (0, binary_utils_1.ua2hex)(encryptedEncryptionKey),
-                    },
-                    k: modifiedObject.id + ':' + secretEncryptionKeyOfObject,
-                },
-            ]);
-            const allEncryptionKeys = _.cloneDeep(modifiedObject.encryptionKeys || {});
-            allEncryptionKeys[delegateId] = _.uniqBy(encryptionKeysCryptedDecrypted, (x) => x.k).map((x) => x.d);
+    extractDelegationsSFKs(document, hcpartyId) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (!document || !hcpartyId) {
+                return Promise.resolve({ extractedKeys: [], hcpartyId: hcpartyId });
+            }
+            const delegationsForAllDelegates = document.delegations;
+            if (!delegationsForAllDelegates || !Object.keys(delegationsForAllDelegates).length) {
+                console.log(`There is no delegation in document (${document.id})`);
+                return Promise.resolve({ extractedKeys: [], hcpartyId: hcpartyId });
+            }
             return {
-                modifiedObject: modifiedObject,
-                encryptionKeys: allEncryptionKeys,
-                secretId: secretEncryptionKeyOfObject,
+                extractedKeys: yield this.entities.secretIdsOf(document, hcpartyId),
+                hcpartyId: (yield this.dataOwnerApi.getCurrentDataOwnerHierarchyIds())[0],
             };
         });
     }
     /**
-     * Gets an updated `child` object that will have its SPKs, CFKs, KSs updated to include delegations from delegator HcP with id `ownerId` to delegate HcP with id `delegateId`
-     * The SFKs of `child` are not updated, so this method assumes this is not the initial delegation on the `child` object
-     * The method also performs some deduplication of all types of delegations.
-     * @param parent : the parent object of `child`; will NOT be mutated
-     * @param child : the object that will be mutated and returned
-     * @param ownerId delegator HcP id
-     * @param delegateId delegate HcP id
-     * @param secretDelegationKey  the secret Id used in the child object to generate the SPK
-     * @param secretEncryptionKey  the secret Id used in the child object to generate the EK (Content Encryption Key)
-     * @returns - an updated `child` object that will contain updated SPKs, CFKs, EKs
-     *  */
-    addDelegationsAndEncryptionKeys(
-    //TODO: suggested name: updateChildGenericDelegationsFromDelegatorToDelegate
-    parent, child, ownerId, delegateId, secretDelegationKey, secretEncryptionKey) {
-        return __awaiter(this, arguments, void 0, function* () {
-            if (parent)
-                this.throwDetailedExceptionForInvalidParameter('parent.id', parent.id, 'addDelegationsAndEncryptionKeys', arguments);
-            this.throwDetailedExceptionForInvalidParameter('child.id', child.id, 'addDelegationsAndEncryptionKeys', arguments);
-            const extendedChildObjectSPKsAndCFKs = secretDelegationKey
-                ? yield this.extendedDelegationsAndCryptedForeignKeys(child, parent, ownerId, delegateId, secretDelegationKey)
-                : { modifiedObject: child, delegations: {}, cryptedForeignKeys: {}, secretId: null };
-            const extendedChildObjectEKs = secretEncryptionKey
-                ? yield this.appendEncryptionKeys(extendedChildObjectSPKsAndCFKs.modifiedObject, ownerId, delegateId, secretEncryptionKey)
-                : { encryptionKeys: {}, modifiedObject: extendedChildObjectSPKsAndCFKs.modifiedObject };
-            const latestObject = extendedChildObjectEKs.modifiedObject;
-            return _.assign(latestObject, {
-                // Conservative version ... We might want to be more aggressive with the deduplication of keys
-                // For each delegate, we are going to concatenate to the src (the new delegations), the object in dest (the current delegations)
-                // for which we do not find an equivalent delegation (same delegator, same delegate)
-                delegations: _.assignWith(child.delegations, extendedChildObjectSPKsAndCFKs.delegations, (dest, src) => (src || []).concat(_.filter(dest, (d) => !src.some((s) => s.owner === d.owner && s.delegatedTo === d.delegatedTo)))),
-                cryptedForeignKeys: _.assignWith(child.cryptedForeignKeys, extendedChildObjectSPKsAndCFKs.cryptedForeignKeys, (dest, src) => (src || []).concat(_.filter(dest, (d) => !src.some((s) => s.owner === d.owner && s.delegatedTo === d.delegatedTo)))),
-                encryptionKeys: _.assignWith(child.encryptionKeys, extendedChildObjectEKs.encryptionKeys, (dest, src) => (src || []).concat(_.filter(dest, (d) => !src.some((s) => s.owner === d.owner && s.delegatedTo === d.delegatedTo)))),
-            });
-        });
-    }
-    /**
-     * Gets the secret IDs (SFKs) inside decrypted SPKs of the given `document`, decrypted by the HcP with the given `hcpartyId` AND by its HcP parents
-     * @param document : the object of which delegations (SPKs) to decrypt
-     * @param hcpartyId : the id of the delegate HcP
-     * @returns - **extractedKeys** array containing secret IDs (SFKs) from decrypted SPKs, from both given HcP and its parents ; can contain duplicates
-     * - **hcpartyId** the given `hcpartyId` OR, if a parent exist, the HcP id of the top parent in the hierarchy  (even if that parent has no delegations)
-     */
-    //TODO: even if there are no delegations for parent HCP (but the parent exists), the returned hcpartyId will be the one of the parent; is this ok?
-    extractDelegationsSFKs(
-    //TODO: suggested name: getSecretIDsSPKofHcpAndParentsFromDocument
-    document, hcpartyId) {
-        if (!document || !hcpartyId) {
-            return Promise.resolve({ extractedKeys: [], hcpartyId: hcpartyId }); //TODO: thow exception instead?
-        }
-        const delegationsForAllDelegates = document.delegations;
-        if (!delegationsForAllDelegates || !Object.keys(delegationsForAllDelegates).length) {
-            console.log(`There is no delegation in document (${document.id})`);
-            return Promise.resolve({ extractedKeys: [], hcpartyId: hcpartyId });
-        }
-        return this.extractKeysFromDelegationsForHcpHierarchy(hcpartyId, document.id, delegationsForAllDelegates);
-    }
-    /**
-     * Gets the secret IDs (SFKs) inside decrypted SPKs of the given `document`, decrypted by the HcP with the given `hcpartyId` AND by its HcP parents
-     * @param document : the object of which delegations (SPKs) to decrypt
-     * @param hcpartyId : the id of the delegate HcP
-     * @returns - **extractedKeys** array containing secret IDs (SFKs) from decrypted SPKs, from both given HcP and its parents ; can contain duplicates
-     * - **hcpartyId** the given `hcpartyId` OR, if a parent exist, the HcP id of the top parent in the hierarchy  (even if that parent has no delegations)
-     */
-    extractSFKsHierarchyFromDelegations(document, hcpartyId) {
-        if (!document || !hcpartyId) {
-            return Promise.resolve([]);
-        }
-        const delegationsForAllDelegates = document.delegations;
-        if (!delegationsForAllDelegates || !Object.keys(delegationsForAllDelegates).length) {
-            console.log(`There is no delegation in document (${document.id})`);
-            return Promise.resolve([]);
-        }
-        return this.extractKeysHierarchyFromDelegationLikes(hcpartyId, document.id, delegationsForAllDelegates);
-    }
-    // noinspection JSUnusedGlobalSymbols
-    extractCryptedFKs(
-    //TODO: suggested name: getSecretIDsCFKofHcpAndParentsFromDocument
-    document, hcpartyId) {
-        if (!document || !document.cryptedForeignKeys) {
-            return Promise.resolve({ extractedKeys: [], hcpartyId: hcpartyId });
-        }
-        const cfksForAllDelegates = document.cryptedForeignKeys;
-        if (!cfksForAllDelegates || !Object.keys(cfksForAllDelegates).length) {
-            console.log(`There is no cryptedForeignKeys in document (${document.id})`);
-            return Promise.resolve({ extractedKeys: [], hcpartyId: hcpartyId });
-        }
-        return this.extractKeysFromDelegationsForHcpHierarchy(hcpartyId, document.id, cfksForAllDelegates);
-    }
-    extractEncryptionsSKs(
-    //TODO: suggested name: getSecretIDsEKofHcpAndParentsFromDocument
-    document, hcpartyId) {
-        if (!document.encryptionKeys) {
-            return Promise.resolve({ extractedKeys: [], hcpartyId: hcpartyId });
-        }
-        const eckeysForAllDelegates = document.encryptionKeys;
-        if (!eckeysForAllDelegates || !Object.keys(eckeysForAllDelegates).length) {
-            return Promise.resolve({ extractedKeys: [], hcpartyId: hcpartyId });
-        }
-        return this.extractKeysFromDelegationsForHcpHierarchy(hcpartyId, document.id, eckeysForAllDelegates);
-    }
-    extractDelegationsSFKsAndEncryptionSKs(ety, ownerId) {
-        const delegationsSfksOwnerPromise = this.extractDelegationsSFKs(ety, ownerId).then((xks) => xks.extractedKeys); //Will climb up hierarchy
-        const encryptionKeysOwnerPromise = this.extractEncryptionsSKs(ety, ownerId).then((xks) => xks.extractedKeys); //Will climb up hierarchy
-        return Promise.all([delegationsSfksOwnerPromise, encryptionKeysOwnerPromise]);
-    }
-    /**
-     * Get decrypted generic secret IDs (secretIdSPKs, parentIds, secretIdEKs) from generic delegations (SPKs, CFKs, EKs)
-     * 1. Get HealthCareParty from it's Id.
