ContractsClient.cs

using System;
using System.Collections.Generic;
using System.IO;
using System.Linq;
using System.Net.Http;
using System.Net.Http.Headers;
using System.Runtime.ExceptionServices;
using System.Security.Cryptography;
using System.Text;
using System.Threading.Tasks;
using System.Xml;
using System.Xml.Schema;
using Waher.Content;
using Waher.Content.Xml;
using Waher.Content.Xml.Text;
using Waher.Content.Xsl;
using Waher.Events;
using Waher.Events.XMPP;
using Waher.Networking.XMPP.Contracts.EventArguments;
using Waher.Networking.XMPP.Contracts.HumanReadable;
using Waher.Networking.XMPP.Contracts.PublicKeys;
using Waher.Networking.XMPP.Contracts.Search;
using Waher.Networking.XMPP.Events;
using Waher.Networking.XMPP.HttpFileUpload;
using Waher.Networking.XMPP.P2P;
using Waher.Networking.XMPP.P2P.E2E;
using Waher.Networking.XMPP.P2P.SymmetricCiphers;
using Waher.Networking.XMPP.StanzaErrors;
using Waher.Persistence;
using Waher.Persistence.Filters;
using Waher.Runtime.Cache;
using Waher.Runtime.Collections;
using Waher.Runtime.Inventory;
using Waher.Runtime.Profiling;
using Waher.Runtime.Settings;
using Waher.Runtime.Temporary;
using Waher.Runtime.Threading;
using Waher.Script;
using Waher.Security;
using Waher.Security.CallStack;
 
namespace Waher.Networking.XMPP.Contracts
{
    public class ContractsClient : XmppExtension
    {
        public const string NamespaceLegalIdentitiesIeeeV1 = "urn:ieee:iot:leg:id:1.0";
 
        public const string NamespaceLegalIdentitiesNeuroFoundationV1 = "urn:nf:iot:leg:id:1.0";
 
        public const string NamespaceLegalIdentitiesCurrent = NamespaceLegalIdentitiesNeuroFoundationV1;
 
        public const SymmetricCipherAlgorithms DefaultCipherAlgorithm = SymmetricCipherAlgorithms.Aes256;
 
        public const string E2eKeySemaphoreName = "XMPP.E2E";
 
        public static readonly string[] NamespacesLegalIdentities = new string[]
        {
            NamespaceLegalIdentitiesIeeeV1,
            NamespaceLegalIdentitiesNeuroFoundationV1
        };
 
        public static bool IsNamespaceLegalIdentity(string Namespace)
        {
            return Array.IndexOf(NamespacesLegalIdentities, Namespace) >= 0;
        }
 
        public const string NamespaceSmartContractsIeeeV1 = "urn:ieee:iot:leg:sc:1.0";
 
        public const string NamespaceSmartContractsNeuroFoundationV1 = "urn:nf:iot:leg:sc:1.0";
 
        public const string NamespaceSmartContractsCurrent = NamespaceSmartContractsNeuroFoundationV1;
 
        public static readonly string[] NamespacesSmartContracts = new string[]
        {
            NamespaceSmartContractsIeeeV1,
            NamespaceSmartContractsNeuroFoundationV1
        };
 
        public static bool IsNamespaceSmartContract(string Namespace)
        {
            return Array.IndexOf(NamespacesSmartContracts, Namespace) >= 0;
        }
 
        public const string NamespaceOnboarding = "http://waher.se/schema/Onboarding/v1.xsd";
 
        private static readonly string KeySettings = typeof(ContractsClient).FullName + ".";
        private static readonly string ContractKeySettings = typeof(ContractsClient).Namespace + ".Contracts.";
 
        private const int CacheSchemaDays = 7;
 
 
        private readonly PublicKeyRecords publicKeys = new PublicKeyRecords();
        private readonly Dictionary<string, KeyEventArgs> matchingKeys = new Dictionary<string, KeyEventArgs>();
        private readonly Cache<string, KeyValuePair<byte[], bool>> contentPerPid = new Cache<string, KeyValuePair<byte[], bool>>(int.MaxValue, TimeSpan.FromDays(1), TimeSpan.FromDays(1));
        private EndpointSecurity keys;
        private DateTime keysTimestamp = DateTime.MinValue;
        private SymmetricCipherAlgorithms preferredEncryptionAlgorithm = DefaultCipherAlgorithm;
        private ICallStackCheck[] approvedSources = null;
        private readonly string componentAddress;
        private string keySettingsPrefix;
        private string contractKeySettingsPrefix;
        private bool keySettingsPrefixLocked = false;
        private bool useKeysForE2e = false;
        private bool preferredEncryptionAlgorithmLocked = false;
        private RandomNumberGenerator rnd = RandomNumberGenerator.Create();
        private Aes aes;
 
        private sealed class LoadedKey : IDisposable
        {
            public LoadedKey(IE2eEndpoint Endpoint, bool MustDispose, DateTime Timestamp)
            {
                this.Endpoint = Endpoint;
                this.MustDispose = MustDispose;
                this.Timestamp = Timestamp;
            }
 
            public IE2eEndpoint Endpoint { get; }
            public bool MustDispose { get; }
            public DateTime Timestamp { get; }
 
            public void Dispose()
            {
                if (this.MustDispose)
                    this.Endpoint?.Dispose();
            }
        }
 
        private sealed class LoadedKeySet : IDisposable
        {
            private IE2eEndpoint[] keys;
            private bool transferred;
 
            public LoadedKeySet(IE2eEndpoint[] Keys, DateTime Timestamp)
            {
                this.keys = Keys;
                this.Timestamp = Timestamp;
            }
 
            public IE2eEndpoint[] Keys => this.keys;
            public DateTime Timestamp { get; }
 
            public IE2eEndpoint[] TransferKeys()
            {
                this.transferred = true;
                return this.keys;
            }
 
            public void Dispose()
            {
                if (!this.transferred && !(this.keys is null))
                {
                    foreach (IE2eEndpoint Key in this.keys)
                        Key.Dispose();
                }
 
                this.keys = Array.Empty<IE2eEndpoint>();
            }
        }
 
        #region Construction
 
        public ContractsClient(XmppClient Client, string ComponentAddress)
            : this(Client, ComponentAddress, null)
        {
        }
 
        [Obsolete("Use overload with ICallStackCheck[] instead.")]
        public ContractsClient(XmppClient Client, string ComponentAddress, object[] ApprovedSources)
            : this(Client, ComponentAddress, Assert.Convert(ApprovedSources))
        {
        }
 
        public ContractsClient(XmppClient Client, string ComponentAddress, ICallStackCheck[] ApprovedSources)
            : base(Client)
        {
            this.componentAddress = ComponentAddress;
            this.approvedSources = ApprovedSources;
            this.SetLegalIdentityStateAllowedSources(ApprovedSources);
            this.keys = null;
 
            #region NeuroFoundation V1
 
            this.client.RegisterMessageHandler("identity", NamespaceLegalIdentitiesNeuroFoundationV1, this.IdentityMessageHandler, true);
            this.client.RegisterMessageHandler("petitionIdentityMsg", NamespaceLegalIdentitiesNeuroFoundationV1, this.PetitionIdentityMessageHandler, false);
            this.client.RegisterMessageHandler("petitionIdentityResponseMsg", NamespaceLegalIdentitiesNeuroFoundationV1, this.PetitionIdentityResponseMessageHandler, false);
            this.client.RegisterMessageHandler("petitionSignatureMsg", NamespaceLegalIdentitiesNeuroFoundationV1, this.PetitionSignatureMessageHandler, false);
            this.client.RegisterMessageHandler("petitionSignatureResponseMsg", NamespaceLegalIdentitiesNeuroFoundationV1, this.PetitionSignatureResponseMessageHandler, false);
            this.client.RegisterMessageHandler("petitionClientUrl", NamespaceLegalIdentitiesNeuroFoundationV1, this.PetitionClientUrlEventHandler, false);
            this.client.RegisterMessageHandler("identityReview", NamespaceLegalIdentitiesNeuroFoundationV1, this.IdentityReviewEventHandler, false);
            this.client.RegisterMessageHandler("clientMessage", NamespaceLegalIdentitiesNeuroFoundationV1, this.ClientMessageEventHandler, false);
 
            this.client.RegisterMessageHandler("contractSigned", NamespaceSmartContractsNeuroFoundationV1, this.ContractSignedMessageHandler, true);
            this.client.RegisterMessageHandler("contractCreated", NamespaceSmartContractsNeuroFoundationV1, this.ContractCreatedMessageHandler, false);
            this.client.RegisterMessageHandler("contractUpdated", NamespaceSmartContractsNeuroFoundationV1, this.ContractUpdatedMessageHandler, false);
            this.client.RegisterMessageHandler("contractDeleted", NamespaceSmartContractsNeuroFoundationV1, this.ContractDeletedMessageHandler, false);
            this.client.RegisterMessageHandler("petitionContractMsg", NamespaceSmartContractsNeuroFoundationV1, this.PetitionContractMessageHandler, false);
            this.client.RegisterMessageHandler("petitionContractResponseMsg", NamespaceSmartContractsNeuroFoundationV1, this.PetitionContractResponseMessageHandler, false);
            this.client.RegisterMessageHandler("contractProposal", NamespaceSmartContractsNeuroFoundationV1, this.ContractProposalMessageHandler, false);
 
            #endregion
 
            #region IEEE v1
 
            this.client.RegisterMessageHandler("identity", NamespaceLegalIdentitiesIeeeV1, this.IdentityMessageHandler, true);
            this.client.RegisterMessageHandler("petitionIdentityMsg", NamespaceLegalIdentitiesIeeeV1, this.PetitionIdentityMessageHandler, false);
            this.client.RegisterMessageHandler("petitionIdentityResponseMsg", NamespaceLegalIdentitiesIeeeV1, this.PetitionIdentityResponseMessageHandler, false);
            this.client.RegisterMessageHandler("petitionSignatureMsg", NamespaceLegalIdentitiesIeeeV1, this.PetitionSignatureMessageHandler, false);
            this.client.RegisterMessageHandler("petitionSignatureResponseMsg", NamespaceLegalIdentitiesIeeeV1, this.PetitionSignatureResponseMessageHandler, false);
            this.client.RegisterMessageHandler("petitionClientUrl", NamespaceLegalIdentitiesIeeeV1, this.PetitionClientUrlEventHandler, false);
            this.client.RegisterMessageHandler("identityReview", NamespaceLegalIdentitiesIeeeV1, this.IdentityReviewEventHandler, false);
            this.client.RegisterMessageHandler("clientMessage", NamespaceLegalIdentitiesIeeeV1, this.ClientMessageEventHandler, false);
 
            this.client.RegisterMessageHandler("contractSigned", NamespaceSmartContractsIeeeV1, this.ContractSignedMessageHandler, true);
            this.client.RegisterMessageHandler("contractCreated", NamespaceSmartContractsIeeeV1, this.ContractCreatedMessageHandler, false);
            this.client.RegisterMessageHandler("contractUpdated", NamespaceSmartContractsIeeeV1, this.ContractUpdatedMessageHandler, false);
            this.client.RegisterMessageHandler("contractDeleted", NamespaceSmartContractsIeeeV1, this.ContractDeletedMessageHandler, false);
            this.client.RegisterMessageHandler("petitionContractMsg", NamespaceSmartContractsIeeeV1, this.PetitionContractMessageHandler, false);
            this.client.RegisterMessageHandler("petitionContractResponseMsg", NamespaceSmartContractsIeeeV1, this.PetitionContractResponseMessageHandler, false);
            this.client.RegisterMessageHandler("contractProposal", NamespaceSmartContractsIeeeV1, this.ContractProposalMessageHandler, false);
 
