libves 2.16.0 → 3.0.0

package/libVES.node.js

@@ -27,7 +27,7 @@
  *
  * @title libVES
  * @dev A JavaScript end-to-end encryption interface to VESvault REST API
- * @version 2.16
+ * @version 3.00
  *
  * @dev Official source code: https://github.com/vesvault/libVES
  *
@@ -51,6 +51,7 @@ if (typeof(libVES) != 'function') function libVES(optns) {
     else if (this.user) this.type = 'primary';
     else throw new libVES.Error('InvalidValue','Required parameters: user || domain');
     this.unlockedKeys = {};
+    this.pendingKeys = {};
 }
 
 libVES.prototype = {
@@ -64,6 +65,7 @@ libVES.prototype = {
     defaultHash: 'SHA256',
     propagators: [],
     request: function(method,uri,body,optns) {
+	var self = this;
 	if (!optns) optns = {};
 	return new Promise(function(resolve,reject) {
 	    var xhr = new XMLHttpRequest();
@@ -80,8 +82,13 @@ libVES.prototype = {
 				    return new libVES.Error(e.type,e.message,e);
 				});
 				if (errs.length) {
+				    var retry = function(o) { return self.request(method, uri, body, (o || optns)); };
 				    if (optns && optns.onerror) try {
-					resolve(optns.onerror(errs));
+					resolve(optns.onerror(errs, optns, retry));
+				    } catch (e) {
+					reject(e);
+				    } else if (self.onerror) try {
+					resolve(self.onerror(errs, optns, retry));
 				    } catch (e) {
 					reject(e);
 				    }
@@ -95,7 +102,7 @@ libVES.prototype = {
 	    if (body != null) xhr.setRequestHeader('Content-Type','application/json');
 	    xhr.setRequestHeader('Accept','application/json');
 	    if (this.user && optns.password) xhr.setRequestHeader('Authorization','Basic ' + btoa(this.user + ':' + optns.password));
-	    else if (optns.token || this.token) xhr.setRequestHeader('Authorization','Bearer ' + (optns.token ? optns.token : this.token));
+	    else if (optns.token ?? this.token) xhr.setRequestHeader('Authorization','Bearer ' + (optns.token ? optns.token : this.token));
 	    xhr.responseType = 'json';
 	    xhr.send(body);
 	}.bind(this));
@@ -120,6 +127,10 @@ libVES.prototype = {
 	}
 	return '';
     },
+    mergeFieldList: function(flds, flds2) {
+	for (var k in flds2) if (flds[k] instanceof Object) flds[k] = this.mergeFieldList(flds[k], flds2[k]); else flds[k] = flds2[k];
+	return flds;
+    },
     elevateAuth: function(optns) {
 	var self = this;
 	if (optns && (optns.password || optns.token)) return Promise.resolve(optns);
@@ -236,7 +247,7 @@ libVES.prototype = {
     unlock: function(veskey) {
 	var self = this;
 	return this.getVaultKey().then(function(vkey) {
-	    return vkey.unlock(Promise.resolve(veskey)).then(function(cryptoKey) {
+	    return vkey.unlock(veskey).then(function(cryptoKey) {
 		if (self.VESkey === null) self.VESkey = veskey;
 		if (!self.token && self.type == 'secondary') return vkey.getSessionToken().then(function(tkn) {
 		    self.token = tkn;
@@ -251,8 +262,13 @@ libVES.prototype = {
 	});
     },
     lock: function() {
-	this.unlockedKeys = {};
-	return Promise.resolve(true);
+	var lock = [];
+	for (var kid in this.unlockedKeys) lock.push(this.unlockedKeys[kid].then(function(k) {
+	    return k.lock();
+	}).catch(function() {}));
+	return Promise.all(lock).then(function() {
+	    return true;
+	});
     },
     reset: function(val) {
 	this.userMe = undefined;
@@ -293,11 +309,11 @@ libVES.prototype = {
 	    });
 	});
     },
-    getItems: function() {
+    getItems: function(flds) {
 	var self = this;
 	return this.getVaultKey().then(function(k) {
 	    return k.getId().then(function(kid) {
-		return k.getVaultEntries({type: true, deleted: true, file: {creator: true, externals: true}, vaultKey: {type: true, user: true}}).then(function(ves) {
+		return k.getVaultEntries(self.mergeFieldList({type: true, deleted: true, file: {creator: true, externals: true}, vaultKey: {type: true, user: true}}, flds)).then(function(ves) {
 		    var vis = {};
 		    var vlst = [];
 		    for (var i = 0; i < ves.length; i++) {
@@ -308,6 +324,7 @@ libVES.prototype = {
 			    if (!vi.vaultKey) vi.vaultKey = undefined;
 			    vi = vis[viid] = self.getItem(vi);
 			    vlst.push(vi);
+			    if (!ves[i].vaultKey) ves[i].vaultKey = {id: kid};
 			    vi.vaultEntryByKey[kid] = ves[i];
 			}
 		    }
@@ -346,7 +363,7 @@ libVES.prototype = {
     _matchUser: function(u) {
 	if (typeof(u) == 'object') {
 	    if (u instanceof libVES.User) return u;
-	    else return new libVES.User(u,this);
+	    else return new libVES.User((u.id ? {id: u.id} : {email: u.email}), this);
 	} else if (typeof(u) == 'string' && u.match(/^\S+\@\S+$/)) return new libVES.User({email: u},this);
 	throw new libVES.Error('BadUser',"Cannot match user: " + u,{value: u});
     },
@@ -377,11 +394,14 @@ libVES.prototype = {
 	}).catch(function(e) {
 	    throw new libVES.Error('NotFound', 'Cannot match externalId for domain:' + ext.domain + ', user:' + user + '. Define libVES.Domain.' + ext.domain + '.userToVaultRef(user) to return a valid reference.',{error: e});
 	})).then(function(exts) {
-	    var vkey = new libVES.VaultKey({externals: exts, creator: self.me()},self);
+            var keyref = {externals: exts};
+            if (self.externalId && self.externalId[0] != '!') keyref.creator = self.me();
+	    var vkey = new libVES.VaultKey(keyref, self);
 	    return vkey.getId().then(function() {
 		return vkey;
 	    }).catch(function(e) {
 		if (e.code != 'NotFound') throw e;
+                if (!keyref.creator) throw new libVES.Error.InvalidKey('Anonymous vaults are not authorized to create temp keys');
 		return Promise.resolve(user || m().then(function(dom) {
 		    return dom.vaultRefToUser(exts[0]);
 		})).catch(function(e) {
@@ -434,8 +454,8 @@ libVES.prototype = {
 	return key.generate(veskey, optns).then(function(k) {
 	    key.setField('vaultItems', veskey.then(function(v) {
 		var vi = new libVES.VaultItem({type: 'password'}, self);
-		return usr.getActiveVaultKeys().then(function() {
-		    return [self.me(), self.getVaultKey(), usr];
+		return usr.getActiveVaultKeys().then(function(akeys) {
+		    return [self.me(), self.getVaultKey()].concat(akeys);
 		}).catch(function(e) {
 		    if (e.code != 'NotFound') throw e;
 		    var sh = self.type == 'secondary' ? [self.me(), self.getVaultKey()] : [self.me()];
@@ -573,6 +593,9 @@ libVES.prototype = {
 		}).catch(function(e) {
 		    if (!e || e.code != 'Unauthorized') throw e;
 		}).then(function() {
+                    self.vaultKey = k.lock().then(function() {
+                        return k;
+                    });
 		    return self.unlock(veskey);
 		});
 	    });
@@ -807,7 +830,7 @@ libVES.prototype = {
 	return self.getVaultKey().then(function(vk) {
 	    return vk.getField('unlockableVaultKeys').then(function(vks) {
 		var rs = {};
-		return Promise.all(vks.map(function(e, i) {
+		return Promise.all((vks || []).map(function(e, i) {
 		    return e.getId().then(function(id) {
 			rs[id] = e;
 		    });
@@ -917,6 +940,11 @@ libVES.Error.Redirect = function(msg, optns) {
 };
 libVES.Error.Redirect.prototype = new libVES.Error('Redirect');
 
+libVES.Error.Unauthorized = function(msg, optns) {
+    this.init(msg, optns);
+};
+libVES.Error.Unauthorized.prototype = new libVES.Error('Unauthorized');
+
 libVES.Error.Internal = function(msg, optns) {
     this.init(msg, optns);
 };
@@ -1024,6 +1052,14 @@ libVES.Util = {
 	}
 	return rs;
     },
+    fillUndefs: function(data, defs) {
+        if (data instanceof Array) data.map((d) => libVES.Util.fillUndefs(d, defs));
+        else if (data && defs) for (var k in defs) if (defs[k]) {
+            if (data[k] === undefined) data[k] = undefined;
+            else if (data[k] instanceof Object) libVES.Util.fillUndefs(data[k], defs[k]);
+        }
+        return data;
+    },
     loadWasm: function(src) {
 	return new Promise(function(resolve, reject) {
 	    var sc = document.createElement('script');
@@ -1712,30 +1748,20 @@ libVES.Object.prototype = {
 	this.setFields(data,data.id == null);
 	if (refs) for (var k in refs) this[k] = Promise.resolve(refs[k]);
     },
-    setFields: function(data,up) {
-	var self = this;
-	var chg = false;
-	for (var k in data) {
-	    if (up === undefined || up) this.fieldUpdate[k] = true;
-	    if (this[k] instanceof Promise) {
-		this[k] = undefined;
-		chg = true;
-	    }
-	    if (this[k] === undefined) this[k] = Promise.resolve(data[k]).then((function(k) {
-		return function(v) {
-		    var clsf;