-     * 2. Decrypt the keys of the given HCP.
-     * 3. Decrypt the parent's key if it has parent.
-     * 4. Return the decrypted key corresponding to the Health Care Party.
-     * @param hcpartyId : the id of the delegate HcP (including its parents) for which to decrypt `extractedKeys`
-     * @param objectId : the id of the object/document of which delegations to decrypt ; used just to log to console a message (Cryptographic mistake) in case the object id inside SPK, CFK, EK is different from this one
-     * @param delegations : generic delegations (can be SPKs, CFKs, EKs) for all delegates from where to extract `extractedKeys`
-     * @returns - **extractedKeys** array containing secret IDs from decrypted generic delegations, from both HCP with given `hcpartyId` and its parents; can contain duplicates
-     * - **hcpartyId** the given `hcpartyId` OR, if a parent exist, the HCP id of the top parent in the hierarchy  (even if that parent has no delegations)
+     * @deprecated (light) You should use:
+     * - {@link IccHelementXApi.decryptPatientIdOf}, {@link IccDocumentXApi.decryptMessageIdOf}, ... to get the crypted foreign keys.
+     * - {@link IccDataOwnerXApi.getCurrentDataOwnerHierarchyIds} to get the full hierarchy for the current data owner (cached). The first element is
+     *   the id of the topmost parent, while the last is the current data owner.
+     * Note that the behaviour of this method has some subtle changes compared to the past:
+     * - throws an error if the provided hcpartyId is not part of the current data owner hierarchy.
+     * - does not provide any guarantees on the ordering of the extracted keys
+     * - deduplicates extracted keys
      */
-    //TODO: even if there are no delegations for parent HCP (but the parent exists), the returned hcpartyId will be the one of the parent
-    extractKeysHierarchyFromDelegationLikes(
-    //TODO suggested name: getSecretIdsOfHcpAndParentsFromGenericDelegations
-    hcpartyId, objectId, delegations) {
-        var _a;
+    extractCryptedFKs(document, hcpartyId) {
         return __awaiter(this, void 0, void 0, function* () {
-            const { dataOwner: hcp } = yield this.getDataOwner(hcpartyId);
-            const extractedKeys = [];
-            if ((_a = delegations[hcpartyId]) === null || _a === void 0 ? void 0 : _a.length) {
-                const decryptedAndImportedAesHcPartyKeys = yield this.getDecryptedAesExchangeKeysOfDelegateAndParentsFromGenericDelegations(hcpartyId, delegations, false);
-                const collatedAesKeysFromDelegatorToHcpartyId = decryptedAndImportedAesHcPartyKeys.reduce((map, k) => { var _a; return (Object.assign(Object.assign({}, map), { [k.delegatorId]: ((_a = map[k.delegatorId]) !== null && _a !== void 0 ? _a : []).concat([k]) })); }, {});
-                extractedKeys.push(...(yield this.decryptKeyInDelegationLikes(delegations[hcpartyId], collatedAesKeysFromDelegatorToHcpartyId, objectId)));
+            if (!document || !document.cryptedForeignKeys) {
+                return Promise.resolve({ extractedKeys: [], hcpartyId: hcpartyId });
+            }
+            const cfksForAllDelegates = document.cryptedForeignKeys;
+            if (!cfksForAllDelegates || !Object.keys(cfksForAllDelegates).length) {
+                console.log(`There is no cryptedForeignKeys in document (${document.id})`);
+                return Promise.resolve({ extractedKeys: [], hcpartyId: hcpartyId });
             }
-            return hcp.parentId
-                ? [
-                    ...(yield this.extractKeysHierarchyFromDelegationLikes(hcp.parentId, objectId, delegations)),
-                    { extractedKeys: extractedKeys, hcpartyId: hcpartyId },
-                ]
-                : [{ extractedKeys: extractedKeys, hcpartyId: hcpartyId }];
+            return {
+                extractedKeys: yield this.entities.owningEntityIdsOf(document, hcpartyId),
+                hcpartyId: (yield this.dataOwnerApi.getCurrentDataOwnerHierarchyIds())[0],
+            };
         });
     }
     /**
-     * Get decrypted generic secret IDs (secretIdSPKs, parentIds, secretIdEKs) from generic delegations (SPKs, CFKs, EKs)
-     * 1. Get Data Owner (HCP, Patient or Device) from it's Id.
-     * 2. Decrypt the keys of the given data owner.
-     * 3. Decrypt the parent's key if it has parent.
-     * 4. Return the decrypted key corresponding to the Health Care Party.
-     * @param dataOwnerId : the id of the delegate data owner (including its parents) for which to decrypt `extractedKeys`
-     * @param objectId : the id of the object/document of which delegations to decrypt ; used just to log to console a message (Cryptographic mistake) in case the object id inside SPK, CFK, EK is different from this one
-     * @param delegations : generic delegations (can be SPKs, CFKs, EKs) for all delegates from where to extract `extractedKeys`
-     * @returns - **extractedKeys** array containing secret IDs from decrypted generic delegations, from both data owner with given `dataOwnerId` and its parents; can contain duplicates
-     * - **dataOwnerId** the given `dataOwnerId` OR, if a parent exist, the data owner id of the top parent in the hierarchy  (even if that parent has no delegations)
+     * @deprecated You should use the extended apis methods to encrypt/decrypt entities or their attachments
+     * Note that the behaviour of this method has some subtle changes compared to the past:
+     * - throws an error if the provided hcpartyId is not part of the current data owner hierarchy.
+     * - does not provide any guarantees on the ordering of the extracted keys
+     * - deduplicates extracted keys
      */
-    //TODO: even if there are no delegations for parent HCP (but the parent exists), the returned dataOwnerId will be the one of the parent
-    extractKeysFromDelegationsForHcpHierarchy(
-    //TODO suggested name: getSecretIdsOfHcpAndParentsFromGenericDelegations
-    dataOwnerId, objectId, delegations) {
-        return this.getDataOwner(dataOwnerId)
-            .then(({ dataOwner: hcp }) => (delegations[dataOwnerId] && delegations[dataOwnerId].length
-            ? this.getDecryptedAesExchangeKeysOfDelegateAndParentsFromGenericDelegations(dataOwnerId, delegations, false).then((decryptedAndImportedAesHcPartyKeys) => {
-                const collatedAesKeysFromDelegatorToHcpartyId = {};
-                decryptedAndImportedAesHcPartyKeys.forEach((k) => {
-                    var _a;
-                    ;
-                    ((_a = collatedAesKeysFromDelegatorToHcpartyId[k.delegatorId]) !== null && _a !== void 0 ? _a : (collatedAesKeysFromDelegatorToHcpartyId[k.delegatorId] = [])).push(k);
-                });
-                return this.decryptKeyInDelegationLikes(delegations[dataOwnerId], collatedAesKeysFromDelegatorToHcpartyId, objectId);
-            })
-            : Promise.resolve([]))
-            .then((extractedKeys) => __awaiter(this, void 0, void 0, function* () {
-            if (extractedKeys.length == 0) {
-                return yield this._extractDelegationsKeysUsingDataOwnerDelegateAesExchangeKeys(hcp, delegations, objectId);
+    extractEncryptionsSKs(document, hcpartyId) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (!document.encryptionKeys) {
+                return Promise.resolve({ extractedKeys: [], hcpartyId: hcpartyId });
+            }
+            const eckeysForAllDelegates = document.encryptionKeys;
+            if (!eckeysForAllDelegates || !Object.keys(eckeysForAllDelegates).length) {
+                return Promise.resolve({ extractedKeys: [], hcpartyId: hcpartyId });
             }
-            return extractedKeys;
-        }))
-            .then((extractedKeys) => __awaiter(this, void 0, void 0, function* () {
-            var _a;
-            const parentExtractedKeys = hcp.parentId
-                ? yield this.extractKeysFromDelegationsForHcpHierarchy(hcp.parentId, objectId, delegations)
-                : { extractedKeys: [], hcpartyId: undefined };
-            return { extractedKeys: extractedKeys.concat(parentExtractedKeys.extractedKeys), hcpartyId: (_a = parentExtractedKeys.hcpartyId) !== null && _a !== void 0 ? _a : dataOwnerId };
-        })))
-            .catch((e) => {
-            console.error(`DataOwner with id ${dataOwnerId} cannot be resolved`);
-            throw e;
+            return {
+                extractedKeys: yield this.entities.encryptionKeysOf(document, hcpartyId),
+                hcpartyId: (yield this.dataOwnerApi.getCurrentDataOwnerHierarchyIds())[0],
+            };
         });
     }
     /**
-     * This method covers the use case when a DataOwner found back access to its data, and needs to use the delegations of its delegates instead
-     * of its own ones
-     *
-     * @param dataOwner The current data owner from whom we want to decrypt the aesExchangeKeys
-     * @param delegations The object delegations to decrypt
-     * @param objectId The object to decrypt id
-     * @private
+     * @deprecated You should not use this method anymore, depending on what you were passing as {@link delegations} you should replace this method as
+     * explained in {@link extractEncryptionsSKs} (if you were passing encryptionKeys), {@link extractCryptedFKs} (cryptedForeignKeys), or
+     * {@link extractDelegationsSFKs} (delegations).
