libves 2.6.0 → 3.0.0

package/libVES.node.js

@@ -27,7 +27,7 @@
  *
  * @title libVES
  * @dev A JavaScript end-to-end encryption interface to VESvault REST API
- * @version 2.06
+ * @version 3.00
  *
  * @dev Official source code: https://github.com/vesvault/libVES
  *
@@ -51,20 +51,25 @@ if (typeof(libVES) != 'function') function libVES(optns) {
     else if (this.user) this.type = 'primary';
     else throw new libVES.Error('InvalidValue','Required parameters: user || domain');
     this.unlockedKeys = {};
+    this.pendingKeys = {};
 }
 
 libVES.prototype = {
+    constructor: libVES,
     apiUrl: 'https://api.ves.host/v1/',
+    pollUrl: 'https://poll.ves.host/v1/',
     wwwUrl: 'https://www.vesvault.com/',
     keyAlgo: 'ECDH',
+    keyOptions: {namedCurve: 'P-521'},
     textCipher: 'AES256GCMp',
     defaultHash: 'SHA256',
-    
+    propagators: [],
     request: function(method,uri,body,optns) {
+	var self = this;
 	if (!optns) optns = {};
 	return new Promise(function(resolve,reject) {
 	    var xhr = new XMLHttpRequest();
-	    xhr.open(method,this.apiUrl + uri);
+	    xhr.open(method, (uri.match(/^https\:/) ? uri : this.apiUrl + uri));
 	    if (optns.abortFn) optns.abortFn(function() {
 		return xhr.abort();
 	    });
@@ -77,8 +82,13 @@ libVES.prototype = {
 				    return new libVES.Error(e.type,e.message,e);
 				});
 				if (errs.length) {
+				    var retry = function(o) { return self.request(method, uri, body, (o || optns)); };
 				    if (optns && optns.onerror) try {
-					resolve(optns.onerror(errs));
+					resolve(optns.onerror(errs, optns, retry));
+				    } catch (e) {
+					reject(e);
+				    } else if (self.onerror) try {
+					resolve(self.onerror(errs, optns, retry));
 				    } catch (e) {
 					reject(e);
 				    }
@@ -92,7 +102,7 @@ libVES.prototype = {
 	    if (body != null) xhr.setRequestHeader('Content-Type','application/json');
 	    xhr.setRequestHeader('Accept','application/json');
 	    if (this.user && optns.password) xhr.setRequestHeader('Authorization','Basic ' + btoa(this.user + ':' + optns.password));
-	    else if (optns.token || this.token) xhr.setRequestHeader('Authorization','Bearer ' + (optns.token ? optns.token : this.token));
+	    else if (optns.token ?? this.token) xhr.setRequestHeader('Authorization','Bearer ' + (optns.token ? optns.token : this.token));
 	    xhr.responseType = 'json';
 	    xhr.send(body);
 	}.bind(this));
@@ -117,6 +127,10 @@ libVES.prototype = {
 	}
 	return '';
     },
+    mergeFieldList: function(flds, flds2) {
+	for (var k in flds2) if (flds[k] instanceof Object) flds[k] = this.mergeFieldList(flds[k], flds2[k]); else flds[k] = flds2[k];
+	return flds;
+    },
     elevateAuth: function(optns) {
 	var self = this;
 	if (optns && (optns.password || optns.token)) return Promise.resolve(optns);
@@ -183,7 +197,7 @@ libVES.prototype = {
 		return flow.setValue(undefined).then(function() {
 		    return flow.addToken(url).then(function(url) {
 			document.location.replace(url);
-			throw {code: 'Redirect', message: 'Starting VES Authorization...'};
+			throw new libVES.Error('Redirect', 'Starting VES Authorization...');
 		    });
 		});
 	    });
@@ -233,7 +247,7 @@ libVES.prototype = {
     unlock: function(veskey) {
 	var self = this;
 	return this.getVaultKey().then(function(vkey) {
-	    return vkey.unlock(Promise.resolve(veskey)).then(function(cryptoKey) {
+	    return vkey.unlock(veskey).then(function(cryptoKey) {
 		if (self.VESkey === null) self.VESkey = veskey;
 		if (!self.token && self.type == 'secondary') return vkey.getSessionToken().then(function(tkn) {
 		    self.token = tkn;
@@ -248,8 +262,13 @@ libVES.prototype = {
 	});
     },
     lock: function() {
-	this.unlockedKeys = {};
-	return Promise.resolve(true);
+	var lock = [];
+	for (var kid in this.unlockedKeys) lock.push(this.unlockedKeys[kid].then(function(k) {
+	    return k.lock();
+	}).catch(function() {}));
+	return Promise.all(lock).then(function() {
+	    return true;
+	});
     },
     reset: function(val) {
 	this.userMe = undefined;
@@ -290,18 +309,22 @@ libVES.prototype = {
 	    });
 	});
     },
-    getItems: function() {
+    getItems: function(flds) {
 	var self = this;
 	return this.getVaultKey().then(function(k) {
 	    return k.getId().then(function(kid) {
-		return k.getVaultEntries().then(function(ves) {
+		return k.getVaultEntries(self.mergeFieldList({type: true, deleted: true, file: {creator: true, externals: true}, vaultKey: {type: true, user: true}}, flds)).then(function(ves) {
 		    var vis = {};
 		    var vlst = [];
 		    for (var i = 0; i < ves.length; i++) {
 			var viid = ves[i].vaultItem.id;
 			if (!vis[viid]) {
-			    var vi = vis[viid] = self.getItem(ves[i].vaultItem);
+			    var vi = ves[i].vaultItem;
+			    if (!vi.file) vi.file = undefined;
+			    if (!vi.vaultKey) vi.vaultKey = undefined;
+			    vi = vis[viid] = self.getItem(vi);
 			    vlst.push(vi);
+			    if (!ves[i].vaultKey) ves[i].vaultKey = {id: kid};
 			    vi.vaultEntryByKey[kid] = ves[i];
 			}
 		    }
@@ -340,7 +363,7 @@ libVES.prototype = {
     _matchUser: function(u) {
 	if (typeof(u) == 'object') {
 	    if (u instanceof libVES.User) return u;
-	    else return new libVES.User(u,this);
+	    else return new libVES.User((u.id ? {id: u.id} : {email: u.email}), this);
 	} else if (typeof(u) == 'string' && u.match(/^\S+\@\S+$/)) return new libVES.User({email: u},this);
 	throw new libVES.Error('BadUser',"Cannot match user: " + u,{value: u});
     },
@@ -356,7 +379,7 @@ libVES.prototype = {
 		    },
 		    vaultRefToUser: function(ext) {
 			var email = ext.externalId ? ext.externalId.replace(/\!.*/, '') : '';
-			if (!email.match(/\@/)) throw {code: 'NotFound', message: 'externalId is not an email for non-existing vault'};
+			if (!email.match(/\@/)) throw new libVES.Error('NotFound', 'externalId is not an email for non-existing vault');
 			return new libVES.User({email: email}, self);
 		    }
 		};
@@ -371,11 +394,14 @@ libVES.prototype = {
 	}).catch(function(e) {
 	    throw new libVES.Error('NotFound', 'Cannot match externalId for domain:' + ext.domain + ', user:' + user + '. Define libVES.Domain.' + ext.domain + '.userToVaultRef(user) to return a valid reference.',{error: e});
 	})).then(function(exts) {
-	    var vkey = new libVES.VaultKey({externals: exts, creator: self.me()},self);
+            var keyref = {externals: exts};
+            if (self.externalId && self.externalId[0] != '!') keyref.creator = self.me();
+	    var vkey = new libVES.VaultKey(keyref, self);
 	    return vkey.getId().then(function() {
 		return vkey;
 	    }).catch(function(e) {
 		if (e.code != 'NotFound') throw e;
+                if (!keyref.creator) throw new libVES.Error.InvalidKey('Anonymous vaults are not authorized to create temp keys');
 		return Promise.resolve(user || m().then(function(dom) {
 		    return dom.vaultRefToUser(exts[0]);
 		})).catch(function(e) {
@@ -426,14 +452,15 @@ libVES.prototype = {
 	var key = new libVES.VaultKey({type: 'temp', algo: this.keyAlgo, user: usr}, self);
 	var veskey = this.generateVESkey(usr);
 	return key.generate(veskey, optns).then(function(k) {
-	    if (self.e2e && self.e2e.length) usr.e2e = self.getVESkeyE2E(veskey, usr);
 	    key.setField('vaultItems', veskey.then(function(v) {
 		var vi = new libVES.VaultItem({type: 'password'}, self);
-		return usr.getActiveVaultKeys().then(function() {
-		    return [self.me(), self.getVaultKey(), usr];
+		return usr.getActiveVaultKeys().then(function(akeys) {
+		    return [self.me(), self.getVaultKey()].concat(akeys);
 		}).catch(function(e) {
 		    if (e.code != 'NotFound') throw e;
-		    return self.type == 'secondary' ? [self.me(), self.getVaultKey()] : [self.me()];
+		    var sh = self.type == 'secondary' ? [self.me(), self.getVaultKey()] : [self.me()];
+		    if (self.propagators) for (var i = 0; i < self.propagators.length; i++) sh.push(self.propagators[i]);
+		    return sh;
 		}).then(function(sh) {
 		    return Promise.all(sh);
 		}).then(function(sh) {
@@ -451,18 +478,6 @@ libVES.prototype = {
 	crypto.getRandomValues(buf);
 	return Promise.resolve(libVES.Util.ByteArrayToB64(buf));
     },
-    getVESkeyE2E: function(veskey,usr) {
-	var self = this;
-	return veskey.then(function(v) {
-	    return libVES.getModule(libVES.E2E,['Dialog','TempKey']).then(function(cls) {
-		return new cls({
-		    user: usr,
-		    e2e: self.e2e,
-		    tempKey: v
-		});
-	    });
-	});
-    },
     setVESkey: function(veskey,lost,options) {
 	var self = this;
 	return this.me().then(function(me) {
@@ -578,6 +593,9 @@ libVES.prototype = {
 		}).catch(function(e) {
 		    if (!e || e.code != 'Unauthorized') throw e;
 		}).then(function() {
+                    self.vaultKey = k.lock().then(function() {
+                        return k;
+                    });
 		    return self.unlock(veskey);
 		});
 	    });
@@ -658,7 +676,7 @@ libVES.prototype = {
 	        return Promise.resolve(shareWith || self.getFileItem(fileRef).then(function(vi) {
 		    return vi.getShareList();
 		}).catch(function(e) {
-		    return self.usersToKeys([{domain: (fileRef.domain || VES.domain)}]);
+		    return self.usersToKeys([{domain: VES.domain, externalId: VES.externalId}]);
 		})).then(function(shareWith) {
 		    return vaultItem.shareWith(shareWith,value);
 		});
@@ -681,8 +699,8 @@ libVES.prototype = {
 	});
     },
     deleteFile: function(fileRef) {
-	return this.getFile(fileRef).then(function(file) {
-	    return file.delete();
+	return this.getFileItem(fileRef).then(function(item) {
+	    return item.delete();
 	});
     },
     newSecret: function(cls) {
@@ -812,7 +830,7 @@ libVES.prototype = {
 	return self.getVaultKey().then(function(vk) {
 	    return vk.getField('unlockableVaultKeys').then(function(vks) {
 		var rs = {};
-		return Promise.all(vks.map(function(e, i) {
+		return Promise.all((vks || []).map(function(e, i) {
 		    return e.getId().then(function(id) {
 			rs[id] = e;
 		    });
@@ -857,9 +875,11 @@ libVES.prototype = {
 					return vkey.rekey(optns);
 				    });
 				    else return vkey.getVaultItems().then(function(vis) {
-					return Promise.all(vis.map(function(vi, i) {
-					    return vi.reshareWith([user]);
-					}));
+					return self.elevateAuth().then(function(optns) {
+					    return Promise.all(vis.map(function(vi, i) {
+						return vi.reshareWith([user], undefined, optns);
+					    }));
+					});
 				    });
 				});
 			    });
@@ -871,11 +891,27 @@ libVES.prototype = {
 		}
 	    });
 	}));
+    },
+    setKeyAlgo: function(optns) {
+	if (typeof(optns) == 'string') {
+	    this.keyOptions = null;
+	    return this.keyAlgo = optns;
+	}
+	var algo = libVES.Algo.fromKeyOptions(optns);
+	if (algo) {
+	    this.keyOptions = optns;
+	    return this.keyAlgo = algo;
+	}
     }
 };
 
-libVES.Error = function(code,msg,optns) {
+libVES.Error = function(code, msg, optns) {
+    if (libVES.Error[code] && (libVES.Error[code].prototype instanceof libVES.Error)) return new (libVES.Error[code])(msg, optns);
     this.code = code;
+    this.init(msg, optns);
+};
+
+libVES.Error.prototype.init = function(msg, optns) {
     this.message = msg;
     if (optns) for (var k in optns) this[k] = optns[k];
 };
@@ -884,6 +920,37 @@ libVES.Error.prototype.toString = function() {
     return this.message || this.code;
 };
 
+libVES.Error.NotFound = function(msg, optns) {
+    this.init(msg, optns);
+};
+libVES.Error.NotFound.prototype = new libVES.Error('NotFound');
+
+libVES.Error.InvalidValue = function(msg, optns) {
+    this.init(msg, optns);
+};
+libVES.Error.InvalidValue.prototype = new libVES.Error('InvalidValue');
+
+libVES.Error.InvalidKey = function(msg, optns) {
+    this.init(msg, optns);
+};
+libVES.Error.InvalidKey.prototype = new libVES.Error('InvalidKey');
+
+libVES.Error.Redirect = function(msg, optns) {
+    this.init(msg, optns);
+};
+libVES.Error.Redirect.prototype = new libVES.Error('Redirect');
+
+libVES.Error.Unauthorized = function(msg, optns) {
+    this.init(msg, optns);
+};
+libVES.Error.Unauthorized.prototype = new libVES.Error('Unauthorized');
+
+libVES.Error.Internal = function(msg, optns) {
+    this.init(msg, optns);
+};
+libVES.Error.Internal.prototype = new libVES.Error('Internal');
+
+
 libVES.getModule = function(sectn,mods) {
     var mod;
     if (mods instanceof Array) mod = mods[0];
@@ -904,6 +971,9 @@ libVES.getModuleFunc = function(sectn,mod,then) {
 libVES.loadModule = function(sectn,mod) {
     return Promise.reject(new libVES.Error('Internal',"Cannot load " + sectn + '.' + mod));
 };
+libVES.maxKeyLen = 48896;
+libVES.maxEncDataLen = 32768;
+
 
 if (!libVES.Domain) libVES.Domain = {};
 
