@smartledger/keys 1.5.2 → 1.5.3

package/dist/lumen-keys.js

@@ -84,17 +84,17 @@ var LumenKeys = (() => {
   });
 
   // node_modules/@noble/hashes/utils.js
-  function isBytes(a2) {
+  function isBytes3(a2) {
     return a2 instanceof Uint8Array || ArrayBuffer.isView(a2) && a2.constructor.name === "Uint8Array";
   }
-  function anumber(n2, title = "") {
+  function anumber2(n2, title = "") {
     if (!Number.isSafeInteger(n2) || n2 < 0) {
       const prefix = title && `"${title}" `;
       throw new Error(`${prefix}expected integer >= 0, got ${n2}`);
     }
   }
-  function abytes(value, length, title = "") {
-    const bytes = isBytes(value);
+  function abytes3(value, length, title = "") {
+    const bytes = isBytes3(value);
     const len = value?.length;
     const needsLen = length !== void 0;
     if (!bytes || needsLen && len !== length) {
@@ -105,14 +105,14 @@ var LumenKeys = (() => {
     }
     return value;
   }
-  function aexists(instance, checkFinished = true) {
+  function aexists2(instance, checkFinished = true) {
     if (instance.destroyed)
       throw new Error("Hash instance has been destroyed");
     if (checkFinished && instance.finished)
       throw new Error("Hash#digest() has already been called");
   }
-  function aoutput(out, instance) {
-    abytes(out, void 0, "digestInto() output");
+  function aoutput2(out, instance) {
+    abytes3(out, void 0, "digestInto() output");
     const min = instance.outputLen;
     if (out.length < min) {
       throw new Error('"digestInto() output" expected to be of length >=' + min);
@@ -121,15 +121,15 @@ var LumenKeys = (() => {
   function u32(arr) {
     return new Uint32Array(arr.buffer, arr.byteOffset, Math.floor(arr.byteLength / 4));
   }
-  function clean(...arrays) {
+  function clean2(...arrays) {
     for (let i2 = 0; i2 < arrays.length; i2++) {
       arrays[i2].fill(0);
     }
   }
-  function createView(arr) {
+  function createView2(arr) {
     return new DataView(arr.buffer, arr.byteOffset, arr.byteLength);
   }
-  function rotr(word, shift) {
+  function rotr2(word, shift) {
     return word << 32 - shift | word >>> shift;
   }
   function byteSwap(word) {
@@ -141,7 +141,7 @@ var LumenKeys = (() => {
     }
     return arr;
   }
-  function createHasher(hashCons, info = {}) {
+  function createHasher2(hashCons, info = {}) {
     const hashC = (msg, opts) => hashCons(opts).update(msg).digest();
     const tmp = hashCons(void 0);
     hashC.outputLen = tmp.outputLen;
@@ -163,18 +163,18 @@ var LumenKeys = (() => {
   });
 
   // node_modules/@noble/hashes/_md.js
-  function Chi(a2, b2, c2) {
+  function Chi2(a2, b2, c2) {
     return a2 & b2 ^ ~a2 & c2;
   }
-  function Maj(a2, b2, c2) {
+  function Maj2(a2, b2, c2) {
     return a2 & b2 ^ a2 & c2 ^ b2 & c2;
   }
-  var HashMD, SHA256_IV, SHA512_IV;
+  var HashMD2, SHA256_IV2, SHA512_IV2;
   var init_md = __esm({
     "node_modules/@noble/hashes/_md.js"() {
       init_esbuild_shims();
       init_utils();
-      HashMD = class {
+      HashMD2 = class {
         constructor(blockLen, outputLen, padOffset, isLE2) {
           __publicField(this, "blockLen");
           __publicField(this, "outputLen");
@@ -192,17 +192,17 @@ var LumenKeys = (() => {
           this.padOffset = padOffset;
           this.isLE = isLE2;
           this.buffer = new Uint8Array(blockLen);
-          this.view = createView(this.buffer);
+          this.view = createView2(this.buffer);
         }
         update(data) {
-          aexists(this);
-          abytes(data);
+          aexists2(this);
+          abytes3(data);
           const { view, buffer, blockLen } = this;
           const len = data.length;
           for (let pos = 0; pos < len; ) {
             const take = Math.min(blockLen - this.pos, len - pos);
             if (take === blockLen) {
-              const dataView = createView(data);
+              const dataView = createView2(data);
               for (; blockLen <= len - pos; pos += blockLen)
                 this.process(dataView, pos);
               continue;
@@ -220,13 +220,13 @@ var LumenKeys = (() => {
           return this;
         }
         digestInto(out) {
-          aexists(this);
-          aoutput(out, this);
+          aexists2(this);
+          aoutput2(out, this);
           this.finished = true;
           const { buffer, view, blockLen, isLE: isLE2 } = this;
           let { pos } = this;
           buffer[pos++] = 128;
-          clean(this.buffer.subarray(pos));
+          clean2(this.buffer.subarray(pos));
           if (this.padOffset > blockLen - pos) {
             this.process(view, 0);
             pos = 0;
@@ -235,7 +235,7 @@ var LumenKeys = (() => {
             buffer[i2] = 0;
           view.setBigUint64(blockLen - 8, BigInt(this.length * 8), isLE2);
           this.process(view, 0);
-          const oview = createView(out);
+          const oview = createView2(out);
           const len = this.outputLen;
           if (len % 4)
             throw new Error("_sha2: outputLen must be aligned to 32bit");
@@ -269,7 +269,7 @@ var LumenKeys = (() => {
           return this._cloneInto();
         }
       };
-      SHA256_IV = /* @__PURE__ */ Uint32Array.from([
+      SHA256_IV2 = /* @__PURE__ */ Uint32Array.from([
         1779033703,
         3144134277,
         1013904242,
@@ -279,7 +279,7 @@ var LumenKeys = (() => {
         528734635,
         1541459225
       ]);
-      SHA512_IV = /* @__PURE__ */ Uint32Array.from([
+      SHA512_IV2 = /* @__PURE__ */ Uint32Array.from([
         1779033703,
         4089235720,
         3144134277,
@@ -346,14 +346,14 @@ var LumenKeys = (() => {
   });
 
   // node_modules/@noble/hashes/sha2.js
-  var SHA256_K, SHA256_W, SHA2_32B, _SHA256, K512, SHA512_Kh, SHA512_Kl, SHA512_W_H, SHA512_W_L, SHA2_64B, _SHA512, sha256, sha512;
+  var SHA256_K2, SHA256_W2, SHA2_32B, _SHA256, K512, SHA512_Kh, SHA512_Kl, SHA512_W_H, SHA512_W_L, SHA2_64B, _SHA512, sha2563, sha512;
   var init_sha2 = __esm({
     "node_modules/@noble/hashes/sha2.js"() {
       init_esbuild_shims();
       init_md();
       init_u64();
       init_utils();
-      SHA256_K = /* @__PURE__ */ Uint32Array.from([
+      SHA256_K2 = /* @__PURE__ */ Uint32Array.from([
         1116352408,
         1899447441,
         3049323471,
@@ -419,8 +419,8 @@ var LumenKeys = (() => {
         3204031479,
         3329325298
       ]);
-      SHA256_W = /* @__PURE__ */ new Uint32Array(64);
-      SHA2_32B = class extends HashMD {
+      SHA256_W2 = /* @__PURE__ */ new Uint32Array(64);
+      SHA2_32B = class extends HashMD2 {
         constructor(outputLen) {
           super(64, outputLen, 8, false);
         }
@@ -441,20 +441,20 @@ var LumenKeys = (() => {
