libves 2.6.0 → 2.16.0

package/libVES.node.js

@@ -27,7 +27,7 @@
  *
  * @title libVES
  * @dev A JavaScript end-to-end encryption interface to VESvault REST API
- * @version 2.06
+ * @version 2.16
  *
  * @dev Official source code: https://github.com/vesvault/libVES
  *
@@ -54,17 +54,20 @@ if (typeof(libVES) != 'function') function libVES(optns) {
 }
 
 libVES.prototype = {
+    constructor: libVES,
     apiUrl: 'https://api.ves.host/v1/',
+    pollUrl: 'https://poll.ves.host/v1/',
     wwwUrl: 'https://www.vesvault.com/',
     keyAlgo: 'ECDH',
+    keyOptions: {namedCurve: 'P-521'},
     textCipher: 'AES256GCMp',
     defaultHash: 'SHA256',
-    
+    propagators: [],
     request: function(method,uri,body,optns) {
 	if (!optns) optns = {};
 	return new Promise(function(resolve,reject) {
 	    var xhr = new XMLHttpRequest();
-	    xhr.open(method,this.apiUrl + uri);
+	    xhr.open(method, (uri.match(/^https\:/) ? uri : this.apiUrl + uri));
 	    if (optns.abortFn) optns.abortFn(function() {
 		return xhr.abort();
 	    });
@@ -183,7 +186,7 @@ libVES.prototype = {
 		return flow.setValue(undefined).then(function() {
 		    return flow.addToken(url).then(function(url) {
 			document.location.replace(url);
-			throw {code: 'Redirect', message: 'Starting VES Authorization...'};
+			throw new libVES.Error('Redirect', 'Starting VES Authorization...');
 		    });
 		});
 	    });
@@ -294,13 +297,16 @@ libVES.prototype = {
 	var self = this;
 	return this.getVaultKey().then(function(k) {
 	    return k.getId().then(function(kid) {
-		return k.getVaultEntries().then(function(ves) {
+		return k.getVaultEntries({type: true, deleted: true, file: {creator: true, externals: true}, vaultKey: {type: true, user: true}}).then(function(ves) {
 		    var vis = {};
 		    var vlst = [];
 		    for (var i = 0; i < ves.length; i++) {
 			var viid = ves[i].vaultItem.id;
 			if (!vis[viid]) {
-			    var vi = vis[viid] = self.getItem(ves[i].vaultItem);
+			    var vi = ves[i].vaultItem;
+			    if (!vi.file) vi.file = undefined;
+			    if (!vi.vaultKey) vi.vaultKey = undefined;
+			    vi = vis[viid] = self.getItem(vi);
 			    vlst.push(vi);
 			    vi.vaultEntryByKey[kid] = ves[i];
 			}
@@ -356,7 +362,7 @@ libVES.prototype = {
 		    },
 		    vaultRefToUser: function(ext) {
 			var email = ext.externalId ? ext.externalId.replace(/\!.*/, '') : '';
-			if (!email.match(/\@/)) throw {code: 'NotFound', message: 'externalId is not an email for non-existing vault'};
+			if (!email.match(/\@/)) throw new libVES.Error('NotFound', 'externalId is not an email for non-existing vault');
 			return new libVES.User({email: email}, self);
 		    }
 		};
@@ -426,14 +432,15 @@ libVES.prototype = {
 	var key = new libVES.VaultKey({type: 'temp', algo: this.keyAlgo, user: usr}, self);
 	var veskey = this.generateVESkey(usr);
 	return key.generate(veskey, optns).then(function(k) {
-	    if (self.e2e && self.e2e.length) usr.e2e = self.getVESkeyE2E(veskey, usr);
 	    key.setField('vaultItems', veskey.then(function(v) {
 		var vi = new libVES.VaultItem({type: 'password'}, self);
 		return usr.getActiveVaultKeys().then(function() {
 		    return [self.me(), self.getVaultKey(), usr];
 		}).catch(function(e) {
 		    if (e.code != 'NotFound') throw e;
-		    return self.type == 'secondary' ? [self.me(), self.getVaultKey()] : [self.me()];
+		    var sh = self.type == 'secondary' ? [self.me(), self.getVaultKey()] : [self.me()];
+		    if (self.propagators) for (var i = 0; i < self.propagators.length; i++) sh.push(self.propagators[i]);
+		    return sh;
 		}).then(function(sh) {
 		    return Promise.all(sh);
 		}).then(function(sh) {
@@ -451,18 +458,6 @@ libVES.prototype = {
 	crypto.getRandomValues(buf);
 	return Promise.resolve(libVES.Util.ByteArrayToB64(buf));
     },
-    getVESkeyE2E: function(veskey,usr) {
-	var self = this;
-	return veskey.then(function(v) {
-	    return libVES.getModule(libVES.E2E,['Dialog','TempKey']).then(function(cls) {
-		return new cls({
-		    user: usr,
-		    e2e: self.e2e,
-		    tempKey: v
-		});
-	    });
-	});
-    },
     setVESkey: function(veskey,lost,options) {
 	var self = this;
 	return this.me().then(function(me) {
@@ -658,7 +653,7 @@ libVES.prototype = {
 	        return Promise.resolve(shareWith || self.getFileItem(fileRef).then(function(vi) {
 		    return vi.getShareList();
 		}).catch(function(e) {
-		    return self.usersToKeys([{domain: (fileRef.domain || VES.domain)}]);
+		    return self.usersToKeys([{domain: VES.domain, externalId: VES.externalId}]);
 		})).then(function(shareWith) {
 		    return vaultItem.shareWith(shareWith,value);
 		});
@@ -681,8 +676,8 @@ libVES.prototype = {
 	});
     },
     deleteFile: function(fileRef) {
-	return this.getFile(fileRef).then(function(file) {
-	    return file.delete();
+	return this.getFileItem(fileRef).then(function(item) {
+	    return item.delete();
 	});
     },
     newSecret: function(cls) {
@@ -857,9 +852,11 @@ libVES.prototype = {
 					return vkey.rekey(optns);
 				    });
 				    else return vkey.getVaultItems().then(function(vis) {
-					return Promise.all(vis.map(function(vi, i) {
-					    return vi.reshareWith([user]);
-					}));
+					return self.elevateAuth().then(function(optns) {
+					    return Promise.all(vis.map(function(vi, i) {
+						return vi.reshareWith([user], undefined, optns);
+					    }));
+					});
 				    });
 				});
 			    });
@@ -871,11 +868,27 @@ libVES.prototype = {
 		}
 	    });
 	}));
+    },
+    setKeyAlgo: function(optns) {
+	if (typeof(optns) == 'string') {
+	    this.keyOptions = null;
+	    return this.keyAlgo = optns;
+	}
+	var algo = libVES.Algo.fromKeyOptions(optns);
+	if (algo) {
+	    this.keyOptions = optns;
+	    return this.keyAlgo = algo;
+	}
     }
 };
 
