Signing
Owns one wallet's active signing identity. Creation and recovery use complete SDK-issued options. Native/backup prerequisites are revalidated at execution. The encrypted database journals interrupted operations; a failed backup submission does not activate the new identity. Successful activation and initialization refresh the wallet's platform credential registration.
Keep one writable wallet instance per database. Provider extensions may read established identities.
Functions
Submits the same identity to an explicitly selected provider; it never invents a seed for an existing key.
Offers backup for an existing retained recovery secret or an explicitly exportable software key.
Removes only pending local state. Any record already accepted by a provider remains discoverable and can be deleted separately; cancellation never silently destroys a recovery copy.
Gives an explicit custodian an additional copy of the key. The local key is retained; this does not create a recovery record or enable remote signing.
Creates P-256 and did:jwk. No provider is selected and no backup is made by default.
Offers only complete choices compatible with the host policy and current native/provider prerequisites.
Offers registered custody destinations only when the current policy permits private-key export.
Deletes a selected backup through its owning provider. Other device copies may remain outside its control.
Discovers safe references and failures from the same attempt. No secret leaves discovery.
Reopens the selected identity, or creates the recommended identity without recovery using configured defaults. Pending and unavailable states never cause replacement key generation. Use creationOptions for an explicit choice.
Reports each configured recovery provider, including its unmet prerequisites.
Validates the record, private/public key and exact DID before offering supported destinations.
Restores into an empty wallet, or repairs the same identity after its native key is missing/invalidated.
Retries a persisted backup submission, or removes an interrupted pre-activation key operation.
Returns established identity metadata, including an explicit unavailable or interrupted state.