@majikah/majik-message 0.3.6 → 0.3.8

package/dist/majik-message.js

@@ -1,39 +1,48 @@
 // MajikMessage.ts
-import { MajikContact, } from "@majikah/majik-contact";
-import { KEY_ALGO } from "./core/crypto/constants";
 import { MessageEnvelope } from "./core/messages/message-envelope";
 import { EnvelopeCache, } from "./core/messages/envelope-cache";
-import { MajikKeyStore } from "./core/crypto/keystore";
-import { arrayBufferToBase64, arrayToBase64, base64ToArrayBuffer, base64ToUint8Array, } from "./core/utils/utilities";
-import { autoSaveMajikFileData, loadSavedMajikFileData, } from "./core/utils/majik-file-utils";
+import { arrayToBase64, base64ToUint8Array } from "./core/utils/utilities";
 import { randomBytes } from "@stablelib/random";
-import { clearAllBlobs, idbLoadBlob, idbSaveBlob, } from "./core/utils/idb-majik-system";
 import { MajikMessageChat } from "./core/database/chat/majik-message-chat";
 import { MajikKey } from "@majikah/majik-key";
 import { MajikEnvelope, } from "@majikah/majik-envelope";
 import { MajikFile, MajikFileError, } from "@majikah/majik-file";
 import { MajikSignature, } from "@majikah/majik-signature";
-import { gzipSync, gunzipSync } from "fflate";
-import { MajikContactManager } from "./core/contacts/majik-contact-manager";
+import { MajikContactManager, } from "./core/contacts/majik-contact-manager";
+import { InMemoryClientStateAdapter, InMemoryKeystoreAdapter, } from "./core/storage";
+import { MajikKeyManager } from "./core/crypto/keystore-manager";
+import { ClientStateManager } from "./core/client-state-manager";
 // ─── MajikMessage ─────────────────────────────────────────────────────────────
 export class MajikMessage {
-    userProfile = "default";
-    id;
-    contacts;
+    _id;
+    _db;
+    _contacts;
+    _keys;
+    _state;
     envelopeCache;
-    listeners = new Map();
-    ownAccounts = new Map();
-    ownAccountsOrder = [];
-    autosaveTimer = null;
-    autosaveIntervalId = null;
-    autosaveIntervalMs = 15_000;
-    autosaveDebounceMs = 500;
-    constructor(config, id, userProfile = "default") {
-        this.userProfile = userProfile || "default";
-        this.id = id || arrayToBase64(randomBytes(32));
-        this.contacts = config.contactManager ?? new MajikContactManager();
-        this.envelopeCache =
-            config.envelopeCache || new EnvelopeCache(undefined, userProfile);
+    _listeners = new Map();
+    /** MajikContact instances for accounts this client owns. */
+    _ownAccounts = new Map();
+    /**
+     * Ordered list of own account IDs — head is the active account.
+     * Source of truth is ClientStateManager; this array is the in-memory
+     * working copy kept in sync on every mutation.
+     */
+    _ownAccountsOrder = [];
+    _autosaveOrderTimer = null;
+    constructor(config, id) {
+        this._id = id || arrayToBase64(randomBytes(32));
+        this._db = config.dbSQL || null;
+        this.envelopeCache = config.envelopeCache || new EnvelopeCache(undefined);
+        this._contacts =
+            config.contactManager ??
+                new MajikContactManager(undefined, undefined, config.adapters?.contacts);
+        this._keys =
+            config.keyManager ??
+                new MajikKeyManager(config.adapters?.keys ?? new InMemoryKeystoreAdapter());
+        this._state =
+            config.clientStateManager ??
+                new ClientStateManager(config.adapters?.clientState ?? new InMemoryClientStateAdapter());
         const events = [
             "message",
             "envelope",
@@ -48,16 +57,105 @@ export class MajikMessage {
             "contact-group-change",
             "active-account-change",
         ];
-        events.forEach((e) => this.listeners.set(e, []));
-        this.attachAutosaveHandlers();
+        events.forEach((e) => this._listeners.set(e, []));
+    }
+    /** Expose the key manager so callers can share it with other clients. */
+    get keyManager() {
+        return this._keys;
+    }
+    /** Expose the client state manager for direct access if needed. */
+    get stateManager() {
+        return this._state;
+    }
+    // ── Hydration ─────────────────────────────────────────────────────────────
+    /**
+     * Load all domains from their adapters and restore client state.
+     * Call once on startup.
+     *
+     * ```ts
+     * const client = new MajikBuwizClient({ adapters: { keys: idbAdapter, ... } });
+     * await client.hydrate();
+     * ```
+     */
+    async hydrate() {
+        // 1. Keys — load into manager cache
+        await this._keys.hydrate();
+        // 2. Contacts + groups
+        await this._contacts.hydrate();
+        // 4. Client state — account order, invoice defaults, etc.
+        await this._state.hydrate();
+        // 5. Own accounts — rebuild from keys loaded in step 1
+        await this._hydrateOwnAccounts();
+        // 6. Account order — restore from state manager, prune stale IDs
+        await this._restoreAccountOrder();
+    }
+    // ── Private hydration helpers ─────────────────────────────────────────────
+    async _hydrateOwnAccounts() {
+        const keys = this._keys.list();
+        for (const key of keys) {
+            if (!this._ownAccounts.has(key.id)) {
+                try {
+                    const contact = key.toContact();
+                    if (!this._contacts.hasContact(contact.id)) {
+                        await this._contacts.addContact(contact);
+                    }
+                    this._ownAccounts.set(key.id, contact);
+                    if (!this._ownAccountsOrder.includes(key.id)) {
+                        this._ownAccountsOrder.push(key.id);
+                    }
+                }
+                catch (err) {
+                    console.warn(`MajikBuwizClient: failed to hydrate own account "${key.id}":`, err);
+                }
+            }
+        }
+    }
+    async _restoreAccountOrder() {
+        try {
+            const saved = await this._state.getAccountOrder();
+            if (saved) {
+                // Prune IDs that no longer exist, then append any new ones at the tail
+                const valid = saved.filter((id) => this._ownAccounts.has(id));
+                const appended = this._ownAccountsOrder.filter((id) => !valid.includes(id));
+                this._ownAccountsOrder = [...valid, ...appended];
+            }
+        }
+        catch {
+            // Non-fatal — order defaults to insertion order from _hydrateOwnAccounts
+        }
+    }
+    _scheduleOrderSave() {
+        if (this._autosaveOrderTimer !== null) {
+            window.clearTimeout(this._autosaveOrderTimer);
+        }
+        this._autosaveOrderTimer = window.setTimeout(() => {
+            void this._persistAccountOrder();
+            this._autosaveOrderTimer = null;
+        }, 300);
+    }
+    async _persistAccountOrder() {
+        try {
+            await this._state.setAccountOrder(this._ownAccountsOrder);
+        }
+        catch (err) {
+            console.warn("MajikBuwizClient: failed to persist account order:", err);
+        }
+    }
+    /**
+     * Construct a client and immediately hydrate it.
+     */
+    static async create(config = {}) {
+        const client = new this(config);
+        await client.hydrate();
+        return client;
     }
     /**
      * Resolve a list of account/contact IDs into MajikRecipient objects.
-     * Each recipient needs their ML-KEM public key from MajikKeyStore.
+     * Each recipient needs their ML-KEM public key from this.keyManager.
      */
     async _resolveRecipientsByPublicKey(publicKeys) {
         return Promise.all(publicKeys.map(async (pkey) => {
-            const contact = await this.contacts.getContactByPublicKeyBase64(pkey);
+            const contact = await this._contacts.getContactByPublicKeyBase64(pkey);
             if (!contact)
                 throw new Error(`No contact found for public key "${pkey}"`);
             const mlPubKey = base64ToUint8Array(contact.mlKey);
@@ -76,8 +174,8 @@ export class MajikMessage {
      * Ensures the account is unlocked and has ML-KEM keys.