         }
         process(view, offset) {
           for (let i2 = 0; i2 < 16; i2++, offset += 4)
-            SHA256_W[i2] = view.getUint32(offset, false);
+            SHA256_W2[i2] = view.getUint32(offset, false);
           for (let i2 = 16; i2 < 64; i2++) {
-            const W15 = SHA256_W[i2 - 15];
-            const W22 = SHA256_W[i2 - 2];
-            const s0 = rotr(W15, 7) ^ rotr(W15, 18) ^ W15 >>> 3;
-            const s1 = rotr(W22, 17) ^ rotr(W22, 19) ^ W22 >>> 10;
-            SHA256_W[i2] = s1 + SHA256_W[i2 - 7] + s0 + SHA256_W[i2 - 16] | 0;
+            const W15 = SHA256_W2[i2 - 15];
+            const W22 = SHA256_W2[i2 - 2];
+            const s0 = rotr2(W15, 7) ^ rotr2(W15, 18) ^ W15 >>> 3;
+            const s1 = rotr2(W22, 17) ^ rotr2(W22, 19) ^ W22 >>> 10;
+            SHA256_W2[i2] = s1 + SHA256_W2[i2 - 7] + s0 + SHA256_W2[i2 - 16] | 0;
           }
           let { A: A2, B: B2, C: C3, D: D2, E: E2, F: F2, G: G3, H: H2 } = this;
           for (let i2 = 0; i2 < 64; i2++) {
-            const sigma1 = rotr(E2, 6) ^ rotr(E2, 11) ^ rotr(E2, 25);
-            const T1 = H2 + sigma1 + Chi(E2, F2, G3) + SHA256_K[i2] + SHA256_W[i2] | 0;
-            const sigma0 = rotr(A2, 2) ^ rotr(A2, 13) ^ rotr(A2, 22);
-            const T2 = sigma0 + Maj(A2, B2, C3) | 0;
+            const sigma1 = rotr2(E2, 6) ^ rotr2(E2, 11) ^ rotr2(E2, 25);
+            const T1 = H2 + sigma1 + Chi2(E2, F2, G3) + SHA256_K2[i2] + SHA256_W2[i2] | 0;
+            const sigma0 = rotr2(A2, 2) ^ rotr2(A2, 13) ^ rotr2(A2, 22);
+            const T2 = sigma0 + Maj2(A2, B2, C3) | 0;
             H2 = G3;
             G3 = F2;
             F2 = E2;
@@ -475,11 +475,11 @@ var LumenKeys = (() => {
           this.set(A2, B2, C3, D2, E2, F2, G3, H2);
         }
         roundClean() {
-          clean(SHA256_W);
+          clean2(SHA256_W2);
         }
         destroy() {
           this.set(0, 0, 0, 0, 0, 0, 0, 0);
-          clean(this.buffer);
+          clean2(this.buffer);
         }
       };
       _SHA256 = class extends SHA2_32B {
@@ -487,14 +487,14 @@ var LumenKeys = (() => {
           super(32);
           // We cannot use array here since array allows indexing by variable
           // which means optimizer/compiler cannot use registers.
-          __publicField(this, "A", SHA256_IV[0] | 0);
-          __publicField(this, "B", SHA256_IV[1] | 0);
-          __publicField(this, "C", SHA256_IV[2] | 0);
-          __publicField(this, "D", SHA256_IV[3] | 0);
-          __publicField(this, "E", SHA256_IV[4] | 0);
-          __publicField(this, "F", SHA256_IV[5] | 0);
-          __publicField(this, "G", SHA256_IV[6] | 0);
-          __publicField(this, "H", SHA256_IV[7] | 0);
+          __publicField(this, "A", SHA256_IV2[0] | 0);
+          __publicField(this, "B", SHA256_IV2[1] | 0);
+          __publicField(this, "C", SHA256_IV2[2] | 0);
+          __publicField(this, "D", SHA256_IV2[3] | 0);
+          __publicField(this, "E", SHA256_IV2[4] | 0);
+          __publicField(this, "F", SHA256_IV2[5] | 0);
+          __publicField(this, "G", SHA256_IV2[6] | 0);
+          __publicField(this, "H", SHA256_IV2[7] | 0);
         }
       };
       K512 = /* @__PURE__ */ (() => split([
@@ -583,7 +583,7 @@ var LumenKeys = (() => {
       SHA512_Kl = /* @__PURE__ */ (() => K512[1])();
       SHA512_W_H = /* @__PURE__ */ new Uint32Array(80);
       SHA512_W_L = /* @__PURE__ */ new Uint32Array(80);
-      SHA2_64B = class extends HashMD {
+      SHA2_64B = class extends HashMD2 {
         constructor(outputLen) {
           super(128, outputLen, 16, false);
         }
@@ -671,39 +671,39 @@ var LumenKeys = (() => {
           this.set(Ah, Al, Bh, Bl, Ch, Cl, Dh, Dl, Eh, El, Fh, Fl, Gh, Gl, Hh, Hl);
         }
         roundClean() {
-          clean(SHA512_W_H, SHA512_W_L);
+          clean2(SHA512_W_H, SHA512_W_L);
         }
         destroy() {
-          clean(this.buffer);
+          clean2(this.buffer);
           this.set(0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0);
         }
       };
       _SHA512 = class extends SHA2_64B {
         constructor() {
           super(64);
-          __publicField(this, "Ah", SHA512_IV[0] | 0);
-          __publicField(this, "Al", SHA512_IV[1] | 0);
-          __publicField(this, "Bh", SHA512_IV[2] | 0);
-          __publicField(this, "Bl", SHA512_IV[3] | 0);
-          __publicField(this, "Ch", SHA512_IV[4] | 0);
-          __publicField(this, "Cl", SHA512_IV[5] | 0);
-          __publicField(this, "Dh", SHA512_IV[6] | 0);
-          __publicField(this, "Dl", SHA512_IV[7] | 0);
-          __publicField(this, "Eh", SHA512_IV[8] | 0);
-          __publicField(this, "El", SHA512_IV[9] | 0);
-          __publicField(this, "Fh", SHA512_IV[10] | 0);
-          __publicField(this, "Fl", SHA512_IV[11] | 0);
-          __publicField(this, "Gh", SHA512_IV[12] | 0);
-          __publicField(this, "Gl", SHA512_IV[13] | 0);
-          __publicField(this, "Hh", SHA512_IV[14] | 0);
-          __publicField(this, "Hl", SHA512_IV[15] | 0);
+          __publicField(this, "Ah", SHA512_IV2[0] | 0);
+          __publicField(this, "Al", SHA512_IV2[1] | 0);
+          __publicField(this, "Bh", SHA512_IV2[2] | 0);
+          __publicField(this, "Bl", SHA512_IV2[3] | 0);
+          __publicField(this, "Ch", SHA512_IV2[4] | 0);
+          __publicField(this, "Cl", SHA512_IV2[5] | 0);
+          __publicField(this, "Dh", SHA512_IV2[6] | 0);
+          __publicField(this, "Dl", SHA512_IV2[7] | 0);
+          __publicField(this, "Eh", SHA512_IV2[8] | 0);
+          __publicField(this, "El", SHA512_IV2[9] | 0);
+          __publicField(this, "Fh", SHA512_IV2[10] | 0);
+          __publicField(this, "Fl", SHA512_IV2[11] | 0);
+          __publicField(this, "Gh", SHA512_IV2[12] | 0);
+          __publicField(this, "Gl", SHA512_IV2[13] | 0);
+          __publicField(this, "Hh", SHA512_IV2[14] | 0);
+          __publicField(this, "Hl", SHA512_IV2[15] | 0);
         }
       };
-      sha256 = /* @__PURE__ */ createHasher(
+      sha2563 = /* @__PURE__ */ createHasher2(
         () => new _SHA256(),
         /* @__PURE__ */ oidNist(1)
       );
-      sha512 = /* @__PURE__ */ createHasher(
+      sha512 = /* @__PURE__ */ createHasher2(
         () => new _SHA512(),
         /* @__PURE__ */ oidNist(3)
       );
@@ -749,7 +749,7 @@ var LumenKeys = (() => {
       s2[0] ^= SHA3_IOTA_H[round];
       s2[1] ^= SHA3_IOTA_L[round];
     }
-    clean(B2);
+    clean2(B2);
   }
   var _0n, _1n, _2n, _7n, _256n, _0x71n, SHA3_PI, SHA3_ROTL, _SHA3_IOTA, IOTAS, SHA3_IOTA_H, SHA3_IOTA_L, rotlH, rotlL, Keccak, genKeccak, sha3_256;
   var init_sha3 = __esm({
@@ -802,7 +802,7 @@ var LumenKeys = (() => {