@@ -982,6 +1052,24 @@ libVES.Util = {
 	}
 	return rs;
     },
+    fillUndefs: function(data, defs) {
+        if (data instanceof Array) data.map((d) => libVES.Util.fillUndefs(d, defs));
+        else if (data && defs) for (var k in defs) if (defs[k]) {
+            if (data[k] === undefined) data[k] = undefined;
+            else if (data[k] instanceof Object) libVES.Util.fillUndefs(data[k], defs[k]);
+        }
+        return data;
+    },
+    loadWasm: function(src) {
+	return new Promise(function(resolve, reject) {
+	    var sc = document.createElement('script');
+	    sc.async = false;
+	    sc.src = src;
+	    sc.onload = resolve;
+	    sc.onerror = reject;
+	    document.getElementsByTagName('head')[0].appendChild(sc);
+	});
+    },
     PEM: {
 	toDER: function(pem) {
 	    var pp = pem.match(/-----BEGIN.*?-----\s*\r?\n([A-Za-z0-9\/\+\=\s\r\n]*)-----END/);
@@ -1136,6 +1224,43 @@ libVES.Util = {
 	    this.value = rs.join('.');
 	} else this.value = s;
     },
+    Key: {
+	fromDER: function(der, callbk) {
+	    var asn = libVES.Util.ASN1.decode(der)[0];
+	    if (typeof(asn[0]) == 'number') {
+		var asn2 = libVES.Util.ASN1.decode(asn[2])[0];
+		var pub = libVES.Util.ASN1.decode(asn2[2]);
+		console.log('pub', pub);
+		if (pub) return callbk(pub[0].slice(1), asn2[1], pub[0][0]);
+		else callbk(null, asn2[1]);
+	    } else return callbk(asn[1].slice(1), null, asn[1][0]);
+	},
+	pubASN1: function(pub, optns) {
+	    var p = new Uint8Array(pub.byteLength + 1);
+	    p[0] = optns && optns.pubBits ? optns.pubBits : 0;
+	    p.set(new Uint8Array(pub), 1);
+	    p.ASN1type = 3;
+	    return p;
+	},
+	toPKCS: function(pub, priv, asn1hdr, optns) {
+	    if (priv) {
+		var seq = [1, priv];
+		if (pub) {
+		    p = libVES.Util.ASN1.encode([libVES.Util.Key.pubASN1(pub, optns)]);
+		    p.ASN1type = 0xa1;
+		    seq.push(p);
+		}
+		var buf = libVES.Util.ASN1.encode([seq]);
+		return libVES.Util.ASN1.encode([[0, asn1hdr, buf]]);
+	    }
+	    return libVES.Util.ASN1.encode([[asn1hdr, libVES.Util.Key.pubASN1(pub, optns)]]);
+	},
+	export: function(pub, priv, asn1hdr, optns) {
+	    var pkcs = libVES.Util.Key.toPKCS(pub, priv, asn1hdr, optns);
+	    if (priv) return libVES.Util.PKCS8.encode8(pkcs, optns);
+	    return libVES.Util.PEM.encode(pkcs, 'PUBLIC KEY');
+	}
+    },
     PKCS1: {
 	import: function(args,chain,optns) {
 	    return chain('container',optns).then(function(der) {
@@ -1318,13 +1443,18 @@ libVES.Util = {
     EC: {
 	import: function(args,chain,optns) {
 	    return chain('container',optns).then(function(der) {
-		var a = {name:'ECDH',namedCurve:libVES.Util.EC.namedCurves[String(args)]};
-		return crypto.subtle.importKey('spki',der,a,true,[]).catch(function() {;
-		    return crypto.subtle.importKey('pkcs8',der,a,true,['deriveKey','deriveBits']).catch(function(e) {
-		        console.log('PKCS8 failed, trying JWK...');
-			var jwk = libVES.Util.PKCS8.toJWK(der);
-			return crypto.subtle.importKey('jwk', jwk, a, true, jwk.key_ops);
-		    });
+		var oid = String(args);
+		var curve = libVES.Util.EC.namedCurves[oid] || oid;
+		var a = {name:'ECDH',namedCurve: curve};
+		return crypto.subtle.importKey('spki',der,a,true,[]).catch(function() {
+		    return crypto.subtle.importKey('pkcs8',der,a,true,['deriveKey','deriveBits']);
+		}).catch(function(e) {
+		    console.log('PKCS8 failed, trying JWK...');
+		    var jwk = libVES.Util.PKCS8.toJWK(der);
+		    return crypto.subtle.importKey('jwk', jwk, a, true, jwk.key_ops);
+		}).catch(function(e) {
+		    console.log('trying WasmECDH...');
+		    return libVES.Algo.ECDH.importWasm(curve, der);
 		});
 	    });
 	},
@@ -1618,30 +1748,20 @@ libVES.Object.prototype = {
 	this.setFields(data,data.id == null);
 	if (refs) for (var k in refs) this[k] = Promise.resolve(refs[k]);
     },
-    setFields: function(data,up) {
-	var self = this;
-	var chg = false;
-	for (var k in data) {
-	    if (up === undefined || up) this.fieldUpdate[k] = true;
-	    if (this[k] instanceof Promise) {
-		this[k] = undefined;
-		chg = true;
-	    }
-	    if (this[k] === undefined) this[k] = Promise.resolve(data[k]).then((function(k) {
-		return function(v) {
-		    var clsf;
-		    if (self.fieldClass[k]) return (clsf = function(v) {
-			if (v instanceof libVES.Object) return v;
-			else if (v instanceof Array) return v.map(function(vv) { return clsf(vv); });
-			else return new (self.fieldClass[k])(v,self.VES);
-		    })(v);
-		    return v;
-		};
-	    })(k));
-	    else return Promise.reject(new libVES.Error('Internal',"Unknown field: " + k));
-	}
-	if (chg && self.trigger) self.trigger.resolve(self);
-	return Promise.resolve(self);
+    setFields: function(flds, up) {
+        var res = Promise.resolve(null);
+        for (var fld in flds) ((fld) => {
+            if (up === undefined || up) this.fieldUpdate[fld] = true;
+            var cls = this.fieldClass[fld];
+            var cur = this[fld];
+            res = this[fld] = res.then(() => Promise.resolve(flds[fld]).then((val) => Promise.resolve(cur).catch((er) => undefined).then((cur) => {
+                if (!cls || !val) return val;
+                else if (val instanceof Array) return val.map((v) => ((v instanceof libVES.Object) ? v : new cls(v, this.VES)));
+                else if (cur instanceof cls) return cur.setFields(val, up);
+                else return (val instanceof libVES.Object) ? val : new cls(val, this.VES);
+            })));
+        })(fld);
+        return res.then(() => this);
     },
     setField: function(fld,val,upd) {
 	var flds = {};
@@ -1650,26 +1770,78 @@ libVES.Object.prototype = {
 	    return self[fld];
 	});
     },
+    unsetField: function(fld) {
+	delete(this[fld]);
+    },
+    _fieldsToLoad: function(fldlst, force, ld) {
+        var flds = {};
+        for (var k in fldlst) flds[k] ||= fldlst[k];
+        for (var i = 0; i < this.fieldSets.length; i++) {
+            for (var k in this.fieldSets[i]) if (fldlst[k]) {
+                for (var k in this.fieldSets[i]) if ((force || !this[k]) && !(flds[k] instanceof Object)) (flds ||= {})[k] = this.fieldSets[i][k];
+                break;
+            }
+        }
+        var res = Promise.resolve(null);
+        for (var fld in flds) ((fld) => {
+            var cur = this[fld];
+            var na = (cur === undefined);
+            var cls = this.fieldClass[fld];
+            res = res.then((res) => Promise.resolve(cur).catch((er) => null).then((cur) => {
+                var lst = null;
+                if (force || na) lst = flds[fld];
+                else if (cls) {
+                    if (cur instanceof Array) lst = ((cur[0] instanceof cls) ? cur[0]._fieldsToLoad(flds[fld], force, ld.then((vals) => vals[fld])) : Promise.resolve(null)).then((lst) => (lst && flds[fld]));
+                    else if (cur instanceof cls) lst = cur._fieldsToLoad(flds[fld], force, ld.then((vals) => vals[fld]));
+                }
+                return Promise.resolve(lst).then((lst) => {
+                    if (lst) (res ||= {})[fld] = lst;
+                    return res;
+                });
+            }));
+            if (na || (!cls && force)) (this[fld] = ld.then((vals) => (vals?.hasOwnProperty(fld) ? (cls && vals[fld] ? ((vals[fld] instanceof Array) ? vals[fld].map((e) => new cls(e, this.VES)) : new cls(vals[fld], this.VES)) : vals[fld]) : cur))).catch(() => null);
+        })(fld);
+        ld.then((vals) => {
+            for (var fld in vals) if (!flds[fld] && !this[fld]) this.setField(fld, vals[fld], false);
+        }).catch((er) => null);
+        return res.then((res) => {
+            if (res) for (var k in fldlst) if (res[k]) return res;
+            return null;
+        });
+    },
+    getFields: function(fldlst, force) {
+        var ldf;
+        var ld = new Promise((resolve, reject) => ldf = [resolve, reject]);
+        this._fieldsToLoad(fldlst, force, ld).then((flds) => this.loadFields(flds, force)).then((vals) => ldf[0](vals)).catch((er) => ldf[1](er));
+	var plst = [];
+	for (var k in fldlst) ((k) => {
+	    plst.push(ld.then(() => this[k]).then(function rslv(v) {
+		if (v instanceof Array) return Promise.all(v.map(function(e, i) {
+		    return rslv(e);
+		}));
+		if (!(v instanceof libVES.Object)) return v;
+		return v.getFields(fldlst[k]);
+	    }));
+	})(k);
+	var rs = {};
+	return Promise.all(plst).then((lst) => {
+	    var i = 0;
+	    for (var k in fldlst) rs[k] = lst[i++];
+	    return rs;
+	});
+    },
     getField: function(fld,fldlst,force) {
-	var self = this;
 	if (!this[fld] || force) {
 	    var flds = {};
-	    for (var i = 0; i < this.fieldSets.length; i++) if (this.fieldSets[i][fld]) {
-		for (var k in this.fieldSets[i]) flds[k] = this.fieldSets[i][k];
-		break;
-	    }
-	    if (fldlst) flds[fld] = fldlst;
-	    if (!flds[fld]) {
-		var cls = self.fieldClass[fld];
-		flds[fld] = cls ? cls.prototype.fieldList : true;
-	    }
-	    this.loadFields(flds,force);
+            flds[fld] = fldlst || true;
+	    this.getFields(flds, force).catch(() => null);
 	}
 	return this[fld];
     },
     loadFields: function(flds,force,optns) {
+        if (!flds) return Promise.resolve({});
 	var self = this;
-	var req = this.id ? this.id.then(function(id) {  return self.VES.get(self.apiUri + '/' + id,flds,optns); }) : self.postData().then(function(data) {
+	return (this.id && !flds.id ? this.id.then(function(id) {  return self.VES.get(self.apiUri + '/' + id,flds,optns); }) : self.postData().then(function(data) {
 	    data['$op'] = 'fetch';
 	    return self.VES.post(self.apiUri,data,flds,optns);
 	}).then(function(data) {
@@ -1678,21 +1850,10 @@ libVES.Object.prototype = {
 		self.fieldUpdate = {id: true};
 	    }
 	    return data;
-	});
-	for (var k in flds) if (force || this[k] === undefined) {
-	    this[k] = req.then((function(fld) {
-		var cls = self.fieldClass[fld];
-		return function(data) {
-		    if (cls && data[fld]) return ((data[fld] instanceof Array) ? data[fld].map(function(v) {
-			return new cls(v,self.VES);
-		    }) : new cls(data[fld],self.VES));
-		    return data[fld];
-		};
-	    })(k));
-	}
+	})).then((data) => libVES.Util.fillUndefs(data, flds));
     },
     reset: function() {
-	for (var k in this.fieldClass) delete(this[k]);
+	for (var k in this.fieldClass) this.unsetField(k);
 	return Promise.resolve();
     },
     getId: function() {
@@ -1766,6 +1927,23 @@ libVES.Object.prototype = {
     },
     resolveError: function(e,field) {
 	throw e;
+    },
+    setUpdate: function(flds) {
+	var rs = [];
+	for (var k in flds) {
+	    if (flds[k]) this.fieldUpdate[k] = true;
+	    else delete(this.fieldUpdate[k]);
+	    if (this[k] && (flds[k] instanceof Object)) (function(p, k) {
+		rs.push(p.then(function rslv(obj) {
+		    if (obj instanceof Array) return Promise.all(obj.map(rslv));
+		    if (obj instanceof libVES.Object) return obj.setUpdate(flds[k]);
+		}));
+	    })(this[k], k);
+	}
+	return Promise.all(rs);
+    },
+    toJSON: function() {
+        return String(this);
     }
 };
 
@@ -1791,6 +1969,22 @@ libVES.File = function(data,VES,refs) {
     this.init(data,VES,refs);
 };
 