      */
     async _resolveIdentity(id, promptFn) {
-        await MajikKeyStore.ensureUnlocked(id, promptFn);
-        const key = MajikKeyStore.get(id);
+        await this.keyManager.ensureUnlocked(id, promptFn);
+        const key = this.keyManager.get(id);
         if (!key)
             throw new Error(`Account not found: ${id}`);
         if (!key.hasMlKem) {
@@ -102,8 +200,8 @@ export class MajikMessage {
         const id = accountId ?? this.getActiveAccount()?.id;
         if (!id)
             throw new Error("No active account — call setActiveAccount() first");
-        await MajikKeyStore.ensureUnlocked(id);
-        const key = MajikKeyStore.get(id);
+        await this.keyManager.ensureUnlocked(id);
+        const key = this.keyManager.get(id);
         if (!key)
             throw new Error(`Account not found in keystore: "${id}"`);
         if (!key.hasMlKem) {
@@ -127,7 +225,7 @@ export class MajikMessage {
      */
     async _resolveFileRecipientsByPublicKey(publicKeys) {
         return Promise.all(publicKeys.map(async (pkey) => {
-            const contact = await this.contacts.getContactByPublicKeyBase64(pkey);
+            const contact = await this._contacts.getContactByPublicKeyBase64(pkey);
             if (!contact)
                 throw new Error(`No contact found for public key "${pkey}"`);
             const mlPubKey = base64ToUint8Array(contact.mlKey);
@@ -148,69 +246,113 @@ export class MajikMessage {
             ? window.location.hostname
             : "extension";
     }
-    // ── Account Management ────────────────────────────────────────────────────
-    generateMnemonic() {
-        return MajikKeyStore.generateMnemonic();
+    // ==========================================================================
+    // ── ACCOUNT MANAGEMENT ────────────────────────────────────────────────────
+    // ==========================================================================
+    generateMnemonic(strength = 128) {
+        return MajikKeyManager.generateMnemonic(strength);
     }
-    async exportAccountMnemonicBackup(id, mnemonic) {
-        return MajikKeyStore.exportMnemonicBackup(id, mnemonic);
+    async createAccount(mnemonic, passphrase, label) {
+        try {
+            const key = await MajikKey.create(mnemonic, passphrase, label);
+            await this._keys.save(key);
+            const contact = key.toContact();
+            this._registerOwnAccount(contact);
+            this._emit("new-account", contact);
+            return { id: key.id, fingerprint: key.fingerprint, backup: key.backup };
+        }
+        catch (err) {
+            this._emit("error", err, { context: "createAccount" });
+            throw err;
+        }
     }
-    /**
-     * Import an account from a mnemonic-encrypted backup.
-     * Fully upgrades to Argon2id KDF + ML-KEM keys in one step.
-     */
     async importAccountFromMnemonicBackup(backupBase64, mnemonic, passphrase, label) {
-        const key = await MajikKeyStore.importFromMnemonicBackup(backupBase64, mnemonic, passphrase, label);
-        if (this.getOwnAccountById(key.id)) {
-            throw new Error("Account with the same ID already exists");
+        try {
+            const key = await this._keys.importFromMnemonicBackup(backupBase64, mnemonic, passphrase, label);
+            if (this.getOwnAccountById(key.id)) {
+                throw new Error("Account with the same ID already exists");
+            }
+            const contact = key.toContact();
+            this._registerOwnAccount(contact);
+            this._emit("new-account", contact);
+            return { id: key.id, fingerprint: key.fingerprint };
         }
-        const keyContact = key.toContact();
-        this.addOwnAccount(keyContact);
-        return { id: key.id, fingerprint: key.fingerprint };
-    }
-    /**
-     * Create a new account from a mnemonic, store it encrypted with passphrase.
-     */
-    async createAccountFromMnemonic(mnemonic, passphrase, label) {
-        const key = await MajikKey.create(mnemonic, passphrase, label);
-        await MajikKeyStore.addMajikKey(key);
-        const keyContact = key.toContact();
-        this.addOwnAccount(keyContact);
-        return { id: key.id, fingerprint: key.fingerprint, backup: key.backup };
-    }
-    addOwnAccount(account) {
-        if (!this.ownAccounts.has(account.id)) {
-            this.ownAccounts.set(account.id, account);
-            this.ownAccountsOrder.push(account.id);
+        catch (err) {
+            this._emit("error", err, { context: "importAccountFromMnemonicBackup" });
+            throw err;
         }
+    }
+    async replaceAccountFromMnemonicBackup(backupBase64, mnemonic, passphrase, label) {
         try {
-            if (!this.contacts.hasContact(account.id)) {
-                this.contacts.addContact(account);
+            const currentAccount = this.getActiveAccountKey();
+            const currentContact = this.getActiveAccount();
+            const finalLabel = label?.trim() || currentContact?.meta?.label;
+            // 1. Import first (no mutation yet)
+            const key = await this._keys.importFromMnemonicBackup(backupBase64, mnemonic, passphrase, finalLabel);
+            // 2. Prevent duplicate (except self-replace)
+            if (this.getOwnAccountById(key.id) && key.id !== currentAccount?.id) {
+                throw new Error("Account with the same ID already exists");
             }
-            if (!this.getActiveAccount()) {
-                this.setActiveAccount(account.id);
+            const contact = key.toContact();
+            // 3. Remove old account if different
+            if (currentAccount && currentAccount.id !== key.id) {
+                await this.removeOwnAccount(currentAccount.id);
             }
-            this.emit("new-account", account);
+            // 4. Register new account
+            this._registerOwnAccount(contact);
+            // 5. Set active
+            await this.setActiveAccount(contact.id, true);
+            this._emit("new-account", contact);
+            return { id: key.id, fingerprint: key.fingerprint };
         }
-        catch {
-            // ignore if contact can't be added
+        catch (err) {
+            this._emit("error", err, {
+                context: "replaceAccountFromMnemonicBackup",
+            });
+            throw err;
         }
-        this.scheduleAutosave();
     }
-    listOwnAccounts(majikahOnly = false) {
-        let accounts = this.ownAccountsOrder
-            .map((id) => this.ownAccounts.get(id))
-            .filter((c) => !!c);
-        if (majikahOnly) {
-            accounts = accounts.filter((a) => this.isContactMajikahRegistered(a.id));
-        }
-        return accounts;
+    async exportAccountMnemonicBackup(id, mnemonic) {
+        return this._keys.exportMnemonicBackup(id, mnemonic);
+    }
+    addOwnAccount(account) {
+        this._registerOwnAccount(account);
+        this._emit("new-account", account);
+    }
+    async removeOwnAccount(id) {
+        if (!this._ownAccounts.has(id))
+            return false;
+        this._ownAccounts.delete(id);
+        const idx = this._ownAccountsOrder.indexOf(id);
+        if (idx > -1)
+            this._ownAccountsOrder.splice(idx, 1);
+        await this._contacts.removeContact(id);
+        await this._keys.delete(id);
+        this._scheduleOrderSave();
+        this._emit("removed-account", id);
+        return true;
     }
     getOwnAccountById(id) {
-        return this.ownAccounts.get(id);
+        return this._ownAccounts.get(id);
+    }
+    getActiveAccount() {
+        if (!this._ownAccountsOrder.length)
+            return null;
+        return this._ownAccounts.get(this._ownAccountsOrder[0]) ?? null;
+    }
+    getActiveAccountKey() {
+        if (!this._ownAccountsOrder.length)
+            return null;
+        const activeKey = this._keys.get(this._ownAccountsOrder[0]);
+        if (!activeKey)
+            return null;
+        return activeKey;
+    }
+    isAccountActive(id) {
+        return this._ownAccounts.has(id) && this._ownAccountsOrder[0] === id;
     }
     async setActiveAccount(id, bypassIdentity = false) {
-        if (!this.ownAccounts.has(id))