-		    if (self.fieldClass[k]) return (clsf = function(v) {
-			if (v instanceof libVES.Object) return v;
-			else if (v instanceof Array) return v.map(function(vv) { return clsf(vv); });
-			else if (v) return new (self.fieldClass[k])(v,self.VES);
-		    })(v);
-		    return v;
-		};
-	    })(k));
-	    else return Promise.reject(new libVES.Error('Internal',"Unknown field: " + k));
-	}
-	if (chg && self.trigger) self.trigger.resolve(self);
-	return Promise.resolve(self);
+    setFields: function(flds, up) {
+        var res = Promise.resolve(null);
+        for (var fld in flds) ((fld) => {
+            if (up === undefined || up) this.fieldUpdate[fld] = true;
+            var cls = this.fieldClass[fld];
+            var cur = this[fld];
+            res = this[fld] = res.then(() => Promise.resolve(flds[fld]).then((val) => Promise.resolve(cur).catch((er) => undefined).then((cur) => {
+                if (!cls || !val) return val;
+                else if (val instanceof Array) return val.map((v) => ((v instanceof libVES.Object) ? v : new cls(v, this.VES)));
+                else if (cur instanceof cls) return cur.setFields(val, up);
+                else return (val instanceof libVES.Object) ? val : new cls(val, this.VES);
+            })));
+        })(fld);
+        return res.then(() => this);
     },
     setField: function(fld,val,upd) {
 	var flds = {};
@@ -1744,54 +1770,78 @@ libVES.Object.prototype = {
 	    return self[fld];
 	});
     },
+    unsetField: function(fld) {
+	delete(this[fld]);
+    },
+    _fieldsToLoad: function(fldlst, force, ld) {
+        var flds = {};
+        for (var k in fldlst) flds[k] ||= fldlst[k];
+        for (var i = 0; i < this.fieldSets.length; i++) {
+            for (var k in this.fieldSets[i]) if (fldlst[k]) {
+                for (var k in this.fieldSets[i]) if ((force || !this[k]) && !(flds[k] instanceof Object)) (flds ||= {})[k] = this.fieldSets[i][k];
+                break;
+            }
+        }
+        var res = Promise.resolve(null);
+        for (var fld in flds) ((fld) => {
+            var cur = this[fld];
+            var na = (cur === undefined);
+            var cls = this.fieldClass[fld];
+            res = res.then((res) => Promise.resolve(cur).catch((er) => null).then((cur) => {
+                var lst = null;
+                if (force || na) lst = flds[fld];
+                else if (cls) {
+                    if (cur instanceof Array) lst = ((cur[0] instanceof cls) ? cur[0]._fieldsToLoad(flds[fld], force, ld.then((vals) => vals[fld])) : Promise.resolve(null)).then((lst) => (lst && flds[fld]));
+                    else if (cur instanceof cls) lst = cur._fieldsToLoad(flds[fld], force, ld.then((vals) => vals[fld]));
+                }
+                return Promise.resolve(lst).then((lst) => {
+                    if (lst) (res ||= {})[fld] = lst;
+                    return res;
+                });
+            }));
+            if (na || (!cls && force)) (this[fld] = ld.then((vals) => (vals?.hasOwnProperty(fld) ? (cls && vals[fld] ? ((vals[fld] instanceof Array) ? vals[fld].map((e) => new cls(e, this.VES)) : new cls(vals[fld], this.VES)) : vals[fld]) : cur))).catch(() => null);
+        })(fld);
+        ld.then((vals) => {
+            for (var fld in vals) if (!flds[fld] && !this[fld]) this.setField(fld, vals[fld], false);
+        }).catch((er) => null);
+        return res.then((res) => {
+            if (res) for (var k in fldlst) if (res[k]) return res;
+            return null;
+        });
+    },
     getFields: function(fldlst, force) {
-	var self = this;
-	var flds = {};
-	for (var i = 0; i < this.fieldSets.length; i++) {
-	    for (var k in this.fieldSets[i]) if (fldlst[k]) {
-		for (var k in this.fieldSets[i]) if ((force || !this[k]) && !(flds[k] instanceof Object)) flds[k] = this.fieldSets[i][k];
-		break;
-	    }
-	}
-	for (var k in fldlst) if ((force || !this[k]) && !(flds[k] instanceof Object)) flds[k] = fldlst[k];
-	for (var k in flds) {
-	    this.loadFields(flds);
-	    break;
-	}
+        var ldf;
+        var ld = new Promise((resolve, reject) => ldf = [resolve, reject]);
+        this._fieldsToLoad(fldlst, force, ld).then((flds) => this.loadFields(flds, force)).then((vals) => ldf[0](vals)).catch((er) => ldf[1](er));
 	var plst = [];
-	for (var k in fldlst) {
-	    plst.push(Promise.resolve(this[k]).then(function(v) {
+	for (var k in fldlst) ((k) => {
+	    plst.push(ld.then(() => this[k]).then(function rslv(v) {
+		if (v instanceof Array) return Promise.all(v.map(function(e, i) {
+		    return rslv(e);
+		}));
 		if (!(v instanceof libVES.Object)) return v;
-		return v.getFields(fldlst[k], force);
+		return v.getFields(fldlst[k]);
 	    }));
-	}
+	})(k);
 	var rs = {};
-	return Promise.all(plst).then(function(lst) {
+	return Promise.all(plst).then((lst) => {
 	    var i = 0;
 	    for (var k in fldlst) rs[k] = lst[i++];
 	    return rs;
 	});
     },
     getField: function(fld,fldlst,force) {
-	var self = this;
 	if (!this[fld] || force) {
 	    var flds = {};
-	    for (var i = 0; i < this.fieldSets.length; i++) if (this.fieldSets[i][fld]) {
-		for (var k in this.fieldSets[i]) flds[k] = this.fieldSets[i][k];
-		break;
-	    }
-	    if (fldlst) flds[fld] = fldlst;
-	    if (!flds[fld]) {
-		var cls = self.fieldClass[fld];
-		flds[fld] = cls ? cls.prototype.fieldList : true;
-	    }
-	    this.loadFields(flds,force);
+            flds[fld] = fldlst || true;
+	    this.getFields(flds, force).catch(() => null);
 	}
 	return this[fld];
     },
     loadFields: function(flds,force,optns) {
+        if (!flds) return Promise.resolve({});
 	var self = this;
-	var req = this.id ? this.id.then(function(id) {  return self.VES.get(self.apiUri + '/' + id,flds,optns); }) : self.postData().then(function(data) {
+	return (this.id && !flds.id ? this.id.then(function(id) {  return self.VES.get(self.apiUri + '/' + id,flds,optns); }) : self.postData().then(function(data) {
 	    data['$op'] = 'fetch';
 	    return self.VES.post(self.apiUri,data,flds,optns);
 	}).then(function(data) {
@@ -1800,21 +1850,10 @@ libVES.Object.prototype = {
 		self.fieldUpdate = {id: true};
 	    }
 	    return data;
-	});
-	for (var k in flds) if (force || this[k] === undefined) {
-	    this[k] = req.then((function(fld) {
-		var cls = self.fieldClass[fld];
-		return function(data) {
-		    if (cls && data[fld]) return ((data[fld] instanceof Array) ? data[fld].map(function(v) {
-			return new cls(v,self.VES);
-		    }) : new cls(data[fld],self.VES));
-		    return data[fld];
-		};
-	    })(k));
-	}
+	})).then((data) => libVES.Util.fillUndefs(data, flds));
     },
     reset: function() {
-	for (var k in this.fieldClass) delete(this[k]);
+	for (var k in this.fieldClass) this.unsetField(k);
 	return Promise.resolve();
     },
     getId: function() {
@@ -1888,6 +1927,23 @@ libVES.Object.prototype = {
     },
     resolveError: function(e,field) {
 	throw e;
+    },
+    setUpdate: function(flds) {
+	var rs = [];
+	for (var k in flds) {
+	    if (flds[k]) this.fieldUpdate[k] = true;
+	    else delete(this.fieldUpdate[k]);
+	    if (this[k] && (flds[k] instanceof Object)) (function(p, k) {
+		rs.push(p.then(function rslv(obj) {
+		    if (obj instanceof Array) return Promise.all(obj.map(rslv));
+		    if (obj instanceof libVES.Object) return obj.setUpdate(flds[k]);
+		}));
+	    })(this[k], k);
+	}
+	return Promise.all(rs);
+    },
+    toJSON: function() {
+        return String(this);
     }
 };
 
@@ -2040,10 +2096,16 @@ libVES.VaultKey.prototype = new libVES.Object({
 	    case 'lost':
 		return self.getVaultItems().then(function(vis) {
 		    var f = function(vis) {
-			if (!vis.length) throw new libVES.Error('InvalidKey','Cannot unlock the secondary key');
+			if (!vis || !vis.length) throw new libVES.Error('InvalidKey','Cannot unlock the secondary key');
 			return vis[0].getType().then(function(t) {
 			    switch (t) {
-				case 'password': return vis[0].get();
+				case 'password': return self.getId().then(function(kid) {
+                                    if (!self.VES.pendingKeys) self.VES.pendingKeys = {};
+                                    if (kid) self.VES.pendingKeys[kid] = true;
+                                    return vis[0].get().finally(function() {
+                                        self.VES.pendingKeys[kid] = false;
+                                    });
+                                });