      */
-    _extractDelegationsKeysUsingDataOwnerDelegateAesExchangeKeys(dataOwner, delegations, objectId) {
+    extractKeysFromDelegationsForHcpHierarchy(dataOwnerId, objectId, delegations) {
         return __awaiter(this, void 0, void 0, function* () {
-            // Find other keys through aesExchangeKeys
-            const dataOwnerPubKeys = yield this.getPublicKeys();
-            const keysToDecrypt = (0, utils_1.fold)(Object.entries(dataOwner.aesExchangeKeys), {}, (acc, [pub, aesForPub]) => {
-                if (dataOwnerPubKeys.find((pubKey) => pubKey.slice(-32) == pub.slice(-32)) == undefined) {
-                    // We get AES Keys only from delegates of keys we don't currently have
-                    // Otherwise, decrypted AES Keys would have previously worked
-                    Object.entries(aesForPub).forEach(([delegateId, aesKeys]) => {
-                        if (delegateId != dataOwner.id) {
-                            const aesAcc = {};
-                            Object.entries(aesKeys)
-                                .filter(([encrPubKey]) => dataOwnerPubKeys.some((pubKey) => pubKey.slice(-32) == encrPubKey))
-                                .forEach(([pubKeyFingerprint, aesEncr]) => {
-                                aesAcc[pubKeyFingerprint] = aesEncr;
-                            });
-                            if (acc[delegateId] == undefined) {
-                                acc[delegateId] = {};
-                            }
-                            acc[delegateId][pub] = aesAcc;
-                        }
-                    });
-                }
-                return acc;
-            });
-            const decryptedAndImportedAesHcPartyKeys = yield (0, utils_1.foldAsync)(Object.entries(keysToDecrypt), [], (delKeysAcc, [delegateId, keysForDelegate]) => __awaiter(this, void 0, void 0, function* () {
-                try {
-                    delKeysAcc.push(yield this.decryptAnyAesExchangeKeyForOwner(keysForDelegate, dataOwner.id, dataOwner.id, delegateId, dataOwnerPubKeys));
-                }
-                catch (e) {
-                    console.log(`Could not decrypt aesExchangeKeys for delegate ${delegateId}`);
-                }
-                return delKeysAcc;
-            }));
-            const collatedAesKeysFromDelegatorToHcpartyId = decryptedAndImportedAesHcPartyKeys.reduce((map, k) => { var _a; return (Object.assign(Object.assign({}, map), { [k.delegatorId]: ((_a = map[k.delegatorId]) !== null && _a !== void 0 ? _a : []).concat([k]) })); }, {});
-            const delegateIdsWithNewExtractedAesKeys = Object.keys(keysToDecrypt);
-            const delegationsToDecrypt = (0, utils_1.fold)(Object.entries(delegations), [], (acc, [delegateId, del]) => {
-                if (delegateIdsWithNewExtractedAesKeys.find((id) => id == delegateId) != undefined) {
-                    acc.push(...delegations[delegateId]);
-                }
-                return acc;
-            });
-            return this.decryptKeyInDelegationLikes(delegationsToDecrypt, collatedAesKeysFromDelegatorToHcpartyId, objectId);
+            return {
+                extractedKeys: yield this.entities.extractMergedHierarchyFromDelegationAndOwner(delegations, dataOwnerId, (x) => !!x, () => Promise.resolve(true)),
+                hcpartyId: (yield this.dataOwnerApi.getCurrentDataOwnerHierarchyIds())[0],
+            };
         });
     }
     /**
-     * Gets an array of generic secret IDs decrypted from a list of generic delegations (SPKs, CFKs, EKs) `delegationsArray`
-     * If a particular generic delegation thows an exception when decrypted, the return value for it's secret ID will be 'false' and a message is logged to console
-     * For each one of the delegations in the `delegationsArray`, it tries to decrypt with the decryptedHcPartyKey of the owner of that delegation;
-     *
-     * @param delegationsArray : generic delegations array
-     * @param aesKeys : **key** HcP ids of delegators/owners in the `delegationsArray`, each with its own decryptedHcPartyKey
-     * @param masterId : is the object id to which the generic delegation belongs to
-     * - used only to check whether the object.id matches the one stored in the decrypted generic delegation item
-     * - even if there's no match, the secret ID is kept as a valid result (and a message logged to console)
-     * @returns array of generic secret IDs (secretIdSPK, parentId, secretIdEK)
+     * @deprecated you should not need this method anymore: the new API will automatically load on startup all keys available through the key storage
+     * facade and/or recoverable through transfer keys or shamir split. If you were using this method to load a key recovered through other means you
+     * will have to do so in your implementation of CryptoStrategies.
+     * You can convert the private key pkcs8 array to a jwk key using {@link pkcs8ToJwk} then you can extract the full key pair using
+     * {@link keyPairFromPrivateKeyJwk}.
      */
-    decryptKeyInDelegationLikes(
-    //TODO: suggested name: getSecretIdsFromGenericDelegations
-    delegationsArray, aesKeysForDataOwnerId, masterId) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const decryptPromises = delegationsArray.map((genericDelegationItem) => __awaiter(this, void 0, void 0, function* () {
-                const aesKeys = aesKeysForDataOwnerId[genericDelegationItem.owner];
-                if (aesKeys === null || aesKeys === void 0 ? void 0 : aesKeys.length) {
-                    return aesKeys.reduce((acc, aesKey) => __awaiter(this, void 0, void 0, function* () {
-                        const accValue = yield acc;
-                        if (accValue) {
-                            return accValue;
-                        }
-                        try {
-                            const decryptedGenericDelegationKey = yield this._AES.decrypt(aesKey.key, (0, binary_utils_1.hex2ua)(genericDelegationItem.key), aesKey.rawKey);
-                            const results = (0, binary_utils_1.ua2string)(decryptedGenericDelegationKey).split(':');
-                            const objectId = results[0]; //must be the ID of the object, for checksum
-                            const genericSecretId = results[1];
-                            const details = 'object ID: ' + masterId + '; generic delegation from ' + genericDelegationItem.owner + ' to ' + genericDelegationItem.delegatedTo;
-                            if (!objectId)
-                                console.warn('Object id is empty; ' + details);
-                            if (!genericSecretId)
-                                console.warn('Secret id is empty; ' + details);
-                            if (objectId !== masterId) {
-                                /*console.log(
-                                  "Cryptographic mistake: object ID is not equal to the expected concatenated id within decrypted generic delegation. This may happen when patients have been merged; " +
-                                    details
-                                )*/
-                            }
-                            return genericSecretId;
-                        }
-                        catch (err) {
-                            console.log(`Could not decrypt generic delegation in object with ID: ${masterId} from ${genericDelegationItem.owner} to ${genericDelegationItem.delegatedTo}: ${err}`);
-                            return undefined;
-                        }
-                    }), Promise.resolve(undefined));
-                }
-                else {
-                    console.log(`Could not find aes key for object with ID: ${masterId}`);
-                }
-            }));
-            return Promise.all(decryptPromises).then((genericSecretId) => genericSecretId.filter((id) => !!id));
-        });
-    }
-    getPublicKeyFromPrivateKey(privateKey, dataOwner) {
-        var _a;
-        if (!privateKey.n || !privateKey.e) {
-            throw new Error('No public key can be deduced from incomplete private key');
-        }
-        const publicKeyFromPrivateKey = (0, utils_1.jwk2spki)(privateKey);
-        const publicKeys = [dataOwner.publicKey].concat(Object.keys((_a = dataOwner.aesExchangeKeys) !== null && _a !== void 0 ? _a : {})).filter((x) => !!x);
-        if (!publicKeys.length) {
-            throw new Error('No public key has been defined for hcp');
-        }
-        const publicKey = publicKeys.find((it) => it === publicKeyFromPrivateKey);
-        if (!publicKey) {
-            throw new Error('No public key can be found for this private key');
-        }
-        return publicKey;
-    }
     loadKeyPairsAsTextInBrowserLocalStorage(healthcarePartyId, privateKey) {
         return __awaiter(this, void 0, void 0, function* () {
-            const { dataOwner } = yield this.getDataOwner(healthcarePartyId);
-            const privateKeyInJwk = (0, utils_1.pkcs8ToJwk)(privateKey);
-            const publicKey = this.getPublicKeyFromPrivateKey(privateKeyInJwk, dataOwner);
-            const keyPair = yield this._RSA.importKeyPair('jwk', privateKeyInJwk, 'jwk', (0, utils_1.spkiToJwk)((0, binary_utils_1.hex2ua)(publicKey)));
-            this.rsaKeyPairs[publicKey.slice(-32)] = keyPair;
-            const exportedKeyPair = yield this._RSA.exportKeys(keyPair, 'jwk', 'jwk');
-            return yield this._keyStorage.storeKeyPair(`${this.rsaLocalStoreIdPrefix}${healthcarePartyId}.${publicKey.slice(-32)}`, exportedKeyPair);
+            yield this.cacheKeyPair((0, utils_1.keyPairFromPrivateKeyJwk)((0, utils_1.pkcs8ToJwk)(privateKey)));
         });
     }
+    /**
+     * @deprecated you should not need this method anymore: the new API will automatically load on startup all keys available through the key storage
+     * facade and/or recoverable through transfer keys or shamir split. If you were using this method to load a key recovered through other means you
+     * will have to do so in your implementation of CryptoStrategies.