           this.outputLen = outputLen;
           this.enableXOF = enableXOF;
           this.rounds = rounds;
-          anumber(outputLen, "outputLen");
+          anumber2(outputLen, "outputLen");
           if (!(0 < blockLen && blockLen < 200))
             throw new Error("only keccak-f1600 function is supported");
           this.state = new Uint8Array(200);
@@ -819,8 +819,8 @@ var LumenKeys = (() => {
           this.pos = 0;
         }
         update(data) {
-          aexists(this);
-          abytes(data);
+          aexists2(this);
+          abytes3(data);
           const { blockLen, state } = this;
           const len = data.length;
           for (let pos = 0; pos < len; ) {
@@ -844,8 +844,8 @@ var LumenKeys = (() => {
           this.keccak();
         }
         writeInto(out) {
-          aexists(this, false);
-          abytes(out);
+          aexists2(this, false);
+          abytes3(out);
           this.finish();
           const bufferOut = this.state;
           const { blockLen } = this;
@@ -865,11 +865,11 @@ var LumenKeys = (() => {
           return this.writeInto(out);
         }
         xof(bytes) {
-          anumber(bytes);
+          anumber2(bytes);
           return this.xofInto(new Uint8Array(bytes));
         }
         digestInto(out) {
-          aoutput(out, this);
+          aoutput2(out, this);
           if (this.finished)
             throw new Error("digest() was already called");
           this.writeInto(out);
@@ -881,7 +881,7 @@ var LumenKeys = (() => {
         }
         destroy() {
           this.destroyed = true;
-          clean(this.state);
+          clean2(this.state);
         }
         _cloneInto(to) {
           const { blockLen, suffix, outputLen, rounds, enableXOF } = this;
@@ -898,7 +898,7 @@ var LumenKeys = (() => {
           return to;
         }
       };
-      genKeccak = (suffix, blockLen, outputLen, info = {}) => createHasher(() => new Keccak(blockLen, suffix, outputLen), info);
+      genKeccak = (suffix, blockLen, outputLen, info = {}) => createHasher2(() => new Keccak(blockLen, suffix, outputLen), info);
       sha3_256 = /* @__PURE__ */ genKeccak(
         6,
         136,
@@ -920,7 +920,7 @@ var LumenKeys = (() => {
     switch (algorithm.toLowerCase()) {
       case "sha256":
       case "sha-256":
-        hashFn = sha256;
+        hashFn = sha2563;
         break;
       case "sha512":
       case "sha-512":
@@ -2435,286 +2435,6 @@ var LumenKeys = (() => {
 
   // ../crypto/dist/esm/registry.js
   init_esbuild_shims();
-  var SignatureSuiteRegistry = class {
-    constructor() {
-      __publicField(this, "suites", /* @__PURE__ */ new Map());
-    }
-    /**
-     * Register a signature suite implementation
-     */
-    register(suite) {
-      if (this.suites.has(suite.suiteId)) {
-        throw new Error(`Signature suite already registered: ${suite.suiteId}`);
-      }
-      this.suites.set(suite.suiteId, suite);
-    }
-    /**
-     * Get a signature suite by ID
-     * @throws Error if suite is not registered
-     */
-    getSuite(suiteId) {
-      const suite = this.suites.get(suiteId);
-      if (!suite) {
-        throw new Error(`Unknown signature suite: ${suiteId}. Available: ${this.listSuites().join(", ")}`);
-      }
-      return suite;
-    }
-    /**
-     * Check if a suite is registered
-     */
-    hasSuite(suiteId) {
-      return this.suites.has(suiteId);
-    }
-    /**
-     * List all registered suite IDs
-     */
-    listSuites() {
-      return [...this.suites.keys()];
-    }
-    /**
-     * Get all registered suite objects
-     */
-    getAllSuites() {
-      return [...this.suites.values()];
-    }
-    /**
-     * Unregister a suite (primarily for testing)
-     */
-    unregister(suiteId) {
-      return this.suites.delete(suiteId);
-    }
-    /**
-     * Clear all registered suites (primarily for testing)
-     */
-    clear() {
-      this.suites.clear();
-    }
-  };
-  var globalRegistry = new SignatureSuiteRegistry();
-
-  // ../crypto/dist/esm/utils.js
-  init_esbuild_shims();
-  function bytesToHex(bytes) {
-    return Array.from(bytes).map((b2) => b2.toString(16).padStart(2, "0")).join("");
-  }
-  function hexToBytes(hex) {
-    if (hex.length % 2 !== 0) {
-      throw new Error("Hex string must have even length");
-    }
-    const bytes = new Uint8Array(hex.length / 2);
-    for (let i2 = 0; i2 < hex.length; i2 += 2) {
-      bytes[i2 / 2] = parseInt(hex.slice(i2, i2 + 2), 16);
-    }
-    return bytes;
-  }
-  async function hashBytes(bytes, algorithm) {
-    if (algorithm === "sha256") {
-      const crypto = await Promise.resolve().then(() => (init_crypto_browser_shim(), crypto_browser_shim_exports));
-      return new Uint8Array(crypto.createHash("sha256").update(bytes).digest());
-    } else if (algorithm === "sha512") {
-      const crypto = await Promise.resolve().then(() => (init_crypto_browser_shim(), crypto_browser_shim_exports));
-      return new Uint8Array(crypto.createHash("sha512").update(bytes).digest());
-    } else if (algorithm === "sha3-256") {
-      const crypto = await Promise.resolve().then(() => (init_crypto_browser_shim(), crypto_browser_shim_exports));
-      return new Uint8Array(crypto.createHash("sha3-256").update(bytes).digest());
-    }
-    throw new Error(`Unsupported hash algorithm: ${algorithm}`);
-  }
-
-  // ../crypto/dist/esm/signing.js
-  init_esbuild_shims();
-
-  // ../crypto/dist/esm/key-registry.js
-  init_esbuild_shims();
-  var InMemoryKeyStorage = class {
-    constructor() {
-      __publicField(this, "keys", /* @__PURE__ */ new Map());
-    }
-    async store(keyId, keypair, meta) {
-      this.keys.set(keyId, { keypair, meta });
-    }
-    async load(keyId) {
-      return this.keys.get(keyId) || null;
-    }
-    async list(filter) {
-      const allMeta = Array.from(this.keys.values()).map((k2) => k2.meta);
-      if (!filter) {
-        return allMeta;
-      }
-      return allMeta.filter((meta) => {
-        return Object.entries(filter).every(([key, value]) => {
-          if (key === "usage" && Array.isArray(value)) {
-            return value.some((u2) => meta.usage.includes(u2));
-          }
-          return meta[key] === value;
-        });
-      });
-    }
-    async delete(keyId) {
-      this.keys.delete(keyId);
-    }
-    async updateMeta(keyId, updates) {
-      const existing = this.keys.get(keyId);
-      if (!existing) {
-        throw new Error(`Key not found: ${keyId}`);
-      }
-      this.keys.set(keyId, {
-        keypair: existing.keypair,
-        meta: { ...existing.meta, ...updates }
-      });
-    }
-    /**
-     * Clear all keys (testing only).