 				default: return f(vis.slice(1));
 			    }
 			});
@@ -2054,26 +2116,57 @@ libVES.VaultKey.prototype = new libVES.Object({
 	    }
 	});
     },
+    invalidVESkey: function() {
+	var self = this;
+	return self.getVaultItems().then(function(vis) {
+            return Promise.all(vis.map(function(vi) {
+                return vi.getVaultEntries().then(function(entries) {
+                    if (entries) for (let i = 0; i < entries.length; i++) if (self.VES.unlockedKeys[entries[i].vaultKey.id]) return Promise.resolve(self.VES.unlockedKeys[entries[i].vaultKey.id]).then(function(key) {
+                        return key.getFields({user: {email: true}, extrenals: {domain: true, externalId: true}}).then(function(flds) {
+                            return vi.unshareWith([flds.externals && flds.externals[0] ? flds.externals[0] : flds.user.email]);
+                        });
+                    });
+                });
+            }));
+        });
+    },
     unlock: function(veskey) {
 	var self = this;
-	if (self.wcPriv) return self.wcPriv;
-	return self.getId().then(function(id) {
-	    if (!self.VES.unlockedKeys[id]) return self.VES.unlockedKeys[id] = self.engine().then(function(m) {
-		return self.resolveVESkey(veskey).then(function(v) {
-		    return self.getPrivateKey().then(function(prk) {
-			return m.import(prk,{password: v});
-		    }).catch(function(e) {
-			if (e.code != 'Legacy' || !self.VES.unlockLegacyKey) throw e;
-			delete(self.VES.unlockedKeys[id]);
-			return self.VES.unlockLegacyKey(self,veskey);
+	if (!self.wcPriv) self.wcPriv = self.getId().then(function(id) {
+	    return Promise.resolve(self.VES.unlockedKeys[id]).then(function(k) {
+		return k.wcPriv;
+	    }).catch(function(e) {
+		let un = self.engine().then(function(m) {
+		    return self.resolveVESkey(veskey).then(function(v) {
+			return self.getPrivateKey().then(function(prk) {
+			    return m.import(prk, {password: v}).catch(function(e) {
+                                if (e && e.code == 'InvalidKey' && !veskey) {
+                                    console.log('Bad key propagated for ' + id + ', unsharing...');
+                                    return self.invalidVESkey().catch(function(e2) {
+                                        console.log(e2);
+                                    }).then(function(r) {
+                                        console.log(r);
+                                        throw e;
+                                    });
+                                }
+                                throw e;
+                            });
+			});
 		    });
 		});
-	    });
-	    else return self.VES.unlockedKeys[id].catch(function(e) {
-		self.VES.unlockedKeys[id] = null;
-		return self.unlock(veskey);
+                let vk = self.VES.unlockedKeys[id] = un.then(function() {
+		    return self;
+		}).catch(function(e) {
+		    if (self.VES.unlockedKeys[id] === vk) delete(self.VES.unlockedKeys[id]);
+		});
+		return un;
 	    });
 	});
+        else if (veskey) self.wcPriv = self.wcPriv.catch(function(e) {
+            delete(self.wcPriv);
+            return self.unlock(veskey);
+        });
+	return self.wcPriv;
     },
     lock: function() {
 	var self = this;
@@ -2251,8 +2344,20 @@ libVES.VaultKey.prototype = new libVES.Object({
 	    });
 	});
     },
-    matchVaults: function(vaultKeys) {
-	return Promise.resolve(false);
+    matchVaults: function(shares) {
+        return this.getFields({id: true, externals: {domain: true, externalId: true}, user: {email: true}}).then((flds) => (shares || []).reduce((res, sh) => res.then((res) => Promise.resolve(sh).then((sh) => {
+            if (res) return res;
+            var ext = flds.externals?.[0];
+            if (sh instanceof libVES.Object) {
+                if (sh instanceof libVES.VaultKey) return sh.getId().then((id) => (id == flds.id ? sh : res));
+                else if ((sh instanceof libVES.External) && ext) return sh.getFields({domain: true, externalId: true}).then((xflds) => (xflds.domain == ext.domain && xflds.externalId == ext.externalId ? sh : res));
+                else if ((sh instanceof libVES.User) && flds.user && !ext) return sh.getEmail().then((email) => (email == flds.user.email ? sh : res));
+            } else if (sh instanceof Object) {
+                if (sh.externalId && sh.externalId == ext?.externalId && (sh.domain || this.VES.domain) == ext.domain) return sh;
+                else if (sh.email && sh.email == flds.user?.email && !ext) return sh;
+            } else if (sh && flds.user?.email == sh && !ext) return sh;
+            return res;
+        })), Promise.resolve(false)));
     },
     getKeyOptions: function() {
 	var self = this;
@@ -2268,7 +2373,7 @@ libVES.VaultItem.prototype = new libVES.Object({
     apiUri: 'vaultItems',
     fieldList: {id: true, deleted: true, file: true},
     fieldClass: {vaultKey: libVES.VaultKey, file: libVES.File},
-    fieldSets: [{type: true, meta: true},{vaultEntries: {id: true, encData: true, vaultKey: {id: true, type: true, user: {id: true}, algo: true, externals: {id: true}}}},{vaultKey: true, file: true}],
+    fieldSets: [{type: true, meta: true},{vaultEntries: {id: true, encData: true, vaultKey: {id: true, type: true, user: {id: true, email: true}, algo: true, externals: {id: true, domain: true, externalId: true}}}},{vaultKey: true, file: true}],
     defaultCipher: 'AES256GCM',
     getRaw: function() {
 	var self = this;
@@ -2277,9 +2382,11 @@ libVES.VaultItem.prototype = new libVES.Object({
 	    var fn = function() {
 		if (vaultEntries) for (; i < vaultEntries.length; i++) {
 		    var k, d;
-		    if ((d = vaultEntries[i].encData) != null && vaultKeys[(k = vaultEntries[i].vaultKey).id]) {
+		    if ((d = vaultEntries[i].encData) != null && (k = vaultKeys[vaultEntries[i].vaultKey.id]) && (!self.VES.pendingKeys || !self.VES.pendingKeys[vaultEntries[i].vaultKey.id])) {
 			i++;
-			return new libVES.VaultKey(k, self.VES).decrypt(d).catch(fn);
+			return Promise.resolve(k).then(function(k) {
+			    return k.decrypt(d).catch(fn);
+			});
 		    }
 		}
 		return Promise.reject(new libVES.Error('InvalidKey',"No unlocked key to decrypt the item",{vaultItem: self}));
@@ -2338,7 +2445,10 @@ libVES.VaultItem.prototype = new libVES.Object({
     },
     build: function(data) {
 	var self = this;
-	return this.getType().then(function(type) {
+	return this.getType().catch(function(e) {
+            if (e && e.code == 'NotFound') return self.setField('type', libVES.VaultItem.Type._detect(data));
+            throw e;
+        }).then(function(type) {
 	    return libVES.getModule(libVES.VaultItem.Type,type).then(function(m) {
 		return m.build.call(self,data);
 	    });
@@ -2350,12 +2460,12 @@ libVES.VaultItem.prototype = new libVES.Object({
     shareWith: function(usrs,val,save) {
 	var self = this;
 	return self.VES.usersToKeys(usrs).then(function(ks) {
-	    return (val == null || self.id ? self.getVaultEntries().then(function(ves) {
+	    return (val == null ? self.getVaultEntries().then(function(ves) {
 		var k_ves = {};
 		var k_used = {};
 		for (var j = 0; j < ves.length; j++) k_ves[ves[j].vaultKey.id] = ves[j];
 		return Promise.all(ks.map(function(k,j) {
-		    return k.getId().then(function(k_id) {
+		    if (!k.fieldUpdate.privateKey) return k.getId().then(function(k_id) {
 			k_used[k_id] = true;
 			return k_ves[k_id];
 		    }).catch(function(){});
@@ -2367,21 +2477,26 @@ libVES.VaultItem.prototype = new libVES.Object({
 		var new_ves = [];
 		var set_ves = [];
 		var valr = null;
+		var key_ids = {};
 		return Promise.all(ks.map(function(k,j) {
 		    return new_ves[j] = (old_ves[j] || (valr != null ? valr : valr = self.resolveRaw(val)).then(function(v) {
-			return k.encrypt(v).then(function(ctext) {
-			    return (function(refs) {
-				if (refs) for (var i in refs) if (refs[i] === k) return Promise.resolve({'$ref':i});
-				return k.postData(null,refs);
-			    })(libVES.Object._refs).then(function(pd) {
+			return (function(refs) {
+			    if (refs) for (var i in refs) if (refs[i] === k) return Promise.resolve({'$ref':i});
+			    return k.postData(null,refs);
+			})(libVES.Object._refs).then(function(pd) {
+			    if (pd.id) {
+				if (key_ids[pd.id]) return;
+				key_ids[pd.id] = true;
+			    }
+			    return k.encrypt(v).then(function(ctext) {
 				return set_ves.push({vaultKey: pd, encData: ctext});
 			    });
 			});