+libVES.Event = function(data, VES, refs) {
+    this.init(data, VES, refs);
+};
+
+libVES.Session = function(data, VES, refs) {
+    this.init(data, VES, refs);
+};
+
+libVES.oldDomain = libVES.Domain;
+libVES.Domain = function(dom, VES) {
+    this.init({id: (dom ? dom : VES.domain)}, VES);
+};
+(function(old) {
+    if (old) for (var k in old) libVES.Domain[k] = old[k];
+})(libVES.oldDomain);
+
 libVES.User.prototype = new libVES.Object({
     apiUri: 'users',
     fieldList: {id: true, email: true, type: true, firstName: true, lastName: true},
@@ -1902,10 +2096,16 @@ libVES.VaultKey.prototype = new libVES.Object({
 	    case 'lost':
 		return self.getVaultItems().then(function(vis) {
 		    var f = function(vis) {
-			if (!vis.length) throw new libVES.Error('InvalidKey','Cannot unlock the secondary key');
+			if (!vis || !vis.length) throw new libVES.Error('InvalidKey','Cannot unlock the secondary key');
 			return vis[0].getType().then(function(t) {
 			    switch (t) {
-				case 'password': return vis[0].get();
+				case 'password': return self.getId().then(function(kid) {
+                                    if (!self.VES.pendingKeys) self.VES.pendingKeys = {};
+                                    if (kid) self.VES.pendingKeys[kid] = true;
+                                    return vis[0].get().finally(function() {
+                                        self.VES.pendingKeys[kid] = false;
+                                    });
+                                });
 				default: return f(vis.slice(1));
 			    }
 			});
@@ -1916,26 +2116,57 @@ libVES.VaultKey.prototype = new libVES.Object({
 	    }
 	});
     },
+    invalidVESkey: function() {
+	var self = this;
+	return self.getVaultItems().then(function(vis) {
+            return Promise.all(vis.map(function(vi) {
+                return vi.getVaultEntries().then(function(entries) {
+                    if (entries) for (let i = 0; i < entries.length; i++) if (self.VES.unlockedKeys[entries[i].vaultKey.id]) return Promise.resolve(self.VES.unlockedKeys[entries[i].vaultKey.id]).then(function(key) {
+                        return key.getFields({user: {email: true}, extrenals: {domain: true, externalId: true}}).then(function(flds) {
+                            return vi.unshareWith([flds.externals && flds.externals[0] ? flds.externals[0] : flds.user.email]);
+                        });
+                    });
+                });
+            }));
+        });
+    },
     unlock: function(veskey) {
 	var self = this;
-	if (self.wcPriv) return self.wcPriv;
-	return self.getId().then(function(id) {
-	    if (!self.VES.unlockedKeys[id]) return self.VES.unlockedKeys[id] = self.engine().then(function(m) {
-		return self.resolveVESkey(veskey).then(function(v) {
-		    return self.getPrivateKey().then(function(prk) {
-			return m.import(prk,{password: v});
-		    }).catch(function(e) {
-			if (e.code != 'Legacy' || !self.VES.unlockLegacyKey) throw e;
-			delete(self.VES.unlockedKeys[id]);
-			return self.VES.unlockLegacyKey(self,veskey);
+	if (!self.wcPriv) self.wcPriv = self.getId().then(function(id) {
+	    return Promise.resolve(self.VES.unlockedKeys[id]).then(function(k) {
+		return k.wcPriv;
+	    }).catch(function(e) {
+		let un = self.engine().then(function(m) {
+		    return self.resolveVESkey(veskey).then(function(v) {
+			return self.getPrivateKey().then(function(prk) {
+			    return m.import(prk, {password: v}).catch(function(e) {
+                                if (e && e.code == 'InvalidKey' && !veskey) {
+                                    console.log('Bad key propagated for ' + id + ', unsharing...');
+                                    return self.invalidVESkey().catch(function(e2) {
+                                        console.log(e2);
+                                    }).then(function(r) {
+                                        console.log(r);
+                                        throw e;
+                                    });
+                                }
+                                throw e;
+                            });
+			});
 		    });
 		});
-	    });
-	    else return self.VES.unlockedKeys[id].catch(function(e) {
-		self.VES.unlockedKeys[id] = null;
-		return self.unlock(veskey);
+                let vk = self.VES.unlockedKeys[id] = un.then(function() {
+		    return self;
+		}).catch(function(e) {
+		    if (self.VES.unlockedKeys[id] === vk) delete(self.VES.unlockedKeys[id]);
+		});
+		return un;
 	    });
 	});
+        else if (veskey) self.wcPriv = self.wcPriv.catch(function(e) {
+            delete(self.wcPriv);
+            return self.unlock(veskey);
+        });
+	return self.wcPriv;
     },
     lock: function() {
 	var self = this;
@@ -1962,12 +2193,14 @@ libVES.VaultKey.prototype = new libVES.Object({
 	});
     },
     generate: function(veskey,optns) {
+	if (!optns) optns = this.VES.keyOptions;
 	var self = this;
+	var a;
 	var wc = optns && optns.privateKey ? libVES.Algo.acquire(optns.privateKey).then(function(wc) {
 	    self.setField('algo',wc.engine.tag);
 	    if (!wc.privateKey) throw new libVES.Error('InvalidValue','Private key expected');
 	    return wc;
-	}) : (optns && optns.algo ? self.setField('algo',optns.algo) : Promise.resolve()).then(function() {
+	}) : (optns && (a = libVES.Algo.fromKeyOptions(optns)) ? self.setField('algo', a) : Promise.resolve()).then(function() {
 	    return self.engine().then(function(e) {
 		return e.generate(optns).then(function(ks) {
 		    ks.engine = e;
@@ -2111,8 +2344,28 @@ libVES.VaultKey.prototype = new libVES.Object({
 	    });
 	});
     },
-    matchVaults: function(vaultKeys) {
-	return Promise.resolve(false);
+    matchVaults: function(shares) {
+        return this.getFields({id: true, externals: {domain: true, externalId: true}, user: {email: true}}).then((flds) => (shares || []).reduce((res, sh) => res.then((res) => Promise.resolve(sh).then((sh) => {
+            if (res) return res;
+            var ext = flds.externals?.[0];
+            if (sh instanceof libVES.Object) {
+                if (sh instanceof libVES.VaultKey) return sh.getId().then((id) => (id == flds.id ? sh : res));
+                else if ((sh instanceof libVES.External) && ext) return sh.getFields({domain: true, externalId: true}).then((xflds) => (xflds.domain == ext.domain && xflds.externalId == ext.externalId ? sh : res));
+                else if ((sh instanceof libVES.User) && flds.user && !ext) return sh.getEmail().then((email) => (email == flds.user.email ? sh : res));
+            } else if (sh instanceof Object) {
+                if (sh.externalId && sh.externalId == ext?.externalId && (sh.domain || this.VES.domain) == ext.domain) return sh;
+                else if (sh.email && sh.email == flds.user?.email && !ext) return sh;
+            } else if (sh && flds.user?.email == sh && !ext) return sh;
+            return res;
+        })), Promise.resolve(false)));
+    },
+    getKeyOptions: function() {
+	var self = this;
+	return self.engine().then(function(e) {
+	    return self.getPublicCryptoKey().then(function(pub) {
+		return e.getKeyOptions(pub);
+	    });
+	});
     }
 });
 
@@ -2120,7 +2373,7 @@ libVES.VaultItem.prototype = new libVES.Object({
     apiUri: 'vaultItems',
     fieldList: {id: true, deleted: true, file: true},
     fieldClass: {vaultKey: libVES.VaultKey, file: libVES.File},
-    fieldSets: [{type: true, meta: true},{vaultEntries: {id: true, encData: true, vaultKey: {id: true, type: true, user: {id: true}, algo: true, externals: {id: true}}}},{vaultKey: true, file: true}],
+    fieldSets: [{type: true, meta: true},{vaultEntries: {id: true, encData: true, vaultKey: {id: true, type: true, user: {id: true, email: true}, algo: true, externals: {id: true, domain: true, externalId: true}}}},{vaultKey: true, file: true}],
     defaultCipher: 'AES256GCM',
     getRaw: function() {
 	var self = this;
@@ -2129,9 +2382,11 @@ libVES.VaultItem.prototype = new libVES.Object({
 	    var fn = function() {
 		if (vaultEntries) for (; i < vaultEntries.length; i++) {
 		    var k, d;
-		    if ((d = vaultEntries[i].encData) != null && vaultKeys[(k = vaultEntries[i].vaultKey).id]) {
+		    if ((d = vaultEntries[i].encData) != null && (k = vaultKeys[vaultEntries[i].vaultKey.id]) && (!self.VES.pendingKeys || !self.VES.pendingKeys[vaultEntries[i].vaultKey.id])) {
 			i++;
-			return new libVES.VaultKey(k, self.VES).decrypt(d).catch(fn);
+			return Promise.resolve(k).then(function(k) {
+			    return k.decrypt(d).catch(fn);
+			});
 		    }
 		}
 		return Promise.reject(new libVES.Error('InvalidKey',"No unlocked key to decrypt the item",{vaultItem: self}));
@@ -2190,7 +2445,10 @@ libVES.VaultItem.prototype = new libVES.Object({
     },
     build: function(data) {
 	var self = this;
-	return this.getType().then(function(type) {
+	return this.getType().catch(function(e) {
+            if (e && e.code == 'NotFound') return self.setField('type', libVES.VaultItem.Type._detect(data));
+            throw e;
+        }).then(function(type) {
 	    return libVES.getModule(libVES.VaultItem.Type,type).then(function(m) {
 		return m.build.call(self,data);
 	    });
@@ -2202,12 +2460,12 @@ libVES.VaultItem.prototype = new libVES.Object({
     shareWith: function(usrs,val,save) {
 	var self = this;
 	return self.VES.usersToKeys(usrs).then(function(ks) {
-	    return (val == null || self.id ? self.getVaultEntries().then(function(ves) {
+	    return (val == null ? self.getVaultEntries().then(function(ves) {
 		var k_ves = {};
 		var k_used = {};
 		for (var j = 0; j < ves.length; j++) k_ves[ves[j].vaultKey.id] = ves[j];
 		return Promise.all(ks.map(function(k,j) {
-		    return k.getId().then(function(k_id) {
+		    if (!k.fieldUpdate.privateKey) return k.getId().then(function(k_id) {
 			k_used[k_id] = true;
 			return k_ves[k_id];
 		    }).catch(function(){});
@@ -2219,21 +2477,26 @@ libVES.VaultItem.prototype = new libVES.Object({
 		var new_ves = [];
 		var set_ves = [];
 		var valr = null;
+		var key_ids = {};
 		return Promise.all(ks.map(function(k,j) {
 		    return new_ves[j] = (old_ves[j] || (valr != null ? valr : valr = self.resolveRaw(val)).then(function(v) {
-			return k.encrypt(v).then(function(ctext) {
-			    return (function(refs) {
-				if (refs) for (var i in refs) if (refs[i] === k) return Promise.resolve({'$ref':i});
-				return k.postData(null,refs);
-			    })(libVES.Object._refs).then(function(pd) {
+			return (function(refs) {
+			    if (refs) for (var i in refs) if (refs[i] === k) return Promise.resolve({'$ref':i});
+			    return k.postData(null,refs);
+			})(libVES.Object._refs).then(function(pd) {
+			    if (pd.id) {
+				if (key_ids[pd.id]) return;
+				key_ids[pd.id] = true;
+			    }
+			    return k.encrypt(v).then(function(ctext) {
 				return set_ves.push({vaultKey: pd, encData: ctext});
 			    });
 			});
 		    }));
 		})).then(function() {
 		    return Promise.all(old_ves.slice(ks.length).map(function(ve,j) {
-			return (new libVES.VaultKey(ve.vaultKey,self.VES)).matchVaults(ks).then(function(f) {
-			    if (f === false) set_ves.push({vaultKey: {id: ve.vaultKey.id}, '$op': 'delete'});
+			return (new libVES.VaultKey(ve.vaultKey,self.VES)).matchVaults(usrs).then(function(f) {
+			    if (!f) set_ves.push({vaultKey: {id: ve.vaultKey.id}, '$op': 'delete'});
 			});
 		    }));
 		}).then(function() {
@@ -2242,11 +2505,20 @@ libVES.VaultItem.prototype = new libVES.Object({
 		});
 	    });
 	}).then(function() {
-	    if (save || save === undefined) return self.post().then(function() {
+	    if (self.id && val != null) return self.setUpdate({id: false, type: true, file: {id: false, externals: {id: false, domain: true, externalId: true}}});
+	}).then(function() {
+	    if (save || save === undefined) return self.post(undefined, undefined, ((save instanceof Object) ? save : undefined)).then(function(flds) {
+                self.vaultEntryByKey = {};
+                self.setFields(flds, false);
 		return self;
+	    }).finally(function() {
+		delete(self.vaultEntries);
 	    });
 	    return self;
-	});
+	}).catch(function(er) {
+	    delete(self.vaultEntries);
+	    throw er;
+        });
     },
     reshareWith: function(share,val,save) {
 	var self = this;
@@ -2269,6 +2541,15 @@ libVES.VaultItem.prototype = new libVES.Object({
 	    });
 	});
     },
+    unshareWith: function(share, save) {
+        return this.getShareVaultKeys().then((vkeys) => Promise.all(vkeys.map((vkey) => vkey.matchVaults(share))).then((del) => this.shareWith(vkeys.filter((vkey, i) => !del[i]), undefined, save)));
+    },
+    set: function(val, save) {
+	var self = this;
+	return self.getShareList().then(function(sh) {
+	    return self.shareWith(sh, val, save);
+	});
+    },
     getShareVaultKeys: function() {
 	var self = this;
 	return this.getVaultEntries().then(function(vaultEntries) {
@@ -2281,12 +2562,17 @@ libVES.VaultItem.prototype = new libVES.Object({
 	var self = this;
 	return this.getShareVaultKeys().then(function(vaultKeys) {
 	    var uids = {};
+	    var xids = {};
 	    return Promise.all(vaultKeys.map(function(e,i) {
 		return e.getExternals().then(function(exts) {
-		    if (exts && exts.length) return exts[0];
+		    if (exts && exts.length) return exts[0].getId().then(function(xid) {
+			if (!xid || xids[xid]) return null;
+			xids[xid] = true;
+			return exts[0];
+		    });
 		    return e.getUser().then(function(u) {
 			return u.getId().then(function(uid) {
-			    if (uids[uid]) return null;
+			    if (!uid || uids[uid]) return null;
 			    uids[uid] = true;
 			    return u;
 			});
@@ -2298,6 +2584,12 @@ libVES.VaultItem.prototype = new libVES.Object({
 		return rs;
 	    });
 	});
+    },
+    delete: function() {
+	var self = this;
+	return self.getId().then(function(id) {
+	    return self.VES.post(self.apiUri + '/' + id, {'$op': 'delete'});
+	});
     }
 });
 libVES.VaultItem.Type = {
@@ -2372,9 +2664,70 @@ libVES.External.prototype = new libVES.Object({
     }
 });
 