            #endregion
 
            this.aes = Aes.Create();
            this.aes.BlockSize = 128;
            this.aes.KeySize = 256;
            this.aes.Mode = CipherMode.CBC;
            this.aes.Padding = PaddingMode.None;
 
            this.keySettingsPrefix = KeySettings;
            this.contractKeySettingsPrefix = ContractKeySettings;
        }
 
        public override void Dispose()
        {
            #region NeuroFoundation V1
 
            this.client.UnregisterMessageHandler("identity", NamespaceLegalIdentitiesNeuroFoundationV1, this.IdentityMessageHandler, true);
            this.client.UnregisterMessageHandler("petitionIdentityMsg", NamespaceLegalIdentitiesNeuroFoundationV1, this.PetitionIdentityMessageHandler, false);
            this.client.UnregisterMessageHandler("petitionIdentityResponseMsg", NamespaceLegalIdentitiesNeuroFoundationV1, this.PetitionIdentityResponseMessageHandler, false);
            this.client.UnregisterMessageHandler("petitionSignatureMsg", NamespaceLegalIdentitiesNeuroFoundationV1, this.PetitionSignatureMessageHandler, false);
            this.client.UnregisterMessageHandler("petitionSignatureResponseMsg", NamespaceLegalIdentitiesNeuroFoundationV1, this.PetitionSignatureResponseMessageHandler, false);
            this.client.UnregisterMessageHandler("petitionClientUrl", NamespaceLegalIdentitiesNeuroFoundationV1, this.PetitionClientUrlEventHandler, false);
            this.client.UnregisterMessageHandler("identityReview", NamespaceLegalIdentitiesNeuroFoundationV1, this.IdentityReviewEventHandler, false);
            this.client.UnregisterMessageHandler("clientMessage", NamespaceLegalIdentitiesNeuroFoundationV1, this.ClientMessageEventHandler, false);
 
            this.client.UnregisterMessageHandler("contractSigned", NamespaceSmartContractsNeuroFoundationV1, this.ContractSignedMessageHandler, true);
            this.client.UnregisterMessageHandler("contractCreated", NamespaceSmartContractsNeuroFoundationV1, this.ContractCreatedMessageHandler, false);
            this.client.UnregisterMessageHandler("contractUpdated", NamespaceSmartContractsNeuroFoundationV1, this.ContractUpdatedMessageHandler, false);
            this.client.UnregisterMessageHandler("contractDeleted", NamespaceSmartContractsNeuroFoundationV1, this.ContractDeletedMessageHandler, false);
            this.client.UnregisterMessageHandler("petitionContractMsg", NamespaceSmartContractsNeuroFoundationV1, this.PetitionContractMessageHandler, false);
            this.client.UnregisterMessageHandler("petitionContractResponseMsg", NamespaceSmartContractsNeuroFoundationV1, this.PetitionContractResponseMessageHandler, false);
            this.client.UnregisterMessageHandler("contractProposal", NamespaceSmartContractsNeuroFoundationV1, this.ContractProposalMessageHandler, false);
 
            #endregion
 
            #region IEEE v1
 
            this.client.UnregisterMessageHandler("identity", NamespaceLegalIdentitiesIeeeV1, this.IdentityMessageHandler, true);
            this.client.UnregisterMessageHandler("petitionIdentityMsg", NamespaceLegalIdentitiesIeeeV1, this.PetitionIdentityMessageHandler, false);
            this.client.UnregisterMessageHandler("petitionIdentityResponseMsg", NamespaceLegalIdentitiesIeeeV1, this.PetitionIdentityResponseMessageHandler, false);
            this.client.UnregisterMessageHandler("petitionSignatureMsg", NamespaceLegalIdentitiesIeeeV1, this.PetitionSignatureMessageHandler, false);
            this.client.UnregisterMessageHandler("petitionSignatureResponseMsg", NamespaceLegalIdentitiesIeeeV1, this.PetitionSignatureResponseMessageHandler, false);
            this.client.UnregisterMessageHandler("petitionClientUrl", NamespaceLegalIdentitiesIeeeV1, this.PetitionClientUrlEventHandler, false);
            this.client.UnregisterMessageHandler("identityReview", NamespaceLegalIdentitiesIeeeV1, this.IdentityReviewEventHandler, false);
            this.client.UnregisterMessageHandler("clientMessage", NamespaceLegalIdentitiesIeeeV1, this.ClientMessageEventHandler, false);
 
            this.client.UnregisterMessageHandler("contractSigned", NamespaceSmartContractsIeeeV1, this.ContractSignedMessageHandler, true);
            this.client.UnregisterMessageHandler("contractCreated", NamespaceSmartContractsIeeeV1, this.ContractCreatedMessageHandler, false);
            this.client.UnregisterMessageHandler("contractUpdated", NamespaceSmartContractsIeeeV1, this.ContractUpdatedMessageHandler, false);
            this.client.UnregisterMessageHandler("contractDeleted", NamespaceSmartContractsIeeeV1, this.ContractDeletedMessageHandler, false);
            this.client.UnregisterMessageHandler("petitionContractMsg", NamespaceSmartContractsIeeeV1, this.PetitionContractMessageHandler, false);
            this.client.UnregisterMessageHandler("petitionContractResponseMsg", NamespaceSmartContractsIeeeV1, this.PetitionContractResponseMessageHandler, false);
            this.client.UnregisterMessageHandler("contractProposal", NamespaceSmartContractsIeeeV1, this.ContractProposalMessageHandler, false);
 
            #endregion
 
            this.keys?.Dispose();
            this.keys = null;
            this.keysTimestamp = DateTime.MinValue;
 
            this.rnd?.Dispose();
            this.rnd = null;
 
            this.aes?.Dispose();
            this.aes = null;
 
            base.Dispose();
        }
 
        public override string[] Extensions => new string[] { };
 
        public string ComponentAddress => this.componentAddress;
 
        #endregion
 
        #region Keys
 
        public DateTime KeysTimestamp => this.keysTimestamp;
 
        public string KeySettingsPrefix => this.keySettingsPrefix;
 
        public string ContractKeySettingsPrefix => this.contractKeySettingsPrefix;
 
        public SymmetricCipherAlgorithms PreferredEncryptionAlgorithm => this.preferredEncryptionAlgorithm;
 
        public void SetPreferredEncryptionAlgorithm(SymmetricCipherAlgorithms Algorithm, bool Lock)
        {
            if (this.preferredEncryptionAlgorithm == Algorithm)
                return;
 
            if (this.preferredEncryptionAlgorithmLocked)
                throw new InvalidOperationException("Preferred Encryptio Algorithm has been locked.");
 
            this.preferredEncryptionAlgorithm = Algorithm;
            this.preferredEncryptionAlgorithmLocked = Lock;
        }
 
        public Task<bool> LoadKeys(bool CreateIfNone)
        {
            return this.LoadKeys(CreateIfNone, null);
        }
 
        public async Task<bool> LoadKeys(bool CreateIfNone, ProfilerThread Thread)
        {
            using Semaphore Lock = await LockKeys();
            return await this.LoadKeysLocked(CreateIfNone, Thread);
        }
 
        private static Task<Semaphore> LockKeys()
        {
            return Semaphores.BeginWrite(E2eKeySemaphoreName);
        }
 
        private async Task<bool> LoadKeysLocked(bool CreateIfNone, ProfilerThread Thread)
        {
            Thread = Thread?.CreateSubThread("Load Keys", ProfilerThreadType.Sequential);
            Thread?.Start();
            try
            {
                using LoadedKeySet LoadedKeys = await this.LoadPersistedKeysAsync(
                    CreateIfNone, Thread);
 
                if (LoadedKeys is null)
                    return false;
 
                this.KeysLoaded(LoadedKeys);
 
                return true;
            }
            finally
            {
                Thread?.Stop();
            }
        }
 
        private async Task<LoadedKeySet> LoadPersistedKeysAsync(bool CreateIfNone, ProfilerThread Thread)
        {
            Thread?.NewState("Search");
 
            List<IE2eEndpoint> Keys = new List<IE2eEndpoint>();
            Dictionary<string, object> Settings = await RuntimeSettings.GetWhereKeyLikeAsync(this.keySettingsPrefix + "*", "*");
 
            Thread?.NewState("Endpoints");
 
            IE2eEndpoint[] AvailableEndpoints = EndpointSecurity.CreateEndpoints(256, 192,
                int.MaxValue, new Type[]
                {
                    typeof(EllipticCurveEndpoint),
                    typeof(ModuleLatticeEndpoint)
                }, Thread);
 
            DateTime? Timestamp = null;
            byte[] Key;
 
            try
            {
                Thread?.NewState("Select");
 
                foreach (KeyValuePair<string, object> Setting in Settings)
                {
                    string LocalName = Setting.Key[this.keySettingsPrefix.Length..];
 
                    if (Setting.Value is string d)
                    {
                        if (string.IsNullOrEmpty(d))
                            continue;
 
                        try
                        {
                            Key = Convert.FromBase64String(d);
                        }
                        catch (Exception)
                        {
                            continue;
                        }
 
                        foreach (IE2eEndpoint Curve in AvailableEndpoints)
                        {
                            if (Curve.LocalName == LocalName)
                            {
                                try
                                {
                                    Keys.Add(Curve.CreatePrivate(Key));
                                    break;
                                }
                                catch (Exception ex)
                                {
                                    Log.Exception(ex);
                                }
                            }
                        }
                    }
                    else if (Setting.Value is DateTime TP && LocalName == "Timestamp")
                        Timestamp = TP;
                }
 
                if (Keys.Count == 0 || (Keys.Count != AvailableEndpoints.Length && CreateIfNone))
                {
                    if (!CreateIfNone)
                        return null;
 
                    Thread?.NewState("Create");
 
                    int i;
                    int c = Keys.Count;
 
                    foreach (IE2eEndpoint Endpoint in AvailableEndpoints)
                    {
                        for (i = 0; i < c; i++)
                        {
                            if (Keys[i].LocalName == Endpoint.LocalName)
                                break;
                        }
 
                        if (i < c)
                            continue;
 
                        if (Endpoint is EllipticCurveEndpoint Curve)
                            Key = this.GetKey(Curve);
                        else if (Endpoint is ModuleLatticeEndpoint ModuleLattice)
                            Key = this.GetKey(ModuleLattice);
                        else
                            continue;
 
                        await RuntimeSettings.SetAsync(this.keySettingsPrefix + Endpoint.LocalName, Convert.ToBase64String(Key));
                        Keys.Add(Endpoint);
                    }
 
                    Timestamp = DateTime.UtcNow;
                    await RuntimeSettings.SetAsync(this.keySettingsPrefix + "Timestamp", Timestamp.Value);
 
                    Log.Notice("Private keys for contracts client created.", this.client.BareJID, string.Empty, "NewKeys");
                }
                else if (!Timestamp.HasValue)
                {
                    Thread?.NewState("Time");
 
                    Timestamp = DateTime.UtcNow;
                    await RuntimeSettings.SetAsync(this.keySettingsPrefix + "Timestamp", Timestamp.Value);
                }
 
                return new LoadedKeySet(Keys.ToArray(), Timestamp.Value);
            }
            finally
            {
                Thread?.NewState("Dispose");
 
                HashSet<IE2eEndpoint> LoadedEndpoints = new HashSet<IE2eEndpoint>(Keys);
 
                foreach (IE2eEndpoint Curve in AvailableEndpoints)
                {
                    if (!LoadedEndpoints.Contains(Curve))
                        Curve.Dispose();
                }
            }
        }
 
        private void KeysLoaded(LoadedKeySet LoadedKeys)
        {
            if (!(this.keys is null))
            {
                if (MatchesLoadedKeys(this.keys, LoadedKeys.Keys))
                    return;
 
                this.keys.Dispose();
                this.keys = null;
            }
 
            if (this.useKeysForE2e)
                this.keys = new EndpointSecurity(this.client, 128, LoadedKeys.TransferKeys());
            else
                this.keys = new EndpointSecurity(null, 128, LoadedKeys.TransferKeys());
 
            this.keysTimestamp = LoadedKeys.Timestamp;
 
            this.ClearMatchingKeyCache();
        }
 
        private void ClearMatchingKeyCache()
        {
            lock (this.matchingKeys)
            {
                this.matchingKeys.Clear();
            }
        }
 
        private byte[] GetKey(EllipticCurveEndpoint EcEndpoint)
        {
            string s = EcEndpoint.Curve.Export();
            XmlDocument Doc = XML.ParseXml(s, true);
            s = Doc.DocumentElement.GetAttribute("d");
            return Convert.FromBase64String(s);
        }
 
        private byte[] GetKey(ModuleLatticeEndpoint MlEndpoint)
        {
            return MlEndpoint.ExportPrivateKey();
        }
 
        public async Task GenerateNewKeys()
        {
            List<LegalIdentityState> ActiveStates = await this.GetActiveLegalIdentityStatesAsync(false);
 
            if (ActiveStates.Count == 0 && this.client.State == XmppState.Connected)
            {
                await this.TryRefreshLegalIdentityStatesAsync();
                ActiveStates = await this.GetActiveLegalIdentityStatesAsync(false);
            }
 
            using Semaphore Lock = await LockKeys();
 
            foreach (LegalIdentityState State in ActiveStates)
                await this.TryGetLegalIdentityEndpointAsync(State, true, true);
 
            await RuntimeSettings.DeleteWhereKeyLikeAsync(this.keySettingsPrefix + "*", "*");
            await this.LoadKeysLocked(true, null);
        }
 
        private async Task<List<LegalIdentityState>> GetActiveLegalIdentityStatesAsync(bool RefreshStates)
        {
            List<LegalIdentityState> ActiveStates = new List<LegalIdentityState>();
 
            foreach (LegalIdentityState State in await Database.Find<LegalIdentityState>(
                new FilterFieldEqualTo("BareJid", this.client.BareJID)))
            {
                if (RefreshStates && (State.State == IdentityState.Created || State.State == IdentityState.Approved))
                {
                    try
                    {
                        LegalIdentity Identity = await this.GetLegalIdentityAsync(State.LegalId);   // Make sure we have the latest.
                        if (Identity.State != State.State)
                        {
                            State.State = Identity.State;
                            State.Timestamp = Identity.Updated;
 