 		    }));
 		})).then(function() {
 		    return Promise.all(old_ves.slice(ks.length).map(function(ve,j) {
-			return (new libVES.VaultKey(ve.vaultKey,self.VES)).matchVaults(ks).then(function(f) {
-			    if (f === false) set_ves.push({vaultKey: {id: ve.vaultKey.id}, '$op': 'delete'});
+			return (new libVES.VaultKey(ve.vaultKey,self.VES)).matchVaults(usrs).then(function(f) {
+			    if (!f) set_ves.push({vaultKey: {id: ve.vaultKey.id}, '$op': 'delete'});
 			});
 		    }));
 		}).then(function() {
@@ -2390,12 +2505,20 @@ libVES.VaultItem.prototype = new libVES.Object({
 		});
 	    });
 	}).then(function() {
-	    if (save || save === undefined) return self.post(undefined, undefined, ((save instanceof Object) ? save : undefined)).then(function() {
-		delete(self.vaultEntries);
+	    if (self.id && val != null) return self.setUpdate({id: false, type: true, file: {id: false, externals: {id: false, domain: true, externalId: true}}});
+	}).then(function() {
+	    if (save || save === undefined) return self.post(undefined, undefined, ((save instanceof Object) ? save : undefined)).then(function(flds) {
+                self.vaultEntryByKey = {};
+                self.setFields(flds, false);
 		return self;
+	    }).finally(function() {
+		delete(self.vaultEntries);
 	    });
 	    return self;
-	});
+	}).catch(function(er) {
+	    delete(self.vaultEntries);
+	    throw er;
+        });
     },
     reshareWith: function(share,val,save) {
 	var self = this;
@@ -2418,6 +2541,15 @@ libVES.VaultItem.prototype = new libVES.Object({
 	    });
 	});
     },
+    unshareWith: function(share, save) {
+        return this.getShareVaultKeys().then((vkeys) => Promise.all(vkeys.map((vkey) => vkey.matchVaults(share))).then((del) => this.shareWith(vkeys.filter((vkey, i) => !del[i]), undefined, save)));
+    },
+    set: function(val, save) {
+	var self = this;
+	return self.getShareList().then(function(sh) {
+	    return self.shareWith(sh, val, save);
+	});
+    },
     getShareVaultKeys: function() {
 	var self = this;
 	return this.getVaultEntries().then(function(vaultEntries) {
@@ -2430,12 +2562,17 @@ libVES.VaultItem.prototype = new libVES.Object({
 	var self = this;
 	return this.getShareVaultKeys().then(function(vaultKeys) {
 	    var uids = {};
+	    var xids = {};
 	    return Promise.all(vaultKeys.map(function(e,i) {
 		return e.getExternals().then(function(exts) {
-		    if (exts && exts.length) return exts[0];
+		    if (exts && exts.length) return exts[0].getId().then(function(xid) {
+			if (!xid || xids[xid]) return null;
+			xids[xid] = true;
+			return exts[0];
+		    });
 		    return e.getUser().then(function(u) {
 			return u.getId().then(function(uid) {
-			    if (uids[uid]) return null;
+			    if (!uid || uids[uid]) return null;
 			    uids[uid] = true;
 			    return u;
 			});
@@ -2451,7 +2588,7 @@ libVES.VaultItem.prototype = new libVES.Object({
     delete: function() {
 	var self = this;
 	return self.getId().then(function(id) {
-	    return this.VES.post(self.apiUri + '/' + id, {'$op': 'delete'});
+	    return self.VES.post(self.apiUri + '/' + id, {'$op': 'delete'});
 	});
     }
 });
@@ -4306,7 +4443,7 @@ libVES.Watch.prototype = {
 	}).then(function(res) {
 	    if (!res.events) return null;
 	    return res.events.map(function(e, i) {
-		return new libVES.Event(e, self.VES);
+		return new libVES.Event(libVES.Util.fillUndefs(e, self.fields), self.VES);
 	    });
 	});
     },
@@ -4321,8 +4458,8 @@ libVES.Watch.prototype = {
 	if (!busy && this.state == 'stop') this.setState('idle');
     },
     start: function(pos) {
-	if (!this.eventfn) throw new libVES.Error('InvalidValue', 'eventfn is not set');
-	if (this.busy) throw new libVES.Error('Internal', 'Watch instance is busy');
+	if (!this.eventfn) return Promise.reject(new libVES.Error('InvalidValue', 'eventfn is not set'));
+	if (this.busy) return Promise.reject(new libVES.Error('Internal', 'Watch instance is busy'));
 	var self = this;
 	self.setBusy(true);
 	this.setState('read');
@@ -4330,13 +4467,17 @@ libVES.Watch.prototype = {
 	    this.next = 0;
 	    return this.getEvents(0, pos).then(function(evs) {
 		self.setBusy(false);
-		return self.received(evs.reverse());
-	    });
+		return self.received(evs ? evs.reverse() : null);
+	    }).finally(function() {
+		self.setBusy(false);
+            });
 	} else {
 	    this.next = pos;
 	    return this.getEvents(pos, 0).then(function(evs) {
 		self.setBusy(false);
 		return self.received(evs);
+	    }).finally(function() {
+		self.setBusy(false);
 	    });
 	}
     },
@@ -4346,31 +4487,30 @@ libVES.Watch.prototype = {
     received: function(evs) {
 	var self = this;
 	var p;
-	if (evs && evs.length) p = evs.reduce(function(v, e) {
+        if (!evs) return null;
+	if (evs.length) return evs.reduce(function(v, ev) {
 	    if (self.active()) try {
-		self.eventfn(e, self);
+		self.eventfn(ev, self);
 	    } catch(e) {
 		console.log(e);
 	    }
-	    return e;
+	    return ev;
 	}, null).getId().then(function(id) {
 	    self.next = id + 1;
+            return self.request();
 	});
 	else {
-	    p = Promise.resolve(null);
 	    if (this.state == 'read') this.setState('poll');
+	    return self.request(), true;
 	}
-	return p.then(function() {
-	    return self.request();
-	});
     },
     request: function() {
-	if (this.busy || !this.active()) return;
+	if (this.busy || !this.active()) return true;
 	var self = this;
 	self.setBusy(true);
 	return self.getEvents(self.next, 0, (self.state == 'poll')).then(function(evs) {
 	    self.setBusy(false);
-	    self.received(evs);
+	    return self.received(evs);
 	}).catch(function(e) {
 	    self.setBusy(false);
 	    if (self.errorfn) try {
@@ -4393,6 +4533,743 @@ libVES.Watch.prototype = {
 	this.setState(this.busy ? 'stop' : 'idle');
     }
 };
-libVES.version = '2.16';
+
+
+
+libVES.subtle = function(optns) {
+    if (!(optns instanceof Object)) {
+        let uri = String(optns);
+        optns = uri.includes('/') ? libVES.Vault.toRef(uri) : {domain: uri};
+    }
+    return new libVES(optns).subtle();
+};
+
+libVES.prototype.subtle = function(ref) {
+    return new libVES.Vault((ref || this), this);
+};
+
+libVES.EventTarget = class extends EventTarget {
+    watchFields() {
+        return {vaultKey: {id: true, user: {id: true, email: true}, externals: {domain: true, externalId: true}}, vaultItem: {id: true, type: true, deleted: true, vaultKey: {id: true, type: true, externals: {domain: true, externalId: true}, user: {id: true, email: true}}, file: {externals: {domain: true, externalId: true}, creator: true}}, authorSession: {id: true, vaultKey: {id: true, type: true, externals: {domain: true, externalId: true}}, domain: true, user: {email: true}, remote: true, userAgent: true}, session: {id: true, vaultKey: {id: true}, user: {id: true}, remote: true, userAgent: true}};
+    }
+
+    dispatchEvent(ev) {
+        if (!ev) return;
+        super.dispatchEvent(ev);
+        if (this['on' + ev.type]) try { this['on' + ev.type](ev) } catch (er) { console.log(er); }
+    }
+
+    start(optns) {
+        if (!this.watch) {
+            let tr = this._eventTracker();
+            if (optns === false) optns = {replay: true};
+            else if (optns != null && !isNaN(optns)) optns = {startEvent: Number(optns)};
+            else if (!(optns instanceof Object)) optns = {};
+            if (optns.startEvent == null) optns.startEvent = -1;
+            this.watch = this.createWatch(optns);
+            this.watch.eventfn = (ev) => (this.eventClear = this.eventClear.then(() => tr._event(ev).then((ev) => this.dispatchEvent(ev)).catch((er) => console.log(er))));
+            this.eventClear = optns.replay ? this.replay((optns.replay instanceof Object) ? optns.replay : optns).then((evs) => Promise.all(evs.map((ev) => this.dispatchEvent(ev)))) : Promise.resolve();
+            return this.watch.start(optns.startEvent).then((v) => (v || this.badauth().then(() => this.watch.start(startEvent)))).catch((er) => {
+              this.watch = null;
+              throw er;
+            });
+        } else throw new libVES.Error.InvalidValue('The watch is already started');
+    }
+
+    stop() {
+        if (this.watch) return Promise.resolve(this.watch.stop()).then(() => this.eventClear).then(() => true).finally(() => this.watch = null);
+        return Promise.resolve(null);
+    }
+
+    events(optns) {