+
+libVES.Event.prototype = new libVES.Object({
+    apiUri: 'events',
+    fieldList: {id: true, recordedAt: true, vaultKey: true, vaultItem: true, user: true},
+    fieldClass: {vaultKey: libVES.VaultKey, vaultItem: libVES.VaultItem, user: libVES.User, creator: libVES.User, session: libVES.Session},
+    getType: function() {
+	return this.getField('type');
+    },
+    getVaultKey: function() {
+	return this.getField('vaultKey');
+    },
+    getVaultItem: function() {
+	return this.getField('vaultItem');
+    },
+    getUser: function() {
+	return this.getField('user');
+    },
+    getCreator: function() {
+	return this.getField('creator');
+    },
+    getSession: function() {
+	return this.getField('session');
+    }
+});
+
+libVES.Session.prototype = new libVES.Object({
+    apiUri: 'sessions',
+    fieldList: {id: true, createdAt: true, expiresAt: true, vaultKey: true, user: true},
+    fieldClass: {vaultKey: libVES.VaultKey, user: libVES.User},
+    getVaultKey: function() {
+	return this.getField('vaultKey');
+    },
+    getUser: function() {
+	return this.getField('user');
+    },
+    getRemote: function() {
+	return this.getField('remote');
+    },
+    getUserAgent: function() {
+	return this.getField('userAgent');
+    }
+});
+
+libVES.Domain.prototype = new libVES.Object({
+    apiUri: 'domains',
+    fieldList: {id: true},
+    fieldClass: {vaultKeys: libVES.VaultKey, vaultItems: libVES.VaultItem, creator: libVES.User},
+    fieldSets: [{vaultItems: {id: true, type: true, file: {creator: true, externals: true}, deleted: true}, vaultKeys: {id: true, type: true, user: {id: true}, algo: true, externals: {id: true}}}],
+    getCreator: function() {
+	return this.getField('creator');
+    },
+    getVaultKeys: function() {
+	return this.getField('vaultKeys');
+    },
+    getVaultItems: function() {
+	return this.getField('vaultItems');
+    }
+});
+
+
 libVES.Algo = {
     ECDH: {
 	tag: 'ECDH',
+	defaultCurve: 'P-521',
 	decrypt: function(k,buf) {
 	    var b = new Uint8Array(buf);
 	    var data = libVES.Util.ASN1.decode(b);
@@ -2398,7 +2751,12 @@ libVES.Algo = {
 	    return libVES.Algo.ECDH.eKey(k).then(function(eKey) {
 		return libVES.Algo.ECDH.cipher(eKey.privateKey,k).then(function(ci) {
 		    return Promise.all([
-			crypto.subtle.exportKey('spki',eKey.publicKey),
+			((k instanceof CryptoKey)
+			    ? crypto.subtle.exportKey('spki',eKey.publicKey)
+			    : libVES.Algo.ECDH.wasm().then(function(wasm) {
+				return libVES.Util.Key.toPKCS(wasm.getpub(eKey.publicKey), null, libVES.Algo.ECDH.asn1hdr(wasm.getoid(eKey.publicKey)));
+			    })
+			),
 			ci.encrypt(buf,true)
 		    ]).then(function(bufs) {
 			var buf = new Uint8Array(bufs[0].byteLength + bufs[1].byteLength);
@@ -2413,21 +2771,32 @@ libVES.Algo = {
 	    });
 	},
 	eKey: function(pub) {
-	    return crypto.subtle.exportKey('jwk',pub).then(function(kdata) {
+	    if (pub instanceof CryptoKey) return crypto.subtle.exportKey('jwk',pub).then(function(kdata) {
 		return crypto.subtle.generateKey({name:'ECDH',namedCurve: kdata.crv},true,['deriveKey','deriveBits']).catch(function(e) {
 		    throw new libVES.Error('InvalidValue','Error generating ECIES ephemeral',{error: e});
 		});
 	    });
+	    return this.wasm().then(function(wasm) {
+		var k = wasm.init(pub.curve);
+		wasm.generate(k);
+		return wasm.privpub(k);
+	    });
 	},
-	cipher: function(priv,pub) {
+	derive: function(priv, pub) {
+	    if (pub instanceof CryptoKey) return Promise.resolve(libVES.Algo.ECDH.curveBytes[pub.algorithm.namedCurve] || crypto.subtle.exportKey('jwk', pub).then(function(jwk) {
+		return jwk.x.length * 3 / 4;
+	    })).then(function(len) {
+		return crypto.subtle.deriveBits({name: 'ECDH', public: pub}, priv, 8 * len);
+	    });
+	    return this.wasm().then(function(wasm) {
+		return wasm.derive(priv, pub);
+	    });
+	},
+	cipher: function(priv, pub) {
 	    return libVES.getModule(libVES.Cipher,'AES256GCMp').then(function(m) {
-		return Promise.resolve(libVES.Algo.ECDH.curveBytes[pub.algorithm.namedCurve] || crypto.subtle.exportKey('jwk',pub).then(function(jwk) {
-		    return jwk.x.length * 3 / 4;
-		})).then(function(len) {
-		    return crypto.subtle.deriveBits({name:'ECDH',public:pub},priv,8 * len).then(function(raw) {
-			return crypto.subtle.digest({name:'SHA-384'},raw).then(function(buf) {
-			    return new m(new Uint8Array(buf).slice(0,m.prototype.keySize + m.prototype.ivSize));
-			});
+		return libVES.Algo.ECDH.derive(priv, pub).then(function(raw) {
+		    return crypto.subtle.digest({name:'SHA-384'},raw).then(function(buf) {
+			return new m(new Uint8Array(buf).slice(0,m.prototype.keySize + m.prototype.ivSize));
 		    });
 		});
 	    });
@@ -2462,13 +2831,22 @@ libVES.Algo = {
 		    }).then(function(der) {
 			return libVES.Util.PEM.encode(der, 'PUBLIC KEY');
 		    });
-	    }
+	    } else return this.wasm().then(function(wasm) {
+		return libVES.Util.Key.export(wasm.getpub(data), wasm.getpriv(data), libVES.Algo.ECDH.asn1hdr(wasm.getoid(data)), optns);
+	    });
 	    throw new libVES.Error('Internal', "Unknown type of key object");
 	},
 	generate: function(optns) {
-	    var op = {name:'ECDH', namedCurve:'P-384'};
+	    var op = {name: 'ECDH', namedCurve: this.defaultCurve};
 	    if (optns) for (var k in optns) op[k] = optns[k];
-	    return crypto.subtle.generateKey(op,true,['deriveKey','deriveBits']);
+	    return crypto.subtle.generateKey(op, true, ['deriveKey', 'deriveBits']).catch(function(e) {
+		console.log('ECDH generateKey failed, trying wasm...', e, op);
+		return libVES.Algo.ECDH.wasm().then(function(wasm) {
+		    var k = wasm.init(op.namedCurve);
+		    if (!k || !wasm.generate(k)) throw new libVES.Error('InvalidValue', 'WasmECDH key generation error (unsupported curve?)');
+		    return wasm.privpub(k);
+		});
+	    });
 	},
 	getPublic: function(priv) {
 	    return crypto.subtle.exportKey('jwk',priv).then(function(k) {
@@ -2481,7 +2859,48 @@ libVES.Algo = {
 		    y: k.y
 		},{name:'ECDH'},true,[]);
 	    });
-	}
+	},
+	getKeyOptions: function(key) {
+	    if (key instanceof CryptoKey) return crypto.subtle.exportKey('jwk', key).then(function(k) {
+		return {namedCurve: k.crv};
+	    });
+	    return {namedCurve: k.curve};
+	},
+	asn1hdr: function(oid) {
+	    return [new libVES.Util.OID(this.OID), new libVES.Util.OID(oid)];
+	},
+	wasm: function() {
+	    if (!this.wasmP) this.wasmP = (typeof(WasmECDH) == 'function' ? Promise.resolve()
+		: libVES.Util.loadWasm(WasmECDHinit.baseUrl + 'WasmECDH.js')
+	    ).then(function() {
+		return WasmECDH(WasmECDHinit);
+	    });
+	    return this.wasmP;
+	},
+	importWasm: function(curve, der) {
+	    return libVES.Algo.ECDH.wasm().then(function(wasm) {
+		return libVES.Util.Key.fromDER(der, function(pub, priv, pubBits) {
+		    var k = wasm.init(curve);
+		    if (!k) return null;
+		    if (pub) wasm.setpub(k, pub);
+		    if (priv) wasm.setpriv(k, priv);
+		    return k;
+		});
+	    });
+	},
+	getMethods: function() {
+	    var crvs = ['P-256', 'P-384', 'P-521'];
+	    return this.wasm().then(function(wasm) {
+		return crvs.concat(wasm.getcurves());
+	    }).catch(function(e) {
+		return crvs;
+	    }).then(function(crvs) {
+		return crvs.map(function(algo) {
+		    return {namedCurve: algo};
+		});
+	    });
+	},
+	OID: '1.2.840.10045.2.1'
     },
     RSA: {
 	tag: 'RSA',
@@ -2540,7 +2959,7 @@ libVES.Algo = {
 	    throw new libVES.Error('Internal',"Unknown type of key object");
 	},
 	generate: function(optns) {
-	    var op = {name:'RSA-OAEP', modulusLength:2048, publicExponent:new Uint8Array([1,0,1]), hash:'SHA-1'};
+	    var op = {name:'RSA-OAEP', modulusLength:4096, publicExponent:new Uint8Array([1,0,1]), hash:'SHA-256'};
 	    if (optns) for (var k in optns) op[k] = optns[k];
 	    return crypto.subtle.generateKey(op,true,['decrypt','encrypt']);
 	},
@@ -2553,9 +2972,25 @@ libVES.Algo = {
 		    key_ops: ['encrypt'],
 		    kty: 'RSA',
 		    n: k.n
-		},{name:'RSA-OAEP',hash:'SHA-1'},true,['encrypt']);
+		},{name:'RSA-OAEP',hash:'SHA-256'},true,['encrypt']);
 	    });
-	}
+	},
+	getKeyOptions: function(key) {
+	    return crypto.subtle.exportKey('jwk', key).then(function(k) {
+		return {modulusLength: ((k.n.length * 6) >> 3) * 8, publicExponent: libVES.Util.B64ToByteArray(k.e)};
+	    });
+	},
+	getMethods: function() {
+	    var bits = [];
+	    var s = 128;
+	    for (var i = 640; i <= 16384; i += s) {
+		bits.push(i);
+		if (i / s >= 8) s <<= 1;
+	    }
+	    return Promise.resolve(bits.map(function(b) {
+		    return {modulusLength: b};
+	    }));
+	},
     },
     RSA_PKCS1_15: {
 	tag: 'RSA_PKCS1_15',
@@ -2592,9 +3027,107 @@ libVES.Algo = {
 	    }
 	});
     },
+    fromKeyOptions: function(optns) {
+	if (optns.namedCurve) return 'ECDH';
+	if (optns.oqsAlgo) return 'OQS';
+	if (optns.modulusLength) return 'RSA';
+    },
     toString: function() {
 	return 'libVES.Algo';
-    }
+    },
+    all: ['RSA', 'ECDH']
+};
+
+WasmECDHinit = {
+    Key: function() {},
+    init: function(curve) {
+	var a = new Uint8Array(libVES.Util.StringToByteArray(curve));
+	var arg1 = this.buf(a.byteLength + 1);
+	arg1.set(a);
+	arg1.set([0], a.byteLength);
+	var ptr = this._WasmECDH_new(arg1.byteOffset);
+	if (!ptr) return null;
+	var key = new this.Key();
+	key.ptr = ptr;
+	key.curve = this.getcurve(key);
+	return key;
+    },
+    buf: function(len) {
+	return new Uint8Array(this.asm.memory.buffer, this._WasmECDH_buf, len);
+    },
+    str: function(ptr) {
+	if (!ptr) return null;
+	var b = new Uint8Array(this.asm.memory.buffer, ptr);
+	return libVES.Util.ByteArrayToString(b.slice(0, b.indexOf(0)));
+    },
+    generate: function(key) {
+	key.private = true;
+	return this._WasmECDH_generate(key.ptr);
+    },
+    setpub: function(key, pub) {
+	var arg1 = this.buf(pub.byteLength);
+	arg1.set(pub);
+	return this._WasmECDH_setpub(key.ptr, arg1.byteOffset, arg1.byteLength);
+    },
+    setpriv: function(key, priv) {
+	key.private = true;
+	var arg1 = this.buf(priv.byteLength);
+	arg1.set(priv);
+	return this._WasmECDH_setpriv(key.ptr, arg1.byteOffset, arg1.byteLength);
+    },
+    getpub: function(key) {
+	var l = this._WasmECDH_getpub(key.ptr);
+	if (l <= 0) return null;
+	var rs = new Uint8Array(l);
+	rs.set(this.buf(l));
+	return rs;
+    },
+    getpriv: function(key) {
+	if (!key.private) return null;
+	var l = this._WasmECDH_getpriv(key.ptr);
+	if (l <= 0) return null;
+	var rs = new Uint8Array(l);
+	rs.set(this.buf(l));
+	return rs;
+    },
+    getcurve: function(key) {
+	return this.str(this._WasmECDH_getcurve(key.ptr));
+    },
+    getoid: function(key) {
+	return this.str(this._WasmECDH_getoid(key.ptr));
+    },
+    derive: function(priv, pub) {
+	var l = this._WasmECDH_derive(priv.ptr, pub.ptr);
+	if (l <= 0) return null;
+	var rs = new Uint8Array(l);
+	rs.set(this.buf(l));
+	return rs;
+    },
+    privpub: function(priv) {
+	var pub = new this.Key();
+	pub.ptr = priv.ptr;
+	pub.curve = priv.curve;
+	return {privateKey: priv, publicKey: pub};
+    },
+    free: function(key) {
+	this._WasmECDH_free(key.ptr);
+    },
+    getcurves: function() {
+	var lst = this._WasmECDH_listinit(1024);
+	var crvs = [];
+	var c;
+	for (var i = 0; (c = this._WasmECDH_listget(lst, i)); i++) {
+	    var crv = this.str(c);
+	    if (crv == '') continue;
+	    crvs.push(crv);
+	}
+	this._WasmECDH_listfree(lst);
+	return crvs;
+    },
+    locateFile: function(file) {
+       return this.baseUrl + file;
+    },
+    baseUrl: 'https://ves.host/pub/'
 };
 