-libVES.Error = function(code,msg,optns) {
+libVES.Error = function(code, msg, optns) {
+    if (libVES.Error[code] && (libVES.Error[code].prototype instanceof libVES.Error)) return new (libVES.Error[code])(msg, optns);
     this.code = code;
+    this.init(msg, optns);
+};
+
+libVES.Error.prototype.init = function(msg, optns) {
     this.message = msg;
     if (optns) for (var k in optns) this[k] = optns[k];
 };
@@ -884,6 +897,32 @@ libVES.Error.prototype.toString = function() {
     return this.message || this.code;
 };
 
+libVES.Error.NotFound = function(msg, optns) {
+    this.init(msg, optns);
+};
+libVES.Error.NotFound.prototype = new libVES.Error('NotFound');
+
+libVES.Error.InvalidValue = function(msg, optns) {
+    this.init(msg, optns);
+};
+libVES.Error.InvalidValue.prototype = new libVES.Error('InvalidValue');
+
+libVES.Error.InvalidKey = function(msg, optns) {
+    this.init(msg, optns);
+};
+libVES.Error.InvalidKey.prototype = new libVES.Error('InvalidKey');
+
+libVES.Error.Redirect = function(msg, optns) {
+    this.init(msg, optns);
+};
+libVES.Error.Redirect.prototype = new libVES.Error('Redirect');
+
+libVES.Error.Internal = function(msg, optns) {
+    this.init(msg, optns);
+};
+libVES.Error.Internal.prototype = new libVES.Error('Internal');
+
+
 libVES.getModule = function(sectn,mods) {
     var mod;
     if (mods instanceof Array) mod = mods[0];
@@ -904,6 +943,9 @@ libVES.getModuleFunc = function(sectn,mod,then) {
 libVES.loadModule = function(sectn,mod) {
     return Promise.reject(new libVES.Error('Internal',"Cannot load " + sectn + '.' + mod));
 };
+libVES.maxKeyLen = 48896;
+libVES.maxEncDataLen = 32768;
+
 
 if (!libVES.Domain) libVES.Domain = {};
 
@@ -982,6 +1024,16 @@ libVES.Util = {
 	}
 	return rs;
     },
+    loadWasm: function(src) {
+	return new Promise(function(resolve, reject) {
+	    var sc = document.createElement('script');
+	    sc.async = false;
+	    sc.src = src;
+	    sc.onload = resolve;
+	    sc.onerror = reject;
+	    document.getElementsByTagName('head')[0].appendChild(sc);
+	});
+    },
     PEM: {
 	toDER: function(pem) {
 	    var pp = pem.match(/-----BEGIN.*?-----\s*\r?\n([A-Za-z0-9\/\+\=\s\r\n]*)-----END/);
@@ -1136,6 +1188,43 @@ libVES.Util = {
 	    this.value = rs.join('.');
 	} else this.value = s;
     },
+    Key: {
+	fromDER: function(der, callbk) {
+	    var asn = libVES.Util.ASN1.decode(der)[0];
+	    if (typeof(asn[0]) == 'number') {
+		var asn2 = libVES.Util.ASN1.decode(asn[2])[0];
+		var pub = libVES.Util.ASN1.decode(asn2[2]);
+		console.log('pub', pub);
+		if (pub) return callbk(pub[0].slice(1), asn2[1], pub[0][0]);
+		else callbk(null, asn2[1]);
+	    } else return callbk(asn[1].slice(1), null, asn[1][0]);
+	},
+	pubASN1: function(pub, optns) {
+	    var p = new Uint8Array(pub.byteLength + 1);
+	    p[0] = optns && optns.pubBits ? optns.pubBits : 0;
+	    p.set(new Uint8Array(pub), 1);
+	    p.ASN1type = 3;
+	    return p;
+	},
+	toPKCS: function(pub, priv, asn1hdr, optns) {
+	    if (priv) {
+		var seq = [1, priv];
+		if (pub) {
+		    p = libVES.Util.ASN1.encode([libVES.Util.Key.pubASN1(pub, optns)]);
+		    p.ASN1type = 0xa1;
+		    seq.push(p);
+		}
+		var buf = libVES.Util.ASN1.encode([seq]);
+		return libVES.Util.ASN1.encode([[0, asn1hdr, buf]]);
+	    }
+	    return libVES.Util.ASN1.encode([[asn1hdr, libVES.Util.Key.pubASN1(pub, optns)]]);
+	},
+	export: function(pub, priv, asn1hdr, optns) {
+	    var pkcs = libVES.Util.Key.toPKCS(pub, priv, asn1hdr, optns);
+	    if (priv) return libVES.Util.PKCS8.encode8(pkcs, optns);
+	    return libVES.Util.PEM.encode(pkcs, 'PUBLIC KEY');
+	}
+    },
     PKCS1: {
 	import: function(args,chain,optns) {
 	    return chain('container',optns).then(function(der) {
@@ -1318,13 +1407,18 @@ libVES.Util = {
     EC: {
 	import: function(args,chain,optns) {
 	    return chain('container',optns).then(function(der) {
-		var a = {name:'ECDH',namedCurve:libVES.Util.EC.namedCurves[String(args)]};
-		return crypto.subtle.importKey('spki',der,a,true,[]).catch(function() {;
-		    return crypto.subtle.importKey('pkcs8',der,a,true,['deriveKey','deriveBits']).catch(function(e) {
-		        console.log('PKCS8 failed, trying JWK...');
-			var jwk = libVES.Util.PKCS8.toJWK(der);
-			return crypto.subtle.importKey('jwk', jwk, a, true, jwk.key_ops);
-		    });
+		var oid = String(args);
+		var curve = libVES.Util.EC.namedCurves[oid] || oid;
+		var a = {name:'ECDH',namedCurve: curve};
+		return crypto.subtle.importKey('spki',der,a,true,[]).catch(function() {
+		    return crypto.subtle.importKey('pkcs8',der,a,true,['deriveKey','deriveBits']);
+		}).catch(function(e) {
+		    console.log('PKCS8 failed, trying JWK...');
+		    var jwk = libVES.Util.PKCS8.toJWK(der);
+		    return crypto.subtle.importKey('jwk', jwk, a, true, jwk.key_ops);
+		}).catch(function(e) {
+		    console.log('trying WasmECDH...');
+		    return libVES.Algo.ECDH.importWasm(curve, der);
 		});
 	    });
 	},
@@ -1633,7 +1727,7 @@ libVES.Object.prototype = {
 		    if (self.fieldClass[k]) return (clsf = function(v) {
 			if (v instanceof libVES.Object) return v;
 			else if (v instanceof Array) return v.map(function(vv) { return clsf(vv); });
-			else return new (self.fieldClass[k])(v,self.VES);
+			else if (v) return new (self.fieldClass[k])(v,self.VES);
 		    })(v);
 		    return v;
 		};
@@ -1650,6 +1744,34 @@ libVES.Object.prototype = {
 	    return self[fld];
 	});
     },
+    getFields: function(fldlst, force) {
+	var self = this;
+	var flds = {};
+	for (var i = 0; i < this.fieldSets.length; i++) {
+	    for (var k in this.fieldSets[i]) if (fldlst[k]) {
+		for (var k in this.fieldSets[i]) if ((force || !this[k]) && !(flds[k] instanceof Object)) flds[k] = this.fieldSets[i][k];
+		break;
+	    }
+	}
+	for (var k in fldlst) if ((force || !this[k]) && !(flds[k] instanceof Object)) flds[k] = fldlst[k];
+	for (var k in flds) {
+	    this.loadFields(flds);
+	    break;
+	}
+	var plst = [];
+	for (var k in fldlst) {
+	    plst.push(Promise.resolve(this[k]).then(function(v) {
+		if (!(v instanceof libVES.Object)) return v;
+		return v.getFields(fldlst[k], force);
+	    }));
+	}
+	var rs = {};
+	return Promise.all(plst).then(function(lst) {
+	    var i = 0;
+	    for (var k in fldlst) rs[k] = lst[i++];
+	    return rs;
+	});
+    },
     getField: function(fld,fldlst,force) {
 	var self = this;
 	if (!this[fld] || force) {
@@ -1791,6 +1913,22 @@ libVES.File = function(data,VES,refs) {
     this.init(data,VES,refs);
 };
 