+        let tr = this._eventTracker();
+        return this.createWatch(optns).getEvents(0, 0).then((evs) => (evs ? evs.reduce((res, ev) => res.then((res) => tr._event(ev, false).then((ev) => ((ev && res.push(ev)), res))), Promise.resolve([])) : this.badauth().then(() => this.events())));
+    }
+
+    toJSON() {
+        return this.uri();
+    }
+};
+
+libVES.Vault = class extends libVES.EventTarget {
+    constructor(ref, ves, fields) {
+        super();
+        this.init(libVES.Vault.toRef(ref, ves), ves, fields);
+    }
+
+    init(ref, ves, fields) {
+        fields ||= {};
+        if (ref.externalId) fields.externals = [{domain: (this.domain = String(ref.domain)), externalId: (this.externalId = String(ref.externalId))}];
+        this.email = ref.email || '';
+        if (ref.email) fields.email = this.email;
+        if (ref.version) this.version = fields.id = Number(ref.version);
+        if (!fields.id) fields.type = this.externalId ? 'secondary' : 'current';
+        this.vaultKey = new libVES.VaultKey(fields, ves);
+        delete(this.admin);
+    };
+
+    item(ref) {
+        return new libVES.Item(ref, this);
+    };
+
+    vault(ref) {
+        if (!ref) return null;
+        return new libVES.Vault(ref, this.vaultKey.VES);
+    }
+
+    entries(optns) {
+        const flds = {encData: true, vaultItem: {type: true, file: {externals: true, creator: {id: true, email: true}}, deleted: true, vaultKey: {type: true, externals: true, user: true}, type: true, meta: true}};
+        const getfn = () => this.vaultKey.getField('vaultEntries', flds, true).then((data) => libVES.Util.fillUndefs(data, flds));
+        if (!this._entriesCache) (this._entriesCache = getfn().then((entries) => (entries || this.badauth().then(getfn)))).catch(() => null).finally(() => this._entriesCache = null);
+        return this._entriesCache;
+    };
+
+    objects(optns) {
+        let found = {items: {}, vaults: {}};
+        return this.entries(optns).then((entries) => Promise.all((entries || []).map((entry) => {
+            const ext = entry.vaultItem?.file?.externals?.[0];
+            if (ext) {
+                if (entry.vaultItem.deleted) return null;
+                let d = (found.items[ext.domain] ||= {});
+                return d[ext.externalId] ? null : (d[ext.externalId] = new libVES.Item(ext, this, entry.vaultItem));
+            }
+            const vkey = entry.vaultItem?.vaultKey;
+            const kext = vkey?.externals?.[0];
+            if (kext && vkey.type == 'secondary' && entry.vaultItem.type == 'password') {
+                let d = (found.vaults[kext.domain] ||= {});
+                    return d[kext.externalId] ? null : (d[kext.externalId] = new libVES.Vault(kext, this.vaultKey.VES, vkey));
+            }
+        }))).then((objs) => objs.filter((obj) => obj));
+    };
+
+    items(optns) {
+        return this.objects(optns).then((objs) => objs.filter((obj) => (obj instanceof libVES.Item)));
+    }
+
+    vaults(optns) {
+        return this.objects(optns).then((objs) => objs.filter((obj) => (obj instanceof libVES.Vault)));
+    }
+
+    _setunlock(reauth) {
+        this.current = true;
+        this.owner = this.externalId[0] != '!';
+        this.lock(600);
+        let rf;
+        if (reauth !== false) (rf = (tmout) => {
+            this.refreshTmout = setTimeout(() => {
+                this.vaultKey.loadFields({encSessionToken: true}, true, {token: ''}).then((flds) => this.vaultKey.setFields(flds)).then(() => this.vaultKey.getSessionToken()).then((tk) => {
+                    this.vaultKey.VES.token = tk;
+                    rf();
+                }).catch((er) => {
+                    console.log(er);
+                    rf(60000);
+                });
+            }, (tmout || 14400000));
+        })();
+        return this;
+    }
+
+    unlock(optns) {
+        if (this.lockInProgress) return this.lock().then(() => this.unlock(optns));
+        if (optns && !(optns instanceof Object)) optns = libVES.Vault.toRef(optns, this.vaultKey.VES);
+        if (optns?.veskey) return this.vaultKey.VES.logout().then(() => {
+            let ves = new libVES(optns);
+            delete(ves.veskey);
+            return ((reauth) => ves.unlock(String(optns.veskey)).then(() => this.init(ves, ves)).then(() => this._setunlock(reauth)))(!this.vaultKey.VES.token);
+        });
+        return this.vaultKey.VES.unlock().catch((er) => {
+            let mode = optns?.mode || 'delegate';
+            switch (mode) {
+                case 'delegate': return this.vaultKey.VES.delegate(optns).then((ves) => this.init(ves, ves));
+                case 'flow': return this.vaultKey.VES.flow(true, optns).then((ves) => this.init(ves, ves));
+                case 'veskey': throw new libVES.Error.InvalidValue('No veskey provided');
+                default: throw new libVES.Error.InvalidValue('Unknown unlock mode: ' + mode + ', expected: delegate|flow');
+            }
+        }).then(() => this._setunlock());
+    }
+
+    unlocked(optns) {
+        return this.vaultKey.VES.unlock().catch((er) => {
+            if (optns?.mode != 'flow') throw er;
+            return this.vaultKey.VES.flow(false, optns).then((ves) => this.init(ves, ves)).then(() => this._setunlock());
+        }).then(() => true).catch((er) => false);
+    }
+
+    anonymous(optns) {
+        if (!(optns instanceof Object)) {
+            if (optns && typeof(optns) == 'string') optns = {veskey: optns};
+            else optns = {};
+        }
+        if (!optns.veskey) return Promise.reject(libVES.Error.InvalidValue('Required: veskey'));
+        if (!this.vaultKey.VES.domain) return Promise.reject(libVES.Error.InvalidValue('Cannot create an anonymous vault without a VES domain'));
+        this.vaultKey.VES.logout();
+        return (optns.externalId ? Promise.resolve(this.vaultKey.VES.externalId = optns.externalId) : crypto.subtle.digest('sha-256', libVES.Util.StringToByteArray('libVES.subtle\0' + this.vaultKey.VES.domain + '\0' + optns.veskey)).then((hash) => {
+            const hex = '0123456789abcdef';
+            let xid = new Uint8Array(hash).reduce(((v, e) => v + hex[e >> 4] + hex[e & 0x0f]), '!');
+            this.vaultKey.VES.externalId = xid;
+        })).then(() => this.vaultKey.VES.unlock(optns.veskey).catch((er) => {
+            if (er?.code == 'NotFound') return this.vaultKey.VES.setAnonymousKey(optns.veskey, optns);
+            else throw er;
+        })).then(() => this.init(this.vaultKey.VES, this.vaultKey.VES)).then(() => this._setunlock());
+    }
+
+    lock(tmout) {
+        this.lockInProgress = false;
+        clearTimeout(this.lockTmout);
+        this.lockTmout = null;
+        if (tmout > 0) {
+            if (tmout > 3600) tmout = 3600;
+            this.lockTmout = setTimeout(() => {
+                this.lockInProgress = true;
+                this.dispatchEvent(new libVES.CustomEvent('authexpire', {detail: {vault: this}}));
+                if (this.lockInProgress) this.lock();
+            }, tmout * 1000);
+            return Promise.resolve(true);
+        }
+        clearTimeout(this.refreshTmout);
+        this.refreshTmout = null;
+        this.stop();
+        return this.vaultKey.VES.logout();
+    }
+
+    random() {
+        return this.vaultKey.VES.generateVESkey();
+    }
+
+    static toRef(value, ves) {
+        switch (typeof(value)) {
+            case 'object':
+                return value;
+            case 'number':
+                value = String(value);
+            case 'string':
+                let uri = new URL(value, "ves://" + (ves && ves.domain ? ves.domain : ''));
+                if (uri.protocol != 'ves:') throw new libVES.Error.InvalidValue("Invalid schema: '" + uri.protocol + "', expected 'ves:'");
+                let p = uri.pathname.split('/');
+                let id = p.length > 1 ? decodeURIComponent(p[1]) : '';
+                let ref = uri.host ? {domain: uri.host, externalId: id} : {version: Number(id)};
+                if (p[2] != null) ref.email = decodeURIComponent(p[2]);
+                if (uri.password) ref.veskey = uri.password;
+                return ref;
+        }
+    };
+
+    static toRefs(refs, ves, owner) {
+        if (!refs) return [];
+        if (!(refs instanceof Array)) refs = [refs];
+        refs = refs.map((ref) => libVES.Vault.toRef(ref, ves)).filter((ref) => ref);
+        if (owner) {