 libVES.Cipher = function(data) {
@@ -3142,10 +3675,14 @@ libVES.Recovery.prototype = {
 	return this.getMyToken().then(function(tkn) {
 	    if (!tkn) throw new libVES.Error('InvalidValue','No assistance available');
 	    return self.vaultKey.getUser().then(function(user) {
-		return tkn.vaultItem.shareWith(assist ? [tkn.user,user] : [tkn.user]).then(function() {
-		    self.tokens = undefined;
-		    self.vaultKey.vaultItems = undefined;
-		    return true;
+		return self.vaultKey.VES.elevateAuth().catch(function(e) {
+		    return undefined;
+		}).then(function(optns) {
+		    return tkn.vaultItem.shareWith((assist ? [tkn.user,user] : [tkn.user]), undefined, optns).then(function() {
+			self.tokens = undefined;
+			self.vaultKey.vaultItems = undefined;
+			return true;
+		    });
 		});
 	    });
 	});
@@ -3394,7 +3931,7 @@ libVES.Flow.prototype.pubJWK = function(org) {
 	    return libVES.Flow.jwkPub(jwk);
 	});
     }) : Promise.resolve(sessionStorage['VESflow|' + org]).then(function(k) {
-	if (!k) throw {code: 'NotFound', message: 'No public key stored for ' + org};
+	if (!k) throw new libVES.Error('NotFound', 'No public key stored for ' + org);
 	return JSON.parse(k);
     }));
 };
@@ -3421,7 +3958,7 @@ libVES.Flow.prototype.cipher = function(url) {
 libVES.Flow.prototype.encrypt = function(url, val) {
     var self = this;
     return Promise.resolve(val || this.value()).then(function(val) {
-	if (val == null) throw {code: 'NoData', message: 'Empty value'};
+	if (val == null) throw new libVES.Error('NoData', 'Empty value');
 	return self.cipher(url).then(function(ci) {
 	    var iv = new Uint8Array(12);
 	    crypto.getRandomValues(iv);
@@ -3512,7 +4049,7 @@ libVES.Flow.prototype.recv = function(dval) {
 	    tk = t;
 	    return true;
 	});
-	if (tk == null) throw {code: 'NotFound', message: 'No valid token in the source url'};
+	if (tk == null) throw new libVES.Error('NotFound', 'No valid token in the source url');
 	return Promise.resolve(self.source(src)).then(function() {
 	    if (dval) for (var k in dval) if (tk[k] === undefined) tk[k] = dval[k];
 	    return self.recvToken(tk);
@@ -3523,7 +4060,7 @@ libVES.Flow.prototype.recv = function(dval) {
 libVES.Flow.prototype.recvToken = function(tk) {
     var org = libVES.Flow.toOrigin(tk.url);
     if (org != this.origin && tk.key) sessionStorage['VESflow|' + org] = JSON.stringify(tk.key);
-    if (!tk.enc) return Promise.reject({url: tk.url, code: 'Incomplete', message: 'Missing encrypted data'});
+    if (!tk.enc) return Promise.reject(new libVES.Error('Incomplete', 'Missing encrypted data', {url: tk.url}));
     return this.decrypt(tk.enc, org);
 };
 
@@ -3538,7 +4075,7 @@ libVES.Flow.prototype.get = function() {
 		self.url = document.location.href;
 		return self.addToken(e.url).then(function(url) {
 		    document.location.replace(url);
-		    throw {code: 'Reload', message: 'Completing the key exchange'};
+		    throw new libVES.Error('Redirect', 'Completing the key exchange');
 		});
 	    }
 	    if (!data) throw e;
@@ -3552,13 +4089,13 @@ libVES.Flow.prototype.store = function(url) {
 	this.sent = 1;
 	return Promise.resolve(sessionStorage['VESflow.' + this.name + '>' + libVES.Flow.toOrigin(url)] = history.state['VESflow.' + this.name]);
     }
-    return Promise.reject({code: 'NotFound', message: 'Value is not set'});
+    return Promise.reject(new libVES.Error('NotFound', 'Value is not set'));
 };
 
 libVES.Flow.prototype.fetch = function(url) {
     var self = this;
     return Promise.resolve(sessionStorage['VESflow.' + self.name + '>' + libVES.Flow.toOrigin(url)]).then(function(ctext) {
-	if (!ctext) throw {code: 'NotFound', message: 'Not in the session storage'};
+	if (!ctext) throw new libVES.Error('NotFound', 'Not in the session storage');
 	return self.decrypt(ctext).then(function(data) {
 	    self.erase(url);
 	    return data;
@@ -3678,19 +4215,16 @@ libVES.Auth.prototype.verify = function(token, auth) {
 libVES.Algo.OQS = {
     tag: 'OQS',
     wasm: function() {
-	if (!this.wasmP) this.wasmP = new Promise(function(resolve, reject) {
-	    if (typeof(WasmOQS) == 'function') return resolve();
-	    var sc = document.createElement('script');
-	    sc.async = false;
-	    sc.src = WasmOQSinit.baseUrl + 'WasmOQS.js';
-	    sc.onload = resolve;
-	    sc.onerror = reject;
-	    document.getElementsByTagName('head')[0].appendChild(sc);
-	}).then(function() {
+	if (!this.wasmP) this.wasmP = (typeof(WasmOQS) == 'function' ? Promise.resolve()
+	    : libVES.Util.loadWasm(WasmOQSinit.baseUrl + 'WasmOQS.js')
+	).then(function() {
 	    return WasmOQS(WasmOQSinit);
 	});
 	return this.wasmP;
     },
+    checkLimits: function(k) {
+	return k.pub.byteLength + k.priv.byteLength <= libVES.maxKeyLen && k.ctextlen + 64 <= libVES.maxEncDataLen;
+    },
     decrypt: function(k,buf) {
 	return this.wasm().then(function(wasm) {
 	    var b = new Uint8Array(buf);
@@ -3737,56 +4271,54 @@ libVES.Algo.OQS = {
     },
     export: function(data, optns) {
 	if (!data || !data.ptr) throw new libVES.Error('Internal', "Unknown type of key object");
-	var pub = new Uint8Array(data.pub.byteLength + 1);
-	pub[0] = 0;
-	pub.set(new Uint8Array(data.pub), 1);
-	pub.ASN1type = 3;
 	var oid = [new libVES.Util.OID(libVES.Algo.OQS.OID), libVES.Util.StringToByteArray(data.algo)];
-	if (data.priv) {
-	    pub = libVES.Util.ASN1.encode([pub]);
-	    pub.ASN1type = 0xa1;
-	    var buf = libVES.Util.ASN1.encode([[1, data.priv, pub]]);
-	    var pkcs8 = libVES.Util.ASN1.encode([[0, oid, buf]]);
-	    return libVES.Util.PKCS8.encode8(pkcs8, optns);
-	}
-	return libVES.Util.PEM.encode(libVES.Util.ASN1.encode([[oid, pub]]), 'PUBLIC KEY');
+	return libVES.Util.Key.export(data.pub, data.priv, oid, optns);
     },
     generate: function(optns) {
-	var algo = optns ? optns.algo : null;
+	var algo = optns ? optns.oqsAlgo : null;
 	if (!algo) algo = this.defaultAlgo;
 	return this.wasm().then(function(wasm) {
 	    var k = wasm.init(algo, true);
 	    if (!k) throw new libVES.Error('InvalidValue', 'OQS key init failed');
-	    if (!wasm.generate(k)) throw new libVES.Error('Internal', 'OQS generate failed');
-	    var pub = {};
+	    if (!libVES.Algo.OQS.checkLimits(k)) throw wasm.free(k), new libVES.Error('Internal', 'OQS key is too large for VES');
+	    if (!wasm.generate(k)) throw wasm.free(k), new libVES.Error('Internal', 'OQS generate failed');
+	    var pub = new wasm.Key(k.algo);
 	    for (var i in k) if (i != 'priv') pub[i] = k[i];
 	    return {privateKey: k, publicKey: pub};
 	});
     },
+    getKeyOptions: function(key) {
+	return {oqsAlgo: k.algo};
+    },
+    getMethods: function() {
+	return this.wasm().then(function(wasm) {
+	    return wasm.getalgos().filter(function(algo) {
+		var k = wasm.init(algo, true);
+		if (!k) return false;
+		var f = libVES.Algo.OQS.checkLimits(k);
+		wasm.free(k);
+		return f;
+	    }).map(function(algo) {
+		return {oqsAlgo: algo};
+	    });
+	});
+    },
     Util: {
 	import: function(args,chain,optns) {
 	    var algo = libVES.Util.ByteArrayToString(args);
 	    return chain('container').then(function(der) {
-		var asn = libVES.Util.ASN1.decode(der)[0];
-		var pkey = null;
-		var pub = null;
-		if (typeof(asn[0]) == 'number') {
-		    var asn2 = libVES.Util.ASN1.decode(asn[2])[0];
-		    pkey = asn2[1];
-		    pub = libVES.Util.ASN1.decode(asn2[2])[0];
-		} else pkey = asn[1];
-		return libVES.Algo.OQS.wasm().then(function(wasm) {
-		    var k = wasm.init(algo, !!pub);
-		    if (!k) throw new libVES.Error('InvalidValue', 'OQS key init failed (bad algo?)');
-		    var s = function(dst, src, dif) {
-			if (!dst || !src || dst.byteLength != src.byteLength - dif) throw new libVES.Error('InvalidValue', 'Incorrect OQS key size');
-			dst.set(src.slice(dif), 0);
-		    };
-		    if (pub) {
-			s(k.priv, pkey, 0);
-			s(k.pub, pub, 1);
-		    } else s(k.pub, pkey, 1);
-		    return k;
+		return libVES.Util.Key.fromDER(der, function(pub, priv, pubBits) {
+		    return libVES.Algo.OQS.wasm().then(function(wasm) {
+			var k = wasm.init(algo, !!priv);
+			if (!k) throw new libVES.Error('InvalidValue', 'OQS key init failed (bad algo?)');
+			var s = function(dst, src) {
+			    if (!dst || !src || dst.byteLength != src.byteLength) throw wasm.free(k), new libVES.Error('InvalidValue', 'Incorrect OQS key size');
+			    dst.set(src, 0);
+			};
+			if (priv) s(k.priv, priv);
+			s(k.pub, pub);
+			return k;
+		    });
 		});
 	    });
 	}
@@ -3794,59 +4326,76 @@ libVES.Algo.OQS = {
     OID: '1.3.6.1.4.1.53675.3.5',
     defaultAlgo: 'Kyber768'
 };
+libVES.Algo.all.push('OQS');
 
 var WasmOQSinit = {
-    init: function(algo, priv) {
-        var a = new Uint8Array(libVES.Util.StringToByteArray(algo));
-        var arg1 = new Uint8Array(this.asm.memory.buffer, 16, 48);
-        arg1.set(a);
-        arg1.set([0], a.byteLength);
-        var ptr = this._WasmOQS_new(arg1.byteOffset, priv);
-        if (!ptr) return null;
-        var key = { ptr: ptr };
-        var priv = this._WasmOQS_priv(ptr);
-        if (priv) key.priv = new Uint8Array(this.asm.memory.buffer, priv, this._WasmOQS_privlen(ptr));
-        key.pub = new Uint8Array(this.asm.memory.buffer, this._WasmOQS_pub(ptr), this._WasmOQS_publen(ptr));
-        key.secretlen = this._WasmOQS_decaps(key.ptr, null, null);
-        key.ctextlen = this._WasmOQS_encaps(key.ptr, null, null);
-        key.algo = algo;
-        return key;
+    Key: function(algo) {
+	this.algo = algo;
+    },
+    init: function(algo, fpriv) {
+	var a = new Uint8Array(libVES.Util.StringToByteArray(algo));
+	var arg1 = new Uint8Array(this.asm.memory.buffer, 16, 48);
+	arg1.set(a);
+	arg1.set([0], a.byteLength);
+	var ptr = this._WasmOQS_new(arg1.byteOffset, fpriv);
+	if (!ptr) return null;
+	var key = new this.Key(algo);
+	key.ptr = ptr;
+	var priv = this._WasmOQS_priv(ptr);
+	if (priv) key.priv = new Uint8Array(this.asm.memory.buffer, priv, this._WasmOQS_privlen(ptr));
+	key.pub = new Uint8Array(this.asm.memory.buffer, this._WasmOQS_pub(ptr), this._WasmOQS_publen(ptr));
+	key.secretlen = this._WasmOQS_decaps(key.ptr, null, null);
+	key.ctextlen = this._WasmOQS_encaps(key.ptr, null, null);
+	return key;
     },
     generate: function(key) {
-        return this._WasmOQS_generate(key.ptr) >= 0;
+	return this._WasmOQS_generate(key.ptr) >= 0;
     },
     encaps: function(key) {
-        var arg1 = new Uint8Array(this.asm.memory.buffer, this._WasmOQS_secretbuf, this._WasmOQS_decaps(key.ptr, null, null));
-        var arg2 = new Uint8Array(this.asm.memory.buffer, this._WasmOQS_ctextbuf, this._WasmOQS_encaps(key.ptr, null, null));
-        if (this._WasmOQS_encaps(key.ptr, arg2.byteOffset, arg1.byteOffset) <= 0) return null;
-        key.secret = new Uint8Array(arg1.byteLength);
-        key.secret.set(arg1);
-        var ctext = new Uint8Array(arg2.byteLength);
-        ctext.set(arg2);
-        return ctext;
+	var arg1 = new Uint8Array(this.asm.memory.buffer, this._WasmOQS_secretbuf, this._WasmOQS_decaps(key.ptr, null, null));
+	var arg2 = new Uint8Array(this.asm.memory.buffer, this._WasmOQS_ctextbuf, this._WasmOQS_encaps(key.ptr, null, null));
+	if (this._WasmOQS_encaps(key.ptr, arg2.byteOffset, arg1.byteOffset) <= 0) return null;
+	key.secret = new Uint8Array(arg1.byteLength);
+	key.secret.set(arg1);
+	var ctext = new Uint8Array(arg2.byteLength);
+	ctext.set(arg2);
+	return ctext;
     },
     decaps: function(key, ctext) {
-        if (!ctext) return key.secret;
-        if (ctext.byteLength != this._WasmOQS_encaps(key.ptr, null, null)) return null;
-        var arg1 = new Uint8Array(this.asm.memory.buffer, this._WasmOQS_secretbuf, this._WasmOQS_decaps(key.ptr, null, null));
-        var arg2 = new Uint8Array(this.asm.memory.buffer, this._WasmOQS_ctextbuf, ctext.byteLength);
-        arg2.set(ctext);
-        if (this._WasmOQS_decaps(key.ptr, arg1.byteOffset, arg2.byteOffset) <= 0) return null;
-        key.secret = new Uint8Array(arg1.byteLength);
-        key.secret.set(arg1);
-        return key.secret;
+	var arg1 = new Uint8Array(this.asm.memory.buffer, this._WasmOQS_secretbuf, this._WasmOQS_decaps(key.ptr, null, null));
+	if (ctext) {
+	    if (ctext.byteLength != this._WasmOQS_encaps(key.ptr, null, null)) return null;
+	    var arg2 = new Uint8Array(this.asm.memory.buffer, this._WasmOQS_ctextbuf, ctext.byteLength);
+	    arg2.set(ctext);
+	    if (this._WasmOQS_decaps(key.ptr, arg1.byteOffset, arg2.byteOffset) <= 0) return null;
+	}
+	var secret = new Uint8Array(arg1.byteLength);
+	secret.set(arg1);
+	return secret;
     },
     free: function(key) {
-        this._WasmOQS_free(key.ptr);
+	this._WasmOQS_free(key.ptr);
+	delete(key.ptr);
+    },
+    getalgos: function() {
+	var algos = [];
+	var a;
+	for (var i = 0; a = this._WasmOQS_enumalgo(i); i++) {
+	    var s = new Uint8Array(this.asm.memory.buffer, a);
+	    var p = s.indexOf(0);
+	    if (!p) continue;
+	    algos.push(libVES.Util.ByteArrayToString(s.slice(0, p)));
+	}
+	return algos;
     },
     test: function(algo) {
-        var k = this.init(algo, 1);
-        this.generate(k);
-        console.log(k);
-        var ctext = this.encaps(k);
-        console.log(k.secret, ctext);
-        var secret = this.decaps(k);
-        console.log(secret);
+	var k = this.init(algo, 1);
+	this.generate(k);
+	var ctext = this.encaps(k);
+	var secret = this.decaps(k);
+	console.log(secret);
+	var secret2 = this.decaps(k, ctext);
+	console.log(secret2);
     },
     locateFile: function(file) {
 	return this.baseUrl + file;
@@ -3854,4 +4403,873 @@ var WasmOQSinit = {
     baseUrl: 'https://ves.host/pub/'
 };
 