-     */
-    clear() {
-      this.keys.clear();
-    }
-  };
-  var KeyRegistry = class {
-    constructor(storage = new InMemoryKeyStorage()) {
-      __publicField(this, "storage");
-      this.storage = storage;
-    }
-    /**
-     * Register a new keypair with metadata.
-     */
-    async registerKey(keyId, keypair, suiteId, options = {}) {
-      const meta = {
-        keyId,
-        suiteId,
-        createdAt: (/* @__PURE__ */ new Date()).toISOString(),
-        expiresAt: options.expiresAt,
-        usage: options.usage || ["signing"],
-        cryptoProfileVersion: options.cryptoProfileVersion || "1.0.0",
-        status: options.status || "active"
-      };
-      await this.storage.store(keyId, keypair, meta);
-      return meta;
-    }
-    /**
-     * Get a keypair and its metadata.
-     */
-    async getKey(keyId) {
-      return await this.storage.load(keyId);
-    }
-    /**
-     * Get only the public key (no private key).
-     */
-    async getPublicKey(keyId) {
-      const result = await this.storage.load(keyId);
-      if (!result)
-        return null;
-      return {
-        publicKey: result.keypair.publicKey,
-        meta: result.meta
-      };
-    }
-    /**
-     * List all keys matching optional filter.
-     */
-    async listKeys(filter) {
-      return await this.storage.list(filter);
-    }
-    /**
-     * List only active, non-expired keys.
-     */
-    async listActiveKeys(filter) {
-      const allKeys = await this.storage.list(filter);
-      const now = /* @__PURE__ */ new Date();
-      return allKeys.filter((meta) => {
-        if (meta.status && meta.status !== "active") {
-          return false;
-        }
-        if (meta.expiresAt && new Date(meta.expiresAt) < now) {
-          return false;
-        }
-        return true;
-      });
-    }
-    /**
-     * Rotate a key: generate new keypair, mark old as 'rotated'.
-     *
-     * Returns the new key's metadata.
-     */
-    async rotateKey(oldKeyId, newKeyId, newKeypair) {
-      const oldKey = await this.storage.load(oldKeyId);
-      if (!oldKey) {
-        throw new Error(`Cannot rotate: key not found: ${oldKeyId}`);
-      }
-      await this.storage.updateMeta(oldKeyId, {
-        status: "rotated"
-      });
-      await this.registerKey(newKeyId, newKeypair, oldKey.meta.suiteId, {
-        usage: oldKey.meta.usage,
-        cryptoProfileVersion: oldKey.meta.cryptoProfileVersion,
-        expiresAt: oldKey.meta.expiresAt,
-        status: "active"
-      });
-      await this.storage.updateMeta(newKeyId, {
-        rotatedFrom: oldKeyId
-      });
-      const result = await this.storage.load(newKeyId);
-      return result.meta;
-    }
-    /**
-     * Revoke a key (marks as unusable, but doesn't delete).
-     */
-    async revokeKey(keyId, reason) {
-      await this.storage.updateMeta(keyId, {
-        status: "revoked",
-        revokedAt: (/* @__PURE__ */ new Date()).toISOString()
-      });
-    }
-    /**
-     * Delete a key permanently (use with caution).
-     */
-    async deleteKey(keyId) {
-      await this.storage.delete(keyId);
-    }
-    /**
-     * Mark expired keys as 'expired' status.
-     * Returns count of keys marked expired.
-     */
-    async markExpiredKeys() {
-      const allKeys = await this.storage.list();
-      const now = /* @__PURE__ */ new Date();
-      let count = 0;
-      for (const meta of allKeys) {
-        if (meta.expiresAt && new Date(meta.expiresAt) < now && meta.status === "active") {
-          await this.storage.updateMeta(meta.keyId, {
-            status: "expired"
-          });
-          count++;
-        }
-      }
-      return count;
-    }
-    /**
-     * Cleanup: delete keys that have been revoked/expired for longer than retention period.