+     * You can extract the full key pair using {@link keyPairFromPrivateKeyJwk}.
+     */
     loadKeyPairsAsJwkInBrowserLocalStorage(healthcarePartyId, privateKey) {
         return __awaiter(this, void 0, void 0, function* () {
-            const { dataOwner } = yield this.getDataOwner(healthcarePartyId);
-            if ((!privateKey.n || !privateKey.e) && dataOwner.publicKey) {
-                //Fallback on default publicKey
-                console.warn('An incomplete key has been completed using the default public key of the data owner');
-                const publicKeyInJwk = (0, utils_1.spkiToJwk)((0, binary_utils_1.hex2ua)(dataOwner.publicKey));
-                privateKey.n = publicKeyInJwk.n;
-                privateKey.e = publicKeyInJwk.e;
-            }
-            const publicKey = this.getPublicKeyFromPrivateKey(privateKey, dataOwner);
-            const keyPair = yield this._RSA.importKeyPair('jwk', privateKey, 'jwk', (0, utils_1.spkiToJwk)((0, binary_utils_1.hex2ua)(publicKey)));
-            this.rsaKeyPairs[publicKey.slice(-32)] = keyPair;
-            const exportedKeyPair = yield this._RSA.exportKeys(keyPair, 'jwk', 'jwk');
-            return yield this._keyStorage.storeKeyPair(`${this.rsaLocalStoreIdPrefix}${healthcarePartyId}.${publicKey.slice(-32)}`, exportedKeyPair);
+            yield this.cacheKeyPair((0, utils_1.keyPairFromPrivateKeyJwk)(privateKey));
         });
     }
-    // noinspection JSUnusedGlobalSymbols
+    /**
+     * @deprecated you should not need this method anymore: the new API will automatically load on startup all keys available through the key storage
+     * facade and/or recoverable through transfer keys or shamir split. If you were using this method to load a key recovered through other means you
+     * will have to do so in your implementation of CryptoStrategies.
+     */
     loadKeyPairsInBrowserLocalStorage(healthcarePartyId, file) {
         const fr = new FileReader();
         return new Promise((resolve, reject) => {
             fr.onerror = reject;
             fr.onabort = reject;
             fr.onload = (e) => {
-                //TODO remove any
                 const privateKey = e.target.result;
                 this.loadKeyPairsAsTextInBrowserLocalStorage(healthcarePartyId, (0, binary_utils_1.hex2ua)(privateKey))
                     .then(() => resolve())
@@ -1084,13 +541,22 @@ class IccCryptoXApi {
         });
     }
     // noinspection JSUnusedGlobalSymbols
+    /**
+     * @deprecated keychains are not part of iCure's api: this method will be removed.
+     */
     saveKeychainInBrowserLocalStorage(id, keychain) {
         this._storage.setItem(this.keychainLocalStoreIdPrefix + id, (0, binary_utils_1.b2a)(new Uint8Array(keychain).reduce((data, byte) => data + String.fromCharCode(byte), '')));
     }
+    /**
+     * @deprecated keychains are not part of iCure's api: this method will be removed.
+     */
     saveKeychainInBrowserLocalStorageAsBase64(id, keyChainB64) {
         this._storage.setItem(this.keychainLocalStoreIdPrefix + id, keyChainB64);
     }
     // noinspection JSUnusedGlobalSymbols
+    /**
+     * @deprecated keychains are not part of iCure's api: this method will be removed.
+     */
     saveKeychainValidityDateInBrowserLocalStorage(id, date) {
         return __awaiter(this, void 0, void 0, function* () {
             if (!id)
@@ -1104,6 +570,8 @@ class IccCryptoXApi {
         });
     }
     /**
+     * @deprecated keychains are not part of iCure's api: this method will be removed.
+     *
      * Populate the HCP.options dict with an encrypted eHealth certificate and unencryped expiry date.
      * Any potentially unencrypted certificates will be pruned from the HCP.
      * @param hcpId Id of the hcp to modify
@@ -1144,6 +612,9 @@ class IccCryptoXApi {
             }));
         });
     }
+    /**
+     * @deprecated keychains are not part of iCure's api: this method will be removed.
+     */
     importKeychainInBrowserFromHCP(hcpId) {
         return this.hcpartyBaseApi.getHealthcareParty(hcpId).then((hcp) => __awaiter(this, void 0, void 0, function* () {
             let crtCryp = null;
@@ -1184,6 +655,8 @@ class IccCryptoXApi {
         }));
     }
     /**
+     * @deprecated e-health certificates and keychains are not part of iCure's api: this method will be removed.
+     *
      * Synchronizes the eHealth certificate from the database into the LocalStorage, returning information on the presence
      * of certificate data in either place.
      *
@@ -1205,13 +678,21 @@ class IccCryptoXApi {
             }
         });
     }
+    /**
+     * @deprecated keychains are not part of iCure's api: this method will be removed.
+     */
     getKeychainInBrowserLocalStorageAsBase64(id) {
         return this._storage.getItem(this.keychainLocalStoreIdPrefix + id);
     }
+    /**
+     * @deprecated keychains are not part of iCure's api: this method will be removed.
+     */
     getKeychainValidityDateInBrowserLocalStorage(id) {
         return this._storage.getItem(this.keychainValidityDateLocalStoreIdPrefix + id);
     }
-    // noinspection JSUnusedGlobalSymbols
+    /**
+     * @deprecated keychains are not part of iCure's api: this method will be removed.
+     */
     loadKeychainFromBrowserLocalStorage(id) {
         return __awaiter(this, void 0, void 0, function* () {
             const lsItem = yield this._storage.getItem(this.keychainLocalStoreIdPrefix + id);
@@ -1219,410 +700,62 @@ class IccCryptoXApi {
         });
     }
     /**
-     * loads the RSA key pair (hcparty) in JWK from local storage, not imported
-     *
-     * @param id  doc id - hcpartyId
-     * @param publicKeyFingerPrint the 32 last characters of public key this private key is associated with
-     * @returns {Object} it is in JWK - not imported
+     * @deprecated you should not need this method anymore to deal with the encryption of iCure entities because everything related to entities
+     * encryption should be done through the entity-specific extended api.
+     * If instead you were using the method for other reasons check {@link getCachedRsaKeyPairForFingerprint} to get an idea of possible replacements.
      */
     loadKeyPairNotImported(id, publicKeyFingerPrint) {
         var _a;
         return __awaiter(this, void 0, void 0, function* () {
-            //TODO decryption
-            const item = publicKeyFingerPrint
-                ? (_a = (yield this._keyStorage.getKeypair(this.rsaLocalStoreIdPrefix + id + '.' + publicKeyFingerPrint.slice(-32)))) !== null && _a !== void 0 ? _a : (yield this._keyStorage.getKeypair(this.rsaLocalStoreIdPrefix + id))
-                : yield this._keyStorage.getKeypair(this.rsaLocalStoreIdPrefix + id);
-            if (!item) {
-                console.warn(`No key can be found in local storage for id ${id} and publicKeyFingerPrint ${publicKeyFingerPrint}`);
-            }
-            return item;
-        });
-    }
-    /**
-     * Loads and imports the RSA key pair (hcparty) from local storage
-     *
-     * @param id  doc id - hcPartyId
-     * @returns {Promise} -> {CryptoKey} - imported RSA
-     */
-    loadKeyPairImported(id) {
-        return new Promise((resolve, reject) => __awaiter(this, void 0, void 0, function* () {
-            try {
-                const jwkKeyPair = yield this._keyStorage.getKeypair(this.rsaLocalStoreIdPrefix + id);
-                if (jwkKeyPair !== undefined) {
-                    if (jwkKeyPair.publicKey && jwkKeyPair.privateKey) {
-                        this._RSA.importKeyPair('jwk', jwkKeyPair.privateKey, 'jwk', jwkKeyPair.publicKey).then(resolve, (err) => {
-                            console.error('Error in RSA.importKeyPair: ' + err);
-                            reject(err);
-                        });
-                    }
-                    else {
-                        const message = 'Error in RSA.importKeyPair: Invalid key';
-                        console.error(message);
-                        reject(Error(message));
-                    }
-                }
-                else {
-                    const message = 'Error in RSA.importKeyPair: Missing key';
-                    console.error(message);
-                    reject(Error(message));
+            if (publicKeyFingerPrint) {
+                const cached = (_a = this.keyManager.getKeyPairForFingerprint(publicKeyFingerPrint)) === null || _a === void 0 ? void 0 : _a.pair;
+                if (cached) {
+                    return this.primitives.RSA.exportKeys(cached, 'jwk', 'jwk');
                 }
             }
-            catch (err) {
-                reject(err);
+            else {
+                const defaultKey = yield this._keyStorage.getKeypair(this.rsaLocalStoreIdPrefix + id);
+                if (defaultKey)
+                    return defaultKey;
             }
-        }));
+            console.warn(`No key can be found in local storage for id ${id} and publicKeyFingerPrint ${publicKeyFingerPrint}`);
+        });
     }
     /**
-     * When a user lost his keys, people to whom he shared information may call this method to give access back to him, re-encrypting their common
-     * AES key using the new user public key.