                            switch (Identity.State)
                            {
                                case IdentityState.Rejected:
                                case IdentityState.Obsoleted:
                                case IdentityState.Compromised:
                                    State.PublicKey = null;
                                    break;
                            }
 
                            await Database.Update(State);
                        }
                    }
                    catch (ItemNotFoundException)
                    {
                        await Database.Delete(State);
                        continue;
                    }
                    catch (Exception ex)
                    {
                        Log.Exception(ex, State.LegalId);
                        throw;
                    }
                }
 
                switch (State.State)
                {
                    case IdentityState.Created:
                    case IdentityState.Approved:
                        ActiveStates.Add(State);
                        break;
                }
            }
 
            return ActiveStates;
        }
 
        private async Task TryRefreshLegalIdentityStatesAsync()
        {
            try
            {
                await this.GetLegalIdentitiesAsync();
            }
            catch (Exception ex)
            {
                Log.Exception(ex);
            }
        }
 
        private static byte[] Clone(byte[] Bin)
        {
            return Bin is null ? null : (byte[])Bin.Clone();
        }
 
        private static bool AreEqual(byte[] A, byte[] B)
        {
            if (ReferenceEquals(A, B))
                return true;
 
            if (A is null || B is null || A.Length != B.Length)
                return false;
 
            int i, c = A.Length;
 
            for (i = 0; i < c; i++)
            {
                if (A[i] != B[i])
                    return false;
            }
 
            return true;
        }
 
        private bool TryExportPrivateKey(IE2eEndpoint Endpoint, out string KeyName, out string KeyNamespace, out byte[] PrivateKey)
        {
            KeyName = Endpoint?.LocalName;
            KeyNamespace = Endpoint?.Namespace;
            PrivateKey = null;
 
            switch (Endpoint)
            {
                case EllipticCurveEndpoint Curve:
                    PrivateKey = this.GetKey(Curve);
                    break;
 
                case ModuleLatticeEndpoint ModuleLattice:
                    PrivateKey = ModuleLattice.ExportPrivateKey();
                    break;
 
                case RsaEndpoint Rsa:
                    PrivateKey = Rsa.Export(true);
                    break;
 
                default:
                    return false;
            }
 
            return !(PrivateKey is null);
        }
 
        private static bool MatchesLoadedKeys(EndpointSecurity EndpointSecurity, IEnumerable<IE2eEndpoint> Keys)
        {
            if (EndpointSecurity is null)
                return false;
 
            foreach (IE2eEndpoint Key in Keys)
            {
                IE2eEndpoint ExistingEndpoint = EndpointSecurity.FindLocalEndpoint(Key.LocalName, Key.Namespace);
 
                if (ExistingEndpoint is null || !AreEqual(ExistingEndpoint.PublicKey, Key.PublicKey))
                    return false;
            }
 
            return true;
        }
 
        private async Task<Tuple<string, string, byte[]>> GetPersistablePrivateKeyAsync(IE2eEndpoint Endpoint)
        {
            if (Endpoint is null)
                return null;
 
            string KeyName = Endpoint.LocalName;
            string KeyNamespace = Endpoint.Namespace;
            string RuntimeValue = await RuntimeSettings.GetAsync(this.keySettingsPrefix + KeyName, string.Empty);
 
            if (!string.IsNullOrEmpty(RuntimeValue))
            {
                try
                {
                    byte[] RuntimePrivateKey = Convert.FromBase64String(RuntimeValue);
 
                    if (EndpointSecurity.TryCreateEndpoint(KeyName, KeyNamespace, out IE2eEndpoint Template))
                    {
                        using (Template)
                        using (IE2eEndpoint RuntimeEndpoint = Template.CreatePrivate(RuntimePrivateKey))
                        {
                            if (AreEqual(RuntimeEndpoint.PublicKey, Endpoint.PublicKey))
                                return new Tuple<string, string, byte[]>(KeyName, KeyNamespace, RuntimePrivateKey);
                        }
                    }
                }
                catch (Exception)
                {
                    // Ignore malformed or mismatched runtime values and fall back to endpoint export.
                }
            }
 
            return this.TryExportPrivateKey(Endpoint, out KeyName, out KeyNamespace, out byte[] PrivateKey) ?
                new Tuple<string, string, byte[]>(KeyName, KeyNamespace, PrivateKey)
                : null;
        }
 
        private IE2eEndpoint TryCreateLegalIdentityEndpoint(LegalIdentityState State)
        {
            if (State is null ||
                !State.HasPrivateKey ||
                string.IsNullOrEmpty(State.KeyName))
            {
                return null;
            }
 
            string KeyNamespace = string.IsNullOrEmpty(State.KeyNamespace) 
                ? EndpointSecurity.IoTHarmonizationE2ECurrent 
                : State.KeyNamespace;
 
            byte[] PrivateKey = State.PrivateKey;
 
            if (PrivateKey is null || !EndpointSecurity.TryCreateEndpoint(State.KeyName,
                KeyNamespace, out IE2eEndpoint Template))
            {
                return null;
            }
 
            try
            {
                return Template.CreatePrivate(PrivateKey);
            }
            catch (Exception ex)
            {
                Log.Exception(ex, State.LegalId);
                return null;
            }
        }
 
        private async Task<bool> SetLegalIdentityKeySnapshotAsync(LegalIdentityState State, IE2eEndpoint Endpoint)
        {
            Tuple<string, string, byte[]> P = State is null ? null : await this.GetPersistablePrivateKeyAsync(Endpoint);
 
            if (P is null)
            {
                return false;
            }
 
            string KeyName = P.Item1;
            string KeyNamespace = P.Item2;
            byte[] PrivateKey = P.Item3;
 
            bool Updated = !AreEqual(State.PublicKey, Endpoint.PublicKey) ||
                State.KeyName != KeyName ||
                State.KeyNamespace != KeyNamespace ||
                !AreEqual(State.HasPrivateKey ? State.PrivateKey : null, PrivateKey);
 
            State.PublicKey = Clone(Endpoint.PublicKey);
            State.KeyName = KeyName;
            State.KeyNamespace = KeyNamespace;
            State.PrivateKey = Clone(PrivateKey);
 
            return Updated;
        }
 
        private async Task<LoadedKey> TryGetLegalIdentityEndpointAsync(LegalIdentityState State, 
            bool MigrateLegacyState, bool Locked)
        {
            IE2eEndpoint Endpoint = this.TryCreateLegalIdentityEndpoint(State);
 
            if (!(Endpoint is null))
            {
                if (State.PublicKey is null)
                {
                    State.PublicKey = Clone(Endpoint.PublicKey);
                    if (!string.IsNullOrEmpty(State.ObjectId))
                        await Database.Update(State);
 
                    return new LoadedKey(Endpoint, true, State.Timestamp);
                }
                else if (!AreEqual(State.PublicKey, Endpoint.PublicKey))
                {
                    Endpoint.Dispose();
                    Endpoint = null;
                }
                else
                    return new LoadedKey(Endpoint, true, State.Timestamp);
            }
 
            bool MissingSnapshot = State?.HasPrivateKey != true || 
                string.IsNullOrEmpty(State.KeyName);
 
            if (!MigrateLegacyState ||
                !MissingSnapshot ||
                State?.PublicKey is null ||
                !(Locked ? await this.LoadKeysLocked(false, null) : await this.LoadKeys(false)))
            {
                return new LoadedKey(null, false, DateTime.MinValue);
            }
 
            Endpoint = this.LocalEndpoint.FindLocalEndpoint(State.PublicKey);
            if (Endpoint is null ||
                !await this.SetLegalIdentityKeySnapshotAsync(State, Endpoint))
            {
                return new LoadedKey(Endpoint, false, State.Timestamp);
            }
 
            if (!string.IsNullOrEmpty(State.ObjectId))
                await Database.Update(State);
 
            IE2eEndpoint Endpoint2 = this.TryCreateLegalIdentityEndpoint(State);
            return Endpoint2 is null 
                ? new LoadedKey(Endpoint, false, State.Timestamp)
                : new LoadedKey(Endpoint2, true, State.Timestamp);
        }
 
        private static bool TryParseContractSharedSecret(string Value, out SymmetricCipherAlgorithms Algorithm,
            out string CreatorJid, out byte[] SharedSecret)
        {
            Algorithm = DefaultCipherAlgorithm;
            CreatorJid = string.Empty;
            SharedSecret = null;
 
            if (string.IsNullOrEmpty(Value))
                return false;
 
            string[] Parts = Value.Split('|');
            if (Parts.Length != 3 || !Enum.TryParse(Parts[0], out Algorithm))
                return false;
 
            CreatorJid = Parts[1];
 
            try
            {
                SharedSecret = Convert.FromBase64String(Parts[2]);
            }
            catch (Exception)
            {
                return false;
            }
 
            return true;
        }
 
        private static Tuple<SymmetricCipherAlgorithms, string, byte[]> CreateContractSharedSecretTuple(
            SymmetricCipherAlgorithms Algorithm, string CreatorJid, byte[] SharedSecret)
        {
            if (SharedSecret is null)
                return null;
 
            return new Tuple<SymmetricCipherAlgorithms, string, byte[]>(Algorithm, CreatorJid ?? string.Empty,
                (byte[])SharedSecret.Clone());
        }
 
        private static string EncodeContractSharedSecret(SymmetricCipherAlgorithms Algorithm, string CreatorJid, byte[] SharedSecret)
        {
            if (SharedSecret is null)
                return null;
 
            return Algorithm.ToString() + "|" + (CreatorJid ?? string.Empty) + "|" + Convert.ToBase64String(SharedSecret);
        }
 
        private async Task<ContractSharedSecretState> GetContractStateAsync(string ContractId)
        {
            return await Database.FindFirstDeleteRest<ContractSharedSecretState>(new FilterAnd(
                new FilterFieldEqualTo("BareJid", this.client.BareJID),
                new FilterFieldEqualTo("ContractId", ContractId)));
        }
 
        private async Task<bool> UpsertContractStateAsync(string ContractId, string CreatorJid, byte[] SharedSecret,
            SymmetricCipherAlgorithms KeyAlgorithm)
        {
            if (string.IsNullOrEmpty(ContractId) || SharedSecret is null)
                return false;
 