-     *
-     * @param retentionDays How many days to keep revoked/expired keys (default: 90)
-     */
-    async pruneOldKeys(retentionDays = 90) {
-      const allKeys = await this.storage.list();
-      const cutoffDate = /* @__PURE__ */ new Date();
-      cutoffDate.setDate(cutoffDate.getDate() - retentionDays);
-      let count = 0;
-      for (const meta of allKeys) {
-        const shouldPrune = meta.status === "revoked" && meta.revokedAt && new Date(meta.revokedAt) < cutoffDate || meta.status === "expired" && meta.expiresAt && new Date(meta.expiresAt) < cutoffDate;
-        if (shouldPrune) {
-          await this.storage.delete(meta.keyId);
-          count++;
-        }
-      }
-      return count;
-    }
-  };
-
-  // ../crypto/dist/esm/errors.js
-  init_esbuild_shims();
-
-  // ../crypto/dist/esm/stateless.js
-  init_esbuild_shims();
 
   // ../crypto/dist/esm/suites/bsv-ecdsa.js
   init_esbuild_shims();
@@ -2738,12 +2458,12 @@ var LumenKeys = (() => {
   };
   var isBig = (n2) => typeof n2 === "bigint";
   var isStr = (s2) => typeof s2 === "string";
-  var isBytes2 = (a2) => a2 instanceof Uint8Array || ArrayBuffer.isView(a2) && a2.constructor.name === "Uint8Array";
-  var abytes2 = (a2, l2) => !isBytes2(a2) || typeof l2 === "number" && l2 > 0 && a2.length !== l2 ? err("Uint8Array expected") : a2;
+  var isBytes = (a2) => a2 instanceof Uint8Array || ArrayBuffer.isView(a2) && a2.constructor.name === "Uint8Array";
+  var abytes = (a2, l2) => !isBytes(a2) || typeof l2 === "number" && l2 > 0 && a2.length !== l2 ? err("Uint8Array expected") : a2;
   var u8n = (len) => new Uint8Array(len);
   var u8fr = (buf) => Uint8Array.from(buf);
   var padh = (n2, pad) => n2.toString(16).padStart(pad, "0");
-  var bytesToHex2 = (b2) => Array.from(abytes2(b2)).map((e2) => padh(e2, 2)).join("");
+  var bytesToHex = (b2) => Array.from(abytes(b2)).map((e2) => padh(e2, 2)).join("");
   var C2 = { _0: 48, _9: 57, A: 65, F: 70, a: 97, f: 102 };
   var _ch = (ch) => {
     if (ch >= C2._0 && ch <= C2._9)
@@ -2754,7 +2474,7 @@ var LumenKeys = (() => {
       return ch - (C2.a - 10);
     return;
   };
-  var hexToBytes2 = (hex) => {
+  var hexToBytes = (hex) => {
     const e2 = "hex invalid";
     if (!isStr(hex))
       return err(e2);
@@ -2772,11 +2492,11 @@ var LumenKeys = (() => {
     }
     return array;
   };
-  var toU8 = (a2, len) => abytes2(isStr(a2) ? hexToBytes2(a2) : u8fr(abytes2(a2)), len);
+  var toU8 = (a2, len) => abytes(isStr(a2) ? hexToBytes(a2) : u8fr(abytes(a2)), len);
   var cr = () => globalThis?.crypto;
   var subtle = () => cr()?.subtle ?? err("crypto.subtle must be defined");
   var concatBytes = (...arrs) => {
-    const r2 = u8n(arrs.reduce((sum, a2) => sum + abytes2(a2).length, 0));
+    const r2 = u8n(arrs.reduce((sum, a2) => sum + abytes(a2).length, 0));
     let pad = 0;
     arrs.forEach((a2) => {
       r2.set(a2, pad);
@@ -2842,7 +2562,7 @@ var LumenKeys = (() => {
     }
     /** Convert Uint8Array or hex string to Point. */
     static fromBytes(bytes) {
-      abytes2(bytes);
+      abytes(bytes);
       let p2 = void 0;
       const head = bytes[0];
       const tail = bytes.subarray(1);
@@ -2991,7 +2711,7 @@ var LumenKeys = (() => {
       return x2 === 0n && y2 === 0n ? I2 : new _Point(x2, y2, 1n);
     }
     toHex(isCompressed) {
-      return bytesToHex2(this.toBytes(isCompressed));
+      return bytesToHex(this.toBytes(isCompressed));
     }
     static fromPrivateKey(k2) {
       return G2.multiply(toPrivScalar(k2));
@@ -3019,10 +2739,10 @@ var LumenKeys = (() => {
   var doubleScalarMulUns = (R2, u1, u2) => {
     return G2.multiply(u1, false).add(R2.multiply(u2, false)).assertValidity();
   };
-  var bytesToNumBE = (b2) => big("0x" + (bytesToHex2(b2) || "0"));
+  var bytesToNumBE = (b2) => big("0x" + (bytesToHex(b2) || "0"));
   var sliceBytesNumBE = (b2, from, to) => bytesToNumBE(b2.subarray(from, to));
   var B256 = 2n ** 256n;
-  var numTo32b = (num) => hexToBytes2(padh(arange(num, 0n, B256), L22));
+  var numTo32b = (num) => hexToBytes(padh(arange(num, 0n, B256), L22));
   var toPrivScalar = (pr) => {
     const num = isBig(pr) ? pr : bytesToNumBE(toU8(pr, L2));
     return arange(num, 1n, N2, "private key invalid 3");
@@ -3044,7 +2764,7 @@ var LumenKeys = (() => {
     }
     /** Create signature from 64b compact (r || s) representation. */
     static fromBytes(b2) {
-      abytes2(b2, L22);
+      abytes(b2, L22);
       const r2 = sliceBytesNumBE(b2, 0, L2);
       const s2 = sliceBytesNumBE(b2, L2, L22);
       return new _Signature(r2, s2);
@@ -3064,7 +2784,7 @@ var LumenKeys = (() => {
       return this.toBytes();
     }
     toCompactHex() {
-      return bytesToHex2(this.toBytes());
+      return bytesToHex(this.toBytes());
     }
     recoverPublicKey(msg) {
       return recoverPublicKey(this, msg);
@@ -3087,7 +2807,7 @@ var LumenKeys = (() => {
     const num = bytesToNumBE(bytes);
     return delta > 0 ? num >> big(delta) : num;
   };
-  var bits2int_modN = (bytes) => modN(bits2int(abytes2(bytes)));
+  var bits2int_modN = (bytes) => modN(bits2int(abytes(bytes)));
   var signOpts = { lowS: true };
   var veriOpts = { lowS: true };
   var prepSig = (msgh, priv, opts = signOpts) => {
@@ -3247,8 +2967,8 @@ var LumenKeys = (() => {
   var randomPrivateKey = () => hashToPrivateKey(randomBytes(L2 + 16));
   var _sha = "SHA-256";
   var etc = {
-    hexToBytes: hexToBytes2,
-    bytesToHex: bytesToHex2,
+    hexToBytes,
+    bytesToHex,
     concatBytes,
     bytesToNumberBE: bytesToNumBE,
     numberToBytesBE: numTo32b,
@@ -3340,15 +3060,15 @@ var LumenKeys = (() => {
 
   // ../../node_modules/@noble/hashes/esm/utils.js
   init_esbuild_shims();
-  function isBytes3(a2) {
+  function isBytes2(a2) {
     return a2 instanceof Uint8Array || ArrayBuffer.isView(a2) && a2.constructor.name === "Uint8Array";
   }
-  function anumber2(n2) {
+  function anumber(n2) {
     if (!Number.isSafeInteger(n2) || n2 < 0)
       throw new Error("positive integer expected, got " + n2);
   }
-  function abytes3(b2, ...lengths) {
-    if (!isBytes3(b2))
+  function abytes2(b2, ...lengths) {
+    if (!isBytes2(b2))
       throw new Error("Uint8Array expected");
     if (lengths.length > 0 && !lengths.includes(b2.length))
       throw new Error("Uint8Array expected of length " + lengths + ", got length=" + b2.length);
@@ -3356,31 +3076,31 @@ var LumenKeys = (() => {
   function ahash(h2) {
     if (typeof h2 !== "function" || typeof h2.create !== "function")
       throw new Error("Hash should be wrapped by utils.createHasher");
-    anumber2(h2.outputLen);
-    anumber2(h2.blockLen);