+libVES.Event = function(data, VES, refs) {
+    this.init(data, VES, refs);
+};
+
+libVES.Session = function(data, VES, refs) {
+    this.init(data, VES, refs);
+};
+
+libVES.oldDomain = libVES.Domain;
+libVES.Domain = function(dom, VES) {
+    this.init({id: (dom ? dom : VES.domain)}, VES);
+};
+(function(old) {
+    if (old) for (var k in old) libVES.Domain[k] = old[k];
+})(libVES.oldDomain);
+
 libVES.User.prototype = new libVES.Object({
     apiUri: 'users',
     fieldList: {id: true, email: true, type: true, firstName: true, lastName: true},
@@ -1962,12 +2100,14 @@ libVES.VaultKey.prototype = new libVES.Object({
 	});
     },
     generate: function(veskey,optns) {
+	if (!optns) optns = this.VES.keyOptions;
 	var self = this;
+	var a;
 	var wc = optns && optns.privateKey ? libVES.Algo.acquire(optns.privateKey).then(function(wc) {
 	    self.setField('algo',wc.engine.tag);
 	    if (!wc.privateKey) throw new libVES.Error('InvalidValue','Private key expected');
 	    return wc;
-	}) : (optns && optns.algo ? self.setField('algo',optns.algo) : Promise.resolve()).then(function() {
+	}) : (optns && (a = libVES.Algo.fromKeyOptions(optns)) ? self.setField('algo', a) : Promise.resolve()).then(function() {
 	    return self.engine().then(function(e) {
 		return e.generate(optns).then(function(ks) {
 		    ks.engine = e;
@@ -2113,6 +2253,14 @@ libVES.VaultKey.prototype = new libVES.Object({
     },
     matchVaults: function(vaultKeys) {
 	return Promise.resolve(false);
+    },
+    getKeyOptions: function() {
+	var self = this;
+	return self.engine().then(function(e) {
+	    return self.getPublicCryptoKey().then(function(pub) {
+		return e.getKeyOptions(pub);
+	    });
+	});
     }
 });
 
@@ -2242,7 +2390,8 @@ libVES.VaultItem.prototype = new libVES.Object({
 		});
 	    });
 	}).then(function() {
-	    if (save || save === undefined) return self.post().then(function() {
+	    if (save || save === undefined) return self.post(undefined, undefined, ((save instanceof Object) ? save : undefined)).then(function() {
+		delete(self.vaultEntries);
 		return self;
 	    });
 	    return self;
@@ -2298,6 +2447,12 @@ libVES.VaultItem.prototype = new libVES.Object({
 		return rs;
 	    });
 	});
+    },
+    delete: function() {
+	var self = this;
+	return self.getId().then(function(id) {
+	    return this.VES.post(self.apiUri + '/' + id, {'$op': 'delete'});
+	});
     }
 });
 libVES.VaultItem.Type = {
@@ -2372,9 +2527,70 @@ libVES.External.prototype = new libVES.Object({
     }
 });
 