            ContractSharedSecretState State = await this.GetContractStateAsync(ContractId);
            byte[] SecretCopy = (byte[])SharedSecret.Clone();
 
            if (State is null)
            {
                State = new ContractSharedSecretState(ContractId)
                {
                    BareJid = this.client.BareJID,
                    CreatorJid = CreatorJid ?? string.Empty,
                    KeyAlgorithm = KeyAlgorithm,
                    SharedSecret = SecretCopy
                };
 
                await Database.Insert(State);
            }
            else
            {
                State.CreatorJid = CreatorJid ?? string.Empty;
                State.KeyAlgorithm = KeyAlgorithm;
                State.SharedSecret = SecretCopy;
 
                await Database.Update(State);
            }
 
            return true;
        }
 
        private Tuple<SymmetricCipherAlgorithms, string, byte[]> TryLoadContractSharedSecret(ContractSharedSecretState State)
        {
            if (State is null || string.IsNullOrEmpty(State.ContractId) || !State.HasSharedSecret)
                return null;
 
            return CreateContractSharedSecretTuple(State.KeyAlgorithm, State.CreatorJid, State.SharedSecret);
        }
 
        private async Task<Tuple<SymmetricCipherAlgorithms, string, byte[]>> TryLoadLegacyContractSharedSecretAsync(
            string ContractId, bool MigrateToState)
        {
            string Name = this.contractKeySettingsPrefix + ContractId;
            string Value = await RuntimeSettings.GetAsync(Name, string.Empty);
 
            if (!TryParseContractSharedSecret(Value, out SymmetricCipherAlgorithms Algorithm, out string CreatorJid,
                out byte[] SharedSecret))
            {
                return null;
            }
 
            if (MigrateToState)
                await this.UpsertContractStateAsync(ContractId, CreatorJid, SharedSecret, Algorithm);
 
            return CreateContractSharedSecretTuple(Algorithm, CreatorJid, SharedSecret);
        }
 
        private async Task<List<ContractSharedSecretState>> GetExportableContractStatesAsync()
        {
            Dictionary<string, ContractSharedSecretState> ContractStates = new Dictionary<string, ContractSharedSecretState>(StringComparer.Ordinal);
            List<ContractSharedSecretState> Result = new List<ContractSharedSecretState>();
 
            foreach (ContractSharedSecretState State in await Database.Find<ContractSharedSecretState>(new FilterFieldEqualTo("BareJid", this.client.BareJID)))
            {
                if (string.IsNullOrEmpty(State.ContractId) || !State.HasSharedSecret)
                    continue;
 
                ContractStates[State.ContractId] = State;
            }
 
            Dictionary<string, object> Settings = await RuntimeSettings.GetWhereKeyLikeAsync(this.contractKeySettingsPrefix + "*", "*");
 
            foreach (KeyValuePair<string, object> Setting in Settings)
            {
                if (!(Setting.Value is string Value))
                    continue;
 
                string ContractId = Setting.Key[this.contractKeySettingsPrefix.Length..];
 
                if (ContractStates.ContainsKey(ContractId) ||
                    !TryParseContractSharedSecret(Value, out SymmetricCipherAlgorithms Algorithm, out string CreatorJid,
                        out byte[] SharedSecret))
                {
                    continue;
                }
 
                if (await this.UpsertContractStateAsync(ContractId, CreatorJid, SharedSecret, Algorithm))
                {
                    ContractSharedSecretState State = await this.GetContractStateAsync(ContractId);
 
                    if (!(State is null))
                        ContractStates[ContractId] = State;
                }
            }
 
            foreach (ContractSharedSecretState State in ContractStates.Values)
                Result.Add(State);
 
            return Result;
        }
 
        public async Task<string> ExportKeys()
        {
            StringBuilder Xml = new StringBuilder();
            XmlWriterSettings Settings = XML.WriterSettings(false, true);
 
            using (XmlWriter Output = XmlWriter.Create(Xml, Settings))
            {
                await this.ExportKeys(Output);
            }
 
            return Xml.ToString();
        }
 
        public async Task ExportKeys(XmlWriter Output)
        {
            this.AssertAllowed();
 
            Output.WriteStartElement("LegalId", NamespaceOnboarding);
 
            Dictionary<string, object> Settings = await RuntimeSettings.GetWhereKeyLikeAsync(this.keySettingsPrefix + "*", "*");
 
            foreach (KeyValuePair<string, object> Setting in Settings)
            {
                string Name = Setting.Key[this.keySettingsPrefix.Length..];
 
                if (Setting.Value is string s)
                {
                    Output.WriteStartElement("S");
                    Output.WriteAttributeString("n", Name);
                    Output.WriteAttributeString("v", s);
                    Output.WriteEndElement();
                }
                else if (Setting.Value is DateTime TP)
                {
                    Output.WriteStartElement("DT");
                    Output.WriteAttributeString("n", Name);
                    Output.WriteAttributeString("v", XML.Encode(TP));
                    Output.WriteEndElement();
                }
            }
 
            foreach (LegalIdentityState State in await Database.Find<LegalIdentityState>(new FilterAnd(
                new FilterFieldEqualTo("BareJid", this.client.BareJID),
                new FilterFieldEqualTo("State", IdentityState.Approved))))
            {
                using LoadedKey Key = await this.TryGetLegalIdentityEndpointAsync(State, true, false);
                IE2eEndpoint Endpoint = Key.Endpoint;
 
                if (Endpoint is null || State.PublicKey is null || !State.HasPrivateKey || string.IsNullOrEmpty(State.KeyName))
                    continue;
 
                Output.WriteStartElement("State");
                Output.WriteAttributeString("legalId", State.LegalId);
                Output.WriteAttributeString("publicKey", Convert.ToBase64String(State.PublicKey));
                Output.WriteAttributeString("timestamp", XML.Encode(State.Timestamp));
                Output.WriteAttributeString("keyName", State.KeyName);
 
                if (!string.IsNullOrEmpty(State.KeyNamespace))
                    Output.WriteAttributeString("keyNamespace", State.KeyNamespace);
 
                Output.WriteAttributeString("hasPrivateKey", CommonTypes.Encode(State.HasPrivateKey));
                Output.WriteAttributeString("privateKey", Convert.ToBase64String(State.PrivateKey));
                Output.WriteEndElement();
            }
 
            foreach (ContractSharedSecretState ContractState in await this.GetExportableContractStatesAsync())
            {
                if (!ContractState.HasSharedSecret)
                    continue;
 
                Output.WriteStartElement("C");
                Output.WriteAttributeString("n", ContractState.ContractId);
                Output.WriteAttributeString("v", EncodeContractSharedSecret(ContractState.KeyAlgorithm,
                    ContractState.CreatorJid, ContractState.SharedSecret));
                Output.WriteEndElement();
            }
 
            Output.WriteEndElement();
        }
 
        public Task<bool> ImportKeys(string Xml)
        {
            XmlDocument Doc = XML.ParseXml(Xml);
 
            return this.ImportKeys(Doc);
        }
 
        public Task<bool> ImportKeys(XmlDocument Xml)
        {
            return this.ImportKeys(Xml.DocumentElement);
        }
 
        public async Task<bool> ImportKeys(XmlElement Xml)
        {
            this.AssertAllowed();
 
            if (Xml is null || Xml.LocalName != "LegalId" || Xml.NamespaceURI != NamespaceOnboarding)
                return false;
 
            foreach (XmlNode N in Xml.ChildNodes)
            {
                if (!(N is XmlElement E))
                    continue;
 
                if (E.NamespaceURI != NamespaceOnboarding)
                    return false;
 
                switch (E.LocalName)
                {
                    case "S":
                        string Name = XML.Attribute(E, "n");
                        string StringValue = XML.Attribute(E, "v");
 
                        await RuntimeSettings.SetAsync(this.keySettingsPrefix + Name, StringValue);
                        break;
 
                    case "DT":
                        Name = XML.Attribute(E, "n");
                        DateTime DateTimeValue = XML.Attribute(E, "v", DateTime.MinValue);
 
                        await RuntimeSettings.SetAsync(this.keySettingsPrefix + Name, DateTimeValue);
                        break;
 
                    case "C":
                        {
                            Name = XML.Attribute(E, "n");
                            StringValue = XML.Attribute(E, "v");
 
                            if (!TryParseContractSharedSecret(StringValue, out SymmetricCipherAlgorithms ContractAlgorithm,
                                out string CreatorJid, out byte[] SharedSecret))
                            {
                                return false;
                            }
 
                            if (!await this.UpsertContractStateAsync(Name, CreatorJid, SharedSecret, ContractAlgorithm))
                                return false;
                            break;
                        }
 
                    case "ContractState":
                        {
                            string ContractId = XML.Attribute(E, "contractId");
                            string CreatorJid = XML.Attribute(E, "creatorJid");
                            string KeyAlgorithm = XML.Attribute(E, "keyAlgorithm");
                            string SharedSecretStr = XML.Attribute(E, "sharedSecret");
                            byte[] SharedSecret;
 
                            if (!Enum.TryParse(KeyAlgorithm, out SymmetricCipherAlgorithms ContractAlgorithm))
                                return false;
 
                            try
                            {
                                SharedSecret = Convert.FromBase64String(SharedSecretStr);
                            }
                            catch (Exception)
                            {
                                return false;
                            }
 
                            if (!await this.UpsertContractStateAsync(ContractId, CreatorJid, SharedSecret, ContractAlgorithm))
                                return false;
                            break;
                        }
 
                    case "State":
                        string LegalId = XML.Attribute(E, "legalId");
                        string PublicKeyStr = XML.Attribute(E, "publicKey");
                        string PrivateKeyStr = XML.Attribute(E, "privateKey");
                        string KeyName = XML.Attribute(E, "keyName");
                        string KeyNamespace = XML.Attribute(E, "keyNamespace");
                        byte[] PublicKey;
                        byte[] PrivateKey = null;
                        DateTimeValue = XML.Attribute(E, "timestamp", DateTime.MinValue);
 
                        try
                        {
                            PublicKey = Convert.FromBase64String(PublicKeyStr);
                        }
                        catch (Exception)
                        {
                            return false;
                        }
 
                        if (!string.IsNullOrEmpty(PrivateKeyStr))
                        {
                            try
                            {
                                PrivateKey = Convert.FromBase64String(PrivateKeyStr);
                            }
                            catch (Exception)
                            {
                                return false;
                            }
                        }
 
                        LegalIdentityState IdState = await Database.FindFirstDeleteRest<LegalIdentityState>(new FilterAnd(
                            new FilterFieldEqualTo("BareJid", this.client.BareJID),
                            new FilterFieldEqualTo("LegalId", LegalId)));
 
                        if (IdState is null)
                        {
                            IdState = new LegalIdentityState()
                            {
                                BareJid = this.client.BareJID,
                                LegalId = LegalId,
                                State = IdentityState.Approved,
                                Timestamp = DateTimeValue,
                                PublicKey = PublicKey,
                                KeyName = KeyName,
                                KeyNamespace = KeyNamespace,
                                PrivateKey = PrivateKey
                            };
 
                            await Database.Insert(IdState);
                        }
                        else
                        {
                            IdState.State = IdentityState.Approved;
                            IdState.Timestamp = DateTimeValue;
                            IdState.PublicKey = PublicKey;
                            IdState.KeyName = KeyName;
                            IdState.KeyNamespace = KeyNamespace;
                            IdState.PrivateKey = PrivateKey;
 
                            await Database.Update(IdState);
                        }
                        break;
 
                    default:
                        return false;
                }
            }
 
            if (await this.LoadKeys(false))
                return true;
 
            foreach (LegalIdentityState State in await Database.Find<LegalIdentityState>(new FilterAnd(
                new FilterFieldEqualTo("BareJid", this.client.BareJID),
                new FilterFieldEqualTo("State", IdentityState.Approved))))
            {
                using LoadedKey Key = await this.TryGetLegalIdentityEndpointAsync(State, true, false);
 
                if (!(Key.Endpoint is null))
                    return true;
            }
 
            return false;
        }
 
        public void SetKeySettingsInstance(string InstanceName, bool Locked)
        {
            if (this.keySettingsPrefixLocked)
                throw new InvalidOperationException("Key settings instance is locked.");
 
            if (string.IsNullOrEmpty(InstanceName))
            {
                this.keySettingsPrefix = KeySettings;
                this.contractKeySettingsPrefix = ContractKeySettings;
            }
            else
            {
                this.keySettingsPrefix = InstanceName + "." + KeySettings;
                this.contractKeySettingsPrefix = InstanceName + "." + ContractKeySettings;
            }
 
            this.keySettingsPrefixLocked = Locked;
        }
 
        public async Task EnableE2eEncryption()
        {
            using Semaphore Lock = await LockKeys();
 
            if (this.useKeysForE2e)
                return;
 
            this.useKeysForE2e = true;
 
            if (this.keys is null)
                await this.LoadKeysLocked(true, null);
 
            if (this.keys.Client is null)
                this.keys.RegisterHandlers(this.client);
        }
 
        public async Task DisableE2eEncryption()
        {
            using Semaphore Lock = await LockKeys();
 
            if (!this.useKeysForE2e)
                return;
 
            this.useKeysForE2e = false;
            this.keys?.UnregisterHandlers(this.client);
        }
 
        public bool IsE2eEncryptionEnabled => EndpointSecurity.IsE2eEncryptionEnabled(this.client);
 
        public byte[] RandomBytes(int Nr)
        {
            if (Nr < 0)
                throw new ArgumentException(nameof(Nr));
 
            byte[] Bytes = new byte[Nr];
 
            this.rnd.GetBytes(Bytes);
 