+        if (!this._ownAccounts.has(id))
             return false;
         if (!bypassIdentity) {
             try {
@@ -221,474 +363,244 @@ export class MajikMessage {
             }
         }
         const previousActive = this.getActiveAccount()?.id;
-        const index = this.ownAccountsOrder.indexOf(id);
+        const index = this._ownAccountsOrder.indexOf(id);
         if (index > -1)
-            this.ownAccountsOrder.splice(index, 1);
-        this.ownAccountsOrder.unshift(id);
-        this.scheduleAutosave();
+            this._ownAccountsOrder.splice(index, 1);
+        this._ownAccountsOrder.unshift(id);
+        this._scheduleOrderSave();
         if (previousActive !== id) {
-            this.emit("active-account-change", this.getActiveAccount(), previousActive);
+            this._emit("active-account-change", this.getActiveAccount(), previousActive);
         }
         return true;
     }
-    getActiveAccount() {
-        if (!this.ownAccountsOrder.length)
-            return null;
-        return this.ownAccounts.get(this.ownAccountsOrder[0]) ?? null;
+    listOwnAccounts(majikahOnly = false) {
+        let accounts = this._ownAccountsOrder
+            .map((id) => this._ownAccounts.get(id))
+            .filter((c) => !!c);
+        if (majikahOnly) {
+            accounts = accounts.filter((a) => this.isContactMajikahRegistered(a.id));
+        }
+        return accounts;
     }
-    isAccountActive(id) {
-        return !!this.ownAccounts.has(id) && this.ownAccountsOrder[0] === id;
+    isContactMajikahRegistered(id) {
+        return this._contacts.isMajikahRegistered(id);
     }
-    removeOwnAccount(id) {
-        if (!this.ownAccounts.has(id))
-            return false;
-        this.ownAccounts.delete(id);
-        const idx = this.ownAccountsOrder.indexOf(id);
-        if (idx > -1)
-            this.ownAccountsOrder.splice(idx, 1);
-        this.removeContact(id);
-        this.envelopeCache.deleteByFingerprint(id).catch(() => { });
-        this.emit("removed-account", id);
-        this.scheduleAutosave();
-        return true;
+    isContactMajikahIdentityChecked(id) {
+        return this._contacts.isMajikahIdentityChecked(id);
     }
-    async hasOwnIdentity(fingerprint) {
-        return MajikKeyStore.hasIdentity(fingerprint);
+    setContactMajikahStatus(id, status) {
+        this._contacts.setMajikahStatus(id, status);
     }
-    async updatePassphrase(currentPassphrase, newPassphrase, id) {
-        const target = id ? this.getOwnAccountById(id) : this.getActiveAccount();
-        if (!target)
-            throw new Error("No target account specified");
-        await MajikKeyStore.updatePassphrase(target.id, currentPassphrase, newPassphrase);
-        this.scheduleAutosave();
+    async hasOwnIdentity(fingerprint) {
+        return this.keyManager.has(fingerprint);
     }
-    // ── Contact Management ────────────────────────────────────────────────────
+    // ==========================================================================
+    // ── CONTACT MANAGEMENT ────────────────────────────────────────────────────
+    // ==========================================================================
     getContactByID(id) {
         if (!id?.trim())
             throw new Error("Invalid contact ID");
-        return this.contacts.getContact(id) ?? null;
-    }
-    hasContact(id) {
-        if (!id?.trim())
-            throw new Error("Invalid contact ID");
-        return this.contacts.hasContact(id);
-    }
-    async hasContactByPublicKeyBase64(publicKey) {
-        if (!publicKey?.trim())
-            throw new Error("Invalid contact public key");
-        return await this.contacts.hasContactByPublicKeyBase64(publicKey);
+        return this._contacts.getContact(id) ?? null;
     }
     async getContactByPublicKey(publicKeyBase64) {
         if (!publicKeyBase64?.trim())
             throw new Error("Invalid public key");
-        return ((await this.contacts.getContactByPublicKeyBase64(publicKeyBase64)) ?? null);
+        return ((await this._contacts.getContactByPublicKeyBase64(publicKeyBase64)) ??
+            null);
     }
-    async exportContactAsJSON(contactID) {
-        const contact = this.contacts.getContact(contactID);
-        if (!contact)
-            return null;
-        let publicKeyBase64;
-        const anyPub = contact.publicKey;
-        if (anyPub?.raw instanceof Uint8Array) {
-            publicKeyBase64 = arrayBufferToBase64(anyPub.raw.buffer);
-        }
-        else {
-            const raw = await crypto.subtle.exportKey("raw", contact.publicKey);
-            publicKeyBase64 = arrayBufferToBase64(raw);
-        }
-        return JSON.stringify({
-            id: contact.id,
-            label: contact.meta?.label || "",
-            publicKey: publicKeyBase64,
-            fingerprint: contact.fingerprint,
-            mlKey: contact.mlKey,
-            edPublicKeyBase64: contact.edPublicKeyBase64,
-            mlDsaPublicKeyBase64: contact.mlDsaPublicKeyBase64,
-        }, null, 2);
-    }
-    async exportContactAsString(contactID) {
-        const contact = this.contacts.getContact(contactID);
-        if (!contact)
-            return null;
-        const compressedString = this.exportContactCompressed(contact);
-        return compressedString;
+    getContactsByID(ids, strict = false) {
+        if (!ids?.length)
+            throw new Error("At least 1 id is required");
+        return this._contacts.getContactsByIds(ids, strict);
+    }
+    async getContactsByPublicKey(publicKeys) {
+        if (!publicKeys?.length)
+            throw new Error("At least 1 public key is required");
+        return await this._contacts.getContactsByPublicKeys(publicKeys);
+    }
+    async getMajikRecipientsByPublicKey(publicKeys, strict) {
+        return await this._contacts.getMajikRecipients("public_key", publicKeys, strict);
+    }
+    async getExpectedSignersByPublicKey(publicKeys, strict) {
+        return await this._contacts.getExpectedSigners("public_key", publicKeys, strict);
+    }
+    async exportContactAsJSON(id) {
+        if (!id?.trim())
+            throw new Error("Invalid contact ID");
+        return this._contacts.exportContactAsJSON(id);
+    }
+    async exportContactAsString(id) {
+        if (!id?.trim())
+            throw new Error("Invalid contact ID");
+        return this._contacts.exportContactAsString(id);
     }
     async importContactFromJSON(jsonStr) {
-        try {
-            const data = JSON.parse(jsonStr);
-            if (!data.id || !data.publicKey || !data.fingerprint) {
-                return { success: false, message: "Invalid contact JSON" };
-            }
-            const rawBuffer = base64ToArrayBuffer(data.publicKey);
-            let publicKey;
-            try {
-                publicKey = await crypto.subtle.importKey("raw", rawBuffer, KEY_ALGO, true, []);
-            }
-            catch {
-                publicKey = { raw: new Uint8Array(rawBuffer) };
-            }
-            this.addContact(new MajikContact({
-                id: data.id,
-                publicKey,
-                fingerprint: data.fingerprint,
-                meta: { label: data.label },
-                mlKey: data.mlKey,
-                edPublicKeyBase64: data.edPublicKeyBase64,
-                mlDsaPublicKeyBase64: data.mlDsaPublicKeyBase64,
-            }));
-            return { success: true, message: "Contact imported successfully" };
-        }
-        catch (err) {
-            return {
-                success: false,
-                message: err instanceof Error ? err.message : "Unknown error",
-            };
-        }
+        if (!jsonStr?.trim())
+            throw new Error("Invalid contact JSON");
+        return this._contacts.importContactFromJSON(jsonStr);
     }
     async importContactFromString(base64Str) {
-        try {
-            const parsedContact = await this.importContactCompressed(base64Str);
-            this.addContact(parsedContact);
-            return { success: true, message: "Contact imported successfully" };
+        if (!base64Str?.trim())
+            throw new Error("Invalid contact string");