+
+libVES.Event.prototype = new libVES.Object({
+    apiUri: 'events',
+    fieldList: {id: true, recordedAt: true, vaultKey: true, vaultItem: true, user: true},
+    fieldClass: {vaultKey: libVES.VaultKey, vaultItem: libVES.VaultItem, user: libVES.User, creator: libVES.User, session: libVES.Session},
+    getType: function() {
+	return this.getField('type');
+    },
+    getVaultKey: function() {
+	return this.getField('vaultKey');
+    },
+    getVaultItem: function() {
+	return this.getField('vaultItem');
+    },
+    getUser: function() {
+	return this.getField('user');
+    },
+    getCreator: function() {
+	return this.getField('creator');
+    },
+    getSession: function() {
+	return this.getField('session');
+    }
+});
+
+libVES.Session.prototype = new libVES.Object({
+    apiUri: 'sessions',
+    fieldList: {id: true, createdAt: true, expiresAt: true, vaultKey: true, user: true},
+    fieldClass: {vaultKey: libVES.VaultKey, user: libVES.User},
+    getVaultKey: function() {
+	return this.getField('vaultKey');
+    },
+    getUser: function() {
+	return this.getField('user');
+    },
+    getRemote: function() {
+	return this.getField('remote');
+    },
+    getUserAgent: function() {
+	return this.getField('userAgent');
+    }
+});
+
+libVES.Domain.prototype = new libVES.Object({
+    apiUri: 'domains',
+    fieldList: {id: true},
+    fieldClass: {vaultKeys: libVES.VaultKey, vaultItems: libVES.VaultItem, creator: libVES.User},
+    fieldSets: [{vaultItems: {id: true, type: true, file: {creator: true, externals: true}, deleted: true}, vaultKeys: {id: true, type: true, user: {id: true}, algo: true, externals: {id: true}}}],
+    getCreator: function() {
+	return this.getField('creator');
+    },
+    getVaultKeys: function() {
+	return this.getField('vaultKeys');
+    },
+    getVaultItems: function() {
+	return this.getField('vaultItems');
+    }
+});
+
+
 libVES.Algo = {
     ECDH: {
 	tag: 'ECDH',
+	defaultCurve: 'P-521',
 	decrypt: function(k,buf) {
 	    var b = new Uint8Array(buf);
 	    var data = libVES.Util.ASN1.decode(b);
@@ -2398,7 +2614,12 @@ libVES.Algo = {
 	    return libVES.Algo.ECDH.eKey(k).then(function(eKey) {
 		return libVES.Algo.ECDH.cipher(eKey.privateKey,k).then(function(ci) {
 		    return Promise.all([
-			crypto.subtle.exportKey('spki',eKey.publicKey),
+			((k instanceof CryptoKey)
+			    ? crypto.subtle.exportKey('spki',eKey.publicKey)
+			    : libVES.Algo.ECDH.wasm().then(function(wasm) {
+				return libVES.Util.Key.toPKCS(wasm.getpub(eKey.publicKey), null, libVES.Algo.ECDH.asn1hdr(wasm.getoid(eKey.publicKey)));
+			    })
+			),
 			ci.encrypt(buf,true)
 		    ]).then(function(bufs) {
 			var buf = new Uint8Array(bufs[0].byteLength + bufs[1].byteLength);
@@ -2413,21 +2634,32 @@ libVES.Algo = {
 	    });
 	},
 	eKey: function(pub) {
-	    return crypto.subtle.exportKey('jwk',pub).then(function(kdata) {
+	    if (pub instanceof CryptoKey) return crypto.subtle.exportKey('jwk',pub).then(function(kdata) {
 		return crypto.subtle.generateKey({name:'ECDH',namedCurve: kdata.crv},true,['deriveKey','deriveBits']).catch(function(e) {
 		    throw new libVES.Error('InvalidValue','Error generating ECIES ephemeral',{error: e});
 		});
 	    });
+	    return this.wasm().then(function(wasm) {
+		var k = wasm.init(pub.curve);
+		wasm.generate(k);
+		return wasm.privpub(k);
+	    });
+	},
+	derive: function(priv, pub) {
+	    if (pub instanceof CryptoKey) return Promise.resolve(libVES.Algo.ECDH.curveBytes[pub.algorithm.namedCurve] || crypto.subtle.exportKey('jwk', pub).then(function(jwk) {
+		return jwk.x.length * 3 / 4;
+	    })).then(function(len) {
+		return crypto.subtle.deriveBits({name: 'ECDH', public: pub}, priv, 8 * len);
+	    });
+	    return this.wasm().then(function(wasm) {
+		return wasm.derive(priv, pub);
+	    });
 	},
-	cipher: function(priv,pub) {
+	cipher: function(priv, pub) {
 	    return libVES.getModule(libVES.Cipher,'AES256GCMp').then(function(m) {
-		return Promise.resolve(libVES.Algo.ECDH.curveBytes[pub.algorithm.namedCurve] || crypto.subtle.exportKey('jwk',pub).then(function(jwk) {
-		    return jwk.x.length * 3 / 4;
-		})).then(function(len) {
-		    return crypto.subtle.deriveBits({name:'ECDH',public:pub},priv,8 * len).then(function(raw) {
-			return crypto.subtle.digest({name:'SHA-384'},raw).then(function(buf) {
-			    return new m(new Uint8Array(buf).slice(0,m.prototype.keySize + m.prototype.ivSize));
-			});
+		return libVES.Algo.ECDH.derive(priv, pub).then(function(raw) {
+		    return crypto.subtle.digest({name:'SHA-384'},raw).then(function(buf) {
+			return new m(new Uint8Array(buf).slice(0,m.prototype.keySize + m.prototype.ivSize));
 		    });
 		});
 	    });
@@ -2462,13 +2694,22 @@ libVES.Algo = {
 		    }).then(function(der) {
 			return libVES.Util.PEM.encode(der, 'PUBLIC KEY');
 		    });
-	    }
+	    } else return this.wasm().then(function(wasm) {
+		return libVES.Util.Key.export(wasm.getpub(data), wasm.getpriv(data), libVES.Algo.ECDH.asn1hdr(wasm.getoid(data)), optns);
+	    });
 	    throw new libVES.Error('Internal', "Unknown type of key object");
 	},
 	generate: function(optns) {
-	    var op = {name:'ECDH', namedCurve:'P-384'};
+	    var op = {name: 'ECDH', namedCurve: this.defaultCurve};
 	    if (optns) for (var k in optns) op[k] = optns[k];
-	    return crypto.subtle.generateKey(op,true,['deriveKey','deriveBits']);
+	    return crypto.subtle.generateKey(op, true, ['deriveKey', 'deriveBits']).catch(function(e) {
+		console.log('ECDH generateKey failed, trying wasm...', e, op);
+		return libVES.Algo.ECDH.wasm().then(function(wasm) {
+		    var k = wasm.init(op.namedCurve);
+		    if (!k || !wasm.generate(k)) throw new libVES.Error('InvalidValue', 'WasmECDH key generation error (unsupported curve?)');
+		    return wasm.privpub(k);
+		});
+	    });
 	},
 	getPublic: function(priv) {
 	    return crypto.subtle.exportKey('jwk',priv).then(function(k) {
@@ -2481,7 +2722,48 @@ libVES.Algo = {
 		    y: k.y
 		},{name:'ECDH'},true,[]);
 	    });
-	}
+	},
+	getKeyOptions: function(key) {
+	    if (key instanceof CryptoKey) return crypto.subtle.exportKey('jwk', key).then(function(k) {
+		return {namedCurve: k.crv};
+	    });
+	    return {namedCurve: k.curve};
+	},
+	asn1hdr: function(oid) {
+	    return [new libVES.Util.OID(this.OID), new libVES.Util.OID(oid)];
+	},
+	wasm: function() {
+	    if (!this.wasmP) this.wasmP = (typeof(WasmECDH) == 'function' ? Promise.resolve()
+		: libVES.Util.loadWasm(WasmECDHinit.baseUrl + 'WasmECDH.js')
+	    ).then(function() {
+		return WasmECDH(WasmECDHinit);
+	    });
+	    return this.wasmP;
+	},
+	importWasm: function(curve, der) {
+	    return libVES.Algo.ECDH.wasm().then(function(wasm) {
+		return libVES.Util.Key.fromDER(der, function(pub, priv, pubBits) {
+		    var k = wasm.init(curve);
+		    if (!k) return null;
+		    if (pub) wasm.setpub(k, pub);
+		    if (priv) wasm.setpriv(k, priv);
+		    return k;
+		});
+	    });
+	},
+	getMethods: function() {
+	    var crvs = ['P-256', 'P-384', 'P-521'];
+	    return this.wasm().then(function(wasm) {
+		return crvs.concat(wasm.getcurves());
+	    }).catch(function(e) {
+		return crvs;
+	    }).then(function(crvs) {
+		return crvs.map(function(algo) {
+		    return {namedCurve: algo};
+		});
+	    });
+	},
+	OID: '1.2.840.10045.2.1'
     },
     RSA: {
 	tag: 'RSA',
@@ -2540,7 +2822,7 @@ libVES.Algo = {
 	    throw new libVES.Error('Internal',"Unknown type of key object");
 	},
 	generate: function(optns) {
-	    var op = {name:'RSA-OAEP', modulusLength:2048, publicExponent:new Uint8Array([1,0,1]), hash:'SHA-1'};
+	    var op = {name:'RSA-OAEP', modulusLength:4096, publicExponent:new Uint8Array([1,0,1]), hash:'SHA-256'};
 	    if (optns) for (var k in optns) op[k] = optns[k];
 	    return crypto.subtle.generateKey(op,true,['decrypt','encrypt']);
 	},
@@ -2553,9 +2835,25 @@ libVES.Algo = {
 		    key_ops: ['encrypt'],
 		    kty: 'RSA',
 		    n: k.n
-		},{name:'RSA-OAEP',hash:'SHA-1'},true,['encrypt']);
+		},{name:'RSA-OAEP',hash:'SHA-256'},true,['encrypt']);
 	    });
-	}
+	},
+	getKeyOptions: function(key) {
+	    return crypto.subtle.exportKey('jwk', key).then(function(k) {
+		return {modulusLength: ((k.n.length * 6) >> 3) * 8, publicExponent: libVES.Util.B64ToByteArray(k.e)};
+	    });
+	},
+	getMethods: function() {
+	    var bits = [];
+	    var s = 128;
+	    for (var i = 640; i <= 16384; i += s) {
+		bits.push(i);
+		if (i / s >= 8) s <<= 1;
+	    }
+	    return Promise.resolve(bits.map(function(b) {
+		    return {modulusLength: b};
+	    }));
+	},
     },
     RSA_PKCS1_15: {
 	tag: 'RSA_PKCS1_15',
@@ -2592,9 +2890,107 @@ libVES.Algo = {
 	    }
 	});
     },
+    fromKeyOptions: function(optns) {
+	if (optns.namedCurve) return 'ECDH';
+	if (optns.oqsAlgo) return 'OQS';
+	if (optns.modulusLength) return 'RSA';
+    },
     toString: function() {
 	return 'libVES.Algo';
-    }
+    },
+    all: ['RSA', 'ECDH']
+};
+
+WasmECDHinit = {
+    Key: function() {},
+    init: function(curve) {
+	var a = new Uint8Array(libVES.Util.StringToByteArray(curve));
+	var arg1 = this.buf(a.byteLength + 1);
+	arg1.set(a);
+	arg1.set([0], a.byteLength);
+	var ptr = this._WasmECDH_new(arg1.byteOffset);
+	if (!ptr) return null;
+	var key = new this.Key();
+	key.ptr = ptr;
+	key.curve = this.getcurve(key);
+	return key;
+    },
+    buf: function(len) {
+	return new Uint8Array(this.asm.memory.buffer, this._WasmECDH_buf, len);
+    },
+    str: function(ptr) {
+	if (!ptr) return null;
+	var b = new Uint8Array(this.asm.memory.buffer, ptr);
+	return libVES.Util.ByteArrayToString(b.slice(0, b.indexOf(0)));
+    },
+    generate: function(key) {
+	key.private = true;
+	return this._WasmECDH_generate(key.ptr);
+    },
+    setpub: function(key, pub) {
+	var arg1 = this.buf(pub.byteLength);
+	arg1.set(pub);
+	return this._WasmECDH_setpub(key.ptr, arg1.byteOffset, arg1.byteLength);
+    },
+    setpriv: function(key, priv) {
+	key.private = true;
+	var arg1 = this.buf(priv.byteLength);
+	arg1.set(priv);
+	return this._WasmECDH_setpriv(key.ptr, arg1.byteOffset, arg1.byteLength);
+    },
+    getpub: function(key) {
+	var l = this._WasmECDH_getpub(key.ptr);
+	if (l <= 0) return null;
+	var rs = new Uint8Array(l);
+	rs.set(this.buf(l));
+	return rs;
+    },
+    getpriv: function(key) {
+	if (!key.private) return null;
+	var l = this._WasmECDH_getpriv(key.ptr);
+	if (l <= 0) return null;
+	var rs = new Uint8Array(l);
+	rs.set(this.buf(l));
+	return rs;
+    },
+    getcurve: function(key) {
+	return this.str(this._WasmECDH_getcurve(key.ptr));
+    },
+    getoid: function(key) {
+	return this.str(this._WasmECDH_getoid(key.ptr));
+    },
+    derive: function(priv, pub) {
+	var l = this._WasmECDH_derive(priv.ptr, pub.ptr);
+	if (l <= 0) return null;
+	var rs = new Uint8Array(l);
+	rs.set(this.buf(l));
+	return rs;
+    },
+    privpub: function(priv) {
+	var pub = new this.Key();
+	pub.ptr = priv.ptr;
+	pub.curve = priv.curve;
+	return {privateKey: priv, publicKey: pub};
+    },
+    free: function(key) {
+	this._WasmECDH_free(key.ptr);
+    },
+    getcurves: function() {
+	var lst = this._WasmECDH_listinit(1024);
+	var crvs = [];
+	var c;
+	for (var i = 0; (c = this._WasmECDH_listget(lst, i)); i++) {
+	    var crv = this.str(c);
+	    if (crv == '') continue;
+	    crvs.push(crv);
+	}
+	this._WasmECDH_listfree(lst);
+	return crvs;
+    },
+    locateFile: function(file) {
+       return this.baseUrl + file;
+    },
+    baseUrl: 'https://ves.host/pub/'
 };
 