            return Bytes;
        }
 
        public ulong RandomInteger()
        {
            byte[] Bin = this.RandomBytes(8);
            return BitConverter.ToUInt64(Bin, 0);
        }
 
        public ulong RandomInteger(ulong MaxExclusive)
        {
            if (MaxExclusive == 0)
                throw new ArgumentException(nameof(MaxExclusive));
 
            return this.RandomInteger() % MaxExclusive;
        }
 
        public int RandomInteger(int MinInclusive, int MaxInclusive)
        {
            if (MaxInclusive < MinInclusive)
                throw new ArgumentException(nameof(MaxInclusive));
 
            ulong Diff = (uint)(MaxInclusive - MinInclusive);
            if (Diff == 0)
                return MinInclusive;
 
            int Result = (int)this.RandomInteger(Diff + 1UL);
            Result += MinInclusive;
 
            return Result;
        }
 
        #endregion
 
        #region Security
 
        [Obsolete("Use the overload taking ICallStackCheck instances instead.")]
        public void SetAllowedSources(object[] ApprovedSources)
        {
            this.SetAllowedSources(Assert.Convert(ApprovedSources));
        }
 
        public void SetAllowedSources(ICallStackCheck[] ApprovedSources)
        {
            if (!(this.approvedSources is null))
                throw new NotSupportedException("Changing approved sources not permitted.");
 
            this.approvedSources = ApprovedSources;
            this.SetLegalIdentityStateAllowedSources(ApprovedSources);
            this.SetContractStateAllowedSources(ApprovedSources);
        }
 
        private void AssertAllowed()
        {
            if (!(this.approvedSources is null))
                Assert.CallFromSource(this.approvedSources);
        }
 
        private void SetLegalIdentityStateAllowedSources(ICallStackCheck[] ApprovedSources)
        {
            if (ApprovedSources is null)
                return;
 
            try
            {
                LegalIdentityState.SetAllowedSources(ApprovedSources);
            }
            catch (NotSupportedException)
            {
                // Sensitive state access has already been configured globally.
            }
        }
 
        private void SetContractStateAllowedSources(ICallStackCheck[] ApprovedSources)
        {
            if (ApprovedSources is null)
                return;
 
            try
            {
                ContractSharedSecretState.SetAllowedSources(ApprovedSources);
            }
            catch (NotSupportedException)
            {
                // Sensitive state access has already been configured globally.
            }
        }
 
        #endregion
 
        #region URIs
 
        public static string LegalIdUriString(string LegalId)
        {
            return "iotid:" + LegalId;
        }
 
        public static Uri LegalIdUri(string LegalId)
        {
            return new Uri(LegalIdUriString(LegalId));
        }
 
        public static string ContractIdUriString(string ContractId)
        {
            return "iotsc:" + ContractId;
        }
 
        public static Uri ContractIdUri(string ContractId)
        {
            return new Uri(ContractIdUriString(ContractId));
        }
 
        #endregion
 
        #region Server Public Keys
 
        public Task GetServerPublicKey(EventHandlerAsync<KeyEventArgs> Callback, object State)
        {
            return this.GetServerPublicKey(this.componentAddress, null, Callback, State);
        }
 
        public Task GetServerPublicKey(DateTime? Timestamp, 
            EventHandlerAsync<KeyEventArgs> Callback, object State)
        {
            return this.GetServerPublicKey(this.componentAddress, Timestamp, Callback, State);
        }
 
        public Task GetServerPublicKey(string Address, EventHandlerAsync<KeyEventArgs> Callback, object State)
        {
            return this.GetServerPublicKey(Address, null, Callback, State);
        }
 
        public async Task GetServerPublicKey(string Address, DateTime? Timestamp,
            EventHandlerAsync<KeyEventArgs> Callback, object State)
        {
            if (this.publicKeys.TryGetRecord(Address, Timestamp ?? DateTime.UtcNow,
                out KeyEventArgs e0))
            {
                e0 = new KeyEventArgs(e0)
                {
                    State = State
                };
 
                await Callback.Raise(this, e0);
            }
            else
            {
                EventHandlerAsync<PublicKeyEventArgs> h = GetLocalPublicKey;
                if (!(h is null))
                {
                    PublicKeyEventArgs e = new PublicKeyEventArgs(Address, Timestamp);
                    await h.Raise(this, e, false);
 
                    if (!(e.Key is null) && e.ValidFrom.HasValue)
                    {
                        if (!(Callback is null))
                        {
                            XmlDocument Doc = new XmlDocument();
                            XmlElement Empty = Doc.CreateElement("Local");
 
                            IqResultEventArgs e1 = new IqResultEventArgs(Empty, string.Empty, string.Empty, string.Empty, true, State);
                            KeyEventArgs e2 = new KeyEventArgs(e1, e.Key, e.ValidFrom.Value, e.ValidTo);
                            await Callback.Raise(this, e2);
                        }
 
                        return;
                    }
                }
 
                StringBuilder sb = new StringBuilder();
 
                sb.Append("<getPublicKey xmlns=\"");
                sb.Append(NamespaceLegalIdentitiesCurrent);
 
                if (Timestamp.HasValue)
                {
                    sb.Append("\" ts=\"");
                    sb.Append(XML.Encode(Timestamp.Value.ToUniversalTime()));
                }
 
                sb.Append("\"/>");
 
                await this.client.SendIqGet(Address, sb.ToString(), async (Sender, e) =>
                {
                    IE2eEndpoint ServerKey = null;
                    XmlElement E;
                    DateTime? From = null;
                    DateTime? To = null;
 
                    if (e.Ok && 
                        !((E = e.FirstElement) is null) && 
                        E.LocalName == "publicKey")
                    {
                        From = XML.Attribute(E, "from", DateTime.MinValue);
                        To = E.HasAttribute("to") ? 
                            XML.Attribute(E, "to", DateTime.MaxValue) : (DateTime?)null;
 
                        foreach (XmlNode N in E.ChildNodes)
                        {
                            if (N is XmlElement E2)
                            {
                                ServerKey = EndpointSecurity.ParseE2eKey(E2);
                                if (!(ServerKey is null))
                                    break;
                            }
                        }
 
                        e.Ok = !(ServerKey is null);
                    }
                    else
                        e.Ok = false;
 
                    e0 = new KeyEventArgs(e, ServerKey, From ?? DateTime.MinValue, To);
 
                    if (e0.Ok)
                    {
                        this.publicKeys.Add(Address, From ?? DateTime.MinValue,
                            To ?? DateTime.UtcNow, e0);
                    }
 
                    await Callback.Raise(this, e0);
                }, State);
            }
        }
 
        public static event EventHandlerAsync<PublicKeyEventArgs> GetLocalPublicKey = null;
 
        public Task<IE2eEndpoint> GetServerPublicKeyAsync()
        {
            return this.GetServerPublicKeyAsync(this.componentAddress);
        }
 
        public async Task<IE2eEndpoint> GetServerPublicKeyAsync(string Address)
        {
            TaskCompletionSource<IE2eEndpoint> Result = new TaskCompletionSource<IE2eEndpoint>();
 
            await this.GetServerPublicKey(Address, (Sender, e) =>
            {
                if (e.Ok)
                    Result.TrySetResult(e.Key);
                else
                    Result.TrySetException(e.StanzaError ?? new Exception("Unable to get public key."));
 
                return Task.CompletedTask;
 
            }, null);
 
            return await Result.Task;
        }
 
        #endregion
 
        #region Matching Local Keys
 
        public Task GetMatchingLocalKey(EventHandlerAsync<KeyEventArgs> Callback, object State)
        {
            return this.GetMatchingLocalKey(this.componentAddress, Callback, State);
        }
 
        private EndpointSecurity LocalEndpoint
        {
            get
            {
                if (this.keys is null)
                    throw new InvalidOperationException("Local keys not loaded or generated.");
 
                return this.keys;
            }
        }
 
        public async Task GetMatchingLocalKey(string Address, EventHandlerAsync<KeyEventArgs> Callback, object State)
        {
            KeyEventArgs e0;
 
            lock (this.matchingKeys)
            {
                if (!this.matchingKeys.TryGetValue(Address, out e0))
                    e0 = null;
            }
 
            if (!(e0 is null))
            {
                e0 = new KeyEventArgs(e0)
                {
                    State = State
                };
 
                await Callback.Raise(this, e0);
            }
            else
            {
                await this.GetServerPublicKey(Address, async (Sender, e) =>
                {
                    IE2eEndpoint LocalKey = null;
 
                    if (e.Ok)
                    {
                        LocalKey = this.LocalEndpoint.FindLocalEndpoint(e.Key);
                        if (LocalKey is null)
                            e.Ok = false;
                    }
 
                    e0 = new KeyEventArgs(e, LocalKey, e.ValidFrom, e.ValidTo);
 
                    if (e0.Ok)
                    {
                        lock (this.matchingKeys)
                        {
                            this.matchingKeys[Address] = e0;
                        }
                    }
 
                    await Callback.Raise(this, e0);
 
                }, State);
            }
        }
 
        public Task<IE2eEndpoint> GetMatchingLocalKeyAsync()
        {
            return this.GetMatchingLocalKeyAsync(this.componentAddress);
        }
 
        public async Task<IE2eEndpoint> GetMatchingLocalKeyAsync(string Address)
        {
            TaskCompletionSource<IE2eEndpoint> Result = new TaskCompletionSource<IE2eEndpoint>();
 
            await this.GetMatchingLocalKey(Address, (Sender, e) =>
            {
                if (e.Ok)
                    Result.TrySetResult(e.Key);
                else
                    Result.TrySetException(e.StanzaError ?? new Exception("Unable to get matching local key."));
 
                return Task.CompletedTask;
 
            }, null);
 
            return await Result.Task;
        }
 
        #endregion
 
        #region ID Application Attributes
 
        public Task GetIdApplicationAttributes(EventHandlerAsync<IdApplicationAttributesEventArgs> Callback, object State)
        {
            return this.client.SendIqGet(this.componentAddress, "<applicationAttributes xmlns='" + NamespaceLegalIdentitiesCurrent + "'/>", (Sender, e) =>
            {
                return Callback.Raise(this, new IdApplicationAttributesEventArgs(e));
 
            }, State);
        }
 
        public async Task<IdApplicationAttributesEventArgs> GetIdApplicationAttributesAsync()
        {
            TaskCompletionSource<IdApplicationAttributesEventArgs> Result = new TaskCompletionSource<IdApplicationAttributesEventArgs>();
 
            await this.GetIdApplicationAttributes((Sender, e) =>
            {
                if (e.Ok)
                    Result.TrySetResult(e);
                else
                    Result.TrySetException(e.StanzaError ?? new Exception("Unable to get ID Application attributes."));
 
                return Task.CompletedTask;
            }, null);
 
            return await Result.Task;
        }
 
        #endregion
 
        #region Apply for a Legal Identity
 
        public Task Apply(Property[] Properties, EventHandlerAsync<LegalIdentityEventArgs> Callback, object State)
        {
            return this.Apply(this.componentAddress, Properties, false, Callback, State);
        }
 
        public Task Apply(string Address, Property[] Properties, EventHandlerAsync<LegalIdentityEventArgs> Callback, object State)
        {
            return this.Apply(Address, Properties, false, Callback, State);
        }
 
        public Task Apply(Property[] Properties, bool Preview, EventHandlerAsync<LegalIdentityEventArgs> Callback, object State)
        {
            return this.Apply(this.componentAddress, Properties, Preview, Callback, State);
        }
 
        public async Task Apply(string Address, Property[] Properties, bool Preview,
            EventHandlerAsync<LegalIdentityEventArgs> Callback, object State)
        {
            this.AssertAllowed();
 
            await this.GetMatchingLocalKey(Address, async (Sender, e) =>
            {
                if (e.Ok)
                {
                    StringBuilder Xml = new StringBuilder();
 
                    Xml.Append("<apply xmlns=\"");
                    Xml.Append(NamespaceLegalIdentitiesCurrent);
 
                    if (Preview)
                        Xml.Append("\" preview=\"true");
 
                    Xml.Append("\">");
 
                    StringBuilder Identity = new StringBuilder();
 