+        const response = await this._contacts.importContactFromString(base64Str);
+        if (response.success) {
+            this._emit("new-contact", response.data);
         }
-        catch (err) {
-            return {
-                success: false,
-                message: err instanceof Error ? err.message : "Unknown error",
-            };
+        else {
+            this._emit("error", response.message);
         }
+        return response;
     }
     async exportContactCompressed(contact) {
-        // Prepare JSON with raw keys
-        let publicKeyBase64;
-        const anyPub = contact.publicKey;
-        if (anyPub?.raw instanceof Uint8Array) {
-            publicKeyBase64 = arrayBufferToBase64(anyPub.raw.buffer);
-        }
-        else {
-            const raw = await crypto.subtle.exportKey("raw", contact.publicKey);
-            publicKeyBase64 = arrayBufferToBase64(raw);
-        }
-        const jsonObj = {
-            id: contact.id,
-            label: contact.meta?.label || "",
-            publicKey: publicKeyBase64,
-            fingerprint: contact.fingerprint,
-            mlKey: contact.mlKey,
-            edPublicKeyBase64: contact.edPublicKeyBase64,
-            mlDsaPublicKeyBase64: contact.mlDsaPublicKeyBase64,
-        };
-        const jsonStr = JSON.stringify(jsonObj);
-        const utf8 = new TextEncoder().encode(jsonStr);
-        // Compress with gzip or Brotli
-        const compressed = gzipSync(utf8);
-        // Encode for string export
-        return arrayToBase64(compressed);
+        if (!contact?.id?.trim())
+            throw new Error("Invalid contact");
+        return this._contacts.exportContactCompressed(contact);
     }
     async importContactCompressed(base64Str) {
-        const compressed = base64ToArrayBuffer(base64Str);
-        const decompressed = gunzipSync(new Uint8Array(compressed));
-        const jsonStr = new TextDecoder().decode(decompressed);
-        const data = JSON.parse(jsonStr);
-        const rawBuffer = base64ToArrayBuffer(data.publicKey);
-        let publicKey;
-        try {
-            publicKey = await crypto.subtle.importKey("raw", rawBuffer, KEY_ALGO, true, []);
-        }
-        catch {
-            publicKey = { raw: new Uint8Array(rawBuffer) };
-        }
-        if (!data?.id || !publicKey || !data?.fingerprint || !data?.mlKey) {
-            throw new Error("Invalid contact JSON");
-        }
-        return new MajikContact({
-            id: data.id,
-            publicKey,
-            fingerprint: data.fingerprint,
-            meta: { label: data.label },
-            mlKey: data.mlKey,
-            edPublicKeyBase64: data.edPublicKeyBase64,
-            mlDsaPublicKeyBase64: data.mlDsaPublicKeyBase64,
-        });
+        if (!base64Str?.trim())
+            throw new Error("Invalid contact string");
+        return this._contacts.importContactCompressed(base64Str);
     }
-    addContact(contact) {
+    async addContact(contact) {
         if (!contact?.id ||
             !contact?.publicKey ||
             !contact?.fingerprint ||
             !contact?.mlKey) {
-            throw new Error("Invalid contact JSON");
+            throw new Error("Invalid contact — missing required fields");
         }
-        this.contacts.addContact(contact);
-        this.emit("new-contact", contact);
-        this.scheduleAutosave();
+        await this._contacts.addContact(contact);
+        this._emit("new-contact", contact);
     }
-    removeContact(id) {
-        const result = this.contacts.removeContact(id);
+    async removeContact(id) {
+        const result = await this._contacts.removeContact(id);
         if (!result.success)
             throw new Error(result.message);
-        this.emit("removed-contact", id);
-        this.scheduleAutosave();
-    }
-    updateContactMeta(id, meta) {
-        this.contacts.updateContactMeta(id, meta);
-        this.scheduleAutosave();
-    }
-    blockContact(id) {
-        this.contacts.blockContact(id);
-        this.scheduleAutosave();
+        this._emit("removed-contact", id);
     }
-    unblockContact(id) {
-        this.contacts.unblockContact(id);
-        this.scheduleAutosave();
-    }
-    listContacts(all = true, majikahOnly = false) {
-        const contacts = this.contacts.listContacts(true, majikahOnly);
-        if (all)
+    listContacts(includeOwnAccounts = false) {
+        const contacts = this._contacts.listContacts(true);
+        if (includeOwnAccounts)
             return contacts;
-        const ownIds = new Set(this.listOwnAccounts(majikahOnly).map((a) => a.id));
+        const ownIds = new Set(this.listOwnAccounts().map((a) => a.id));
         return contacts.filter((c) => !ownIds.has(c.id));
     }
-    isContactMajikahRegistered(id) {
-        return this.contacts.isMajikahRegistered(id);
-    }
-    isContactMajikahIdentityChecked(id) {
-        return this.contacts.isMajikahIdentityChecked(id);
-    }
-    setContactMajikahStatus(id, status) {
-        this.contacts.setMajikahStatus(id, status);
-        this.scheduleAutosave();
+    async updateContactMeta(id, meta) {
+        await this._contacts.updateContactMeta(id, meta);
     }
-    /* ================================
-     * Group CRUD Pass-throughs
-     * ================================ */
-    /**
-     * Creates and registers a new user-defined group.
-     * Throws if a group with the same ID already exists.
-     */
-    createGroup(id, name, meta, initialMemberIds) {
-        const newGroup = this.contacts.createGroup(id, name, meta, initialMemberIds);
-        this.emit("new-contact-group", newGroup);
-        this.scheduleAutosave();
+    async createGroup(id, name, meta, initialMemberIds) {
+        const newGroup = await this._contacts.createGroup(id, name, meta, initialMemberIds);
+        this._emit("new-contact-group", newGroup);
         return this;
     }
-    /**
-     * Registers an already-constructed MajikContactGroup instance.
-     * Throws if a group with the same ID already exists.
-     */
-    addGroup(group) {
-        this.contacts.addGroup(group);
-        this.emit("new-contact-group", group);
-        this.scheduleAutosave();
+    async addGroup(group) {
+        await this._contacts.addGroup(group);
+        this._emit("new-contact-group", group);
         return this;
     }
-    /**
-     * Removes a user group by ID.
-     * System groups (Favorites, Blocked) cannot be deleted.
-     */
-    removeGroup(id) {
-        const response = this.contacts.removeGroup(id);
-        this.emit("removed-contact-group", response.data);
-        this.scheduleAutosave();
+    async removeGroup(id) {
+        const response = await this._contacts.removeGroup(id);
+        this._emit("removed-contact-group", response.data);
         return response;
     }
-    /**
-     * Returns a group by ID, or undefined if not found.
-     */
     getContactGroup(id) {
-        return this.contacts.getGroup(id);
+        return this._contacts.getGroup(id);
     }
-    /**
-     * Returns a group by ID. Throws if not found.
-     */
     getGroupOrThrow(id) {
-        return this.contacts.getGroupOrThrow(id);
+        return this._contacts.getGroupOrThrow(id);
     }
-    /**
-     * Returns true if a group with the given ID exists.
-     */
     hasGroup(id) {
-        return this.contacts.hasGroup(id);
+        return this._contacts.hasGroup(id);
     }
-    /**
-     * Returns all groups.
-     *
-     * @param includeSystem  Include system groups (Favorites, Blocked). Default: true.
-     * @param sortedByName   Sort results alphabetically by group name. Default: false.
-     */
     listContactGroups(includeSystem = true, sortedByName = false) {
-        return this.contacts.listGroups(includeSystem, sortedByName);
+        return this._contacts.listGroups(includeSystem, sortedByName);
     }
-    /**
-     * Returns only user-created groups (excludes Favorites and Blocked).
-     * Sorted alphabetically by name.
-     */
     listUserGroups(sortedByName = true) {
-        return this.contacts.listGroups(false, sortedByName);
+        return this._contacts.listGroups(false, sortedByName);
     }
-    /**
-     * Returns only system groups (Favorites and Blocked).