 libVES.Cipher = function(data) {
@@ -3142,10 +3538,14 @@ libVES.Recovery.prototype = {
 	return this.getMyToken().then(function(tkn) {
 	    if (!tkn) throw new libVES.Error('InvalidValue','No assistance available');
 	    return self.vaultKey.getUser().then(function(user) {
-		return tkn.vaultItem.shareWith(assist ? [tkn.user,user] : [tkn.user]).then(function() {
-		    self.tokens = undefined;
-		    self.vaultKey.vaultItems = undefined;
-		    return true;
+		return self.vaultKey.VES.elevateAuth().catch(function(e) {
+		    return undefined;
+		}).then(function(optns) {
+		    return tkn.vaultItem.shareWith((assist ? [tkn.user,user] : [tkn.user]), undefined, optns).then(function() {
+			self.tokens = undefined;
+			self.vaultKey.vaultItems = undefined;
+			return true;
+		    });
 		});
 	    });
 	});
@@ -3394,7 +3794,7 @@ libVES.Flow.prototype.pubJWK = function(org) {
 	    return libVES.Flow.jwkPub(jwk);
 	});
     }) : Promise.resolve(sessionStorage['VESflow|' + org]).then(function(k) {
-	if (!k) throw {code: 'NotFound', message: 'No public key stored for ' + org};
+	if (!k) throw new libVES.Error('NotFound', 'No public key stored for ' + org);
 	return JSON.parse(k);
     }));
 };
@@ -3421,7 +3821,7 @@ libVES.Flow.prototype.cipher = function(url) {
 libVES.Flow.prototype.encrypt = function(url, val) {
     var self = this;
     return Promise.resolve(val || this.value()).then(function(val) {
-	if (val == null) throw {code: 'NoData', message: 'Empty value'};
+	if (val == null) throw new libVES.Error('NoData', 'Empty value');
 	return self.cipher(url).then(function(ci) {
 	    var iv = new Uint8Array(12);
 	    crypto.getRandomValues(iv);
@@ -3512,7 +3912,7 @@ libVES.Flow.prototype.recv = function(dval) {
 	    tk = t;
 	    return true;
 	});
-	if (tk == null) throw {code: 'NotFound', message: 'No valid token in the source url'};
+	if (tk == null) throw new libVES.Error('NotFound', 'No valid token in the source url');
 	return Promise.resolve(self.source(src)).then(function() {
 	    if (dval) for (var k in dval) if (tk[k] === undefined) tk[k] = dval[k];
 	    return self.recvToken(tk);
@@ -3523,7 +3923,7 @@ libVES.Flow.prototype.recv = function(dval) {
 libVES.Flow.prototype.recvToken = function(tk) {
     var org = libVES.Flow.toOrigin(tk.url);
     if (org != this.origin && tk.key) sessionStorage['VESflow|' + org] = JSON.stringify(tk.key);
-    if (!tk.enc) return Promise.reject({url: tk.url, code: 'Incomplete', message: 'Missing encrypted data'});
+    if (!tk.enc) return Promise.reject(new libVES.Error('Incomplete', 'Missing encrypted data', {url: tk.url}));
     return this.decrypt(tk.enc, org);
 };
 