-     *
-     * @param delegateUser Delegate Data Owner User, in charge of giving access back to the person who previously gave him some access
-     * @param ownerId Id of the data owner to which we would like to give access back
-     * @param ownerNewPublicKey New Data Owner Public Key we want to use to re-encrypt previously created AES key
-     *
-     * @return The DataOwner, updated by the delegateUser to add the new encrypted AES Key using the new provided public key
+     * @deprecated use {@link IccIcureMaintenanceXApi.applyKeyPairUpdate} instead.
      */
     giveAccessBackTo(delegateUser, ownerId, ownerNewPublicKey) {
-        var _a, _b, _c, _d;
-        return __awaiter(this, void 0, void 0, function* () {
-            const delegateId = (_b = (_a = delegateUser.healthcarePartyId) !== null && _a !== void 0 ? _a : delegateUser.patientId) !== null && _b !== void 0 ? _b : delegateUser.deviceId;
-            if (!delegateId) {
-                throw new Error(`DelegateUser ${delegateUser.id} must be a data Owner`);
-            }
-            const delegatePublicKeys = yield this.getPublicKeys();
-            const newPubKeyCryptoKey = yield this._RSA.importKey('jwk', (0, utils_1.spkiToJwk)((0, binary_utils_1.hex2ua)(ownerNewPublicKey)), ['encrypt']);
-            const dataOwnerToUpdate = yield this.getDataOwner(ownerId);
-            const newAesExchangeKeys = yield (0, utils_1.foldAsync)(Object.entries((_c = dataOwnerToUpdate.dataOwner.aesExchangeKeys) !== null && _c !== void 0 ? _c : {}), (_d = dataOwnerToUpdate.dataOwner.aesExchangeKeys) !== null && _d !== void 0 ? _d : {}, (pubAcc, [pubKey, newAesExcKeys]) => __awaiter(this, void 0, void 0, function* () {
-                var _e;
-                const existingKeys = (_e = pubAcc[pubKey]) !== null && _e !== void 0 ? _e : {};
-                pubAcc[pubKey] = yield (0, utils_1.foldAsync)(Object.entries(newAesExcKeys), existingKeys, (delAcc, [delId, delKeys]) => __awaiter(this, void 0, void 0, function* () {
-                    if (delId == delegateId && pubKey != ownerNewPublicKey) {
-                        // Add the AES Key encrypted with the new public key in the aesExchangeKeys
-                        try {
-                            // First, we decrypt it using the delegate RSA Public Key
-                            const encrAesKeyInfo = yield this.decryptHcPartyKey(delegateId, dataOwnerToUpdate.dataOwner.id, delegateId, pubKey, delKeys, delegatePublicKeys).then((delegatorAndKeys) => __awaiter(this, void 0, void 0, function* () {
-                                // Then, we encrypt it using the owner new RSA Public Key (provided in argument)
-                                return yield this.encryptAesKeyOnlyForProvidedKeys(delegatorAndKeys === null || delegatorAndKeys === void 0 ? void 0 : delegatorAndKeys.rawKey, dataOwnerToUpdate, [newPubKeyCryptoKey])
-                                    .then((encrAes) => Object.values(encrAes)[0])
-                                    .then((encrAesInfo) => {
-                                    return { pubKeyUsedToEncryptAes: Object.keys(encrAesInfo)[0], encryptedAes: Object.values(encrAesInfo)[0] };
-                                });
-                            }));
-                            delKeys[encrAesKeyInfo.pubKeyUsedToEncryptAes] = encrAesKeyInfo.encryptedAes;
-                        }
-                        catch (e) {
-                            console.log(`${delegateId} could not re-encrypt AES Key of ${dataOwnerToUpdate.dataOwner.id}`);
-                        }
-                        finally {
-                            delAcc[delId] = delKeys;
-                        }
-                    }
-                    else {
-                        // Otherwise, we don't transform the aesExchangeKeys for this delegate
-                        delAcc[delId] = delKeys;
-                    }
-                    return delAcc;
-                }));
-                return pubAcc;
-            }));
-            // After adding the potential new aesExchangeKeys, we save the updated data owner
-            return this._saveDataOwner({
-                type: dataOwnerToUpdate.type,
-                dataOwner: Object.assign(Object.assign({}, dataOwnerToUpdate.dataOwner), { aesExchangeKeys: newAesExchangeKeys }),
-            });
-        });
-    }
-    addNewKeyPairForOwnerId(maintenanceTasksApi, user, ownerId, generateTransferKey = true, sendMaintenanceTasks = true) {
-        return __awaiter(this, void 0, void 0, function* () {
-            return this.addNewKeyPairForOwner(maintenanceTasksApi, user, yield this.getDataOwner(ownerId), generateTransferKey, sendMaintenanceTasks);
-        });
-    }
-    addNewKeyPairForOwner(maintenanceTasksApi, user, cdo, generateTransferKey = true, sendMaintenanceTasks = true) {
         return __awaiter(this, void 0, void 0, function* () {
-            const generatedKeypair = yield this.RSA.generateKeyPair();
-            return this.addKeyPairForOwner(maintenanceTasksApi, user, cdo, generatedKeypair, generateTransferKey, sendMaintenanceTasks);
+            yield this.exchangeKeys.base.giveAccessBackTo(ownerId, ownerNewPublicKey, this.userKeysManager.getDecryptionKeys());
+            return this.dataOwnerApi.getDataOwner(ownerId);
         });
     }
-    addRawKeyPairForOwnerId(maintenanceTasksApi, user, ownerId, keypair, generateTransferKey = true, sendMaintenanceTasks = true) {
-        return __awaiter(this, void 0, void 0, function* () {
-            return this.addRawKeyPairForOwner(maintenanceTasksApi, user, yield this.getDataOwner(ownerId), keypair, generateTransferKey, sendMaintenanceTasks);
-        });
-    }
-    addRawKeyPairForOwner(maintenanceTasksApi, user, cdo, keypair, generateTransferKey = true, sendMaintenanceTasks = true) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const importedPrivateKey = yield this._RSA.importKey('pkcs8', (0, binary_utils_1.hex2ua)(keypair.privateKey), ['decrypt']);
-            const importedPublicKey = yield this._RSA.importKey('spki', (0, binary_utils_1.hex2ua)(keypair.publicKey), ['encrypt']);
-            return this.addKeyPairForOwner(maintenanceTasksApi, user, cdo, { publicKey: importedPublicKey, privateKey: importedPrivateKey }, generateTransferKey, sendMaintenanceTasks);
-        });
-    }
-    addKeyPairForOwner(maintenanceTasksApi, user, cdo, keypair, generateTransferKey = true, sendMaintenanceTasks = true) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const publicKeyHex = (0, binary_utils_1.ua2hex)(yield this.RSA.exportKey(keypair.publicKey, 'spki'));
-            const gen = (yield this._AES.generateCryptoKey(true));
-            yield this.cacheKeyPair({
-                publicKey: yield this.RSA.exportKey(keypair.publicKey, 'jwk'),
-                privateKey: yield this.RSA.exportKey(keypair.privateKey, 'jwk'),
-            });
-            const { type: ownerType, dataOwner: ownerToUpdate } = yield this.createOrUpdateAesExchangeKeysFor(cdo, gen, {