+    anumber(h2.outputLen);
+    anumber(h2.blockLen);
   }
-  function aexists2(instance, checkFinished = true) {
+  function aexists(instance, checkFinished = true) {
     if (instance.destroyed)
       throw new Error("Hash instance has been destroyed");
     if (checkFinished && instance.finished)
       throw new Error("Hash#digest() has already been called");
   }
-  function aoutput2(out, instance) {
-    abytes3(out);
+  function aoutput(out, instance) {
+    abytes2(out);
     const min = instance.outputLen;
     if (out.length < min) {
       throw new Error("digestInto() expects output buffer of length at least " + min);
     }
   }
-  function clean2(...arrays) {
+  function clean(...arrays) {
     for (let i2 = 0; i2 < arrays.length; i2++) {
       arrays[i2].fill(0);
     }
   }
-  function createView2(arr) {
+  function createView(arr) {
     return new DataView(arr.buffer, arr.byteOffset, arr.byteLength);
   }
-  function rotr2(word, shift) {
+  function rotr(word, shift) {
     return word << 32 - shift | word >>> shift;
   }
   function utf8ToBytes(str) {
@@ -3391,12 +3111,12 @@ var LumenKeys = (() => {
   function toBytes(data) {
     if (typeof data === "string")
       data = utf8ToBytes(data);
-    abytes3(data);
+    abytes2(data);
     return data;
   }
   var Hash = class {
   };
-  function createHasher2(hashCons) {
+  function createHasher(hashCons) {
     const hashC = (msg) => hashCons().update(toBytes(msg)).digest();
     const tmp = hashCons();
     hashC.outputLen = tmp.outputLen;
@@ -3428,16 +3148,16 @@ var LumenKeys = (() => {
       for (let i2 = 0; i2 < pad.length; i2++)
         pad[i2] ^= 54 ^ 92;
       this.oHash.update(pad);
-      clean2(pad);
+      clean(pad);
     }
     update(buf) {
-      aexists2(this);
+      aexists(this);
       this.iHash.update(buf);
       return this;
     }
     digestInto(out) {
-      aexists2(this);
-      abytes3(out, this.outputLen);
+      aexists(this);
+      abytes2(out, this.outputLen);
       this.finished = true;
       this.iHash.digestInto(out);
       this.oHash.update(out);
@@ -3493,13 +3213,13 @@ var LumenKeys = (() => {
     view.setUint32(byteOffset + h2, wh, isLE2);
     view.setUint32(byteOffset + l2, wl, isLE2);
   }
-  function Chi2(a2, b2, c2) {
+  function Chi(a2, b2, c2) {
     return a2 & b2 ^ ~a2 & c2;
   }
-  function Maj2(a2, b2, c2) {
+  function Maj(a2, b2, c2) {
     return a2 & b2 ^ a2 & c2 ^ b2 & c2;
   }
-  var HashMD2 = class extends Hash {
+  var HashMD = class extends Hash {
     constructor(blockLen, outputLen, padOffset, isLE2) {
       super();
       this.finished = false;
@@ -3511,18 +3231,18 @@ var LumenKeys = (() => {
       this.padOffset = padOffset;
       this.isLE = isLE2;
       this.buffer = new Uint8Array(blockLen);
-      this.view = createView2(this.buffer);
+      this.view = createView(this.buffer);
     }
     update(data) {
-      aexists2(this);
+      aexists(this);
       data = toBytes(data);
-      abytes3(data);
+      abytes2(data);
       const { view, buffer, blockLen } = this;
       const len = data.length;
       for (let pos = 0; pos < len; ) {
         const take = Math.min(blockLen - this.pos, len - pos);
         if (take === blockLen) {
-          const dataView = createView2(data);
+          const dataView = createView(data);
           for (; blockLen <= len - pos; pos += blockLen)
             this.process(dataView, pos);
           continue;
@@ -3540,13 +3260,13 @@ var LumenKeys = (() => {
       return this;
     }
     digestInto(out) {
-      aexists2(this);
-      aoutput2(out, this);
+      aexists(this);
+      aoutput(out, this);
       this.finished = true;
       const { buffer, view, blockLen, isLE: isLE2 } = this;
       let { pos } = this;
       buffer[pos++] = 128;
-      clean2(this.buffer.subarray(pos));
+      clean(this.buffer.subarray(pos));
       if (this.padOffset > blockLen - pos) {
         this.process(view, 0);
         pos = 0;
@@ -3555,7 +3275,7 @@ var LumenKeys = (() => {
         buffer[i2] = 0;
       setBigUint64(view, blockLen - 8, BigInt(this.length * 8), isLE2);
       this.process(view, 0);
-      const oview = createView2(out);
+      const oview = createView(out);
       const len = this.outputLen;
       if (len % 4)
         throw new Error("_sha2: outputLen should be aligned to 32bit");
@@ -3589,7 +3309,7 @@ var LumenKeys = (() => {
       return this._cloneInto();
     }
   };
-  var SHA256_IV2 = /* @__PURE__ */ Uint32Array.from([
+  var SHA256_IV = /* @__PURE__ */ Uint32Array.from([
     1779033703,
     3144134277,
     1013904242,
@@ -3601,7 +3321,7 @@ var LumenKeys = (() => {
   ]);
 
   // ../../node_modules/@noble/hashes/esm/sha2.js
-  var SHA256_K2 = /* @__PURE__ */ Uint32Array.from([
+  var SHA256_K = /* @__PURE__ */ Uint32Array.from([
     1116352408,
     1899447441,
     3049323471,
@@ -3667,18 +3387,18 @@ var LumenKeys = (() => {
     3204031479,
     3329325298
   ]);
-  var SHA256_W2 = /* @__PURE__ */ new Uint32Array(64);
-  var SHA256 = class extends HashMD2 {
+  var SHA256_W = /* @__PURE__ */ new Uint32Array(64);
+  var SHA256 = class extends HashMD {
     constructor(outputLen = 32) {
       super(64, outputLen, 8, false);
-      this.A = SHA256_IV2[0] | 0;
-      this.B = SHA256_IV2[1] | 0;
-      this.C = SHA256_IV2[2] | 0;
-      this.D = SHA256_IV2[3] | 0;
-      this.E = SHA256_IV2[4] | 0;
-      this.F = SHA256_IV2[5] | 0;
-      this.G = SHA256_IV2[6] | 0;
-      this.H = SHA256_IV2[7] | 0;
+      this.A = SHA256_IV[0] | 0;
+      this.B = SHA256_IV[1] | 0;
+      this.C = SHA256_IV[2] | 0;
+      this.D = SHA256_IV[3] | 0;
+      this.E = SHA256_IV[4] | 0;
+      this.F = SHA256_IV[5] | 0;
+      this.G = SHA256_IV[6] | 0;
+      this.H = SHA256_IV[7] | 0;
     }
     get() {
       const { A: A2, B: B2, C: C3, D: D2, E: E2, F: F2, G: G3, H: H2 } = this;
@@ -3697,20 +3417,20 @@ var LumenKeys = (() => {
     }
     process(view, offset) {
       for (let i2 = 0; i2 < 16; i2++, offset += 4)
-        SHA256_W2[i2] = view.getUint32(offset, false);
+        SHA256_W[i2] = view.getUint32(offset, false);
       for (let i2 = 16; i2 < 64; i2++) {
-        const W15 = SHA256_W2[i2 - 15];
-        const W22 = SHA256_W2[i2 - 2];
-        const s0 = rotr2(W15, 7) ^ rotr2(W15, 18) ^ W15 >>> 3;
-        const s1 = rotr2(W22, 17) ^ rotr2(W22, 19) ^ W22 >>> 10;
-        SHA256_W2[i2] = s1 + SHA256_W2[i2 - 7] + s0 + SHA256_W2[i2 - 16] | 0;
+        const W15 = SHA256_W[i2 - 15];
+        const W22 = SHA256_W[i2 - 2];
+        const s0 = rotr(W15, 7) ^ rotr(W15, 18) ^ W15 >>> 3;
+        const s1 = rotr(W22, 17) ^ rotr(W22, 19) ^ W22 >>> 10;