+
+
+libVES.Watch = function(obj, optns) {
+    if (obj instanceof libVES) obj = obj.domain ? (obj.externalId ? obj.getVaultKey() : new libVES.Domain(null, obj)) : obj.me();
+    var self = this;
+    this.object = Promise.resolve(obj).then(function(o) {
+	if (o instanceof libVES.VaultKey) {
+	    self.uri = 'vaultKeys/';
+	} else if (o instanceof libVES.VaultItem) {
+	    self.uri = 'vaultItems/';
+	} else if (o instanceof libVES.User) {
+	    self.uri = 'users/';
+	} else if (o instanceof libVES.Domain) {
+	    self.uri = 'domains/';
+	} else {
+	    throw new libVES.Error('Internal', 'Watchable object expected');
+	}
+	self.VES = o.VES;
+	return o;
+    });
+    if (optns) for (var k in optns) this[k] = optns[k];
+};
+
+libVES.Watch.prototype = {
+    fields: {vaultKey: {id: true, user: true, externals: true, creator: true}, vaultItem: {id: true, vaultKey: true, file: {externals: true, creator: true}}, session: {id: true, userAgent: true, remote: true, createdAt: true, expiresAt: true}},
+    state: 'idle',
+    timeout: 900,
+    getEvents: function(start, ct, poll) {
+	var self = this;
+	return self.object.then(function(o) {
+	    return o.getId().then(function(id) {
+		return (poll ? self.VES.pollUrl : '') + self.uri + id
+		    + '?fields=events(' + self.VES.uriListFields(self.fields) + ')%5B' + start + (ct >= 0 ? '%2B' : '') + ct + '%5D'
+		    + (poll ? '&poll=' + self.timeout : '');
+	    });
+	}).then(function(url) {
+	    return self.VES.get(url);
+	}).then(function(res) {
+	    if (!res.events) return null;
+	    return res.events.map(function(e, i) {
+		return new libVES.Event(libVES.Util.fillUndefs(e, self.fields), self.VES);
+	    });
+	});
+    },
+    setState: function(st) {
+	if (this.statefn) try {
+	    this.statefn(st, this);
+	} catch(e) {}
+	this.state = st;
+    },
+    setBusy: function(busy) {
+	this.busy = busy;
+	if (!busy && this.state == 'stop') this.setState('idle');
+    },
+    start: function(pos) {
+	if (!this.eventfn) return Promise.reject(new libVES.Error('InvalidValue', 'eventfn is not set'));
+	if (this.busy) return Promise.reject(new libVES.Error('Internal', 'Watch instance is busy'));
+	var self = this;
+	self.setBusy(true);
+	this.setState('read');
+	if (pos < 0) {
+	    this.next = 0;
+	    return this.getEvents(0, pos).then(function(evs) {
+		self.setBusy(false);
+		return self.received(evs ? evs.reverse() : null);
+	    }).finally(function() {
+		self.setBusy(false);
+            });
+	} else {
+	    this.next = pos;
+	    return this.getEvents(pos, 0).then(function(evs) {
+		self.setBusy(false);
+		return self.received(evs);
+	    }).finally(function() {
+		self.setBusy(false);
+	    });
+	}
+    },
+    active: function() {
+	return this.state == 'read' || this.state == 'poll';
+    },
+    received: function(evs) {
+	var self = this;
+	var p;
+        if (!evs) return null;
+	if (evs.length) return evs.reduce(function(v, ev) {
+	    if (self.active()) try {
+		self.eventfn(ev, self);
+	    } catch(e) {
+		console.log(e);
+	    }
+	    return ev;
+	}, null).getId().then(function(id) {
+	    self.next = id + 1;
+            return self.request();
+	});
+	else {
+	    if (this.state == 'read') this.setState('poll');
+	    return self.request(), true;
+	}
+    },
+    request: function() {
+	if (this.busy || !this.active()) return true;
+	var self = this;
+	self.setBusy(true);
+	return self.getEvents(self.next, 0, (self.state == 'poll')).then(function(evs) {
+	    self.setBusy(false);
+	    return self.received(evs);
+	}).catch(function(e) {
+	    self.setBusy(false);
+	    if (self.errorfn) try {
+		self.errorfn(e, self);
+	    } catch(e) {
+		console.log(e);
+	    }
+	    return self.retry();
+	});
+    },
+    retry: function() {
+	var self = this;
+	return new Promise(function(resolve, reject) {
+	    window.setTimeout(function() {
+		resolve(self.request());
+	    }, 1000);
+	});
+    },
+    stop: function() {
+	this.setState(this.busy ? 'stop' : 'idle');
+    }
+};
+
+
+
+libVES.subtle = function(optns) {
+    if (!(optns instanceof Object)) {
+        let uri = String(optns);
+        optns = uri.includes('/') ? libVES.Vault.toRef(uri) : {domain: uri};
+    }
+    return new libVES(optns).subtle();
+};
+
+libVES.prototype.subtle = function(ref) {
+    return new libVES.Vault((ref || this), this);
+};
+
+libVES.EventTarget = class extends EventTarget {
+    watchFields() {
+        return {vaultKey: {id: true, user: {id: true, email: true}, externals: {domain: true, externalId: true}}, vaultItem: {id: true, type: true, deleted: true, vaultKey: {id: true, type: true, externals: {domain: true, externalId: true}, user: {id: true, email: true}}, file: {externals: {domain: true, externalId: true}, creator: true}}, authorSession: {id: true, vaultKey: {id: true, type: true, externals: {domain: true, externalId: true}}, domain: true, user: {email: true}, remote: true, userAgent: true}, session: {id: true, vaultKey: {id: true}, user: {id: true}, remote: true, userAgent: true}};
+    }
+
+    dispatchEvent(ev) {
+        if (!ev) return;
+        super.dispatchEvent(ev);
+        if (this['on' + ev.type]) try { this['on' + ev.type](ev) } catch (er) { console.log(er); }
+    }
+
+    start(optns) {
+        if (!this.watch) {
+            let tr = this._eventTracker();
+            if (optns === false) optns = {replay: true};
+            else if (optns != null && !isNaN(optns)) optns = {startEvent: Number(optns)};
+            else if (!(optns instanceof Object)) optns = {};
+            if (optns.startEvent == null) optns.startEvent = -1;
+            this.watch = this.createWatch(optns);
+            this.watch.eventfn = (ev) => (this.eventClear = this.eventClear.then(() => tr._event(ev).then((ev) => this.dispatchEvent(ev)).catch((er) => console.log(er))));
+            this.eventClear = optns.replay ? this.replay((optns.replay instanceof Object) ? optns.replay : optns).then((evs) => Promise.all(evs.map((ev) => this.dispatchEvent(ev)))) : Promise.resolve();
+            return this.watch.start(optns.startEvent).then((v) => (v || this.badauth().then(() => this.watch.start(startEvent)))).catch((er) => {
+              this.watch = null;
+              throw er;
+            });
+        } else throw new libVES.Error.InvalidValue('The watch is already started');
+    }
+
+    stop() {
+        if (this.watch) return Promise.resolve(this.watch.stop()).then(() => this.eventClear).then(() => true).finally(() => this.watch = null);
+        return Promise.resolve(null);
+    }
+
+    events(optns) {
+        let tr = this._eventTracker();
+        return this.createWatch(optns).getEvents(0, 0).then((evs) => (evs ? evs.reduce((res, ev) => res.then((res) => tr._event(ev, false).then((ev) => ((ev && res.push(ev)), res))), Promise.resolve([])) : this.badauth().then(() => this.events())));
+    }
+
+    toJSON() {
+        return this.uri();
+    }
+};
+
+libVES.Vault = class extends libVES.EventTarget {
+    constructor(ref, ves, fields) {
+        super();
+        this.init(libVES.Vault.toRef(ref, ves), ves, fields);
+    }
+
+    init(ref, ves, fields) {
+        fields ||= {};
+        if (ref.externalId) fields.externals = [{domain: (this.domain = String(ref.domain)), externalId: (this.externalId = String(ref.externalId))}];
+        this.email = ref.email || '';
+        if (ref.email) fields.email = this.email;
+        if (ref.version) this.version = fields.id = Number(ref.version);
+        if (!fields.id) fields.type = this.externalId ? 'secondary' : 'current';
+        this.vaultKey = new libVES.VaultKey(fields, ves);
+        delete(this.admin);
+    };
+
+    item(ref) {
+        return new libVES.Item(ref, this);
+    };
+
+    vault(ref) {
+        if (!ref) return null;
+        return new libVES.Vault(ref, this.vaultKey.VES);
+    }
+
+    entries(optns) {
+        const flds = {encData: true, vaultItem: {type: true, file: {externals: true, creator: {id: true, email: true}}, deleted: true, vaultKey: {type: true, externals: true, user: true}, type: true, meta: true}};
+        const getfn = () => this.vaultKey.getField('vaultEntries', flds, true).then((data) => libVES.Util.fillUndefs(data, flds));
+        if (!this._entriesCache) (this._entriesCache = getfn().then((entries) => (entries || this.badauth().then(getfn)))).catch(() => null).finally(() => this._entriesCache = null);
+        return this._entriesCache;
+    };
+
+    objects(optns) {
+        let found = {items: {}, vaults: {}};
+        return this.entries(optns).then((entries) => Promise.all((entries || []).map((entry) => {
+            const ext = entry.vaultItem?.file?.externals?.[0];
+            if (ext) {
+                if (entry.vaultItem.deleted) return null;
+                let d = (found.items[ext.domain] ||= {});
+                return d[ext.externalId] ? null : (d[ext.externalId] = new libVES.Item(ext, this, entry.vaultItem));
+            }
+            const vkey = entry.vaultItem?.vaultKey;
+            const kext = vkey?.externals?.[0];
+            if (kext && vkey.type == 'secondary' && entry.vaultItem.type == 'password') {
+                let d = (found.vaults[kext.domain] ||= {});
+                    return d[kext.externalId] ? null : (d[kext.externalId] = new libVES.Vault(kext, this.vaultKey.VES, vkey));
+            }
+        }))).then((objs) => objs.filter((obj) => obj));
+    };
+
+    items(optns) {
+        return this.objects(optns).then((objs) => objs.filter((obj) => (obj instanceof libVES.Item)));
+    }
+
+    vaults(optns) {
+        return this.objects(optns).then((objs) => objs.filter((obj) => (obj instanceof libVES.Vault)));
+    }
+
+    _setunlock(reauth) {
+        this.current = true;
+        this.owner = this.externalId[0] != '!';
+        this.lock(600);
+        let rf;
+        if (reauth !== false) (rf = (tmout) => {
+            this.refreshTmout = setTimeout(() => {
+                this.vaultKey.loadFields({encSessionToken: true}, true, {token: ''}).then((flds) => this.vaultKey.setFields(flds)).then(() => this.vaultKey.getSessionToken()).then((tk) => {
+                    this.vaultKey.VES.token = tk;
+                    rf();
+                }).catch((er) => {
+                    console.log(er);
+                    rf(60000);
+                });
+            }, (tmout || 14400000));
+        })();
+        return this;
+    }
+
+    unlock(optns) {
+        if (this.lockInProgress) return this.lock().then(() => this.unlock(optns));
+        if (optns && !(optns instanceof Object)) optns = libVES.Vault.toRef(optns, this.vaultKey.VES);
+        if (optns?.veskey) return this.vaultKey.VES.logout().then(() => {
+            let ves = new libVES(optns);
+            delete(ves.veskey);
+            return ((reauth) => ves.unlock(String(optns.veskey)).then(() => this.init(ves, ves)).then(() => this._setunlock(reauth)))(!this.vaultKey.VES.token);
+        });
+        return this.vaultKey.VES.unlock().catch((er) => {
+            let mode = optns?.mode || 'delegate';
+            switch (mode) {
+                case 'delegate': return this.vaultKey.VES.delegate(optns).then((ves) => this.init(ves, ves));
+                case 'flow': return this.vaultKey.VES.flow(true, optns).then((ves) => this.init(ves, ves));
+                case 'veskey': throw new libVES.Error.InvalidValue('No veskey provided');
+                default: throw new libVES.Error.InvalidValue('Unknown unlock mode: ' + mode + ', expected: delegate|flow');
+            }
+        }).then(() => this._setunlock());
+    }
+
+    unlocked(optns) {
+        return this.vaultKey.VES.unlock().catch((er) => {
+            if (optns?.mode != 'flow') throw er;
+            return this.vaultKey.VES.flow(false, optns).then((ves) => this.init(ves, ves)).then(() => this._setunlock());
+        }).then(() => true).catch((er) => false);
+    }
+
+    anonymous(optns) {
+        if (!(optns instanceof Object)) {
+            if (optns && typeof(optns) == 'string') optns = {veskey: optns};
+            else optns = {};
+        }
+        if (!optns.veskey) return Promise.reject(libVES.Error.InvalidValue('Required: veskey'));
+        if (!this.vaultKey.VES.domain) return Promise.reject(libVES.Error.InvalidValue('Cannot create an anonymous vault without a VES domain'));
+        this.vaultKey.VES.logout();
+        return (optns.externalId ? Promise.resolve(this.vaultKey.VES.externalId = optns.externalId) : crypto.subtle.digest('sha-256', libVES.Util.StringToByteArray('libVES.subtle\0' + this.vaultKey.VES.domain + '\0' + optns.veskey)).then((hash) => {
+            const hex = '0123456789abcdef';
+            let xid = new Uint8Array(hash).reduce(((v, e) => v + hex[e >> 4] + hex[e & 0x0f]), '!');
+            this.vaultKey.VES.externalId = xid;
+        })).then(() => this.vaultKey.VES.unlock(optns.veskey).catch((er) => {
+            if (er?.code == 'NotFound') return this.vaultKey.VES.setAnonymousKey(optns.veskey, optns);
+            else throw er;
+        })).then(() => this.init(this.vaultKey.VES, this.vaultKey.VES)).then(() => this._setunlock());
+    }
+
+    lock(tmout) {
+        this.lockInProgress = false;
+        clearTimeout(this.lockTmout);
+        this.lockTmout = null;
+        if (tmout > 0) {
+            if (tmout > 3600) tmout = 3600;
+            this.lockTmout = setTimeout(() => {
+                this.lockInProgress = true;