-                pubKey: keypair.publicKey,
-                privKey: keypair.privateKey,
-            }).then((dataOwnerWithUpdatedAesKeys) => __awaiter(this, void 0, void 0, function* () {
-                return generateTransferKey
-                    ? yield this.createOrUpdateTransferKeysFor(dataOwnerWithUpdatedAesKeys, gen, { pubKey: keypair.publicKey, privKey: keypair.privateKey })
-                    : dataOwnerWithUpdatedAesKeys;
-            }));
-            const modifiedDataOwnerAndType = yield this._saveDataOwner({ type: ownerType, dataOwner: ownerToUpdate });
-            const sentMaintenanceTasks = sendMaintenanceTasks
-                ? yield this.sendMaintenanceTasks(maintenanceTasksApi, user, modifiedDataOwnerAndType.dataOwner, keypair.publicKey)
-                : [];
-            return {
-                dataOwner: sentMaintenanceTasks.length
-                    ? yield this.retrieveDataOwnerInfoAfterPotentialUpdate(modifiedDataOwnerAndType.dataOwner)
-                    : modifiedDataOwnerAndType.dataOwner,
-                publicKey: publicKeyHex,
-                privateKey: (0, binary_utils_1.ua2hex)((yield this.RSA.exportKey(keypair.privateKey, 'pkcs8'))),
-            };
-        });
-    }
-    _saveDataOwner(dataOwner) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const ownerType = dataOwner.type;
-            const ownerToUpdate = dataOwner.dataOwner;
-            return ownerType === 'hcp'
-                ? yield (this.dataOwnerCache[ownerToUpdate.id] = this.hcpartyBaseApi
-                    .modifyHealthcareParty(ownerToUpdate)
-                    .then((x) => ({ type: 'hcp', dataOwner: x })))
-                : ownerType === 'patient'
-                    ? yield (this.dataOwnerCache[ownerToUpdate.id] = this.patientBaseApi
-                        .modifyPatient(ownerToUpdate)
-                        .then((x) => ({ type: 'patient', dataOwner: x })))
-                    : yield (this.dataOwnerCache[ownerToUpdate.id] = this.deviceBaseApi
-                        .updateDevice(ownerToUpdate)
-                        .then((x) => ({ type: 'device', dataOwner: x })));
-        });
-    }
-    createOrUpdateAesExchangeKeysFor(cdo, decryptedAesExchangeKey, keyToEncrypt) {
-        var _a;
-        return __awaiter(this, void 0, void 0, function* () {
-            const publicKeyHex = (0, binary_utils_1.ua2hex)(yield this.RSA.exportKey(keyToEncrypt.pubKey, 'spki'));
-            const existingAesExchangeKeys = (_a = cdo.dataOwner.aesExchangeKeys) !== null && _a !== void 0 ? _a : {};
-            existingAesExchangeKeys[publicKeyHex] = yield this.encryptAesKeyFor(decryptedAesExchangeKey, cdo.dataOwner, keyToEncrypt.pubKey);
-            return { type: cdo.type, dataOwner: Object.assign(Object.assign({}, cdo.dataOwner), { aesExchangeKeys: existingAesExchangeKeys }) };
-        });
-    }
-    createOrUpdateTransferKeysFor(dataOwner, decryptedAesExchangeKey, keyToEncrypt) {
-        var _a;
-        return __awaiter(this, void 0, void 0, function* () {
-            const pubKeyToEncryptHex = (0, binary_utils_1.ua2hex)(yield this.RSA.exportKey(keyToEncrypt.pubKey, 'spki'));
-            const encryptedKey = (0, binary_utils_1.ua2hex)(yield this._AES.encrypt(yield this._AES.importKey('raw', (0, binary_utils_1.hex2ua)(decryptedAesExchangeKey)), (yield this.RSA.exportKey(keyToEncrypt.privKey, 'pkcs8')), decryptedAesExchangeKey));
-            const dataOwnerExistingPubKeys = Array.from(yield this.getDataOwnerHexPublicKeys(dataOwner.dataOwner));
-            const transferKeys = (0, utils_1.fold)(dataOwnerExistingPubKeys, (_a = dataOwner.dataOwner.transferKeys) !== null && _a !== void 0 ? _a : {}, (pubAcc, pubKeyHex) => {
-                var _a;
-                if (pubKeyHex !== pubKeyToEncryptHex) {
-                    const existingKeys = (_a = pubAcc[pubKeyHex]) !== null && _a !== void 0 ? _a : {};
-                    existingKeys[pubKeyToEncryptHex] = encryptedKey;
-                    pubAcc[pubKeyHex] = existingKeys;
-                }
-                return pubAcc;
-            });
-            return { type: dataOwner.type, dataOwner: Object.assign(Object.assign({}, dataOwner.dataOwner), { transferKeys: transferKeys }) };
-        });
-    }
-    encryptAesKeyFor(aesKey, dataOwner, doNewPublicKey) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const dataOwnerAllPubKeys = [doNewPublicKey].concat(yield this.getDataOwnerPublicKeys(dataOwner));
-            return this.encryptAesKeyOnlyForProvidedKeys(aesKey, dataOwner, dataOwnerAllPubKeys);
-        });
-    }
-    encryptAesKeyOnlyForProvidedKeys(aesKey, dataOwner, dataOwnerPubKeys) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const encryptedAesForDataOwner = yield (0, utils_1.foldAsync)(dataOwnerPubKeys, {}, (encrAes, pubKey) => __awaiter(this, void 0, void 0, function* () {
-                encrAes[(0, binary_utils_1.ua2hex)(yield this.RSA.exportKey(pubKey, 'spki')).slice(-32)] = (0, binary_utils_1.ua2hex)(yield this._RSA.encrypt(pubKey, (0, binary_utils_1.hex2ua)(aesKey)));
-                return encrAes;
-            }));
-            return { [dataOwner.id]: encryptedAesForDataOwner };
-        });
-    }
-    retrieveDataOwnerInfoAfterPotentialUpdate(dataOwnerToUpdate) {
-        this.emptyHcpCache(dataOwnerToUpdate.id);
-        return this.getDataOwner(dataOwnerToUpdate.id).then(({ type, dataOwner }) => {
-            var _a, _b, _c, _d;
-            return {
-                type: type,
-                dataOwner: Object.assign(Object.assign({}, dataOwner), { transferKeys: dataOwnerToUpdate.transferKeys, hcPartyKeys: (0, utils_1.fold)(Object.entries((_a = dataOwnerToUpdate.hcPartyKeys) !== null && _a !== void 0 ? _a : {}), (_b = dataOwner.hcPartyKeys) !== null && _b !== void 0 ? _b : {}, (acc, [delegateId, hcKeys]) => {
-                        acc[delegateId] = hcKeys;
-                        return acc;
-                    }), aesExchangeKeys: (0, utils_1.fold)(Object.entries((_c = dataOwnerToUpdate.aesExchangeKeys) !== null && _c !== void 0 ? _c : {}), (_d = dataOwner.aesExchangeKeys) !== null && _d !== void 0 ? _d : {}, (pubAcc, [pubKey, newAesExcKeys]) => {
-                        var _a;
-                        const existingKeys = (_a = pubAcc[pubKey]) !== null && _a !== void 0 ? _a : {};
-                        pubAcc[pubKey] = (0, utils_1.fold)(Object.entries(newAesExcKeys), existingKeys, (delAcc, [delId, delKeys]) => {
-                            delAcc[delId] = delKeys;
-                            return delAcc;
-                        });
-                        return pubAcc;
-                    }) }),
-            };
-        });
-    }
-    sendMaintenanceTasks(maintenanceTaskApi, user, dataOwner, newPublicKey) {
+    /**
+     * @deprecated You don't need to manually generate exchange keys as they will be automatically created by the api when needed.