-     */
     listSystemGroups() {
-        return this.contacts.listGroups(true).filter((g) => g.isSystem);
+        return this._contacts.listGroups(true).filter((g) => g.isSystem);
     }
-    /**
-     * Updates mutable metadata on a group (name, description).
-     * Name is locked on system groups — will throw if attempted.
-     */
-    updateGroupMeta(id, meta) {
-        const updatedGroup = this.contacts.updateGroupMeta(id, meta);
-        this.emit("contact-group-change", updatedGroup);
-        this.scheduleAutosave();
+    async updateGroupMeta(id, meta) {
+        const updatedGroup = await this._contacts.updateGroupMeta(id, meta);
+        this._emit("contact-group-change", updatedGroup);
         return this;
     }
-    /* ================================
-     * Group Membership Pass-throughs
-     * ================================ */
-    /**
-     * Adds a contact to a group.
-     * Validates the contact exists in the directory.
-     * If the group is the system Blocked group, also calls contact.block().
-     * Throws if the contact is already a member — use addContactToGroupIfAbsent for idempotent.
-     */
-    addContactToGroup(groupID, contactID) {
-        const updatedGroup = this.contacts.addContactToGroup(groupID, contactID);
-        this.emit("contact-group-change", updatedGroup);
-        this.scheduleAutosave();
+    async addContactToGroup(groupID, contactID) {
+        const updatedGroup = await this._contacts.addContactToGroup(groupID, contactID);
+        this._emit("contact-group-change", updatedGroup);
         return this;
     }
-    /**
-     * Adds multiple contacts to a group in one call (all-or-nothing).
-     */
-    addContactsToGroup(groupID, contactIds) {
-        const updatedGroup = this.contacts.addContactsToGroup(groupID, contactIds);
-        this.emit("contact-group-change", updatedGroup);
-        this.scheduleAutosave();
+    async addContactsToGroup(groupID, contactIds) {
+        const updatedGroup = await this._contacts.addContactsToGroup(groupID, contactIds);
+        this._emit("contact-group-change", updatedGroup);
         return this;
     }
-    /**
-     * Removes a contact from a group.
-     * If the group is the system Blocked group, also calls contact.unblock().
-     * Throws if the contact is not a member — use removeContactFromGroupIfPresent for idempotent.
-     */
-    removeContactFromGroup(groupID, contactID) {
-        const updatedGroup = this.contacts.removeContactFromGroup(groupID, contactID);
-        this.emit("contact-group-change", updatedGroup);
-        this.scheduleAutosave();
+    async removeContactFromGroup(groupID, contactID) {
+        const updatedGroup = await this._contacts.removeContactFromGroup(groupID, contactID);
+        this._emit("contact-group-change", updatedGroup);
         return this;
     }
-    /**
-     * Moves a contact from one group to another atomically.
-     * Throws if the contact is not a member of the source group.
-     */
-    moveContactBetweenGroups(contactID, fromGroupId, toGroupId) {
-        const updatedGroup = this.contacts.moveContactBetweenGroups(contactID, fromGroupId, toGroupId);
-        this.emit("contact-group-change", updatedGroup);
-        this.scheduleAutosave();
+    async moveContactBetweenGroups(contactID, fromGroupId, toGroupId) {
+        const updatedGroup = await this._contacts.moveContactBetweenGroups(contactID, fromGroupId, toGroupId);
+        this._emit("contact-group-change", updatedGroup);
         return this;
     }
-    /* ================================
-     * Group Query Pass-throughs
-     * ================================ */
-    /**
-     * Returns all hydrated MajikContact instances in the given group.
-     * Contacts removed from the directory since last save are silently skipped.
-     */
     getContactsInGroup(groupID) {
-        return this.contacts.getContactsInGroup(groupID);
+        return this._contacts.getContactsInGroup(groupID);
     }
-    /**
-     * Returns hydrated contacts in the group, sorted by label (or ID if no label).
-     */
     getContactsInGroupSorted(groupID) {
-        return this.contacts.getContactsInGroupSorted(groupID);
+        return this._contacts.getContactsInGroupSorted(groupID);
     }
-    /**
-     * Returns true if the contact is a member of the given group.
-     */
     isContactInGroup(groupID, contactID) {
-        return this.contacts.isContactInGroup(groupID, contactID);
+        return this._contacts.isContactInGroup(groupID, contactID);
     }
-    /**
-     * Returns all groups the contact belongs to.
-     */
     getGroupsForContact(contactID) {
-        return this.contacts.getGroupsForContact(contactID);
+        return this._contacts.getGroupsForContact(contactID);
     }
-    /**
-     * Returns all group IDs the contact belongs to.
-     */
     getGroupIdsForContact(contactID) {
-        return this.contacts.getGroupIdsForContact(contactID);
+        return this._contacts.getGroupIdsForContact(contactID);
     }
-    /* ================================
-     * System Group Convenience Pass-throughs
-     * ================================ */
-    /**
-     * Adds the contact to the Favorites group (idempotent).
-     */
-    addContactToFavorites(contactID) {
-        const updatedGroup = this.contacts.addToFavorites(contactID);
-        this.emit("contact-group-change", updatedGroup);
-        this.scheduleAutosave();
+    async addContactToFavorites(contactID) {
+        const updatedGroup = await this._contacts.addToFavorites(contactID);
+        this._emit("contact-group-change", updatedGroup);
         return this;
     }
-    /**
-     * Removes the contact from the Favorites group (idempotent).
-     */
-    removeContactFromFavorites(contactID) {
-        const updatedGroup = this.contacts.removeFromFavorites(contactID);
-        this.emit("contact-group-change", updatedGroup);
-        this.scheduleAutosave();
+    async removeContactFromFavorites(contactID) {
+        const updatedGroup = await this._contacts.removeFromFavorites(contactID);
+        this._emit("contact-group-change", updatedGroup);
         return this;
     }
-    /**
-     * Returns true if the contact is in the Favorites group.
-     */
     isContactFavorite(contactID) {
-        return this.contacts.isFavorite(contactID);
+        return this._contacts.isFavorite(contactID);
     }
-    /**
-     * Returns true if the contact is in the Blocked group.
-     */
     isContactBlocked(contactID) {
-        return this.contacts.isContactBlocked(contactID);
+        return this._contacts.isContactBlocked(contactID);
     }
-    /**
-     * Returns the Favorites system group instance.
-     */
     getFavoritesGroup() {
-        return this.contacts.getFavoritesGroup();
+        return this._contacts.getFavoritesGroup();
     }
-    /**
-     * Returns the Blocked system group instance.
-     */
     getBlockedGroup() {
-        return this.contacts.getBlockedGroup();
+        return this._contacts.getBlockedGroup();
     }
-    /**
-     * Returns all contacts in the Favorites group as hydrated MajikContact instances.
-     */
     getFavoriteContacts() {
-        return this.contacts.getContactsInGroup(this.contacts.getFavoritesGroup().id);
+        return this._contacts.getContactsInGroup(this._contacts.getFavoritesGroup().id);
     }
-    /**
-     * Returns all contacts in the Blocked group as hydrated MajikContact instances.
-     */
     getBlockedContacts() {
-        return this.contacts.getContactsInGroup(this.contacts.getBlockedGroup().id);
+        return this._contacts.getContactsInGroup(this._contacts.getBlockedGroup().id);
     }
-    /* ================================
-     * Directory Clear
-     * ================================ */
-    /**
-     * Clears both the directory and all group memberships.
-     * System groups are preserved (re-bootstrapped by the group manager).
-     */
-    clearDirectory() {
-        this.contacts.clear();
-        this.scheduleAutosave();
+    async clearDirectory() {
+        await this._contacts.clear();
         return this;
     }
+    resolveSignerLabel(signerId) {
+        const ownAccount = this._ownAccounts.get(signerId);
+        if (ownAccount?.meta?.label)
+            return ownAccount.meta.label;
+        const contact = this._contacts.getContact(signerId);
+        if (contact?.meta?.label)
+            return contact.meta.label;
+        return `${signerId.slice(0, 16)}…`;
+    }
     // ── Encryption / Decryption ───────────────────────────────────────────────
     /**
      * Compose and encrypt a message for one or more recipients.