+                this.dispatchEvent(new libVES.CustomEvent('authexpire', {detail: {vault: this}}));
+                if (this.lockInProgress) this.lock();
+            }, tmout * 1000);
+            return Promise.resolve(true);
+        }
+        clearTimeout(this.refreshTmout);
+        this.refreshTmout = null;
+        this.stop();
+        return this.vaultKey.VES.logout();
+    }
+
+    random() {
+        return this.vaultKey.VES.generateVESkey();
+    }
+
+    static toRef(value, ves) {
+        switch (typeof(value)) {
+            case 'object':
+                return value;
+            case 'number':
+                value = String(value);
+            case 'string':
+                let uri = new URL(value, "ves://" + (ves && ves.domain ? ves.domain : ''));
+                if (uri.protocol != 'ves:') throw new libVES.Error.InvalidValue("Invalid schema: '" + uri.protocol + "', expected 'ves:'");
+                let p = uri.pathname.split('/');
+                let id = p.length > 1 ? decodeURIComponent(p[1]) : '';
+                let ref = uri.host ? {domain: uri.host, externalId: id} : {version: Number(id)};
+                if (p[2] != null) ref.email = decodeURIComponent(p[2]);
+                if (uri.password) ref.veskey = uri.password;
+                return ref;
+        }
+    };
+
+    static toRefs(refs, ves, owner) {
+        if (!refs) return [];
+        if (!(refs instanceof Array)) refs = [refs];
+        refs = refs.map((ref) => libVES.Vault.toRef(ref, ves)).filter((ref) => ref);
+        if (owner) {
+            if (!ves.externalId) throw new libVES.Error.Unauthorized('The vault is locked');
+            refs.push({domain: ves.domain, externalId: ves.externalId});
+        }
+        return refs;
+    }
+
+    static toUri(ref, short) {
+        if (ref.externalId && short) return (ref.domain == short ? '' : '//' + encodeURIComponent(ref.domain) + '/') + encodeURIComponent(ref.externalId).replaceAll('%40', '@');
+        let uri = ref.externalId ?  "ves://" + encodeURIComponent(ref.domain) + "/" + encodeURIComponent(ref.externalId) : "ves://" + (ref.version ? "/" + String(Number(ref.version)) : encodeURIComponent(ref.domain ?? '') + "/");
+        if (ref.email != null) uri += '/' + encodeURIComponent(ref.email);
+        return uri;
+    }
+
+    uri() {
+        if (!this.externalId && !this.version && !this.email) return null;
+        return libVES.Vault.toUri(this);
+    }
+
+    short() {
+        return libVES.Vault.toUri(this, this.vaultKey.VES.domain);
+    }
+
+    badauth() {
+        const ves = this.vaultKey.VES;
+        if (!this.externalId || (this.externalId == ves.externalId && this.domain == ves.domain)) return Promise.reject(new libVES.Error.InvalidKey('Not authorized for this key'));
+        return this.vaultKey.getFields({encSessionToken: true, type: true, algo: true, publicKey: true, privateKey: true, vaultItems: {type: true, vaultEntries: {vaultKey : {id: true}, encData: true}, meta: true}}).then(() => {
+            const ves2 = new libVES({domain: this.domain, externalId: this.externalId});
+            ves2.vaultKey = Promise.resolve(this.vaultKey);
+            ves2.unlockedKeys = ves.unlockedKeys;
+            ves2.pendingKeys = ves.pendingKeys;
+            this.vaultKey.VES = ves2;
+            return ves2.unlock();
+        });
+    }
+
+    createWatch() {
+        let w = new libVES.Watch(this.vaultKey);
+        w.fields = {vaultItem: {id: true, type: true, deleted: true, vaultKey: {id: true, type: true, algo: true, publicKey: true, externals: {domain: true, externalId: true}, user: {id: true, email: true}}, file: {externals: {domain: true, externalId: true}, creator: true}, meta: true}, authorSession: {vaultKey: {id: true, externals: {domain: true, externalId: true}, user: {email: true}, type: true}, domain: true, user: {email: true}, remote: true, userAgent: true}, session: {id: true, remote: true, userAgent: true, vaultKey: {id: true}, user: {id: true}}};
+        return w;
+    }
+
+    replay(optns) {
+        return this.objects(optns).then((objs) => Promise.all(objs.map((obj) => {
+            if (obj instanceof libVES.Item) return new libVES.CustomEvent('itemadd', {detail: {replay: true, item: obj, share: this}});
+            else if (obj instanceof libVES.Vault) return new libVES.CustomEvent('vaultadd', {detail: {replay: true, vault: obj, share: this}});
+        })));
+    }
+
+    password() {
+        return this.vaultKey.getVaultItems().then((vitems) => {
+            if (!vitems) return this.badauth().then(() => this.password());
+            return vitems.reduce((p, vitem) => p.catch((e) => vitem.getType().then((type) => (type == 'password' ? vitem.getId().then((id) => this.item({version: id})) : Promise.reject(e)))), Promise.reject(new libVES.Error.NotFound('No password item found')));
+        });
+    }
+
+    verify() {
+        if (this.current !== undefined) return Promise.resolve(this);
+        return this.vaultKey.VES.usersToKeys([(this.externalId ? {domain: this.domain, externalId: this.externalId} : this.email)]).then((vkeys) => Promise.all(vkeys.map((vkey) => vkey.getFields(vkey.id ? {id: true, type: true} : {type: true}))).then((flds) => flds.reduce((res, fld, idx) => {
+            if (res) return res;
+            if (this.version) return this.version == fld.id ? vkeys[idx] : null;
+            switch (fld.type) {
+                case 'secondary': case 'current': case 'temp': return vkeys[idx];
+            }
+        }, null))).then((vkey) => {
+            if (!vkey) throw new libVES.Error.NotFound('Cannot find or create a matching key');
+            return vkey.getType().then((type) => {
+                this.current = (type == 'current' || type == 'secondary');
+                this.owner = (this.externalId != null && this.externalId == vkey.VES.externalId && this.domain == vkey.VES.domain) || (!!this.email && this.email == vkey.VES.email);
+                this.vaultKey = vkey;
+                return this;
+            });
+        });
+    }
+
+    _eventTracker() {
+        return new libVES.EventTracker(this);
+    }
+
+    toString() {
+        return 'libVES.Vault(' + (this.uri() ?? '[pending]') + ')';
+    }
+
+};
+
+libVES.Author = class {
+    constructor(sess, ves) {
+        this.sessid = sess.id;
+        if (sess.vaultKey?.externals?.[0]) this.vault = new libVES.Vault(sess.vaultKey.externals[0], ves);
+        else if (sess.user?.email) this.vault = new libVES.Vault({email: sess.user.email}, ves);
+        this.remote = sess.remote;
+        this.userAgent = sess.userAgent;
+    }
+    toString() {
+        return 'libVES.Author(' + (this.sessid ?? '') + ')';
+    }
+    toJSON() {
+        return this.sessid;
+    }
+};
+
+libVES.CustomEvent = class extends CustomEvent {
+    toString() {
+        return 'libVES.CustomEvent(' + this.type + (this.detail?.id ? '[' + this.detail.id + ']' : '') + (this.detail?.at ? ' @' + this.detail.at : '') + ')';
+    }
+    toJSON() {
+        return this.detail?.id;
+    }
+};
+
+libVES.EventTracker = class {
+    constructor(vault, share) {
+        this.vault = vault;
+        this.share = share;
+        this.items = {};
+    }
+
+    _event(e, attn) {
+        const event = (type, detail) => {
+            detail.event = e;
+            return e.getFields({id: true, recordedAt: true, authorSession: {vaultKey: {id: true, externals: {domain: true, externalId: true}, user: {email: true}}, user: {email: true}, domain: true, remote: true, userAgent: true}}).then((flds) => {
+                detail.id = flds?.id;
+                if (flds?.recordedAt) detail.at = new Date(flds.recordedAt);
+                detail.author = new libVES.Author((flds?.authorSession ?? {}), this.vault.vaultKey.VES);
+            }).catch(() => null).then(() => new libVES.CustomEvent(type, {detail: detail}));
+        }
+        return e.getType().then((type) => {
+            const itemfn = (ac, attn, sh) => e.getVaultItem().then((vitem) => vitem.getType().then((itype) => {
+                switch (itype) {
+                    case 'string': case 'file':
+                        return vitem.getFields({id: true, file: {externals: {domain: true, externalId: true}}, deleted: true, type: true, meta: true}).then((flds) => {
+                            let ext = flds?.file?.externals?.[0];
+                            if (!ext) return null;
+                            let item = new libVES.Item({domain: ext.domain, externalId: ext.externalId, version: flds.id}, this.vault, flds);
+                            let ids = (this.items[item.uri()] ||= []);
+                            let idx = ids.indexOf(flds.id);
+                            if (idx < 0 && (flds.deleted === false || (ac == 'create' || ac == 'add'))) ids.unshift(flds.id), idx = 0;
+                            return event((idx == 0 ? '' : 'old') + 'item' + ac, {item: item, share: sh});
+                        });
+                    case 'password':
+                        return vitem.getFields({vaultKey: {type: true, externals: {domain: true, externalId: true}}}).then((flds) => {
+                            switch (flds?.vaultKey?.type) {
+                                case 'secondary':
+                                    return event('vault' + ac, {vault: this.vault.vault(flds.vaultKey.externals?.[0]), share: sh});
+                                default:
+                                    if (attn) return vitem.getVaultKey().then((vkey) => this.vault.vaultKey.VES.attnVaultKeys([vkey])).catch((e) => console.log(e)).then(() => null);
+                            }
+                        });
+                }
+            }));
+            const sharefn = () => (this.share ? e.getVaultKey().then((vkey) => vkey.getFields({id: true, type: true, externals: {domain: true, externalId: true}, user: {id: true, email: true}}).then((flds) => {
+                let f = flds?.externals?.[0] ? flds.externals[0] : (flds?.user?.email ? {email: flds.user.email} : {});
+                f.version = flds.id;
+                let vault = this.vault.vault(f);
+                vault.current = (f.externals && flds.type == 'secondary') || (f.email && flds.type == 'current');
+                return vault;
+            })) : Promise.resolve(this.vault));
+            switch (type) {
+                case 'vaultEntry.deleted':
+                    return sharefn().then((sh) => itemfn('remove', false, sh));
+                case 'vaultEntry.created':
+                    return sharefn().then((sh) => itemfn('add', attn !== false, sh));
+                case 'vaultItem.deleted':
+                    return itemfn('delete');
+                case 'vaultItem.created':
+                    return itemfn('create');
+                case 'vaultItem.listening':
+                    return itemfn('change');
+                case 'session.created':
+                    return e.getFields({session: {id: true, remote: true, userAgent: true, vaultKey: {id: true}, user: {id: true}}}).then((flds) => {
+                        if (!flds?.session) return null;
+                        let ses = new libVES.Author(flds.session, this.vault.vaultKey.VES);
+                        ses.vault = this.vault;
+                        return event('sessioncreate', {vault: this.vault, session: ses});
+                    });
+            }
+        }).catch((er) => (console.log(er), event('error', {error: er})));
+    }
+};
+
+
+
+libVES.Item = class extends libVES.EventTarget {
+    constructor(ref, vault, fields) {
+        const ves = vault.vaultKey.VES;
+        super();
+        if (ref == null || typeof(ref) == 'function') {
+            this.provisional = {share: [vault], ref: (ref || libVES.Item.newRef)};
+        } else {
+            ref = libVES.Vault.toRef(ref, ves);
+            if ((!ref.domain || !ref.externalId) && !ref.version) throw new libVES.Error.InvalidValue('Bad item reference');
+            this.domain = ref.domain;
+            this.externalId = ref.externalId;
+            this.version = ref.version || null;
+        }
+        this.vault = vault;
+        this._vaultItem(ves, fields);
+    };
+
+    static newRef() {
+        let d = new Date();
+        return ((d.getFullYear() * 100 + d.getMonth() + 1) * 100 + d.getDate()).toFixed(0) + '.' + (((d.getHours() + 100) * 100 + d.getMinutes()) * 100 + d.getSeconds() + d.getMilliseconds() / 1000).toFixed(3).slice(-10);
+    }
+
+    _vaultItem(ves, fields) {
+        if (this.vaultItem && this._entriesCache !== null) return this.vaultItem;
+        ves ||= this.vaultItem.VES;
+        if (!fields) {
+            fields = this.externalId ? {file: {externals: [{domain: this.domain, externalId: this.externalId}]}} : {};
+            if (this.version) fields.id = this.version;
+        } else if (fields.vaultEntries) this._entriesCache = Promise.resolve(fields).finally(() => this._entriesCache = null);
+        return this.vaultItem = new libVES.VaultItem(fields, ves);
+    };
+
+    _entries() {
+        if (this.provisional) return Promise.reject(new libVES.Error.NotFound('Not available for a provisional item'));
+        if (this._entriesCache) return this._entriesCache;
+        this._entriesCache = this._vaultItem().getFields({vaultEntries: {encData: true, vaultKey: {id: true, type: true, algo: true, privateKey: true, publicKey: true, user: {id: true, email: true}, externals: {domain: true, externalId: true}}}, file: {creator: {id: true}}, vaultKey: {user: {id: true}}, deleted: true}).then((flds) => {