                    Identity.Append("<identity><clientPublicKey>");
                    e.Key.ToXml(Identity, NamespaceLegalIdentitiesCurrent);
                    Identity.Append("</clientPublicKey>");
 
                    foreach (Property Property in Properties)
                    {
                        Identity.Append("<property name=\"");
                        Identity.Append(XML.Encode(Property.Name));
                        Identity.Append("\" value=\"");
                        Identity.Append(XML.Encode(Property.Value));
                        Identity.Append("\"/>");
                    }
 
                    string s = Identity.ToString();
                    Xml.Append(s);
 
                    s += "</identity>";
 
                    byte[] Bin = Encoding.UTF8.GetBytes(s);
                    byte[] Signature = e.Key.Sign(Bin);
 
                    Xml.Append("<clientSignature>");
                    Xml.Append(Convert.ToBase64String(Signature));
                    Xml.Append("</clientSignature>");
 
                    Xml.Append("</identity></apply>");
 
                    await this.client.SendIqSet(Address, Xml.ToString(), async (sender2, e2) =>
                    {
                        LegalIdentity Identity2 = null;
                        XmlElement E;
 
                        if (e2.Ok && !((E = e2.FirstElement) is null) &&
                            E.LocalName == "identity")
                        {
                            Identity2 = LegalIdentity.Parse(E);
                            await this.UpdateSettings(Identity2, e.Key.PublicKey);
                        }
                        else
                            e2.Ok = false;
 
                        await Callback.Raise(this, new LegalIdentityEventArgs(e2, Identity2));
                    }, e.State);
                }
                else
                    await Callback.Raise(this, new LegalIdentityEventArgs(e, null));
            }, State);
        }
 
        public Task<LegalIdentity> ApplyAsync(Property[] Properties)
        {
            return this.ApplyAsync(this.componentAddress, Properties, false);
        }
 
        public Task<LegalIdentity> ApplyAsync(string Address, Property[] Properties)
        {
            return this.ApplyAsync(Address, Properties, false);
        }
 
        public Task<LegalIdentity> ApplyAsync(Property[] Properties, bool Preview)
        {
            return this.ApplyAsync(this.componentAddress, Properties, Preview);
        }
 
        public async Task<LegalIdentity> ApplyAsync(string Address, Property[] Properties, bool Preview)
        {
            TaskCompletionSource<LegalIdentity> Result = new TaskCompletionSource<LegalIdentity>();
 
            await this.Apply(Address, Properties, Preview, (Sender, e) =>
            {
                if (e.Ok)
                    Result.TrySetResult(e.Identity);
                else
                    Result.TrySetException(e.StanzaError ?? new Exception("Unable to apply for a legal identity to be registered."));
 
                return Task.CompletedTask;
 
            }, null);
 
            return await Result.Task;
        }
 
        #endregion
 
        #region Mark Identity as Ready for Approval
 
        public Task ReadyForApproval(string LegalIdentityId, EventHandlerAsync<IqResultEventArgs> Callback, object State)
        {
            return this.ReadyForApproval(this.componentAddress, LegalIdentityId, Callback, State);
        }
 
        public Task ReadyForApproval(string Address, string LegalIdentityId, EventHandlerAsync<IqResultEventArgs> Callback, object State)
        {
            this.AssertAllowed();
 
            StringBuilder Xml = new StringBuilder();
 
            Xml.Append("<readyForApproval xmlns=\"");
            Xml.Append(NamespaceLegalIdentitiesCurrent);
            Xml.Append("\" id=\"");
            Xml.Append(XML.Encode(LegalIdentityId));
            Xml.Append("\"/>");
 
            return this.client.SendIqSet(Address, Xml.ToString(), Callback, State);
        }
 
        public Task ReadyForApprovalAsync(string LegalIdentityId)
        {
            return this.ReadyForApprovalAsync(this.componentAddress, LegalIdentityId);
        }
 
        public async Task ReadyForApprovalAsync(string Address, string LegalIdentityId)
        {
            TaskCompletionSource<bool> Result = new TaskCompletionSource<bool>();
 
            await this.ReadyForApproval(Address, LegalIdentityId, (Sender, e) =>
            {
                if (e.Ok)
                    Result.TrySetResult(true);
                else
                    Result.TrySetException(e.StanzaError ?? new Exception("Unable to flag identity as ready for approval."));
 
                return Task.CompletedTask;
 
            }, null);
 
            await Result.Task;
        }
 
        #endregion
 
        #region Identity Review message
 
        private async Task IdentityReviewEventHandler(object Sender, MessageEventArgs e)
        {
            string LegalId = XML.Attribute(e.Content, "id");
            IdentityReviewEventArgs e2 = new IdentityReviewEventArgs(e, LegalId);
            ParseValidationDetails(e.Content, e2);
 
            if ((e2.IsValid.HasValue && e2.IsValid.Value) ||
                (!e2.IsValid.HasValue && (e2.HasValidatedClaims || e2.HasValidatedPhotos)))
            {
                await this.AddIdentityReviewAttachment(e2);
            }
 
            await this.IdentityReview.Raise(this, e2);
        }
 
        public event EventHandlerAsync<IdentityReviewEventArgs> IdentityReview;
 
        public static void ParseValidationDetails(XmlElement Content,
            IdentityReviewEventArgs e)
        {
            ChunkedList<InvalidClaim> InvalidClaims = null;
            ChunkedList<InvalidPhoto> InvalidPhotos = null;
            ChunkedList<ValidationError> ValidationErrors = null;
            ChunkedList<ValidClaim> ValidClaims = null;
            ChunkedList<ValidPhoto> ValidPhotos = null;
            ChunkedList<PotentialClaim> PotentialClaims = null;
            ChunkedList<string> UnvalidatedClaims = null;
            ChunkedList<string> UnvalidatedPhotos = null;
 
            foreach (XmlNode N in Content.ChildNodes)
            {
                if (!(N is XmlElement E))
                    continue;
 
                switch (E.LocalName)
                {
                    case "invalidClaim":
                        string Claim = XML.Attribute(E, "claim");
                        string Message = XML.Attribute(E, "message");
                        string Code = XML.Attribute(E, "code");
                        string Service = XML.Attribute(E, "service");
                        string Language = XML.Attribute(E, "xml:lang");
 
                        InvalidClaims ??= new ChunkedList<InvalidClaim>();
                        InvalidClaims.Add(new InvalidClaim(Claim, Message, Language, Code, Service));
                        break;
 
                    case "invalidPhoto":
                        string FileName = XML.Attribute(E, "fileName");
                        Message = XML.Attribute(E, "message");
                        Code = XML.Attribute(E, "code");
                        Service = XML.Attribute(E, "service");
                        Language = XML.Attribute(E, "xml:lang");
 
                        InvalidPhotos ??= new ChunkedList<InvalidPhoto>();
                        InvalidPhotos.Add(new InvalidPhoto(FileName, Message, Language, Code, Service));
                        break;
 
                    case "error":
                        ValidationErrorType Type = XML.Attribute(E, "type", ValidationErrorType.Client);
                        Message = XML.Attribute(E, "message");
                        Code = XML.Attribute(E, "code");
                        Service = XML.Attribute(E, "service");
                        Language = XML.Attribute(E, "xml:lang");
 
                        ChunkedList<KeyValuePair<string, object>> Tags = null;
 
                        foreach (XmlNode N2 in E.ChildNodes)
                        {
                            if (!(N2 is XmlElement E2))
                                continue;
 
                            if (E2.LocalName == "tag")
                            {
                                string TagName = XML.Attribute(E2, "name");
                                string TagValue = XML.Attribute(E2, "value");
                                string TagType = XML.Attribute(E2, "type");
 
                                if (!XmppEventReceptor.TryParse(TagValue, TagType, out object TagValueParsed))
                                    TagValueParsed = TagValue;
 
                                Tags ??= new ChunkedList<KeyValuePair<string, object>>();
                                Tags.Add(new KeyValuePair<string, object>(TagName, TagValueParsed));
                            }
                        }
 
                        ValidationErrors ??= new ChunkedList<ValidationError>();
                        ValidationErrors.Add(new ValidationError(Type, Message, Language, Code, Service,
                            Tags?.ToArray() ?? Array.Empty<KeyValuePair<string, object>>()));
                        break;
 
                    case "validatedClaim":
                        Claim = XML.Attribute(E, "claim");
                        Service = XML.Attribute(E, "service");
 
                        ValidClaims ??= new ChunkedList<ValidClaim>();
                        ValidClaims.Add(new ValidClaim(Claim, Service));
                        break;
 
                    case "validatedPhoto":
                        FileName = XML.Attribute(E, "fileName");
                        Service = XML.Attribute(E, "service");
 
                        ValidPhotos ??= new ChunkedList<ValidPhoto>();
                        ValidPhotos.Add(new ValidPhoto(FileName, Service));
                        break;
 
                    case "potentialClaim":
                        Claim = XML.Attribute(E, "claim");
                        string Value = XML.Attribute(E, "value");
                        Service = XML.Attribute(E, "service");
 
                        PotentialClaims ??= new ChunkedList<PotentialClaim>();
                        PotentialClaims.Add(new PotentialClaim(Claim, Value, Service));
                        break;
 
                    case "unvalidatedClaim":
                        Claim = XML.Attribute(E, "claim");
 
                        UnvalidatedClaims ??= new ChunkedList<string>();
                        UnvalidatedClaims.Add(Claim);
                        break;
 
                    case "unvalidatedPhoto":
                        FileName = XML.Attribute(E, "fileName");
 
                        UnvalidatedPhotos ??= new ChunkedList<string>();
                        UnvalidatedPhotos.Add(FileName);
                        break;
                }
            }
 
            e.InvalidClaims = InvalidClaims?.ToArray();
            e.InvalidPhotos = InvalidPhotos?.ToArray();
            e.ValidationErrors = ValidationErrors?.ToArray();
            e.ValidClaims = ValidClaims?.ToArray();
            e.ValidPhotos = ValidPhotos?.ToArray();
            e.PotentialClaims = PotentialClaims?.ToArray();
            e.UnvalidatedClaims = UnvalidatedClaims?.ToArray();
            e.UnvalidatedPhotos = UnvalidatedPhotos?.ToArray();
        }
 
        private async Task<LegalIdentity> AddIdentityReviewAttachment(IdentityReviewEventArgs e)
        {
            string Xml = e.Content.OuterXml;
            byte[] Data = Encoding.UTF8.GetBytes(Xml.ToString());
            string FileName = "ApplicationReview.xml";
            string ContentType = XmlCodec.DefaultContentType + "; charset=utf-8";
 
            return await this.UploadLegalIdAttachmentAsync(e.LegalId, FileName, Data, ContentType);
        }
 
        #endregion
 
        #region Client Message
 
        private async Task ClientMessageEventHandler(object Sender, MessageEventArgs e)
        {
            string LegalId = XML.Attribute(e.Content, "id");
            string Code = XML.Attribute(e.Content, "code");
            ValidationErrorType Type = XML.Attribute(e.Content, "type", ValidationErrorType.Client);
            ClientMessageEventArgs e2 = new ClientMessageEventArgs(e, LegalId, Code, Type);
            ParseValidationDetails(e.Content, e2);
 
            await this.ClientMessage.Raise(this, e2);
        }
 
        public event EventHandlerAsync<ClientMessageEventArgs> ClientMessage;
 
        #endregion
 
        #region Validate Legal Identity
 
        public Task Validate(LegalIdentity Identity, EventHandlerAsync<IdentityValidationEventArgs> Callback, object State)
        {
            return this.Validate(Identity, true, true, Callback, State);
        }
 
        public Task Validate(LegalIdentity Identity, bool ValidateState, EventHandlerAsync<IdentityValidationEventArgs> Callback, object State)
        {
            return this.Validate(Identity, ValidateState, true, Callback, State);
        }
 
        public async Task Validate(LegalIdentity Identity, bool ValidateState, bool ValidateAttachments,
            EventHandlerAsync<IdentityValidationEventArgs> Callback, object State)
        {
            if (Identity is null)
            {
                await this.ReturnStatus(IdentityStatus.IdentityUndefined, Callback, State);
                return;
            }
 
            if (ValidateState && Identity.State != IdentityState.Approved)
            {
                await this.ReturnStatus(IdentityStatus.NotApproved, Callback, State,
                    new KeyValuePair<string, object>("State", Identity.State));
                return;
            }
 