+        SHA256_W[i2] = s1 + SHA256_W[i2 - 7] + s0 + SHA256_W[i2 - 16] | 0;
       }
       let { A: A2, B: B2, C: C3, D: D2, E: E2, F: F2, G: G3, H: H2 } = this;
       for (let i2 = 0; i2 < 64; i2++) {
-        const sigma1 = rotr2(E2, 6) ^ rotr2(E2, 11) ^ rotr2(E2, 25);
-        const T1 = H2 + sigma1 + Chi2(E2, F2, G3) + SHA256_K2[i2] + SHA256_W2[i2] | 0;
-        const sigma0 = rotr2(A2, 2) ^ rotr2(A2, 13) ^ rotr2(A2, 22);
-        const T2 = sigma0 + Maj2(A2, B2, C3) | 0;
+        const sigma1 = rotr(E2, 6) ^ rotr(E2, 11) ^ rotr(E2, 25);
+        const T1 = H2 + sigma1 + Chi(E2, F2, G3) + SHA256_K[i2] + SHA256_W[i2] | 0;
+        const sigma0 = rotr(A2, 2) ^ rotr(A2, 13) ^ rotr(A2, 22);
+        const T2 = sigma0 + Maj(A2, B2, C3) | 0;
         H2 = G3;
         G3 = F2;
         F2 = E2;
@@ -3731,17 +3451,46 @@ var LumenKeys = (() => {
       this.set(A2, B2, C3, D2, E2, F2, G3, H2);
     }
     roundClean() {
-      clean2(SHA256_W2);
+      clean(SHA256_W);
     }
     destroy() {
       this.set(0, 0, 0, 0, 0, 0, 0, 0);
-      clean2(this.buffer);
+      clean(this.buffer);
     }
   };
-  var sha2562 = /* @__PURE__ */ createHasher2(() => new SHA256());
+  var sha256 = /* @__PURE__ */ createHasher(() => new SHA256());
 
   // ../../node_modules/@noble/hashes/esm/sha256.js
-  var sha2563 = sha2562;
+  var sha2562 = sha256;
+
+  // ../crypto/dist/esm/utils.js
+  init_esbuild_shims();
+  function bytesToHex2(bytes) {
+    return Array.from(bytes).map((b2) => b2.toString(16).padStart(2, "0")).join("");
+  }
+  function hexToBytes2(hex) {
+    if (hex.length % 2 !== 0) {
+      throw new Error("Hex string must have even length");
+    }
+    const bytes = new Uint8Array(hex.length / 2);
+    for (let i2 = 0; i2 < hex.length; i2 += 2) {
+      bytes[i2 / 2] = parseInt(hex.slice(i2, i2 + 2), 16);
+    }
+    return bytes;
+  }
+  async function hashBytes(bytes, algorithm) {
+    if (algorithm === "sha256") {
+      const crypto = await Promise.resolve().then(() => (init_crypto_browser_shim(), crypto_browser_shim_exports));
+      return new Uint8Array(crypto.createHash("sha256").update(bytes).digest());
+    } else if (algorithm === "sha512") {
+      const crypto = await Promise.resolve().then(() => (init_crypto_browser_shim(), crypto_browser_shim_exports));
+      return new Uint8Array(crypto.createHash("sha512").update(bytes).digest());
+    } else if (algorithm === "sha3-256") {
+      const crypto = await Promise.resolve().then(() => (init_crypto_browser_shim(), crypto_browser_shim_exports));
+      return new Uint8Array(crypto.createHash("sha3-256").update(bytes).digest());
+    }
+    throw new Error(`Unsupported hash algorithm: ${algorithm}`);
+  }
 
   // ../crypto/dist/esm/derivation/bip32.js
   init_esbuild_shims();
@@ -10208,8 +9957,8 @@ zoo`.split("\n");
     if (compressed) {
       payload[33] = 1;
     }
-    const hash1 = sha2563(payload);
-    const hash2 = sha2563(hash1);
+    const hash1 = sha2562(payload);
+    const hash2 = sha2562(hash1);
     const checksum2 = hash2.slice(0, 4);
     const data = new Uint8Array(payload.length + 4);
     data.set(payload);
@@ -10223,8 +9972,8 @@ zoo`.split("\n");
     }
     const payload = data.slice(0, -4);
     const checksum2 = data.slice(-4);
-    const hash1 = sha2563(payload);
-    const hash2 = sha2563(hash1);
+    const hash1 = sha2562(payload);
+    const hash2 = sha2562(hash1);
     const expectedChecksum = hash2.slice(0, 4);
     if (!checksum2.every((byte, i2) => byte === expectedChecksum[i2])) {
       throw new Error("Invalid WIF checksum");
@@ -10244,7 +9993,7 @@ zoo`.split("\n");
   }
 
   // ../crypto/dist/esm/suites/bsv-ecdsa.js
-  etc.hmacSha256Sync = (key, ...msgs) => hmac(sha2563, key, etc.concatBytes(...msgs));
+  etc.hmacSha256Sync = (key, ...msgs) => hmac(sha2562, key, etc.concatBytes(...msgs));
   var BsvEcdsaSuite = class {
     constructor() {
       __publicField(this, "suiteId", "bsv-ecdsa-secp256k1");
@@ -10277,17 +10026,17 @@ zoo`.split("\n");
       }
     }
     exportPublicKey(pub) {
-      return bytesToHex(pub);
+      return bytesToHex2(pub);
     }
     importPublicKey(encoded) {
-      return hexToBytes(encoded);
+      return hexToBytes2(encoded);
     }
     exportPrivateKey(priv) {
       return encodeWIF(priv, true, "mainnet");
     }
     importPrivateKey(encoded) {
       if (encoded.length === 64) {
-        const bytes = hexToBytes(encoded);
+        const bytes = hexToBytes2(encoded);
         if (bytes.length !== 32) {
           throw new Error("Private key must be 32 bytes");
         }
@@ -10353,20 +10102,20 @@ zoo`.split("\n");
       }
     }
     exportPublicKey(pub) {
-      return bytesToHex(pub);
+      return bytesToHex2(pub);
     }
     importPublicKey(encoded) {
-      const bytes = hexToBytes(encoded);
+      const bytes = hexToBytes2(encoded);
       if (bytes.length !== this.sizes.publicKey) {
         throw new Error(`${this.suiteId} public key must be ${this.sizes.publicKey} bytes, got ${bytes.length}`);
       }
       return bytes;
     }
     exportPrivateKey(priv) {
-      return bytesToHex(priv);
+      return bytesToHex2(priv);
     }
     importPrivateKey(encoded) {
-      const bytes = hexToBytes(encoded);
+      const bytes = hexToBytes2(encoded);
       if (bytes.length !== this.sizes.privateKey) {
         throw new Error(`${this.suiteId} private key must be ${this.sizes.privateKey} bytes, got ${bytes.length}`);
       }
@@ -10401,6 +10150,263 @@ zoo`.split("\n");
     }
   };
 
+  // ../crypto/dist/esm/registry.js
+  var SignatureSuiteRegistry = class {
+    constructor() {
+      __publicField(this, "suites", /* @__PURE__ */ new Map());
+    }
+    /**
+     * Register a signature suite implementation
+     */
+    register(suite) {
+      if (this.suites.has(suite.suiteId)) {
+        throw new Error(`Signature suite already registered: ${suite.suiteId}`);
+      }
+      this.suites.set(suite.suiteId, suite);
+    }
+    /**
+     * Get a signature suite by ID
+     * @throws Error if suite is not registered
+     */
+    getSuite(suiteId) {
+      const suite = this.suites.get(suiteId);
+      if (!suite) {
+        throw new Error(`Unknown signature suite: ${suiteId}. Available: ${this.listSuites().join(", ")}`);
+      }
+      return suite;
+    }
+    /**
+     * Check if a suite is registered
+     */
+    hasSuite(suiteId) {
+      return this.suites.has(suiteId);
+    }
+    /**
+     * List all registered suite IDs
+     */
+    listSuites() {
+      return [...this.suites.keys()];
+    }
+    /**
+     * Get all registered suite objects
+     */