+            if (!ves.externalId) throw new libVES.Error.Unauthorized('The vault is locked');
+            refs.push({domain: ves.domain, externalId: ves.externalId});
+        }
+        return refs;
+    }
+
+    static toUri(ref, short) {
+        if (ref.externalId && short) return (ref.domain == short ? '' : '//' + encodeURIComponent(ref.domain) + '/') + encodeURIComponent(ref.externalId).replaceAll('%40', '@');
+        let uri = ref.externalId ?  "ves://" + encodeURIComponent(ref.domain) + "/" + encodeURIComponent(ref.externalId) : "ves://" + (ref.version ? "/" + String(Number(ref.version)) : encodeURIComponent(ref.domain ?? '') + "/");
+        if (ref.email != null) uri += '/' + encodeURIComponent(ref.email);
+        return uri;
+    }
+
+    uri() {
+        if (!this.externalId && !this.version && !this.email) return null;
+        return libVES.Vault.toUri(this);
+    }
+
+    short() {
+        return libVES.Vault.toUri(this, this.vaultKey.VES.domain);
+    }
+
+    badauth() {
+        const ves = this.vaultKey.VES;
+        if (!this.externalId || (this.externalId == ves.externalId && this.domain == ves.domain)) return Promise.reject(new libVES.Error.InvalidKey('Not authorized for this key'));
+        return this.vaultKey.getFields({encSessionToken: true, type: true, algo: true, publicKey: true, privateKey: true, vaultItems: {type: true, vaultEntries: {vaultKey : {id: true}, encData: true}, meta: true}}).then(() => {
+            const ves2 = new libVES({domain: this.domain, externalId: this.externalId});
+            ves2.vaultKey = Promise.resolve(this.vaultKey);
+            ves2.unlockedKeys = ves.unlockedKeys;
+            ves2.pendingKeys = ves.pendingKeys;
+            this.vaultKey.VES = ves2;
+            return ves2.unlock();
+        });
+    }
+
+    createWatch() {
+        let w = new libVES.Watch(this.vaultKey);
+        w.fields = {vaultItem: {id: true, type: true, deleted: true, vaultKey: {id: true, type: true, algo: true, publicKey: true, externals: {domain: true, externalId: true}, user: {id: true, email: true}}, file: {externals: {domain: true, externalId: true}, creator: true}, meta: true}, authorSession: {vaultKey: {id: true, externals: {domain: true, externalId: true}, user: {email: true}, type: true}, domain: true, user: {email: true}, remote: true, userAgent: true}, session: {id: true, remote: true, userAgent: true, vaultKey: {id: true}, user: {id: true}}};
+        return w;
+    }
+
+    replay(optns) {
+        return this.objects(optns).then((objs) => Promise.all(objs.map((obj) => {
+            if (obj instanceof libVES.Item) return new libVES.CustomEvent('itemadd', {detail: {replay: true, item: obj, share: this}});
+            else if (obj instanceof libVES.Vault) return new libVES.CustomEvent('vaultadd', {detail: {replay: true, vault: obj, share: this}});
+        })));
+    }
+
+    password() {
+        return this.vaultKey.getVaultItems().then((vitems) => {
+            if (!vitems) return this.badauth().then(() => this.password());
+            return vitems.reduce((p, vitem) => p.catch((e) => vitem.getType().then((type) => (type == 'password' ? vitem.getId().then((id) => this.item({version: id})) : Promise.reject(e)))), Promise.reject(new libVES.Error.NotFound('No password item found')));
+        });
+    }
+
+    verify() {
+        if (this.current !== undefined) return Promise.resolve(this);
+        return this.vaultKey.VES.usersToKeys([(this.externalId ? {domain: this.domain, externalId: this.externalId} : this.email)]).then((vkeys) => Promise.all(vkeys.map((vkey) => vkey.getFields(vkey.id ? {id: true, type: true} : {type: true}))).then((flds) => flds.reduce((res, fld, idx) => {
+            if (res) return res;
+            if (this.version) return this.version == fld.id ? vkeys[idx] : null;
+            switch (fld.type) {
+                case 'secondary': case 'current': case 'temp': return vkeys[idx];
+            }
+        }, null))).then((vkey) => {
+            if (!vkey) throw new libVES.Error.NotFound('Cannot find or create a matching key');
+            return vkey.getType().then((type) => {
+                this.current = (type == 'current' || type == 'secondary');
+                this.owner = (this.externalId != null && this.externalId == vkey.VES.externalId && this.domain == vkey.VES.domain) || (!!this.email && this.email == vkey.VES.email);
+                this.vaultKey = vkey;
+                return this;
+            });
+        });
+    }
+
+    _eventTracker() {
+        return new libVES.EventTracker(this);
+    }
+
+    toString() {
+        return 'libVES.Vault(' + (this.uri() ?? '[pending]') + ')';
+    }
+
+};
+
+libVES.Author = class {
+    constructor(sess, ves) {
+        this.sessid = sess.id;
+        if (sess.vaultKey?.externals?.[0]) this.vault = new libVES.Vault(sess.vaultKey.externals[0], ves);
+        else if (sess.user?.email) this.vault = new libVES.Vault({email: sess.user.email}, ves);
+        this.remote = sess.remote;
+        this.userAgent = sess.userAgent;
+    }
+    toString() {
+        return 'libVES.Author(' + (this.sessid ?? '') + ')';
+    }
+    toJSON() {
+        return this.sessid;
+    }
+};
+
+libVES.CustomEvent = class extends CustomEvent {
+    toString() {
+        return 'libVES.CustomEvent(' + this.type + (this.detail?.id ? '[' + this.detail.id + ']' : '') + (this.detail?.at ? ' @' + this.detail.at : '') + ')';
+    }
+    toJSON() {
+        return this.detail?.id;
+    }
+};
+
+libVES.EventTracker = class {
+    constructor(vault, share) {
+        this.vault = vault;
+        this.share = share;
+        this.items = {};
+    }
+
+    _event(e, attn) {
+        const event = (type, detail) => {
+            detail.event = e;
+            return e.getFields({id: true, recordedAt: true, authorSession: {vaultKey: {id: true, externals: {domain: true, externalId: true}, user: {email: true}}, user: {email: true}, domain: true, remote: true, userAgent: true}}).then((flds) => {
+                detail.id = flds?.id;
+                if (flds?.recordedAt) detail.at = new Date(flds.recordedAt);
+                detail.author = new libVES.Author((flds?.authorSession ?? {}), this.vault.vaultKey.VES);
+            }).catch(() => null).then(() => new libVES.CustomEvent(type, {detail: detail}));
+        }
+        return e.getType().then((type) => {
+            const itemfn = (ac, attn, sh) => e.getVaultItem().then((vitem) => vitem.getType().then((itype) => {
+                switch (itype) {
+                    case 'string': case 'file':
+                        return vitem.getFields({id: true, file: {externals: {domain: true, externalId: true}}, deleted: true, type: true, meta: true}).then((flds) => {
+                            let ext = flds?.file?.externals?.[0];
+                            if (!ext) return null;
+                            let item = new libVES.Item({domain: ext.domain, externalId: ext.externalId, version: flds.id}, this.vault, flds);
+                            let ids = (this.items[item.uri()] ||= []);
+                            let idx = ids.indexOf(flds.id);
+                            if (idx < 0 && (flds.deleted === false || (ac == 'create' || ac == 'add'))) ids.unshift(flds.id), idx = 0;
+                            return event((idx == 0 ? '' : 'old') + 'item' + ac, {item: item, share: sh});
+                        });
+                    case 'password':
+                        return vitem.getFields({vaultKey: {type: true, externals: {domain: true, externalId: true}}}).then((flds) => {
+                            switch (flds?.vaultKey?.type) {
+                                case 'secondary':
+                                    return event('vault' + ac, {vault: this.vault.vault(flds.vaultKey.externals?.[0]), share: sh});
+                                default:
+                                    if (attn) return vitem.getVaultKey().then((vkey) => this.vault.vaultKey.VES.attnVaultKeys([vkey])).catch((e) => console.log(e)).then(() => null);
+                            }
+                        });
+                }
+            }));
+            const sharefn = () => (this.share ? e.getVaultKey().then((vkey) => vkey.getFields({id: true, type: true, externals: {domain: true, externalId: true}, user: {id: true, email: true}}).then((flds) => {
+                let f = flds?.externals?.[0] ? flds.externals[0] : (flds?.user?.email ? {email: flds.user.email} : {});