@@ -710,8 +622,7 @@ export class MajikMessage {
         if (cache) {
             await this.envelopeCache.set(new MessageEnvelope(envelope.toBinary()), this._source);
         }
-        this.scheduleAutosave();
-        this.emit("envelope", envelope);
+        this._emit("envelope", envelope);
         return scannerString;
     }
     /**
@@ -764,7 +675,7 @@ export class MajikMessage {
         }
         catch (err) {
             console.warn("Error: ", err);
-            this.emit("error", err, { context: "encryptTextForScanner" });
+            this._emit("error", err, { context: "encryptTextForScanner" });
             return null;
         }
     }
@@ -829,7 +740,7 @@ export class MajikMessage {
             return { messageChat, scannerString };
         }
         catch (err) {
-            this.emit("error", err, { context: "createEncryptedMajikMessageChat" });
+            this._emit("error", err, { context: "createEncryptedMajikMessageChat" });
             throw err;
         }
     }
@@ -848,7 +759,7 @@ export class MajikMessage {
             return await envelope.decrypt(identity);
         }
         catch (err) {
-            this.emit("error", err, { context: "decryptMajikMessageChat" });
+            this._emit("error", err, { context: "decryptMajikMessageChat" });
             throw err;
         }
     }
@@ -889,7 +800,7 @@ export class MajikMessage {
         const activeId = this.getActiveAccount()?.id;
         if (!activeId)
             throw new Error("No active account — call setActiveAccount() first");
-        const signingKey = MajikKeyStore.get(activeId);
+        const signingKey = this.keyManager.get(activeId);
         // ── 4. Build CreateOptions ─────────────────────────────────────────────
         const createOptions = {
             data,
@@ -1030,9 +941,9 @@ export class MajikMessage {
         if (!id)
             throw new Error("No active account — call setActiveAccount() first");
         try {
-            await MajikKeyStore.ensureUnlocked(id);
+            await this.keyManager.ensureUnlocked(id);
             // get() is safe after ensureUnlocked() — key is in the memory cache.
-            const key = MajikKeyStore.get(id);
+            const key = this.keyManager.get(id);
             if (!key)
                 throw new Error(`Account not found in keystore: "${id}"`);
             if (!key.hasSigningKeys) {
@@ -1045,7 +956,7 @@ export class MajikMessage {
             });
         }
         catch (err) {
-            this.emit("error", err, { context: "signMajikFile" });
+            this._emit("error", err, { context: "signMajikFile" });
             throw err;
         }
     }
@@ -1087,7 +998,7 @@ export class MajikMessage {
             return file.verify(sig.extractPublicKeys());
         }
         catch (err) {
-            this.emit("error", err, { context: "verifyMajikFile" });
+            this._emit("error", err, { context: "verifyMajikFile" });
             throw err;
         }
     }
@@ -1136,7 +1047,7 @@ export class MajikMessage {
             return file.verifyBinary(decryptIdentity, sig.extractPublicKeys());
         }
         catch (err) {
-            this.emit("error", err, { context: "verifyMajikFileBinary" });
+            this._emit("error", err, { context: "verifyMajikFileBinary" });
             throw err;
         }
     }
@@ -1170,7 +1081,7 @@ export class MajikMessage {
             return false;
         // get() checks the memory cache — no async needed since the account
         // must already be loaded to be the active account.
-        const key = MajikKeyStore.get(id);
+        const key = this.keyManager.get(id);
         if (!key)
             return false;
         return key.fingerprint === sigInfo.signerId;
@@ -1448,7 +1359,7 @@ export class MajikMessage {
         const id = accountId ?? this.getActiveAccount()?.id;
         if (!id)
             return false;
-        const key = MajikKeyStore.get(id);
+        const key = this.keyManager.get(id);
         return key?.hasSigningKeys === true;
     }
     // ── Envelope Cache ────────────────────────────────────────────────────────
@@ -1459,30 +1370,30 @@ export class MajikMessage {
         const response = await this.envelopeCache.clear();
         if (!response?.success)
             throw new Error(response.message);
-        this.scheduleAutosave();
+        this._scheduleOrderSave();
         return response.success;
     }
     // ── Identity / Passphrase ─────────────────────────────────────────────────
     /**
      * Ensure an identity is unlocked.
-     * Delegates entirely to MajikKeyStore.ensureUnlocked() — passphrase prompting
+     * Delegates entirely to this.keyManager.ensureUnlocked() — passphrase prompting
      * is handled there via onUnlockRequested or the optional promptFn.
      */
     async ensureIdentityUnlocked(id, promptFn) {
-        return MajikKeyStore.ensureUnlocked(id, promptFn);
+        return this.keyManager.ensureUnlocked(id, promptFn);
     }
     async isPassphraseValid(passphrase, id) {
         const target = id ? this.getOwnAccountById(id) : this.getActiveAccount();
         if (!target)
             return false;
-        return MajikKeyStore.isPassphraseValid(target.id, passphrase);
+        return this.keyManager.isPassphraseValid(target.id, passphrase);
     }
     // ── Events ────────────────────────────────────────────────────────────────
     on(event, callback) {
-        this.listeners.get(event)?.push(callback);
+        this._listeners.get(event)?.push(callback);
     }
     off(event, callback) {
-        const cbs = this.listeners.get(event);
+        const cbs = this._listeners.get(event);
         if (!cbs?.length)
             return;
         if (callback) {
@@ -1491,11 +1402,11 @@ export class MajikMessage {
                 cbs.splice(i, 1);
         }
         else {
-            this.listeners.set(event, []);
+            this._listeners.set(event, []);
         }
     }
-    emit(event, ...args) {
-        this.listeners.get(event)?.forEach((cb) => cb(...args));
+    _emit(event, ...args) {
+        this._listeners.get(event)?.forEach((cb) => cb(...args));
     }
     // ── Content & File Signing ────────────────────────────────────────────────
     /**
@@ -1514,8 +1425,8 @@ export class MajikMessage {
         if (!id)
             throw new Error("No active account — call setActiveAccount() first");
         try {
-            await MajikKeyStore.ensureUnlocked(id);
-            const key = MajikKeyStore.get(id);
+            await this.keyManager.ensureUnlocked(id);
+            const key = this.keyManager.get(id);
             if (!key)
                 throw new Error(`Account not found in keystore: "${id}"`);
             if (!key.hasSigningKeys) {
@@ -1528,7 +1439,7 @@ export class MajikMessage {
             });
         }
         catch (err) {
-            this.emit("error", err, { context: "signContent" });
+            this._emit("error", err, { context: "signContent" });
             throw err;
         }
     }
@@ -1551,8 +1462,8 @@ export class MajikMessage {
         if (!id)
             throw new Error("No active account — call setActiveAccount() first");
         try {
-            await MajikKeyStore.ensureUnlocked(id);
-            const key = MajikKeyStore.get(id);
+            await this.keyManager.ensureUnlocked(id);
+            const key = this.keyManager.get(id);
             if (!key)
                 throw new Error(`Account not found in keystore: "${id}"`);
             if (!key.hasSigningKeys) {
@@ -1567,7 +1478,7 @@ export class MajikMessage {
             });
         }
         catch (err) {
-            this.emit("error", err, { context: "signFile" });
+            this._emit("error", err, { context: "signFile" });
             throw err;
         }
     }
@@ -1596,8 +1507,8 @@ export class MajikMessage {
         const id = options?.accountId ?? this.getActiveAccount()?.id;
         if (!id)
             throw new Error("No active account — call setActiveAccount() first");
-        await MajikKeyStore.ensureUnlocked(id);
-        const key = MajikKeyStore.get(id);
+        await this.keyManager.ensureUnlocked(id);
+        const key = this.keyManager.get(id);
         if (!key)
             throw new Error(`Account not found in keystore: "${id}"`);
         if (!key.hasSigningKeys) {
@@ -1621,7 +1532,7 @@ export class MajikMessage {
                 };
             }
             catch (err) {
-                this.emit("error", err, { context: "batchSignFiles" });
+                this._emit("error", err, { context: "batchSignFiles" });
                 return {
                     blob: null,
                     signature: null,
@@ -1670,7 +1581,7 @@ export class MajikMessage {
             return MajikSignature.verify(content, sig, sig.extractPublicKeys());
         }
         catch (err) {
-            this.emit("error", err, { context: "verifyContent" });
+            this._emit("error", err, { context: "verifyContent" });
             throw err;
         }
     }
@@ -1726,7 +1637,7 @@ export class MajikMessage {