+            if (!flds?.vaultEntries) return Promise.reject(new libVES.Error.InvalidKey('Not authorized to access this item'));
+            return flds;
+        });
+        this._entriesCache.catch((er) => null).finally(() => this._entriesCache = null);
+        return this._entriesCache;
+    };
+
+    _get() {
+        return this._entries().then(() => this.vaultItem.get());
+    };
+
+    _reset() {
+        this._entriesCache = null;
+    };
+
+    latest() {
+        return this.externalId && this.version ? this.vault.item({domain: this.domain, externalId: this.externalId}) : this;
+    };
+
+    get() {
+        return this._get().then((val) => {
+            if (typeof(val) != 'string') throw new libVES.Error.InvalidValue('The item value is not a string');
+            return val;
+        });
+    };
+
+    put(value, shares) {
+        if (value == null) return Promise.reject(new libVES.Error.InvalidValue('The item value cannot be empty'));
+        let prref;
+        return (shares ? Promise.resolve(libVES.Vault.toRefs(shares, this.vaultItem.VES, true)) : this.share().then((shares) => {
+            let owner = shares.reduce((cur, sh) => (cur || ((sh.owner && sh.externalId?.match(/@/)) ? sh : null)), null);
+            if (owner && owner.uri() != this.vault.uri()) shares.push(this.vault.vault({domain: '.admin', externalId: owner.externalId}));
+            return shares;
+        }).catch((e) => {
+            if (e && e.code == 'NotFound') return libVES.Vault.toRefs([], this.vaultItem.VES, true);
+            throw e;
+        })).then((shares) => {
+            if (!this.provisional) return shares;
+            prref = libVES.Vault.toRef(this.provisional.ref(), this.vaultItem.VES);
+            if (!prref?.externalId) return Promise.reject(new libVES.Error.InvalidValue('Bad provisional reference generated by the supplied function'));
+            return this.vaultItem.setFields({file: {externals: [prref]}}).then(() => shares);
+        }).then((shares) => this.vaultItem.shareWith(shares, value)).then(() => {
+            if (prref) {
+                this.externalId = prref.externalId;
+                this.domain = prref.domain;
+                delete(this.provisional);
+            }
+            this.version = null;
+            this._reset();
+            return value;
+        });
+    };
+
+    cipher(optns, shares) {
+        return this._get().then((val) => {
+            if (!(val instanceof libVES.Cipher)) throw new libVES.Error.InvalidValue('The item value is not a cipher');
+            return (shares ? this.share(shares) : Promise.resolve(null)).then(() => val);
+        }).catch((e) => {
+            if (e && e.code == 'NotFound') {
+                let algo = optns?.algo || this.vaultItem.VES.cipherAlgo || 'AES256GCM1K';
+                if (!libVES.Cipher[algo]) throw new libVES.Error.InvalidValue('Unsupported cipher: ' + algo);
+                let ci = new libVES.Cipher[algo]();
+                return this.put(ci, shares);
+            }
+            throw e;
+        }).then((ci) => new libVES.ItemCipher(ci, this));
+    };
+
+    json(val, shares) {
+        if (val === undefined) return this.get().then((val) => JSON.parse(val));
+        return this.put(JSON.stringify(val), shares).then(() => val);
+    };
+
+    exists() {
+        return this._entries().then((flds) => !flds?.deleted).catch((e) => {
+            if (e?.code == 'NotFound') return false;
+            if (e?.code == 'InvalidKey') return true;
+            throw e;
+        });
+    };
+
+    _provShare(shares, del) {
+        return new Promise((resolve, reject) => {
+            let uris = libVES.Vault.toRefs(shares, this.vaultItem.VES).map((ref) => this.vault.vault(ref).uri());
+            let prov = {};
+            this.provisional.share.map((sh) => prov[sh.uri()] = sh);
+            resolve(this.vaultItem.VES.usersToKeys(libVES.Vault.toRefs(uris.filter((uri) => !prov[uri]))));
+        }).then((vkeys) => Promise.all(vkeys.map((vkey => vkey.getFields({user: {email: true}, externals: {domain: true, externalId: true}, type: true}).then((flds) => {
+            let sh = new libVES.Vault((flds?.externals?.[0] ?? flds?.user?.email), this.vaultItem.VES, flds);
+            if (sh) return sh.verify();
+        }))))).then((shares) => shares.filter((sh) => sh)).then((shares) => {
+            this.provisional.share = this.provisional.share.concat(shares);
+            if (del) {
+                let uris = {};
+                shares.map((sh) => uris[sh.uri()] = sh);
+                uris[this.vault.uri()] = this.vault;
+                this.provisional.share = this.provisional.share.filter((sh) => uris[sh.uri()]);
+            }
+            return this.provisional.share;
+        });
+    }
+
+    share(shares) {
+        if (this.provisional) {
+            if (shares) return this._provShare(shares, true);
+            return Promise.resolve(this.provisional.share);
+        }
+        return (shares ? (this._reset(), this.vaultItem.shareWith(libVES.Vault.toRefs(shares, this.vaultItem.VES, true))) : Promise.resolve(null)).then(() => {
+            let result = [];
+            let found = {};
+            let admins = {};
+            return this._entries().then((flds) => flds.vaultEntries.map((entry) => {
+                let vkey = entry?.vaultKey;
+                let ref = vkey?.externals?.[0];
+                if (!ref) {
+                    const email = vkey?.user?.email;
+                    ref = email ? {email: email} : {version: vkey?.id};
+                }
+                let vault = new libVES.Vault(ref, this.vaultItem.VES);
+                let uri = vault.uri();
+                if (!found[uri]) {
+                    result.push(found[uri] = vault);
+                    let uid = vkey?.user?.id;
+                    vault.owner = !!uid && uid == (flds.file?.creator?.id ?? flds.vaultKey?.user?.id);
+                    if (vault.domain == '.admin') admins[vault.externalId] = true;
+                }
+                switch (vkey?.type) {
+                    case 'current': case 'secondary':
+                        found[uri].current = true;
+                        break;
+                    default:
+                        vault.current = false;
+                }
+            })).then(() => {
+                result.map((sh) => sh.admin = !!admins[sh.externalId]);
+                return result;
+            });
+        });
+    };
+
+    add(shares) {
+        if (this.provisional) return this._provShare(shares, false).then(() => true);
+        return this._entries().then(() => this.vaultItem.getShareVaultKeys()).then((vkeys) => {
+            if (!vkeys) throw new libVES.Error.InvalidKey('Not authorized to share this item');
+            if (!shares) return true;
+            libVES.Vault.toRefs(shares, this.vaultItem.VES).map((share) => vkeys.push(share));
+            this._reset();
+            return this.vaultItem.shareWith(vkeys);
+        }).then(() => true);
+    };
+
+    remove(shares) {
+        shares = libVES.Vault.toRefs(shares, this.vaultItem.VES);
+        if (!shares || !shares.length) return Promise.resolve(true);
+        if (this.provisional) return new Promise((resolve, reject) => {
+            let uris = {};
+            shares.map((sh) => uris[this.vault.vault(sh).uri()] = true);
+            this.provisional.share = this.provisional.share.filter((sh) => !uris[sh.uri()]);
+            resolve(true);
+        });
+        return this._entries().then(() => this.vaultItem.unshareWith(shares)).then(() => (this._reset(), true));
+    };
+
+    refuse() {
+        return this.remove(this.vault);
+    };
+
+    delete() {
+        this._reset();
+        return this.vaultItem.delete();
+    }
+
+    badauth() {
+        return (this.vaultItem.VES == this.vault.vaultKey.VES ? this.vault.badauth() : Promise.resolve(null)).then(() => this.vaultItem.VES = this.vault.vaultKey.VES);
+    }
+
+    shareFor(share) {
+        let uri = this.vault.vault(share).uri();
+        return uri ? this.share().then((shares) => shares.reduce((res, sh) => (res ?? (sh.uri() == uri ? sh : null)), null)) : null;
+    }
+
+    uri() {
+        if (!this.externalId && !this.version) return null;
+        return libVES.Vault.toUri(this);
+    }
+
+    short() {
+        if (!this.externalId) return null;
+        return libVES.Vault.toUri(this, this.vaultItem.VES.domain);
+    }
+
+    _eventTracker() {
+        return new libVES.EventTracker(this.vault, true);
+    }
+
+    createWatch() {
+        let w = new libVES.Watch(this.vaultItem);
+        w.fields = {vaultKey: {id: true, type: true, algo: true, publicKey: true, externals: {domain: true, externalId: true}, user: {id: true, email: true}}, vaultItem: {id: true, type: true, meta: true, deleted: true, vaultKey: {id: true, type: true, algo: true, publicKey: true, externals: {domain: true, externalId: true}, user: {id: true, email: true}}, file: {externals: {domain: true, externalId: true}, creator: true}}, authorSession: {vaultKey: {id: true, type: true, externals: {domain: true, externalId: true}}, domain: true, user: {email: true}, remote: true, userAgent: true}};
+        return w;
+    }
+
+    replay() {
+        return this.share().then((vaults) => Promise.all(vaults.map((vault) => {
+            if (this.externalId) return new libVES.CustomEvent('itemadd', {detail: {replay: true, item: this, share: vault}});
+            else return new libVES.CustomEvent('vaultadd', {detail: {replay: true, vault: this.vault, share: vault}});
+        })));
+    }
+
+    readable() {
+        return this._get().then(() => true).catch((er) => {
+            switch (er?.code) {
+                case 'NotFound':
+                case 'InvalidKey': return false;
+                default: throw er;
+            }
+        });
+    }
+
+    writable() {
+        return this.shareFor(this.vault).then((sh) => sh && (sh.owner || sh.admin)).catch((er) => {
+            switch (er?.code) {
+                case 'NotFound': return true;
+                case 'InvalidKey': return false;
+                default: throw er;
+            }
+        });
+    }
+
+    toString() {
+        return 'libVES.Item(' + (this.uri() ?? '[provisional]') + ')';
+    }
+
+};
+
+libVES.ItemCipher = class {
+    constructor(ci, item) {
+        this.cipher = ci;
+        this.item = item;
+    }
+
+    meta(val) {
+        if (val == null) return Promise.resolve(this.cipher.meta);
+        if (!(val instanceof Object)) return Promise.reject(new libVES.Error.InvalidValue('Cipher metadata must be an object'));
+        this.cipher.meta = val;
+        return this.item.put(this.cipher).then(() => this.cipher.meta);
+    }
+
+    reset(final) {
+        if (final && !this.final) return Promise.resolve(null);
+        this.final = false;
+        return this.item.vaultItem.get().then((ci) => this.cipher = ci);
+    }
+
+    encrypt(data, optns) {
+        return this.reset(true).then(() => {
+            this.final = optns?.final !== false;
+            if (data instanceof Blob) {
+                return data.arrayBuffer().then((buf) => this.cipher.encrypt(buf, this.final)).then((ctext) => {
+                    const op = {type: 'application/vnd.ves.encrypted'};
+                    if (optns) optns.type = data.type;
+                    if (data instanceof File) {
+                        if (optns) optns.name = data.name;
+                        return new File([ctext], this.item.externalId, op);
+                    }
+                    return new Blob([ctext], op);
+                });
+            } else if (data instanceof ArrayBuffer) return this.cipher.encrypt(data, this.final).then((ctext) => ctext.buffer);
+            else if ((data instanceof Object) && (data.buffer instanceof ArrayBuffer)) return this.cipher.encrypt(data.buffer, this.final).then((ctext) => new data.constructor(ctext.buffer));
+            else return this.cipher.encrypt(libVES.Util.StringToByteArray(String(data)), this.final).then((ctext) => libVES.Util.ByteArrayToB64(ctext));
+        });
+    }
+
+    decrypt(data, optns) {
+        return this.reset(true).then(() => {
+            this.final = optns?.final !== false;
+            if (data instanceof Blob) {
+                return data.arrayBuffer().then((buf) => this.cipher.decrypt(buf, this.final)).then((ctext) => {
+                    if (data instanceof File) return new File([ctext], (optns?.name || ''), optns);
+                    return new Blob([ctext], optns);
+                });
+            } else if (data instanceof ArrayBuffer) return this.cipher.decrypt(data, this.final).then((ctext) => ctext.buffer);
+            else if ((data instanceof Object) && (data.buffer instanceof ArrayBuffer)) return this.cipher.decrypt(data.buffer, this.final).then((ctext) => new data.constructor(ctext.buffer));
+            else return this.cipher.decrypt(libVES.Util.B64ToByteArray(String(data)), this.final).then((ctext) => libVES.Util.ByteArrayToString(ctext));
+        });
+    }
+
+    toString() {
+        return 'libVES.ItemCipher(' + String(this.item) + ')';
+    }
+
+    toJSON() {
+        return this.item?.uri();
+    }
+};
+libVES.version = '3.00';
+
 module.exports = libVES;