@@ -3538,7 +3938,7 @@ libVES.Flow.prototype.get = function() {
 		self.url = document.location.href;
 		return self.addToken(e.url).then(function(url) {
 		    document.location.replace(url);
-		    throw {code: 'Reload', message: 'Completing the key exchange'};
+		    throw new libVES.Error('Redirect', 'Completing the key exchange');
 		});
 	    }
 	    if (!data) throw e;
@@ -3552,13 +3952,13 @@ libVES.Flow.prototype.store = function(url) {
 	this.sent = 1;
 	return Promise.resolve(sessionStorage['VESflow.' + this.name + '>' + libVES.Flow.toOrigin(url)] = history.state['VESflow.' + this.name]);
     }
-    return Promise.reject({code: 'NotFound', message: 'Value is not set'});
+    return Promise.reject(new libVES.Error('NotFound', 'Value is not set'));
 };
 
 libVES.Flow.prototype.fetch = function(url) {
     var self = this;
     return Promise.resolve(sessionStorage['VESflow.' + self.name + '>' + libVES.Flow.toOrigin(url)]).then(function(ctext) {
-	if (!ctext) throw {code: 'NotFound', message: 'Not in the session storage'};
+	if (!ctext) throw new libVES.Error('NotFound', 'Not in the session storage');
 	return self.decrypt(ctext).then(function(data) {
 	    self.erase(url);
 	    return data;
@@ -3678,19 +4078,16 @@ libVES.Auth.prototype.verify = function(token, auth) {
 libVES.Algo.OQS = {
     tag: 'OQS',
     wasm: function() {
-	if (!this.wasmP) this.wasmP = new Promise(function(resolve, reject) {
-	    if (typeof(WasmOQS) == 'function') return resolve();
-	    var sc = document.createElement('script');
-	    sc.async = false;
-	    sc.src = WasmOQSinit.baseUrl + 'WasmOQS.js';
-	    sc.onload = resolve;
-	    sc.onerror = reject;
-	    document.getElementsByTagName('head')[0].appendChild(sc);
-	}).then(function() {
+	if (!this.wasmP) this.wasmP = (typeof(WasmOQS) == 'function' ? Promise.resolve()
+	    : libVES.Util.loadWasm(WasmOQSinit.baseUrl + 'WasmOQS.js')
+	).then(function() {
 	    return WasmOQS(WasmOQSinit);
 	});
 	return this.wasmP;
     },
+    checkLimits: function(k) {
+	return k.pub.byteLength + k.priv.byteLength <= libVES.maxKeyLen && k.ctextlen + 64 <= libVES.maxEncDataLen;
+    },
     decrypt: function(k,buf) {
 	return this.wasm().then(function(wasm) {
 	    var b = new Uint8Array(buf);
@@ -3737,56 +4134,54 @@ libVES.Algo.OQS = {
     },
     export: function(data, optns) {
 	if (!data || !data.ptr) throw new libVES.Error('Internal', "Unknown type of key object");
-	var pub = new Uint8Array(data.pub.byteLength + 1);
-	pub[0] = 0;
-	pub.set(new Uint8Array(data.pub), 1);
-	pub.ASN1type = 3;
 	var oid = [new libVES.Util.OID(libVES.Algo.OQS.OID), libVES.Util.StringToByteArray(data.algo)];
-	if (data.priv) {
-	    pub = libVES.Util.ASN1.encode([pub]);
-	    pub.ASN1type = 0xa1;
-	    var buf = libVES.Util.ASN1.encode([[1, data.priv, pub]]);
-	    var pkcs8 = libVES.Util.ASN1.encode([[0, oid, buf]]);
-	    return libVES.Util.PKCS8.encode8(pkcs8, optns);
-	}
-	return libVES.Util.PEM.encode(libVES.Util.ASN1.encode([[oid, pub]]), 'PUBLIC KEY');
+	return libVES.Util.Key.export(data.pub, data.priv, oid, optns);
     },
     generate: function(optns) {
-	var algo = optns ? optns.algo : null;
+	var algo = optns ? optns.oqsAlgo : null;
 	if (!algo) algo = this.defaultAlgo;
 	return this.wasm().then(function(wasm) {
 	    var k = wasm.init(algo, true);
 	    if (!k) throw new libVES.Error('InvalidValue', 'OQS key init failed');
-	    if (!wasm.generate(k)) throw new libVES.Error('Internal', 'OQS generate failed');
-	    var pub = {};
+	    if (!libVES.Algo.OQS.checkLimits(k)) throw wasm.free(k), new libVES.Error('Internal', 'OQS key is too large for VES');
+	    if (!wasm.generate(k)) throw wasm.free(k), new libVES.Error('Internal', 'OQS generate failed');
+	    var pub = new wasm.Key(k.algo);
 	    for (var i in k) if (i != 'priv') pub[i] = k[i];
 	    return {privateKey: k, publicKey: pub};
 	});
     },
+    getKeyOptions: function(key) {
+	return {oqsAlgo: k.algo};
+    },
+    getMethods: function() {
+	return this.wasm().then(function(wasm) {
+	    return wasm.getalgos().filter(function(algo) {
+		var k = wasm.init(algo, true);
+		if (!k) return false;
+		var f = libVES.Algo.OQS.checkLimits(k);
+		wasm.free(k);
+		return f;
+	    }).map(function(algo) {
+		return {oqsAlgo: algo};
+	    });
+	});
+    },
     Util: {
 	import: function(args,chain,optns) {
 	    var algo = libVES.Util.ByteArrayToString(args);
 	    return chain('container').then(function(der) {
-		var asn = libVES.Util.ASN1.decode(der)[0];
-		var pkey = null;
-		var pub = null;
-		if (typeof(asn[0]) == 'number') {
-		    var asn2 = libVES.Util.ASN1.decode(asn[2])[0];
-		    pkey = asn2[1];
-		    pub = libVES.Util.ASN1.decode(asn2[2])[0];
-		} else pkey = asn[1];
-		return libVES.Algo.OQS.wasm().then(function(wasm) {
-		    var k = wasm.init(algo, !!pub);
-		    if (!k) throw new libVES.Error('InvalidValue', 'OQS key init failed (bad algo?)');
-		    var s = function(dst, src, dif) {
-			if (!dst || !src || dst.byteLength != src.byteLength - dif) throw new libVES.Error('InvalidValue', 'Incorrect OQS key size');
-			dst.set(src.slice(dif), 0);
-		    };
-		    if (pub) {
-			s(k.priv, pkey, 0);
-			s(k.pub, pub, 1);
-		    } else s(k.pub, pkey, 1);
-		    return k;
+		return libVES.Util.Key.fromDER(der, function(pub, priv, pubBits) {
+		    return libVES.Algo.OQS.wasm().then(function(wasm) {
+			var k = wasm.init(algo, !!priv);
+			if (!k) throw new libVES.Error('InvalidValue', 'OQS key init failed (bad algo?)');
+			var s = function(dst, src) {
+			    if (!dst || !src || dst.byteLength != src.byteLength) throw wasm.free(k), new libVES.Error('InvalidValue', 'Incorrect OQS key size');
+			    dst.set(src, 0);
+			};
+			if (priv) s(k.priv, priv);
+			s(k.pub, pub);
+			return k;
+		    });
 		});
 	    });
 	}
@@ -3794,59 +4189,76 @@ libVES.Algo.OQS = {
     OID: '1.3.6.1.4.1.53675.3.5',
     defaultAlgo: 'Kyber768'
 };
+libVES.Algo.all.push('OQS');
 