+                f.version = flds.id;
+                let vault = this.vault.vault(f);
+                vault.current = (f.externals && flds.type == 'secondary') || (f.email && flds.type == 'current');
+                return vault;
+            })) : Promise.resolve(this.vault));
+            switch (type) {
+                case 'vaultEntry.deleted':
+                    return sharefn().then((sh) => itemfn('remove', false, sh));
+                case 'vaultEntry.created':
+                    return sharefn().then((sh) => itemfn('add', attn !== false, sh));
+                case 'vaultItem.deleted':
+                    return itemfn('delete');
+                case 'vaultItem.created':
+                    return itemfn('create');
+                case 'vaultItem.listening':
+                    return itemfn('change');
+                case 'session.created':
+                    return e.getFields({session: {id: true, remote: true, userAgent: true, vaultKey: {id: true}, user: {id: true}}}).then((flds) => {
+                        if (!flds?.session) return null;
+                        let ses = new libVES.Author(flds.session, this.vault.vaultKey.VES);
+                        ses.vault = this.vault;
+                        return event('sessioncreate', {vault: this.vault, session: ses});
+                    });
+            }
+        }).catch((er) => (console.log(er), event('error', {error: er})));
+    }
+};
+
+
+
+libVES.Item = class extends libVES.EventTarget {
+    constructor(ref, vault, fields) {
+        const ves = vault.vaultKey.VES;
+        super();
+        if (ref == null || typeof(ref) == 'function') {
+            this.provisional = {share: [vault], ref: (ref || libVES.Item.newRef)};
+        } else {
+            ref = libVES.Vault.toRef(ref, ves);
+            if ((!ref.domain || !ref.externalId) && !ref.version) throw new libVES.Error.InvalidValue('Bad item reference');
+            this.domain = ref.domain;
+            this.externalId = ref.externalId;
+            this.version = ref.version || null;
+        }
+        this.vault = vault;
+        this._vaultItem(ves, fields);
+    };
+
+    static newRef() {
+        let d = new Date();
+        return ((d.getFullYear() * 100 + d.getMonth() + 1) * 100 + d.getDate()).toFixed(0) + '.' + (((d.getHours() + 100) * 100 + d.getMinutes()) * 100 + d.getSeconds() + d.getMilliseconds() / 1000).toFixed(3).slice(-10);
+    }
+
+    _vaultItem(ves, fields) {
+        if (this.vaultItem && this._entriesCache !== null) return this.vaultItem;
+        ves ||= this.vaultItem.VES;
+        if (!fields) {
+            fields = this.externalId ? {file: {externals: [{domain: this.domain, externalId: this.externalId}]}} : {};
+            if (this.version) fields.id = this.version;
+        } else if (fields.vaultEntries) this._entriesCache = Promise.resolve(fields).finally(() => this._entriesCache = null);
+        return this.vaultItem = new libVES.VaultItem(fields, ves);
+    };
+
+    _entries() {
+        if (this.provisional) return Promise.reject(new libVES.Error.NotFound('Not available for a provisional item'));
+        if (this._entriesCache) return this._entriesCache;
+        this._entriesCache = this._vaultItem().getFields({vaultEntries: {encData: true, vaultKey: {id: true, type: true, algo: true, privateKey: true, publicKey: true, user: {id: true, email: true}, externals: {domain: true, externalId: true}}}, file: {creator: {id: true}}, vaultKey: {user: {id: true}}, deleted: true}).then((flds) => {
+            if (!flds?.vaultEntries) return Promise.reject(new libVES.Error.InvalidKey('Not authorized to access this item'));
+            return flds;
+        });
+        this._entriesCache.catch((er) => null).finally(() => this._entriesCache = null);
+        return this._entriesCache;
+    };
+
+    _get() {
+        return this._entries().then(() => this.vaultItem.get());
+    };
+
+    _reset() {
+        this._entriesCache = null;
+    };
+
+    latest() {
+        return this.externalId && this.version ? this.vault.item({domain: this.domain, externalId: this.externalId}) : this;
+    };
+
+    get() {
+        return this._get().then((val) => {
+            if (typeof(val) != 'string') throw new libVES.Error.InvalidValue('The item value is not a string');
+            return val;
+        });
+    };
+
+    put(value, shares) {
+        if (value == null) return Promise.reject(new libVES.Error.InvalidValue('The item value cannot be empty'));
+        let prref;
+        return (shares ? Promise.resolve(libVES.Vault.toRefs(shares, this.vaultItem.VES, true)) : this.share().then((shares) => {
+            let owner = shares.reduce((cur, sh) => (cur || ((sh.owner && sh.externalId?.match(/@/)) ? sh : null)), null);
+            if (owner && owner.uri() != this.vault.uri()) shares.push(this.vault.vault({domain: '.admin', externalId: owner.externalId}));
+            return shares;
+        }).catch((e) => {
+            if (e && e.code == 'NotFound') return libVES.Vault.toRefs([], this.vaultItem.VES, true);
+            throw e;
+        })).then((shares) => {
+            if (!this.provisional) return shares;
+            prref = libVES.Vault.toRef(this.provisional.ref(), this.vaultItem.VES);
+            if (!prref?.externalId) return Promise.reject(new libVES.Error.InvalidValue('Bad provisional reference generated by the supplied function'));
+            return this.vaultItem.setFields({file: {externals: [prref]}}).then(() => shares);
+        }).then((shares) => this.vaultItem.shareWith(shares, value)).then(() => {
+            if (prref) {
+                this.externalId = prref.externalId;
+                this.domain = prref.domain;
+                delete(this.provisional);
+            }
+            this.version = null;
+            this._reset();
+            return value;
+        });
+    };
+
+    cipher(optns, shares) {
+        return this._get().then((val) => {
+            if (!(val instanceof libVES.Cipher)) throw new libVES.Error.InvalidValue('The item value is not a cipher');
+            return (shares ? this.share(shares) : Promise.resolve(null)).then(() => val);
+        }).catch((e) => {
+            if (e && e.code == 'NotFound') {
+                let algo = optns?.algo || this.vaultItem.VES.cipherAlgo || 'AES256GCM1K';
+                if (!libVES.Cipher[algo]) throw new libVES.Error.InvalidValue('Unsupported cipher: ' + algo);
+                let ci = new libVES.Cipher[algo]();
+                return this.put(ci, shares);
+            }
+            throw e;
+        }).then((ci) => new libVES.ItemCipher(ci, this));
+    };
+
+    json(val, shares) {
+        if (val === undefined) return this.get().then((val) => JSON.parse(val));
+        return this.put(JSON.stringify(val), shares).then(() => val);
+    };
+
+    exists() {
+        return this._entries().then((flds) => !flds?.deleted).catch((e) => {
+            if (e?.code == 'NotFound') return false;
+            if (e?.code == 'InvalidKey') return true;
+            throw e;
+        });
+    };
+
+    _provShare(shares, del) {
+        return new Promise((resolve, reject) => {
+            let uris = libVES.Vault.toRefs(shares, this.vaultItem.VES).map((ref) => this.vault.vault(ref).uri());
+            let prov = {};
+            this.provisional.share.map((sh) => prov[sh.uri()] = sh);
+            resolve(this.vaultItem.VES.usersToKeys(libVES.Vault.toRefs(uris.filter((uri) => !prov[uri]))));
+        }).then((vkeys) => Promise.all(vkeys.map((vkey => vkey.getFields({user: {email: true}, externals: {domain: true, externalId: true}, type: true}).then((flds) => {
+            let sh = new libVES.Vault((flds?.externals?.[0] ?? flds?.user?.email), this.vaultItem.VES, flds);
+            if (sh) return sh.verify();
+        }))))).then((shares) => shares.filter((sh) => sh)).then((shares) => {
+            this.provisional.share = this.provisional.share.concat(shares);
+            if (del) {
+                let uris = {};
+                shares.map((sh) => uris[sh.uri()] = sh);
+                uris[this.vault.uri()] = this.vault;
+                this.provisional.share = this.provisional.share.filter((sh) => uris[sh.uri()]);
+            }
+            return this.provisional.share;
+        });
+    }
+
+    share(shares) {
+        if (this.provisional) {