            DateTime UtcNow = DateTime.UtcNow;
 
            if (UtcNow < Identity.From.ToUniversalTime())    // To avoid Time-zone problems
            {
                await this.ReturnStatus(IdentityStatus.NotValidYet, Callback, State,
                    new KeyValuePair<string, object>("From", Identity.From));
                return;
            }
 
            if (UtcNow > Identity.To.ToUniversalTime())      // To avoid Time-zone problems
            {
                await this.ReturnStatus(IdentityStatus.NotValidAnymore, Callback, State,
                    new KeyValuePair<string, object>("To", Identity.To));
                return;
            }
 
            if (string.IsNullOrEmpty(Identity.Provider))
            {
                await this.ReturnStatus(IdentityStatus.NoTrustProvider, Callback, State);
                return;
            }
 
            if (string.IsNullOrEmpty(Identity.ClientKeyName) ||
                Identity.ClientPubKey is null || Identity.ClientPubKey.Length == 0)
            {
                await this.ReturnStatus(IdentityStatus.NoClientPublicKey, Callback, State);
                return;
            }
 
            if (Identity.ClientSignature is null || Identity.ClientSignature.Length == 0)
            {
                await this.ReturnStatus(IdentityStatus.NoClientSignature, Callback, State);
                return;
            }
 
            StringBuilder Xml = new StringBuilder();
            Identity.Serialize(Xml, false, false, false, false, false, false, false);
            byte[] Data = Encoding.UTF8.GetBytes(Xml.ToString());
 
            bool? b = this.ValidateSignature(Identity, Data, Identity.ClientSignature);
            if (b.HasValue)
            {
                if (!b.Value)
                {
                    await this.ReturnStatus(IdentityStatus.ClientSignatureInvalid, Callback, State,
                        new KeyValuePair<string, object>("DataBase64", Convert.ToBase64String(Data)),
                        new KeyValuePair<string, object>("SignatureBase64", Convert.ToBase64String(Identity.ClientSignature)),
                        new KeyValuePair<string, object>("ClientKeyName", Identity.ClientKeyName),
                        new KeyValuePair<string, object>("ClientPubKeyBase64", Convert.ToBase64String(Identity.ClientPubKey)));
                    return;
                }
            }
            else
            {
                await this.ReturnStatus(IdentityStatus.ClientKeyNotRecognized, Callback, State,
                    new KeyValuePair<string, object>("KeyName", Identity.ClientKeyName));
                return;
            }
 
            if (Identity.State == IdentityState.Approved && ValidateState &&
                ValidateAttachments && !(Identity.Attachments is null))
            {
                foreach (Attachment Attachment in Identity.Attachments)
                {
                    if (string.IsNullOrEmpty(Attachment.Url))
                    {
                        await this.ReturnStatus(IdentityStatus.AttachmentLacksUrl, Callback, State,
                            new KeyValuePair<string, object>("AttachmentId", Attachment.Id));
                        return;
                    }
 
                    try
                    {
                        KeyValuePair<string, TemporaryFile> P = await this.GetAttachmentAsync(Attachment.Url, SignWith.LatestApprovedIdOrCurrentKeys, 30000);
                        using TemporaryFile File = P.Value;
 
                        if (P.Key != Attachment.ContentType)
                        {
                            await this.ReturnStatus(IdentityStatus.AttachmentInconsistency, Callback, State,
                                new KeyValuePair<string, object>("AttachmentId", Attachment.Id),
                                new KeyValuePair<string, object>("AttachmentUrl", Attachment.Url),
                                new KeyValuePair<string, object>("ExpectedContentType", Attachment.ContentType),
                                new KeyValuePair<string, object>("ContentType", P.Key));
                            return;
                        }
 
                        File.Position = 0;
 
                        b = this.ValidateSignature(Identity, File, Attachment.Signature);
                        if (b.HasValue)
                        {
                            if (!b.Value)
                            {
                                await this.ReturnStatus(IdentityStatus.AttachmentSignatureInvalid, Callback, State,
                                    new KeyValuePair<string, object>("AttachmentId", Attachment.Id),
                                    new KeyValuePair<string, object>("AttachmentUrl", Attachment.Url),
                                    new KeyValuePair<string, object>("AttachmentSignatureBase64", Convert.ToBase64String(Attachment.Signature)));
                                return;
                            }
                        }
                        else
                        {
                            await this.ReturnStatus(IdentityStatus.ClientKeyNotRecognized, Callback, State,
                                new KeyValuePair<string, object>("AttachmentId", Attachment.Id),
                                new KeyValuePair<string, object>("AttachmentUrl", Attachment.Url),
                                new KeyValuePair<string, object>("KeyName", Identity.ClientKeyName));
                            return;
                        }
                    }
                    catch (Exception ex)
                    {
                        this.client.Error("Attachment " + Attachment.Url + "unavailable: " + ex.Message);
                        await this.ReturnStatus(IdentityStatus.AttachmentUnavailable, Callback, State,
                            new KeyValuePair<string, object>("AttachmentId", Attachment.Id),
                            new KeyValuePair<string, object>("AttachmentUrl", Attachment.Url),
                            new KeyValuePair<string, object>("Error", ex.Message));
                        return;
                    }
                }
            }
 
            if (Identity.ServerSignature is null || Identity.ServerSignature.Length == 0)
            {
                await this.ReturnStatus(IdentityStatus.NoProviderSignature, Callback, State);
                return;
            }
 
            Xml.Clear();
            Identity.Serialize(Xml, false, true, true, true, true, false, false);
            Data = Encoding.UTF8.GetBytes(Xml.ToString());
 
            bool HasOldPublicKey = this.publicKeys.TryGetRecord(Identity.Provider, 
                Identity.Updated, out _);
 
            await this.GetServerPublicKey(Identity.Provider, Identity.Updated, async (Sender, e) =>
            {
                if (e.Ok && !(e.Key is null))
                {
                    bool Valid = e.Key.Verify(Data, Identity.ServerSignature);
 
                    if (Valid)
                    {
                        await this.ReturnStatus(IdentityStatus.Valid, Callback, State);
                        return;
                    }
 
                    if (!HasOldPublicKey)
                    {
                        await this.ReturnStatus(IdentityStatus.ProviderSignatureInvalid, Callback, State,
                            new KeyValuePair<string, object>("Provider", Identity.Provider),
                            new KeyValuePair<string, object>("LocalName", e.Key.LocalName),
                            new KeyValuePair<string, object>("Namespace", e.Key.Namespace),
                            new KeyValuePair<string, object>("PublicKeyBase64", e.Key.PublicKeyBase64),
                            new KeyValuePair<string, object>("DataBase64", Convert.ToBase64String(Data)),
                            new KeyValuePair<string, object>("SignatureBase64", Convert.ToBase64String(Identity.ServerSignature)));
                        return;
                    }
 
                    this.publicKeys.Remove(Identity.Provider);
 
                    await this.GetServerPublicKey(Identity.Provider, Identity.Updated,
                        (sender2, e2) =>
                        {
                            if (e2.Ok && !(e2.Key is null))
                            {
                                if (e.Key.Equals(e2.Key))
                                {
                                    return this.ReturnStatus(IdentityStatus.ProviderSignatureInvalid, Callback, State,
                                        new KeyValuePair<string, object>("Provider", Identity.Provider),
                                        new KeyValuePair<string, object>("LocalName", e.Key.LocalName),
                                        new KeyValuePair<string, object>("Namespace", e.Key.Namespace),
                                        new KeyValuePair<string, object>("PublicKeyBase64", e.Key.PublicKeyBase64),
                                        new KeyValuePair<string, object>("DataBase64", Convert.ToBase64String(Data)),
                                        new KeyValuePair<string, object>("SignatureBase64", Convert.ToBase64String(Identity.ServerSignature)));
                                }
 
                                Valid = e2.Key.Verify(Data, Identity.ServerSignature);
 
                                if (Valid)
                                    return this.ReturnStatus(IdentityStatus.Valid, Callback, State);
                                else
                                {
                                    return this.ReturnStatus(IdentityStatus.ProviderSignatureInvalid, Callback, State,
                                        new KeyValuePair<string, object>("Provider", Identity.Provider),
                                        new KeyValuePair<string, object>("LocalName", e2.Key.LocalName),
                                        new KeyValuePair<string, object>("Namespace", e2.Key.Namespace),
                                        new KeyValuePair<string, object>("PublicKeyBase64", e.Key.PublicKeyBase64),
                                        new KeyValuePair<string, object>("DataBase64", Convert.ToBase64String(Data)),
                                        new KeyValuePair<string, object>("SignatureBase64", Convert.ToBase64String(Identity.ServerSignature)));
                                }
                            }
                            else
                            {
                                return this.ReturnStatus(IdentityStatus.NoProviderPublicKey, Callback, State,
                                    new KeyValuePair<string, object>("Provider", Identity.Provider));
                            }
 
                        }, State);
                }
                else if (e.StanzaError is RecipientUnavailableException)
                {
                    await this.ReturnStatus(IdentityStatus.NoResponse, Callback, State,
                        new KeyValuePair<string, object>("Provider", Identity.Provider));
                }
                else
                {
                    await this.ReturnStatus(IdentityStatus.NoProviderPublicKey, Callback, State,
                        new KeyValuePair<string, object>("Provider", Identity.Provider));
                }
 
            }, State);
        }
 
        public bool? ValidateSignature(LegalIdentity Identity, byte[] Data, byte[] Signature)
        {
            if (Identity.ClientKeyName.StartsWith("RSA") &&
                int.TryParse(Identity.ClientKeyName[3..], out int KeySize))
            {
                return RsaEndpoint.Verify(Data, Signature, KeySize, Identity.ClientPubKey);
            }
            else if (EndpointSecurity.TryGetEndpoint(Identity.ClientKeyName,
                Identity.Namespace.Replace(":iot:leg:id:", ":iot:e2e:").Replace("urn:ieee:", "urn:nf:"),
                out IE2eEndpoint LocalKey) &&
                LocalKey is EllipticCurveEndpoint LocalEc)
            {
                return LocalEc.Verify(Data, Identity.ClientPubKey, Signature);
            }
            else
                return null;
        }
 
        public bool? ValidateSignature(LegalIdentity Identity, Stream Data, byte[] Signature)
        {
            if (Identity.ClientKeyName.StartsWith("RSA") &&
                int.TryParse(Identity.ClientKeyName[3..], out int KeySize))
            {
                return RsaEndpoint.Verify(Data, Signature, KeySize, Identity.ClientPubKey);
            }
            else if (EndpointSecurity.TryGetEndpoint(Identity.ClientKeyName,
                Identity.Namespace.Replace(":iot:leg:id:", ":iot:e2e:").Replace("urn:ieee:", "urn:nf:"),
                out IE2eEndpoint LocalKey) &&
                LocalKey is EllipticCurveEndpoint LocalEc)
            {
                return LocalEc.Verify(Data, Identity.ClientPubKey, Signature);
            }
            else
                return null;
        }
 
        private async Task ReturnStatus(IdentityStatus Status, EventHandlerAsync<IdentityValidationEventArgs> Callback, object State,
            params KeyValuePair<string, object>[] Tags)
        {
            await Callback.Raise(this, new IdentityValidationEventArgs(Status, State, Tags));
        }
 
        public Task<IdentityValidationEventArgs> ValidateAsync(LegalIdentity Identity)
        {
            return this.ValidateAsync(Identity, true, true);
        }
 
        public Task<IdentityValidationEventArgs> ValidateAsync(LegalIdentity Identity, bool ValidateState)
        {
            return this.ValidateAsync(Identity, ValidateState, true);
        }
 
        public async Task<IdentityValidationEventArgs> ValidateAsync(LegalIdentity Identity,
            bool ValidateState, bool ValidateAttachments)
        {
            TaskCompletionSource<IdentityValidationEventArgs> Result = new TaskCompletionSource<IdentityValidationEventArgs>();
 
            await this.Validate(Identity, ValidateState, ValidateAttachments, (Sender, e) =>
            {
                Result.TrySetResult(e);
                return Task.CompletedTask;
            }, null);
 
            return await Result.Task;
        }
 
        #endregion
 
        #region Legal Identity update event
 
        private bool IsFromTrustProvider(string Id, string From)
        {
            int i = Id.IndexOf('@');
            if (i < 0)
                return false;
 