             return results[0];
         }
         catch (err) {
-            this.emit("error", err, { context: "verifyFile" });
+            this._emit("error", err, { context: "verifyFile" });
             throw err;
         }
     }
@@ -1795,7 +1706,7 @@ export class MajikMessage {
                 };
             }
             catch (err) {
-                this.emit("error", err, { context: "batchVerifyFiles" });
+                this._emit("error", err, { context: "batchVerifyFiles" });
                 return {
                     valid: false,
                     signerId: undefined,
@@ -1824,7 +1735,7 @@ export class MajikMessage {
             return MajikSignature.extractFrom(file, options);
         }
         catch (err) {
-            this.emit("error", err, { context: "extractSignature" });
+            this._emit("error", err, { context: "extractSignature" });
             throw err;
         }
     }
@@ -1842,7 +1753,7 @@ export class MajikMessage {
             return MajikSignature.stripFrom(file, options);
         }
         catch (err) {
-            this.emit("error", err, { context: "stripSignature" });
+            this._emit("error", err, { context: "stripSignature" });
             throw err;
         }
     }
@@ -1860,7 +1771,7 @@ export class MajikMessage {
             return MajikSignature.isSigned(file, options);
         }
         catch (err) {
-            this.emit("error", err, { context: "isFileSigned" });
+            this._emit("error", err, { context: "isFileSigned" });
             throw err;
         }
     }
@@ -1878,7 +1789,7 @@ export class MajikMessage {
         const id = accountId ?? this.getActiveAccount()?.id;
         if (!id)
             throw new Error("No active account — call setActiveAccount() first");
-        const key = MajikKeyStore.get(id);
+        const key = this.keyManager.get(id);
         if (!key)
             throw new Error(`Account not found in keystore: "${id}"`);
         if (!key.hasSigningKeys) {
@@ -1936,7 +1847,7 @@ export class MajikMessage {
             return MajikSignature.getAllowlist(file, options);
         }
         catch (err) {
-            this.emit("error", err, { context: "getAllowlist" });
+            this._emit("error", err, { context: "getAllowlist" });
             throw err;
         }
     }
@@ -1953,7 +1864,7 @@ export class MajikMessage {
             return MajikSignature.canSign(file, key, options);
         }
         catch (err) {
-            this.emit("error", err, { context: "canSign" });
+            this._emit("error", err, { context: "canSign" });
             throw err;
         }
     }
@@ -1967,7 +1878,7 @@ export class MajikMessage {
             return MajikSignature.isMultiSig(file, options);
         }
         catch (err) {
-            this.emit("error", err, { context: "isMultiSig" });
+            this._emit("error", err, { context: "isMultiSig" });
             throw err;
         }
     }
@@ -1994,7 +1905,7 @@ export class MajikMessage {
             return MajikSignature.getSignatories(file, options, filter);
         }
         catch (err) {
-            this.emit("error", err, { context: "getSignatories" });
+            this._emit("error", err, { context: "getSignatories" });
             throw err;
         }
     }
@@ -2007,7 +1918,7 @@ export class MajikMessage {
             return MajikSignature.getSignedSignatories(file, options);
         }
         catch (err) {
-            this.emit("error", err, { context: "getSignedSignatories" });
+            this._emit("error", err, { context: "getSignedSignatories" });
             throw err;
         }
     }
@@ -2020,7 +1931,7 @@ export class MajikMessage {
             return MajikSignature.getPendingSignatories(file, options);
         }
         catch (err) {
-            this.emit("error", err, { context: "getPendingSignatories" });
+            this._emit("error", err, { context: "getPendingSignatories" });
             throw err;
         }
     }
@@ -2033,7 +1944,7 @@ export class MajikMessage {
             return MajikSignature.getAllSignatories(file, options);
         }
         catch (err) {
-            this.emit("error", err, { context: "getAllSignatories" });
+            this._emit("error", err, { context: "getAllSignatories" });
             throw err;
         }
     }
@@ -2050,7 +1961,7 @@ export class MajikMessage {
             return MajikSignature.getIssuer(file, options);
         }
         catch (err) {
-            this.emit("error", err, { context: "getIssuer" });
+            this._emit("error", err, { context: "getIssuer" });
             throw err;
         }
     }
@@ -2077,7 +1988,7 @@ export class MajikMessage {
             return MajikSignature.extractFrom(file, options);
         }
         catch (err) {
-            this.emit("error", err, { context: "getFileSignatureInfo" });
+            this._emit("error", err, { context: "getFileSignatureInfo" });
             throw err;
         }
     }
@@ -2098,7 +2009,7 @@ export class MajikMessage {
             return MajikSignature.getEnvelopeInfo(file, options);
         }
         catch (err) {
-            this.emit("error", err, { context: "getEnvelopeInfo" });
+            this._emit("error", err, { context: "getEnvelopeInfo" });
             throw err;
         }
     }
@@ -2119,7 +2030,7 @@ export class MajikMessage {
         if (!id)
             throw new Error("No active account — call setActiveAccount() first");
         try {
-            const key = MajikKeyStore.get(id);
+            const key = this.keyManager.get(id);
             if (!key)
                 throw new Error(`Account not found in keystore: "${id}"`);
             return MajikSignature.seal(file, key, {
@@ -2128,7 +2039,7 @@ export class MajikMessage {
             });
         }
         catch (err) {
-            this.emit("error", err, { context: "seal" });
+            this._emit("error", err, { context: "seal" });
             throw err;
         }
     }
@@ -2146,7 +2057,7 @@ export class MajikMessage {
             return MajikSignature.verifySeal(file, options);
         }
         catch (err) {
-            this.emit("error", err, { context: "verifySeal" });
+            this._emit("error", err, { context: "verifySeal" });
             throw err;
         }
     }
@@ -2163,7 +2074,7 @@ export class MajikMessage {
             return MajikSignature.getSealInfo(file, options);
         }
         catch (err) {
-            this.emit("error", err, { context: "getSealInfo" });
+            this._emit("error", err, { context: "getSealInfo" });
             throw err;
         }
     }
@@ -2176,7 +2087,7 @@ export class MajikMessage {
             return MajikSignature.isSealed(file, options);
         }
         catch (err) {
-            this.emit("error", err, { context: "isSealed" });
+            this._emit("error", err, { context: "isSealed" });
             throw err;
         }
     }
@@ -2197,14 +2108,14 @@ export class MajikMessage {
         }
         // Option B: contact ID looked up from the contact directory
         if (options.contactID) {
-            const contact = this.contacts.getContact(options.contactID);
+            const contact = this._contacts.getContact(options.contactID);
             if (!contact) {
                 throw new Error(`No contact found for id "${options.contactID}"`);
             }
             // Own accounts are in the keystore — get their signing keys directly
             const ownAccount = this.getOwnAccountById(options.contactID);
             if (ownAccount) {
-                const key = MajikKeyStore.get(options.contactID);
+                const key = this.keyManager.get(options.contactID);
                 if (key?.hasSigningKeys) {
                     return MajikSignature.publicKeysFromMajikKey(key);
                 }
@@ -2222,7 +2133,7 @@ export class MajikMessage {
         }
         // Option C: raw base64 public key — look up via contact directory
         if (options.publicKeyBase64) {
-            const contact = await this.contacts.getContactByPublicKeyBase64(options.publicKeyBase64);
+            const contact = await this._contacts.getContactByPublicKeyBase64(options.publicKeyBase64);
             if (!contact) {
                 throw new Error(`No contact found for public key "${options.publicKeyBase64}"`);
             }
@@ -2237,182 +2148,45 @@ export class MajikMessage {
         }
         return null;
     }
-    // ── Serialization ─────────────────────────────────────────────────────────
-    async toJSON() {
-        const json = {
-            id: this.id,
-            contacts: await this.contacts.toJSON(),
-            envelopeCache: this.envelopeCache.toJSON(),
-        };
+    // ==========================================================================
+    // ── RESET ─────────────────────────────────────────────────────────────────
+    // ==========================================================================
+    /**
+     * Wipe all data from every adapter and reset in-memory state.