+     * Note that this method has some changes compared to previous version:
+     * - The method may return any data owner (including devices)
+     * - The method will throw an exception if the provided ownerId does not match the current data owner
+     */
+    generateKeyForDelegate(ownerId, delegateId) {
+        var _a, _b;
         return __awaiter(this, void 0, void 0, function* () {
-            const hexNewPubKey = (0, binary_utils_1.ua2hex)(yield this.RSA.exportKey(newPublicKey, 'spki'));
-            const nonAccessiblePubKeys = Array.from(this.getDataOwnerHexPublicKeys(dataOwner).values())
-                .filter((existingPubKey) => existingPubKey != hexNewPubKey)
-                .filter((existingPubKey) => __awaiter(this, void 0, void 0, function* () { return (yield this.getPublicKeysAsSpki()).find((pubKey) => pubKey == existingPubKey) == undefined; }));
-            if (nonAccessiblePubKeys.length) {
-                const tasksForDelegates = Object.entries(yield this.getEncryptedAesExchangeKeysForDelegate(dataOwner.id))
-                    .filter(([delegatorId]) => delegatorId != dataOwner.id)
-                    .flatMap(([delegatorId, delegatorKeys]) => {
-                    return Object.entries(delegatorKeys).flatMap(([, aesExchangeKeys]) => {
-                        return Object.keys(aesExchangeKeys).map((delegatePubKey) => {
-                            return { delegateId: delegatorId, maintenanceTask: this.createMaintenanceTask(dataOwner, delegatePubKey) };
-                        });
-                    });
-                });
-                const tasksForDelegator = (yield this._getDelegateIdsOf(dataOwner))
-                    .filter((delegateId) => delegateId != dataOwner.id)
-                    .map((delegateId) => {
-                    return { delegateId: delegateId, maintenanceTask: this.createMaintenanceTask(dataOwner, hexNewPubKey) };
-                });
-                return yield tasksForDelegates.concat(tasksForDelegator).reduce((existingTasks, task) => __awaiter(this, void 0, void 0, function* () {
-                    const taskToCreate = yield (maintenanceTaskApi === null || maintenanceTaskApi === void 0 ? void 0 : maintenanceTaskApi.newInstance(user, task.maintenanceTask, [task.delegateId]));
-                    const createdTask = taskToCreate ? yield (maintenanceTaskApi === null || maintenanceTaskApi === void 0 ? void 0 : maintenanceTaskApi.createMaintenanceTaskWithUser(user, taskToCreate)) : undefined;
-                    return createdTask ? (yield existingTasks).concat(createdTask) : yield existingTasks;
-                }), Promise.resolve([]));
-            }
-            else {
-                return [];
+            if (ownerId !== (yield this.dataOwnerApi.getCurrentDataOwnerId())) {
+                throw new Error('You can only create delegation where the delegator is the current data owner');
             }
+            return ((_b = (_a = (yield this.exchangeKeysManager.getOrCreateEncryptionExchangeKeysTo(delegateId)).updatedDelegator) === null || _a === void 0 ? void 0 : _a.dataOwner) !== null && _b !== void 0 ? _b : (yield this.dataOwnerApi.getDataOwner(ownerId)).dataOwner);
         });
     }
-    createMaintenanceTask(concernedDataOwner, concernedPubKey) {
-        return new models_1.MaintenanceTask({
-            id: this.randomUuid(),
-            taskType: 'KEY_PAIR_UPDATE',
-            status: models_1.MaintenanceTask.StatusEnum.Pending,
-            properties: [
-                new models_1.PropertyStub({
-                    id: 'dataOwnerConcernedId',
-                    type: new models_1.PropertyTypeStub({ type: models_1.PropertyTypeStub.TypeEnum.STRING }),
-                    typedValue: new models_1.TypedValueObject({
-                        type: models_1.TypedValueObject.TypeEnum.STRING,
-                        stringValue: concernedDataOwner.id,
-                    }),
-                }),
-                new models_1.PropertyStub({
-                    id: 'dataOwnerConcernedPubKey',
-                    type: new models_1.PropertyTypeStub({ type: models_1.PropertyTypeStub.TypeEnum.STRING }),
-                    typedValue: new models_1.TypedValueObject({
-                        type: models_1.TypedValueObject.TypeEnum.STRING,
-                        stringValue: concernedPubKey,
-                    }),
-                }),
-            ],
-        });
-    }
-    getDataOwnerHexPublicKeys(dataOwner) {
-        return new Set((dataOwner.publicKey ? [dataOwner.publicKey] : [])
-            .concat(dataOwner.aesExchangeKeys ? Object.keys(dataOwner.aesExchangeKeys) : [])
-            .filter((pubKey) => !!pubKey));
-    }
-    getDataOwnerPublicKeys(dataOwner) {
-        return __awaiter(this, void 0, void 0, function* () {
-            return yield Promise.all(Array.from(this.getDataOwnerHexPublicKeys(dataOwner)).map((pubKey) => __awaiter(this, void 0, void 0, function* () { return yield this._RSA.importKey('jwk', (0, utils_1.spkiToJwk)((0, binary_utils_1.hex2ua)(pubKey)), ['encrypt']); })));
-        });
-    }
-    generateKeyForDelegate(ownerId, delegateId) {
-        //Preload hcp and patient because we need them and they are going to be invalidated from the caches
-        return (0, utils_1.notConcurrent)(this.generateKeyConcurrencyMap, ownerId, () => __awaiter(this, void 0, void 0, function* () {
-            var _a, _b, _c, _d, _e;
-            const [{ type: ownerType, dataOwner: owner }, { dataOwner: delegate }] = yield Promise.all([
-                this.getDataOwner(ownerId),
-                this.getDataOwner(delegateId),
-            ]);
-            const availablePublicKeysFingerprints = Object.keys(this.rsaKeyPairs);
-            const ownerLegacyPublicKey = owner.publicKey;
-            const isOwnerLegacyPublicKeyAvailable = ownerLegacyPublicKey
-                ? availablePublicKeysFingerprints.some((fp) => ownerLegacyPublicKey.endsWith(fp))
-                : false;
-            const availableOwnerPublicKeys = [
-                ownerLegacyPublicKey,
-                ...Object.keys(owner.aesExchangeKeys || {}).filter((x) => x !== ownerLegacyPublicKey),
-            ].filter((k) => !!k && availablePublicKeysFingerprints.some((fp) => k.endsWith(fp)));
-            const selectedPublicKey = availableOwnerPublicKeys[0];
-            if (!selectedPublicKey) {
-                throw new Error(`Invalid owner, no public key, keypairs have not be set for ${ownerId}`);
-            }
-            if (((owner.hcPartyKeys || {})[delegateId] && owner.publicKey && availablePublicKeysFingerprints.includes(owner.publicKey.slice(-32))) ||
-                Object.values(owner.aesExchangeKeys || {}).some((x) => x[delegateId] && Object.keys(x[delegateId]).some((k) => availablePublicKeysFingerprints.includes(k)))) {
-                return owner;
-            }
-            let ownerCombinedAesExchangeKeys = (_a = owner.aesExchangeKeys) !== null && _a !== void 0 ? _a : {};
-            if (ownerLegacyPublicKey && !((_b = owner.aesExchangeKeys) !== null && _b !== void 0 ? _b : {})[ownerLegacyPublicKey]) {
-                //Transfer keys from old structure (hcparty keys) to new one (aesExchangeKeys)
-                const unknownDataOwnerCounterPartIds = Object.keys((_c = owner.hcPartyKeys) !== null && _c !== void 0 ? _c : {}).filter((x) => x !== ownerId && x !== delegateId);
-                const counterParts = [
-                    owner,
-                    delegate,
-                    ...(yield Promise.all(unknownDataOwnerCounterPartIds.map((cpid) => this.getDataOwner(cpid).then((dot) => dot.dataOwner)))),
-                ];
-                ownerCombinedAesExchangeKeys = Object.assign({ [ownerLegacyPublicKey]: Object.entries((_d = owner.hcPartyKeys) !== null && _d !== void 0 ? _d : {}).reduce((map, [hcpId, keys]) => {
-                        var _a, _b;
-                        return (Object.assign(Object.assign(Object.assign({}, map), { [hcpId]: { [ownerLegacyPublicKey.slice(-32)]: keys[0], [(_b = (_a = counterParts.find((x) => x.id === hcpId)) === null || _a === void 0 ? void 0 : _a.publicKey) !== null && _b !== void 0 ? _b : '']: keys[1] } }), {}));
-                    }, {}) }, ownerCombinedAesExchangeKeys);
-            }
-            const delegatePublicKeys = [delegate.publicKey, ...Object.keys((_e = delegate.aesExchangeKeys) !== null && _e !== void 0 ? _e : {}).filter((x) => x !== delegate.publicKey)].filter((x) => !!x);
-            if (!delegatePublicKeys.length) {
-                throw new Error(`Invalid delegate, no public key, keypairs have not be set for ${delegateId}`);
-            }
-            const genProm = this._AES.generateCryptoKey(true).then((AESKey) => __awaiter(this, void 0, void 0, function* () {
-                var _f, _g;
-                const allPubKeys = [...availableOwnerPublicKeys, ...delegatePublicKeys];
-                const encryptedAesKeys = yield allPubKeys.reduce((map, pubK) => __awaiter(this, void 0, void 0, function* () {
-                    return (Object.assign(Object.assign({}, (yield map)), { [pubK.slice(-32)]: (0, binary_utils_1.ua2hex)(yield this._RSA.encrypt(yield this._RSA.importKey('jwk', (0, utils_1.spkiToJwk)((0, binary_utils_1.hex2ua)(pubK)), ['encrypt']), (0, binary_utils_1.hex2ua)(AESKey))) }));
-                }), Promise.resolve({}));
-                if (delegate.publicKey && ownerLegacyPublicKey && isOwnerLegacyPublicKeyAvailable) {
-                    owner.hcPartyKeys[delegateId] = [encryptedAesKeys[ownerLegacyPublicKey.slice(-32)], encryptedAesKeys[delegate.publicKey.slice(-32)]];
-                }
-                owner.aesExchangeKeys = this.fixAesExchangeKeyEntriesToFingerprints(Object.assign(Object.assign({}, (ownerCombinedAesExchangeKeys !== null && ownerCombinedAesExchangeKeys !== void 0 ? ownerCombinedAesExchangeKeys : {})), { [selectedPublicKey]: Object.assign(Object.assign({}, ((_g = (_f = owner.aesExchangeKeys) === null || _f === void 0 ? void 0 : _f[selectedPublicKey]) !== null && _g !== void 0 ? _g : {})), { [delegateId]: encryptedAesKeys }) }));
-                return new Promise((resolve, reject) => {
-                    ownerType === 'hcp'
-                        ? (this.dataOwnerCache[owner.id] = this.hcpartyBaseApi
-                            .modifyHealthcareParty(owner)
-                            .then((x) => ({ type: 'hcp', dataOwner: x })))
-                            .then((x) => resolve(['hcp', x.dataOwner]))
-                            .catch((e) => reject(e))
-                        : ownerType === 'patient'
-                            ? (this.dataOwnerCache[owner.id] = this.patientBaseApi.modifyPatient(owner).then((x) => ({ type: 'patient', dataOwner: x })))
-                                .then((x) => resolve(['patient', x.dataOwner]))
-                                .catch((e) => reject(e))
-                            : (this.dataOwnerCache[owner.id] = this.deviceBaseApi.updateDevice(owner).then((x) => ({ type: 'device', dataOwner: x })))
-                                .then((x) => resolve(['device', x.dataOwner]))
-                                .catch((e) => reject(e));
-                });
-            }));
-            this.hcPartyKeysRequestsCache[delegateId] = genProm.then(() => {
-                return this.forceGetEncryptedAesExchangeKeysForDelegate(delegateId);
-            });
-            return genProm.then((res) => {
-                return res[1];
-            });
-        }));
-    }
+    /**
+     * @deprecated replace with {@link IccDataOwnerXApi.getDataOwner}. Note that data owners are not cached anymore.