 var WasmOQSinit = {
-    init: function(algo, priv) {
-        var a = new Uint8Array(libVES.Util.StringToByteArray(algo));
-        var arg1 = new Uint8Array(this.asm.memory.buffer, 16, 48);
-        arg1.set(a);
-        arg1.set([0], a.byteLength);
-        var ptr = this._WasmOQS_new(arg1.byteOffset, priv);
-        if (!ptr) return null;
-        var key = { ptr: ptr };
-        var priv = this._WasmOQS_priv(ptr);
-        if (priv) key.priv = new Uint8Array(this.asm.memory.buffer, priv, this._WasmOQS_privlen(ptr));
-        key.pub = new Uint8Array(this.asm.memory.buffer, this._WasmOQS_pub(ptr), this._WasmOQS_publen(ptr));
-        key.secretlen = this._WasmOQS_decaps(key.ptr, null, null);
-        key.ctextlen = this._WasmOQS_encaps(key.ptr, null, null);
-        key.algo = algo;
-        return key;
+    Key: function(algo) {
+	this.algo = algo;
+    },
+    init: function(algo, fpriv) {
+	var a = new Uint8Array(libVES.Util.StringToByteArray(algo));
+	var arg1 = new Uint8Array(this.asm.memory.buffer, 16, 48);
+	arg1.set(a);
+	arg1.set([0], a.byteLength);
+	var ptr = this._WasmOQS_new(arg1.byteOffset, fpriv);
+	if (!ptr) return null;
+	var key = new this.Key(algo);
+	key.ptr = ptr;
+	var priv = this._WasmOQS_priv(ptr);
+	if (priv) key.priv = new Uint8Array(this.asm.memory.buffer, priv, this._WasmOQS_privlen(ptr));
+	key.pub = new Uint8Array(this.asm.memory.buffer, this._WasmOQS_pub(ptr), this._WasmOQS_publen(ptr));
+	key.secretlen = this._WasmOQS_decaps(key.ptr, null, null);
+	key.ctextlen = this._WasmOQS_encaps(key.ptr, null, null);
+	return key;
     },
     generate: function(key) {
-        return this._WasmOQS_generate(key.ptr) >= 0;
+	return this._WasmOQS_generate(key.ptr) >= 0;
     },
     encaps: function(key) {
-        var arg1 = new Uint8Array(this.asm.memory.buffer, this._WasmOQS_secretbuf, this._WasmOQS_decaps(key.ptr, null, null));
-        var arg2 = new Uint8Array(this.asm.memory.buffer, this._WasmOQS_ctextbuf, this._WasmOQS_encaps(key.ptr, null, null));
-        if (this._WasmOQS_encaps(key.ptr, arg2.byteOffset, arg1.byteOffset) <= 0) return null;
-        key.secret = new Uint8Array(arg1.byteLength);
-        key.secret.set(arg1);
-        var ctext = new Uint8Array(arg2.byteLength);
-        ctext.set(arg2);
-        return ctext;
+	var arg1 = new Uint8Array(this.asm.memory.buffer, this._WasmOQS_secretbuf, this._WasmOQS_decaps(key.ptr, null, null));
+	var arg2 = new Uint8Array(this.asm.memory.buffer, this._WasmOQS_ctextbuf, this._WasmOQS_encaps(key.ptr, null, null));
+	if (this._WasmOQS_encaps(key.ptr, arg2.byteOffset, arg1.byteOffset) <= 0) return null;
+	key.secret = new Uint8Array(arg1.byteLength);
+	key.secret.set(arg1);
+	var ctext = new Uint8Array(arg2.byteLength);
+	ctext.set(arg2);
+	return ctext;
     },
     decaps: function(key, ctext) {
-        if (!ctext) return key.secret;
-        if (ctext.byteLength != this._WasmOQS_encaps(key.ptr, null, null)) return null;
-        var arg1 = new Uint8Array(this.asm.memory.buffer, this._WasmOQS_secretbuf, this._WasmOQS_decaps(key.ptr, null, null));
-        var arg2 = new Uint8Array(this.asm.memory.buffer, this._WasmOQS_ctextbuf, ctext.byteLength);
-        arg2.set(ctext);
-        if (this._WasmOQS_decaps(key.ptr, arg1.byteOffset, arg2.byteOffset) <= 0) return null;
-        key.secret = new Uint8Array(arg1.byteLength);
-        key.secret.set(arg1);
-        return key.secret;
+	var arg1 = new Uint8Array(this.asm.memory.buffer, this._WasmOQS_secretbuf, this._WasmOQS_decaps(key.ptr, null, null));
+	if (ctext) {
+	    if (ctext.byteLength != this._WasmOQS_encaps(key.ptr, null, null)) return null;
+	    var arg2 = new Uint8Array(this.asm.memory.buffer, this._WasmOQS_ctextbuf, ctext.byteLength);
+	    arg2.set(ctext);
+	    if (this._WasmOQS_decaps(key.ptr, arg1.byteOffset, arg2.byteOffset) <= 0) return null;
+	}
+	var secret = new Uint8Array(arg1.byteLength);
+	secret.set(arg1);
+	return secret;
     },
     free: function(key) {
-        this._WasmOQS_free(key.ptr);
+	this._WasmOQS_free(key.ptr);
+	delete(key.ptr);
+    },
+    getalgos: function() {
+	var algos = [];
+	var a;
+	for (var i = 0; a = this._WasmOQS_enumalgo(i); i++) {
+	    var s = new Uint8Array(this.asm.memory.buffer, a);
+	    var p = s.indexOf(0);
+	    if (!p) continue;
+	    algos.push(libVES.Util.ByteArrayToString(s.slice(0, p)));
+	}
+	return algos;
     },
     test: function(algo) {
-        var k = this.init(algo, 1);
-        this.generate(k);
-        console.log(k);
-        var ctext = this.encaps(k);
-        console.log(k.secret, ctext);
-        var secret = this.decaps(k);
-        console.log(secret);
+	var k = this.init(algo, 1);
+	this.generate(k);
+	var ctext = this.encaps(k);
+	var secret = this.decaps(k);
+	console.log(secret);
+	var secret2 = this.decaps(k, ctext);
+	console.log(secret2);
     },
     locateFile: function(file) {
 	return this.baseUrl + file;
@@ -3854,4 +4266,133 @@ var WasmOQSinit = {
     baseUrl: 'https://ves.host/pub/'
 };
 