+     * The client remains usable — call hydrate() or add new accounts after reset.
+     */
+    async resetData() {
         try {
-            const accounts = [];
-            for (const id of this.ownAccountsOrder) {
-                const acct = this.ownAccounts.get(id);
-                if (acct)
-                    accounts.push(await acct.toJSON());
+            await this._keys.adapter.clear();
+            await this._contacts.clear();
+            await this._state.clear();
+            if (this._db) {
+                await this._db.vacuum();
+                await this._db.optimize();
             }
-            json.ownAccounts = { accounts, order: [...this.ownAccountsOrder] };
-        }
-        catch (e) {
-            console.warn("Failed to serialize ownAccounts:", e);
-        }
-        return json;
-    }
-    static async fromJSON(json) {
-        // const migratedJSON = migrateMajikMessageJSON(json);
-        // ── Step 2: restore MajikContactManager (directory + groups together) ─
-        const contactManager = await MajikContactManager.fromJSON(json.contacts);
-        const envelopeCache = EnvelopeCache.fromJSON(json.envelopeCache);
-        const instance = new this({ contactManager, envelopeCache }, json.id);
-        try {
-            if (json.ownAccounts && Array.isArray(json.ownAccounts.accounts)) {
-                for (const acct of json.ownAccounts.accounts) {
-                    try {
-                        const raw = base64ToArrayBuffer(acct.publicKeyBase64);
-                        const publicKey = await crypto.subtle.importKey("raw", raw, KEY_ALGO, true, []);
-                        const contact = MajikContact.create(acct.id, publicKey, acct.fingerprint, acct.meta);
-                        instance.ownAccounts.set(contact.id, contact);
-                    }
-                    catch (e) {
-                        console.info("Fallback restoring own account (raw-key wrapper)", acct.id, e);
-                    }
-                }
-                if (Array.isArray(json.ownAccounts.order)) {
-                    instance.ownAccountsOrder = [...json.ownAccounts.order];
-                }
-                // Fallback: populate from contacts if accounts array failed
-                if (instance.ownAccounts.size === 0) {
-                    for (const id of instance.ownAccountsOrder) {
-                        const c = instance.contacts.getContact(id);
-                        if (c)
-                            instance.ownAccounts.set(id, c);
-                    }
-                }
-                // Ensure own accounts are in contacts
-                instance.ownAccountsOrder.forEach((id) => {
-                    const c = instance.ownAccounts.get(id);
-                    if (c && !instance.contacts.hasContact(c.id)) {
-                        instance.contacts.addContact(c);
-                    }
-                });
-            }
-        }
-        catch (e) {
-            console.warn("Error restoring ownAccounts:", e);
-        }
-        return instance;
-    }
-    // ── Persistence ───────────────────────────────────────────────────────────
-    attachAutosaveHandlers() {
-        if (typeof window === "undefined")
-            return;
-        try {
-            window.addEventListener("beforeunload", () => void this.saveState());
-        }
-        catch {
-            /* ignore */
-        }
-        this.startAutosave();
-    }
-    startAutosave() {
-        if (this.autosaveIntervalId || typeof window === "undefined")
-            return;
-        this.autosaveIntervalId = window.setInterval(() => void this.saveState(), this.autosaveIntervalMs);
-    }
-    stopAutosave() {
-        if (!this.autosaveIntervalId || typeof window === "undefined")
-            return;
-        window.clearInterval(this.autosaveIntervalId);
-        this.autosaveIntervalId = null;
-    }
-    scheduleAutosave() {
-        if (typeof window === "undefined")
-            return;
-        if (this.autosaveTimer)
-            window.clearTimeout(this.autosaveTimer);
-        this.autosaveTimer = window.setTimeout(() => {
-            void this.saveState();
-            this.autosaveTimer = null;
-        }, this.autosaveDebounceMs);
-    }
-    async saveState() {
-        try {
-            const json = await this.toJSON();
-            await idbSaveBlob("majik-message-state", autoSaveMajikFileData(json), this.userProfile);
-        }
-        catch (err) {
-            console.error("Failed to save MajikMessage state:", err);
-        }
-    }
-    async loadState() {
-        try {
-            const saved = await idbLoadBlob("majik-message-state", this.userProfile);
-            if (!saved?.data)
-                return;
-            const loaded = await loadSavedMajikFileData(saved.data);
-            // Pass raw parsed object — fromJSON handles migration internally
-            const restored = await MajikMessage.fromJSON(loaded.j);
-            this.id = restored.id;
-            this.contacts = restored.contacts;
-            this.envelopeCache = restored.envelopeCache;
-            this.ownAccounts = restored.ownAccounts;
-            this.ownAccountsOrder = [...restored.ownAccountsOrder];
+            this._ownAccounts.clear();
+            this._ownAccountsOrder = [];
+            this._keys = new MajikKeyManager(this._keys.adapter);
+            this._emit("active-account-change", null);
         }
         catch (err) {
-            console.error("Failed to load MajikMessage state:", err);
+            throw new Error(`Failed to reset data: ${err instanceof Error ? err.message : err}`);
         }
     }
-    static async loadOrCreate(config, userProfile = "default") {
-        try {
-            const saved = await idbLoadBlob("majik-message-state", userProfile);
-            if (saved?.data) {
-                const loaded = await loadSavedMajikFileData(saved.data);
-                const instance = (await this.fromJSON(loaded.j));
-                instance.attachAutosaveHandlers();
-                return instance;
-            }
-        }
-        catch (err) {
-            console.warn("Error loading saved MajikMessage state:", err);
+    // ==========================================================================
+    // ── PRIVATE HELPERS ───────────────────────────────────────────────────────
+    // ==========================================================================
+    _registerOwnAccount(contact) {
+        if (!this._ownAccounts.has(contact.id)) {
+            this._ownAccounts.set(contact.id, contact);
+            this._ownAccountsOrder.push(contact.id);
+            this._scheduleOrderSave();
         }
-        const created = new this(config);
-        await created.saveState();
-        created.attachAutosaveHandlers();
-        return created;
-    }
-    async resetData(userProfile = "default") {
-        try {
-            await this.clearCachedEnvelopes();
-            for (const id of [...this.ownAccountsOrder]) {
-                await MajikKeyStore.deleteIdentity(id).catch(() => { });
-            }
-            this.ownAccounts.clear();
-            this.ownAccountsOrder = [];
-            try {
-                this.contacts.clear();
-            }
-            catch {
-                /* ignore */
-            }
-            try {
-                await MajikKeyStore.deleteAll();
-            }
-            catch {
-                /* ignore */
-            }
-            this.id = arrayToBase64(randomBytes(32));
-            try {
-                await clearAllBlobs(userProfile);
-            }
-            catch {
-                /* ignore */
-            }
-            this.stopAutosave();
-            this.startAutosave();
-            this.emit("active-account-change", null);
+        if (!this._contacts.hasContact(contact.id)) {
+            this._contacts.addContact(contact);
         }
-        catch (err) {
-            throw new Error(`Failed to reset data: ${err instanceof Error ? err.message : err}`);
+        if (!this.getActiveAccount()) {
+            void this.setActiveAccount(contact.id, true);
         }
     }
 }