+     */
     getDataOwner(ownerId, loadIfMissingFromCache = true) {
-        var _a;
-        return ((_a = this.dataOwnerCache[ownerId]) !== null && _a !== void 0 ? _a : (loadIfMissingFromCache
-            ? (this.dataOwnerCache[ownerId] = this.patientBaseApi
-                .getPatient(ownerId)
-                .then((x) => ({ type: 'patient', dataOwner: x }))
-                .catch(() => this.deviceBaseApi.getDevice(ownerId).then((x) => ({ type: 'device', dataOwner: x })))
-                .catch(() => this.hcpartyBaseApi.getHealthcareParty(ownerId).then((x) => ({ type: 'hcp', dataOwner: x })))
-                .catch((e) => {
-                delete this.dataOwnerCache[ownerId];
-                throw e;
-            }))
-            : undefined));
+        return this.dataOwnerApi.getDataOwner(ownerId);
     }
-    // noinspection JSUnusedGlobalSymbols
+    /**
+     * @deprecated the crypto api will automatically verify on startup the validity of private keys, but in some cases you may want to verify the
+     * validity of keys recovered in your implementation of {@link CryptoStrategies}: in this case the method has been replaced with
+     * {@link RSA.checkKeyPairValidity}
+     */
     checkPrivateKeyValidity(dataOwner) {
         var _a;
         return __awaiter(this, void 0, void 0, function* () {
@@ -1630,10 +763,10 @@ class IccCryptoXApi {
             return yield publicKeys.reduce((pres, publicKey) => __awaiter(this, void 0, void 0, function* () {
                 const res = yield pres;
                 try {
-                    const k = yield this._RSA.importKey('jwk', (0, utils_1.spkiToJwk)((0, binary_utils_1.hex2ua)(publicKey)), ['encrypt']);
-                    const cipher = yield this._RSA.encrypt(k, (0, binary_utils_1.utf8_2ua)('shibboleth'));
+                    const k = yield this.primitives.RSA.importKey('jwk', (0, utils_1.spkiToJwk)((0, binary_utils_1.hex2ua)(publicKey)), ['encrypt']);
+                    const cipher = yield this.primitives.RSA.encrypt(k, (0, binary_utils_1.utf8_2ua)('shibboleth'));
                     const ikp = yield this.getCachedRsaKeyPairForFingerprint(dataOwner.id, publicKey.slice(-32));
-                    const plainText = (0, binary_utils_1.ua2utf8)(yield this._RSA.decrypt(ikp.privateKey, new Uint8Array(cipher)));
+                    const plainText = (0, binary_utils_1.ua2utf8)(yield this.primitives.RSA.decrypt(ikp.privateKey, new Uint8Array(cipher)));
                     return plainText === 'shibboleth' || res;
                 }
                 catch (e) {
@@ -1642,61 +775,34 @@ class IccCryptoXApi {
             }), Promise.resolve(false));
         });
     }
-    throwDetailedExceptionForInvalidParameter(argName, argValue, methodName, methodArgs) {
-        if (argValue)
-            return;
-        let details = '\nMethod name: icc-crypto-x-api.' + methodName + '()\nArguments:';
-        if (methodArgs) {
-            try {
-                const argsArray = [...methodArgs];
-                _.each(argsArray, (arg, index) => (details += '\n[' + index + ']: ' + JSON.stringify(arg)));
-            }
-            catch (ex) {
-                details += '; a problem occured while logging arguments details: ' + ex;
-            }
-        }
-        throw '### THIS SHOULD NOT HAPPEN: ' + argName + ' has an invalid value: ' + argValue + details;
-    }
+    /**
+     * @deprecated (See {@link extractEncryptionsSKs} for a detailed explanation).
+     */
     getEncryptionDecryptionKeys(dataOwnerId, document) {
         return __awaiter(this, void 0, void 0, function* () {
-            try {
-                return !document.id
-                    ? undefined
-                    : _.uniq((yield this.extractKeysFromDelegationsForHcpHierarchy(dataOwnerId, document.id, (document.encryptionKeys && Object.keys(document.encryptionKeys).length && document.encryptionKeys) || document.delegations)).extractedKeys);
-            }
-            catch (e) {
-                return undefined;
-            }
-        });
-    }
-    dataOwnerCanDecryptPatient(dataOwnerId, p) {
-        var _a, _b;
-        return __awaiter(this, void 0, void 0, function* () {
-            if (p.encryptionKeys && ((_a = p.encryptionKeys[dataOwnerId]) === null || _a === void 0 ? void 0 : _a.length))
-                return true;
-            const dataOwner = yield this.getDataOwner(dataOwnerId);
-            if (dataOwner.type === 'hcp' && p.encryptionKeys && ((_b = p.encryptionKeys[dataOwner.dataOwner.parentId]) === null || _b === void 0 ? void 0 : _b.length))
-                return true;
-            return false;
+            return this.entities.encryptionKeysOf(document, dataOwnerId);
         });
     }
+    /**
+     * @deprecated For the encryption/decryption of iCure entities and attachments you should rely solely on the extended apis methods.
+     */
     encryptDecrypt(method, content, edKey, user, documentObject) {
         return __awaiter(this, void 0, void 0, function* () {
             if (!content || !(edKey || ((user === null || user === void 0 ? void 0 : user.healthcarePartyId) && documentObject)))
                 return content;
             if (edKey) {
-                const importedEdKey = yield this._AES.importKey('raw', (0, binary_utils_1.hex2ua)(edKey.replace(/-/g, '')));
+                const importedEdKey = yield this.primitives.AES.importKey('raw', (0, binary_utils_1.hex2ua)(edKey.replace(/-/g, '')));
                 try {
-                    return yield this._AES[method](importedEdKey, content);
+                    return yield this.primitives.AES[method](importedEdKey, content);
                 }
                 catch (e) {
                     return content;
                 }
             }
-            const sfks = yield this.extractKeysFromDelegationsForHcpHierarchy(user === null || user === void 0 ? void 0 : user.healthcarePartyId, documentObject === null || documentObject === void 0 ? void 0 : documentObject.id, documentObject === null || documentObject === void 0 ? void 0 : documentObject.encryptionKeys);
-            const importedEdKey = yield this._AES.importKey('raw', (0, binary_utils_1.hex2ua)(sfks.extractedKeys[0].replace(/-/g, '')));
+            const encryptionKeys = yield this.entities.encryptionKeysOf(documentObject, user === null || user === void 0 ? void 0 : user.healthcarePartyId);
+            const importedEdKey = yield this.primitives.AES.importKey('raw', (0, binary_utils_1.hex2ua)(encryptionKeys[0].replace(/-/g, '')));
             try {
-                return yield this._AES[method](importedEdKey, content);
+                return yield this.primitives.AES[method](importedEdKey, content);
             }
             catch (e) {
                 return content;
@@ -1704,28 +810,11 @@ class IccCryptoXApi {
         });
     }
     /**
-     * Store keypair in storage
-     *
-     * @param id
-     * @param keyPair should be JWK
-     *
-     * @deprecated use storage.setItem instead
+     * @deprecated you should not need to interact directly with the storage instance used by the iCure sdk.
      */
     storeKeyPair(id, keyPair) {
         this._storage.setItem(this.rsaLocalStoreIdPrefix + id, JSON.stringify(keyPair));
     }
-    fixAesExchangeKeyEntriesToFingerprints(aesExchangeKeys) {
-        return Object.fromEntries(Object.entries(aesExchangeKeys).map(([delegatorPubKey, allDelegates]) => [
-            delegatorPubKey,
-            Object.fromEntries(Object.entries(allDelegates).map(([delegateId, keyEntries]) => [
-                delegateId,
-                Object.fromEntries(Object.entries(keyEntries).map(([publicKey, encryptedValue]) => [
-                    publicKey.slice(-32),
-                    encryptedValue
-                ]))
-            ]))
-        ]));
-    }
 }
 exports.IccCryptoXApi = IccCryptoXApi;
 //# sourceMappingURL=icc-crypto-x-api.js.map