+
+
+libVES.Watch = function(obj, optns) {
+    if (obj instanceof libVES) obj = obj.domain ? (obj.externalId ? obj.getVaultKey() : new libVES.Domain(null, obj)) : obj.me();
+    var self = this;
+    this.object = Promise.resolve(obj).then(function(o) {
+	if (o instanceof libVES.VaultKey) {
+	    self.uri = 'vaultKeys/';
+	} else if (o instanceof libVES.VaultItem) {
+	    self.uri = 'vaultItems/';
+	} else if (o instanceof libVES.User) {
+	    self.uri = 'users/';
+	} else if (o instanceof libVES.Domain) {
+	    self.uri = 'domains/';
+	} else {
+	    throw new libVES.Error('Internal', 'Watchable object expected');
+	}
+	self.VES = o.VES;
+	return o;
+    });
+    if (optns) for (var k in optns) this[k] = optns[k];
+};
+
+libVES.Watch.prototype = {
+    fields: {vaultKey: {id: true, user: true, externals: true, creator: true}, vaultItem: {id: true, vaultKey: true, file: {externals: true, creator: true}}, session: {id: true, userAgent: true, remote: true, createdAt: true, expiresAt: true}},
+    state: 'idle',
+    timeout: 900,
+    getEvents: function(start, ct, poll) {
+	var self = this;
+	return self.object.then(function(o) {
+	    return o.getId().then(function(id) {
+		return (poll ? self.VES.pollUrl : '') + self.uri + id
+		    + '?fields=events(' + self.VES.uriListFields(self.fields) + ')%5B' + start + (ct >= 0 ? '%2B' : '') + ct + '%5D'
+		    + (poll ? '&poll=' + self.timeout : '');
+	    });
+	}).then(function(url) {
+	    return self.VES.get(url);
+	}).then(function(res) {
+	    if (!res.events) return null;
+	    return res.events.map(function(e, i) {
+		return new libVES.Event(e, self.VES);
+	    });
+	});
+    },
+    setState: function(st) {
+	if (this.statefn) try {
+	    this.statefn(st, this);
+	} catch(e) {}
+	this.state = st;
+    },
+    setBusy: function(busy) {
+	this.busy = busy;
+	if (!busy && this.state == 'stop') this.setState('idle');
+    },
+    start: function(pos) {
+	if (!this.eventfn) throw new libVES.Error('InvalidValue', 'eventfn is not set');
+	if (this.busy) throw new libVES.Error('Internal', 'Watch instance is busy');
+	var self = this;
+	self.setBusy(true);
+	this.setState('read');
+	if (pos < 0) {
+	    this.next = 0;
+	    return this.getEvents(0, pos).then(function(evs) {
+		self.setBusy(false);
+		return self.received(evs.reverse());
+	    });
+	} else {
+	    this.next = pos;
+	    return this.getEvents(pos, 0).then(function(evs) {
+		self.setBusy(false);
+		return self.received(evs);
+	    });
+	}
+    },
+    active: function() {
+	return this.state == 'read' || this.state == 'poll';
+    },
+    received: function(evs) {
+	var self = this;
+	var p;
+	if (evs && evs.length) p = evs.reduce(function(v, e) {
+	    if (self.active()) try {
+		self.eventfn(e, self);
+	    } catch(e) {
+		console.log(e);
+	    }
+	    return e;
+	}, null).getId().then(function(id) {
+	    self.next = id + 1;
+	});
+	else {
+	    p = Promise.resolve(null);
+	    if (this.state == 'read') this.setState('poll');
+	}
+	return p.then(function() {
+	    return self.request();
+	});
+    },
+    request: function() {
+	if (this.busy || !this.active()) return;
+	var self = this;
+	self.setBusy(true);
+	return self.getEvents(self.next, 0, (self.state == 'poll')).then(function(evs) {
+	    self.setBusy(false);
+	    self.received(evs);
+	}).catch(function(e) {
+	    self.setBusy(false);
+	    if (self.errorfn) try {
+		self.errorfn(e, self);
+	    } catch(e) {
+		console.log(e);
+	    }
+	    return self.retry();
+	});
+    },
+    retry: function() {
+	var self = this;
+	return new Promise(function(resolve, reject) {
+	    window.setTimeout(function() {
+		resolve(self.request());
+	    }, 1000);
+	});
+    },
+    stop: function() {
+	this.setState(this.busy ? 'stop' : 'idle');
+    }
+};
+libVES.version = '2.16';
+
 module.exports = libVES;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "libves",
-  "version": "2.6.0",
+  "version": "2.16.0",
   "description": "Simple, safe and secure end-to-end encryption at-rest",
   "main": "libVES.node.js",
   "scripts": {