+            if (shares) return this._provShare(shares, true);
+            return Promise.resolve(this.provisional.share);
+        }
+        return (shares ? (this._reset(), this.vaultItem.shareWith(libVES.Vault.toRefs(shares, this.vaultItem.VES, true))) : Promise.resolve(null)).then(() => {
+            let result = [];
+            let found = {};
+            let admins = {};
+            return this._entries().then((flds) => flds.vaultEntries.map((entry) => {
+                let vkey = entry?.vaultKey;
+                let ref = vkey?.externals?.[0];
+                if (!ref) {
+                    const email = vkey?.user?.email;
+                    ref = email ? {email: email} : {version: vkey?.id};
+                }
+                let vault = new libVES.Vault(ref, this.vaultItem.VES);
+                let uri = vault.uri();
+                if (!found[uri]) {
+                    result.push(found[uri] = vault);
+                    let uid = vkey?.user?.id;
+                    vault.owner = !!uid && uid == (flds.file?.creator?.id ?? flds.vaultKey?.user?.id);
+                    if (vault.domain == '.admin') admins[vault.externalId] = true;
+                }
+                switch (vkey?.type) {
+                    case 'current': case 'secondary':
+                        found[uri].current = true;
+                        break;
+                    default:
+                        vault.current = false;
+                }
+            })).then(() => {
+                result.map((sh) => sh.admin = !!admins[sh.externalId]);
+                return result;
+            });
+        });
+    };
+
+    add(shares) {
+        if (this.provisional) return this._provShare(shares, false).then(() => true);
+        return this._entries().then(() => this.vaultItem.getShareVaultKeys()).then((vkeys) => {
+            if (!vkeys) throw new libVES.Error.InvalidKey('Not authorized to share this item');
+            if (!shares) return true;
+            libVES.Vault.toRefs(shares, this.vaultItem.VES).map((share) => vkeys.push(share));
+            this._reset();
+            return this.vaultItem.shareWith(vkeys);
+        }).then(() => true);
+    };
+
+    remove(shares) {
+        shares = libVES.Vault.toRefs(shares, this.vaultItem.VES);
+        if (!shares || !shares.length) return Promise.resolve(true);
+        if (this.provisional) return new Promise((resolve, reject) => {
+            let uris = {};
+            shares.map((sh) => uris[this.vault.vault(sh).uri()] = true);
+            this.provisional.share = this.provisional.share.filter((sh) => !uris[sh.uri()]);
+            resolve(true);
+        });
+        return this._entries().then(() => this.vaultItem.unshareWith(shares)).then(() => (this._reset(), true));
+    };
+
+    refuse() {
+        return this.remove(this.vault);
+    };
+
+    delete() {
+        this._reset();
+        return this.vaultItem.delete();
+    }
+
+    badauth() {
+        return (this.vaultItem.VES == this.vault.vaultKey.VES ? this.vault.badauth() : Promise.resolve(null)).then(() => this.vaultItem.VES = this.vault.vaultKey.VES);
+    }
+
+    shareFor(share) {
+        let uri = this.vault.vault(share).uri();
+        return uri ? this.share().then((shares) => shares.reduce((res, sh) => (res ?? (sh.uri() == uri ? sh : null)), null)) : null;
+    }
+
+    uri() {
+        if (!this.externalId && !this.version) return null;
+        return libVES.Vault.toUri(this);
+    }
+
+    short() {
+        if (!this.externalId) return null;
+        return libVES.Vault.toUri(this, this.vaultItem.VES.domain);
+    }
+
+    _eventTracker() {
+        return new libVES.EventTracker(this.vault, true);
+    }
+
+    createWatch() {
+        let w = new libVES.Watch(this.vaultItem);
+        w.fields = {vaultKey: {id: true, type: true, algo: true, publicKey: true, externals: {domain: true, externalId: true}, user: {id: true, email: true}}, vaultItem: {id: true, type: true, meta: true, deleted: true, vaultKey: {id: true, type: true, algo: true, publicKey: true, externals: {domain: true, externalId: true}, user: {id: true, email: true}}, file: {externals: {domain: true, externalId: true}, creator: true}}, authorSession: {vaultKey: {id: true, type: true, externals: {domain: true, externalId: true}}, domain: true, user: {email: true}, remote: true, userAgent: true}};
+        return w;
+    }
+
+    replay() {
+        return this.share().then((vaults) => Promise.all(vaults.map((vault) => {
+            if (this.externalId) return new libVES.CustomEvent('itemadd', {detail: {replay: true, item: this, share: vault}});
+            else return new libVES.CustomEvent('vaultadd', {detail: {replay: true, vault: this.vault, share: vault}});
+        })));
+    }
+
+    readable() {
+        return this._get().then(() => true).catch((er) => {
+            switch (er?.code) {
+                case 'NotFound':
+                case 'InvalidKey': return false;
+                default: throw er;
+            }
+        });
+    }
+
+    writable() {
+        return this.shareFor(this.vault).then((sh) => sh && (sh.owner || sh.admin)).catch((er) => {
+            switch (er?.code) {
+                case 'NotFound': return true;
+                case 'InvalidKey': return false;
+                default: throw er;
+            }
+        });
+    }
+
+    toString() {
+        return 'libVES.Item(' + (this.uri() ?? '[provisional]') + ')';
+    }
+
+};
+
+libVES.ItemCipher = class {
+    constructor(ci, item) {
+        this.cipher = ci;
+        this.item = item;
+    }
+
+    meta(val) {
+        if (val == null) return Promise.resolve(this.cipher.meta);
+        if (!(val instanceof Object)) return Promise.reject(new libVES.Error.InvalidValue('Cipher metadata must be an object'));
+        this.cipher.meta = val;
+        return this.item.put(this.cipher).then(() => this.cipher.meta);
+    }
+
+    reset(final) {
+        if (final && !this.final) return Promise.resolve(null);
+        this.final = false;
+        return this.item.vaultItem.get().then((ci) => this.cipher = ci);
+    }
+
+    encrypt(data, optns) {
+        return this.reset(true).then(() => {
+            this.final = optns?.final !== false;
+            if (data instanceof Blob) {
+                return data.arrayBuffer().then((buf) => this.cipher.encrypt(buf, this.final)).then((ctext) => {
+                    const op = {type: 'application/vnd.ves.encrypted'};
+                    if (optns) optns.type = data.type;
+                    if (data instanceof File) {
+                        if (optns) optns.name = data.name;
+                        return new File([ctext], this.item.externalId, op);
+                    }
+                    return new Blob([ctext], op);
+                });
+            } else if (data instanceof ArrayBuffer) return this.cipher.encrypt(data, this.final).then((ctext) => ctext.buffer);
+            else if ((data instanceof Object) && (data.buffer instanceof ArrayBuffer)) return this.cipher.encrypt(data.buffer, this.final).then((ctext) => new data.constructor(ctext.buffer));
+            else return this.cipher.encrypt(libVES.Util.StringToByteArray(String(data)), this.final).then((ctext) => libVES.Util.ByteArrayToB64(ctext));
+        });
+    }
+
+    decrypt(data, optns) {
+        return this.reset(true).then(() => {
+            this.final = optns?.final !== false;
+            if (data instanceof Blob) {
+                return data.arrayBuffer().then((buf) => this.cipher.decrypt(buf, this.final)).then((ctext) => {
+                    if (data instanceof File) return new File([ctext], (optns?.name || ''), optns);
+                    return new Blob([ctext], optns);
+                });
+            } else if (data instanceof ArrayBuffer) return this.cipher.decrypt(data, this.final).then((ctext) => ctext.buffer);
+            else if ((data instanceof Object) && (data.buffer instanceof ArrayBuffer)) return this.cipher.decrypt(data.buffer, this.final).then((ctext) => new data.constructor(ctext.buffer));
+            else return this.cipher.decrypt(libVES.Util.B64ToByteArray(String(data)), this.final).then((ctext) => libVES.Util.ByteArrayToString(ctext));
+        });
+    }
+
+    toString() {
+        return 'libVES.ItemCipher(' + String(this.item) + ')';
+    }
+
+    toJSON() {
+        return this.item?.uri();
+    }
+};
+libVES.version = '3.00';
 
 module.exports = libVES;