+    getAllSuites() {
+      return [...this.suites.values()];
+    }
+    /**
+     * Unregister a suite (primarily for testing)
+     */
+    unregister(suiteId) {
+      return this.suites.delete(suiteId);
+    }
+    /**
+     * Clear all registered suites (primarily for testing)
+     */
+    clear() {
+      this.suites.clear();
+    }
+  };
+  var globalRegistry = new SignatureSuiteRegistry();
+  globalRegistry.register(new BsvEcdsaSuite());
+  globalRegistry.register(new MlDsa44Suite());
+  globalRegistry.register(new MlDsa65Suite());
+  globalRegistry.register(new MlDsa87Suite());
+
+  // ../crypto/dist/esm/signing.js
+  init_esbuild_shims();
+
+  // ../crypto/dist/esm/key-registry.js
+  init_esbuild_shims();
+  var InMemoryKeyStorage = class {
+    constructor() {
+      __publicField(this, "keys", /* @__PURE__ */ new Map());
+    }
+    async store(keyId, keypair, meta) {
+      this.keys.set(keyId, { keypair, meta });
+    }
+    async load(keyId) {
+      return this.keys.get(keyId) || null;
+    }
+    async list(filter) {
+      const allMeta = Array.from(this.keys.values()).map((k2) => k2.meta);
+      if (!filter) {
+        return allMeta;
+      }
+      return allMeta.filter((meta) => {
+        return Object.entries(filter).every(([key, value]) => {
+          if (key === "usage" && Array.isArray(value)) {
+            return value.some((u2) => meta.usage.includes(u2));
+          }
+          return meta[key] === value;
+        });
+      });
+    }
+    async delete(keyId) {
+      this.keys.delete(keyId);
+    }
+    async updateMeta(keyId, updates) {
+      const existing = this.keys.get(keyId);
+      if (!existing) {
+        throw new Error(`Key not found: ${keyId}`);
+      }
+      this.keys.set(keyId, {
+        keypair: existing.keypair,
+        meta: { ...existing.meta, ...updates }
+      });
+    }
+    /**
+     * Clear all keys (testing only).
+     */
+    clear() {
+      this.keys.clear();
+    }
+  };
+  var KeyRegistry = class {
+    constructor(storage = new InMemoryKeyStorage()) {
+      __publicField(this, "storage");
+      this.storage = storage;
+    }
+    /**
+     * Register a new keypair with metadata.
+     */
+    async registerKey(keyId, keypair, suiteId, options = {}) {
+      const meta = {
+        keyId,
+        suiteId,
+        createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+        expiresAt: options.expiresAt,
+        usage: options.usage || ["signing"],
+        cryptoProfileVersion: options.cryptoProfileVersion || "1.0.0",
+        status: options.status || "active"
+      };
+      await this.storage.store(keyId, keypair, meta);
+      return meta;
+    }
+    /**
+     * Get a keypair and its metadata.
+     */
+    async getKey(keyId) {
+      return await this.storage.load(keyId);
+    }
+    /**
+     * Get only the public key (no private key).
+     */
+    async getPublicKey(keyId) {
+      const result = await this.storage.load(keyId);
+      if (!result)
+        return null;
+      return {
+        publicKey: result.keypair.publicKey,
+        meta: result.meta
+      };
+    }
+    /**
+     * List all keys matching optional filter.
+     */
+    async listKeys(filter) {
+      return await this.storage.list(filter);
+    }
+    /**
+     * List only active, non-expired keys.
+     */
+    async listActiveKeys(filter) {
+      const allKeys = await this.storage.list(filter);
+      const now = /* @__PURE__ */ new Date();
+      return allKeys.filter((meta) => {
+        if (meta.status && meta.status !== "active") {
+          return false;
+        }
+        if (meta.expiresAt && new Date(meta.expiresAt) < now) {
+          return false;
+        }
+        return true;
+      });
+    }
+    /**
+     * Rotate a key: generate new keypair, mark old as 'rotated'.
+     *
+     * Returns the new key's metadata.
+     */
+    async rotateKey(oldKeyId, newKeyId, newKeypair) {
+      const oldKey = await this.storage.load(oldKeyId);
+      if (!oldKey) {
+        throw new Error(`Cannot rotate: key not found: ${oldKeyId}`);
+      }
+      await this.storage.updateMeta(oldKeyId, {
+        status: "rotated"
+      });
+      await this.registerKey(newKeyId, newKeypair, oldKey.meta.suiteId, {
+        usage: oldKey.meta.usage,
+        cryptoProfileVersion: oldKey.meta.cryptoProfileVersion,
+        expiresAt: oldKey.meta.expiresAt,
+        status: "active"
+      });
+      await this.storage.updateMeta(newKeyId, {
+        rotatedFrom: oldKeyId
+      });
+      const result = await this.storage.load(newKeyId);
+      return result.meta;
+    }
+    /**
+     * Revoke a key (marks as unusable, but doesn't delete).
+     */
+    async revokeKey(keyId, reason) {
+      await this.storage.updateMeta(keyId, {
+        status: "revoked",
+        revokedAt: (/* @__PURE__ */ new Date()).toISOString()
+      });
+    }
+    /**
+     * Delete a key permanently (use with caution).
+     */
+    async deleteKey(keyId) {
+      await this.storage.delete(keyId);
+    }
+    /**
+     * Mark expired keys as 'expired' status.
+     * Returns count of keys marked expired.
+     */
+    async markExpiredKeys() {
+      const allKeys = await this.storage.list();
+      const now = /* @__PURE__ */ new Date();
+      let count = 0;
+      for (const meta of allKeys) {
+        if (meta.expiresAt && new Date(meta.expiresAt) < now && meta.status === "active") {
+          await this.storage.updateMeta(meta.keyId, {
+            status: "expired"
+          });
+          count++;
+        }
+      }
+      return count;
+    }
+    /**
+     * Cleanup: delete keys that have been revoked/expired for longer than retention period.
+     *
+     * @param retentionDays How many days to keep revoked/expired keys (default: 90)
+     */
+    async pruneOldKeys(retentionDays = 90) {
+      const allKeys = await this.storage.list();
+      const cutoffDate = /* @__PURE__ */ new Date();
+      cutoffDate.setDate(cutoffDate.getDate() - retentionDays);
+      let count = 0;
+      for (const meta of allKeys) {
+        const shouldPrune = meta.status === "revoked" && meta.revokedAt && new Date(meta.revokedAt) < cutoffDate || meta.status === "expired" && meta.expiresAt && new Date(meta.expiresAt) < cutoffDate;
+        if (shouldPrune) {
+          await this.storage.delete(meta.keyId);
+          count++;
+        }
+      }
+      return count;
+    }
+  };
+
+  // ../crypto/dist/esm/errors.js
+  init_esbuild_shims();
+
+  // ../crypto/dist/esm/stateless.js
+  init_esbuild_shims();
+
   // src/sdk.ts
   var DefaultKeySDK = class {
     constructor(config) {