            Id = Id[(i + 1)..];
 
            i = From.IndexOf('@');
            if (i >= 0)
                return false;
 
            return (string.Compare(Id, From, true) == 0 ||
                From.EndsWith("." + Id, StringComparison.CurrentCultureIgnoreCase));
        }
 
        private async Task IdentityMessageHandler(object Sender, MessageEventArgs e)
        {
            LegalIdentity Identity = LegalIdentity.Parse(e.Content);
 
            if (!this.IsFromTrustProvider(Identity.Id, e.From))
            {
                this.client.Warning("Incoming identity message discarded: " + Identity.Id + " not from " + e.From + ".");
                return;
            }
 
            if (string.Compare(e.FromBareJID, Identity.Provider, true) != 0)
            {
                this.client.Warning("Incoming identity message discarded: Sender " + e.FromBareJID + " not equal to Trust Provider " + Identity.Provider + ".");
                return;
            }
 
            await this.Validate(Identity, false, async (sender2, e2) =>
            {
                if (e2.Status != IdentityStatus.Valid)
                {
                    this.client.Warning("Invalid legal identity received and discarded. Validation status: " + e2.Status.ToString());
 
                    Log.Warning("Invalid legal identity received and discarded.", this.client.BareJID, e.From,
                        new KeyValuePair<string, object>("Status", e2.Status));
 
                    return;
                }
 
                await this.UpdateSettings(Identity);
                await this.IdentityUpdated.Raise(this, new LegalIdentityEventArgs(new IqResultEventArgs(e.Message, e.Id, e.To, e.From, e.Ok, null), Identity));
 
            }, null);
        }
 
        private Task UpdateSettings(LegalIdentity Identity)
        {
            return this.UpdateSettings(Identity, Identity?.ClientPubKey);
        }
 
        public Task<bool> HasPrivateKey(LegalIdentity Identity)
        {
            return this.HasPrivateKey(Identity.Id);
        }
 
        public async Task<bool> HasPrivateKey(string IdentityId)
        {
            LegalIdentityState State = await Database.FindFirstIgnoreRest<LegalIdentityState>(new FilterAnd(
                new FilterFieldEqualTo("BareJid", this.client.BareJID),
                new FilterFieldEqualTo("LegalId", IdentityId)));
 
            using LoadedKey Key = await this.TryGetLegalIdentityEndpointAsync(State, true, false);
 
            return !(Key.Endpoint is null);
        }
 
        public Task<string> GetLatestApprovedLegalId()
        {
            return this.GetLatestApprovedLegalId(null);
        }
 
        public async Task<string> GetLatestApprovedLegalId(byte[] PublicKey)
        {
            string PublicKeyBase64 = PublicKey is null ? string.Empty : Convert.ToBase64String(PublicKey);
 
            foreach (LegalIdentityState State in await Database.Find<LegalIdentityState>(new FilterAnd(
                new FilterFieldEqualTo("BareJid", this.client.BareJID),
                new FilterFieldEqualTo("State", IdentityState.Approved)), "-Timestamp"))
            {
                using LoadedKey Key = await this.TryGetLegalIdentityEndpointAsync(State, true, false);
 
                if (Key.Endpoint is null || State.PublicKey is null)
                    continue;
 
                if (!(PublicKey is null) && Convert.ToBase64String(State.PublicKey) != PublicKeyBase64)
                    continue;
 
                return State.LegalId;
            }
 
            return null;
        }
 
        private async Task<LoadedKey> GetLatestApprovedKey(bool ExceptionIfNone)
        {
            bool HaveStates = false;
 
            foreach (LegalIdentityState State in await Database.Find<LegalIdentityState>(new FilterAnd(
                new FilterFieldEqualTo("BareJid", this.client.BareJID),
                new FilterFieldEqualTo("State", IdentityState.Approved)), "-Timestamp"))
            {
                HaveStates = true;
 
                LoadedKey Key = await this.TryGetLegalIdentityEndpointAsync(State, true, false);
                if (!(Key.Endpoint is null))
                    return Key;
 
                Key.Dispose();
            }
 
            if (ExceptionIfNone)
            {
                if (HaveStates)
                {
                    throw new Exception("Private keys are not available on this device (" + this.client.BareJID +
                        "). Were they created on another device?");
                }
                else
                    throw new Exception("No approved legal identity available on this device (" + this.client.BareJID + ").");
            }
 
            return new LoadedKey(null, false, DateTime.MinValue);
        }
 
        private async Task<LegalIdentityState> FindPreviewStateAsync(byte[] PublicKey, string LegalId)
        {
            if (PublicKey is null)
                return null;
 
            foreach (LegalIdentityState State in await Database.Find<LegalIdentityState>(new FilterAnd(
                new FilterFieldEqualTo("BareJid", this.client.BareJID),
                new FilterFieldEqualTo("State", IdentityState.Created))))
            {
                if (State.LegalId != LegalId && AreEqual(State.PublicKey, PublicKey))
                    return State;
            }
 
            return null;
        }
 
        private async Task UpdateSettings(LegalIdentity Identity, byte[] PublicKey)
        {
            PublicKey ??= Identity?.ClientPubKey;
 
            if (!string.IsNullOrEmpty(Identity.Id))
            {
                LegalIdentityState StateObj = Types.Instantiate<LegalIdentityState>(false, Identity.Id);
 
                if (string.IsNullOrEmpty(StateObj.ObjectId))
                {
                    LegalIdentityState StateObj2 = await Database.FindFirstDeleteRest<LegalIdentityState>(new FilterAnd(
                        new FilterFieldEqualTo("BareJid", this.client.BareJID),
                        new FilterFieldEqualTo("LegalId", Identity.Id)));
 
                    if (StateObj2 is null)
                    {
                        StateObj2 = await this.FindPreviewStateAsync(PublicKey, Identity.Id);
                        if (StateObj2 is null)
                            StateObj.BareJid = this.client.BareJID;
                        else
                        {
                            if (!string.IsNullOrEmpty(StateObj2.LegalId))
                                Types.UnregisterSingleton(StateObj2, StateObj2.LegalId);
 
                            StateObj2.LegalId = Identity.Id;
                            Types.ReplaceSingleton(StateObj2, Identity.Id);
                            StateObj = StateObj2;
                        }
                    }
                    else
                    {
                        Types.ReplaceSingleton(StateObj2, Identity.Id);
                        StateObj = StateObj2;
                    }
                }
 
                DateTime Timestamp = Identity.Updated > Identity.Created ? Identity.Updated : Identity.Created;
 
                if (Timestamp > StateObj.Timestamp ||
                    (StateObj.PublicKey is null && !(PublicKey is null)) ||
                    (!StateObj.HasPrivateKey && !(PublicKey is null)) ||
                    (string.IsNullOrEmpty(StateObj.KeyName) && !(PublicKey is null)) ||
                    Identity.State > StateObj.State)
                {
                    StateObj.State = Identity.State;
                    StateObj.Timestamp = Timestamp;
 
                    if (PublicKey is null)
                    {
                        switch (Identity.State)
                        {
                            case IdentityState.Compromised:
                            case IdentityState.Obsoleted:
                            case IdentityState.Rejected:
                                StateObj.PublicKey = null;
                                break;
                        }
                    }
                    else
                    {
                        if (await this.LoadKeys(false))
                        {
                            IE2eEndpoint Endpoint = this.LocalEndpoint.FindLocalEndpoint(PublicKey);
 
                            if (!(Endpoint is null))
                                await this.SetLegalIdentityKeySnapshotAsync(StateObj, Endpoint);
                            else
                                StateObj.PublicKey = Clone(PublicKey);
                        }
                        else
                            StateObj.PublicKey = Clone(PublicKey);
                    }
 
                    if (string.IsNullOrEmpty(StateObj.ObjectId))
                        await Database.Insert(StateObj);
                    else
                        await Database.Update(StateObj);
                }
            }
        }
 
        public event EventHandlerAsync<LegalIdentityEventArgs> IdentityUpdated = null;
 
        #endregion
 
        #region Get Legal Identities
 
        public Task GetLegalIdentities(EventHandlerAsync<LegalIdentitiesEventArgs> Callback, object State)
        {
            return this.GetLegalIdentities(this.componentAddress, Callback, State);
        }
 
        public Task GetLegalIdentities(string Address, EventHandlerAsync<LegalIdentitiesEventArgs> Callback, object State)
        {
            return this.client.SendIqGet(Address, "<getLegalIdentities xmlns=\"" + NamespaceLegalIdentitiesCurrent + "\"/>",
                this.IdentitiesResponse, new object[] { Callback, State });
        }
 
        private async Task IdentitiesResponse(object Sender, IqResultEventArgs e)
        {
            object[] P = (object[])e.State;
            EventHandlerAsync<LegalIdentitiesEventArgs> Callback = (EventHandlerAsync<LegalIdentitiesEventArgs>)P[0];
            LegalIdentity[] Identities = null;
            XmlElement E;
 
            if (e.Ok && !((E = e.FirstElement) is null) && E.LocalName == "identities")
            {
                List<LegalIdentity> IdentitiesList = new List<LegalIdentity>();
 
                foreach (XmlNode N in E.ChildNodes)
                {
                    if (N is XmlElement E2 && E2.LocalName == "identity")
                    {
                        LegalIdentity Identity = LegalIdentity.Parse(E2);
                        IdentitiesList.Add(Identity);
 
                        try
                        {
                            await this.UpdateSettings(Identity);
                        }
                        catch (Exception ex)
                        {
                            Log.Exception(ex, Identity.Id);
                        }
                    }
                }
 
                Identities = IdentitiesList.ToArray();
            }
            else
                e.Ok = false;
 
            e.State = P[1];
            await Callback.Raise(this, new LegalIdentitiesEventArgs(e, Identities));
        }
 
        public Task<LegalIdentity[]> GetLegalIdentitiesAsync()
        {
            return this.GetLegalIdentitiesAsync(this.componentAddress);
        }
 
        public async Task<LegalIdentity[]> GetLegalIdentitiesAsync(string Address)
        {
            TaskCompletionSource<LegalIdentity[]> Result = new TaskCompletionSource<LegalIdentity[]>();
 
            await this.GetLegalIdentities(Address, (Sender, e) =>
            {
                if (e.Ok)
                    Result.TrySetResult(e.Identities);
                else
                    Result.TrySetException(e.StanzaError ?? new Exception("Unable to get legal identities."));
 
                return Task.CompletedTask;
 
            }, null);
 
            return await Result.Task;
        }
 
        #endregion
 
        #region Get Legal Identity
 
        public Task GetLegalIdentity(string LegalIdentityId, EventHandlerAsync<LegalIdentityEventArgs> Callback, object State)
        {
            return this.GetLegalIdentity(this.GetTrustProvider(LegalIdentityId), LegalIdentityId, Callback, State);
        }
 
        public string GetTrustProvider(string EntityId)
        {
            int i = EntityId.IndexOf('@');
            if (i < 0)
                return this.componentAddress;
            else
                return EntityId[(i + 1)..];
        }
 
        public Task GetLegalIdentity(string Address, string LegalIdentityId, EventHandlerAsync<LegalIdentityEventArgs> Callback, object State)
        {
            return this.client.SendIqGet(Address, "<getLegalIdentity id=\"" + XML.Encode(LegalIdentityId) + "\" xmlns=\"" +
                NamespaceLegalIdentitiesCurrent + "\"/>", async (Sender, e) =>
            {
                LegalIdentity Identity = null;
                XmlElement E;
 
                if (e.Ok && !((E = e.FirstElement) is null) && E.LocalName == "identity")
                    Identity = LegalIdentity.Parse(E);
                else
                    e.Ok = false;
 
                await Callback.Raise(this, new LegalIdentityEventArgs(e, Identity));
            }, State);
        }
 
        public Task<LegalIdentity> GetLegalIdentityAsync(string LegalIdentityId)
        {
            return this.GetLegalIdentityAsync(this.GetTrustProvider(LegalIdentityId), LegalIdentityId);
        }
 
        public async Task<LegalIdentity> GetLegalIdentityAsync(string Address, string LegalIdentityId)
        {
            TaskCompletionSource<LegalIdentity> Result = new TaskCompletionSource<LegalIdentity>();
 
            await this.GetLegalIdentity(Address, LegalIdentityId, (Sender, e) =>
            {
                if (e.Ok)
                    Result.TrySetResult(e.Identity);
                else
                    Result.TrySetException(e.StanzaError ?? new Exception("Unable to get legal identity."));
 
                return Task.CompletedTask;
 
            }, null);
 
            return await Result.Task;
        }
 
        #endregion
 
        #region Obsolete Legal Identity
 
        public Task ObsoleteLegalIdentity(string LegalIdentityId, EventHandlerAsync<LegalIdentityEventArgs> Callback, object State)
        {
            return this.ObsoleteLegalIdentity(this.GetTrustProvider(LegalIdentityId), LegalIdentityId, Callback, State);
        }
 
        public Task ObsoleteLegalIdentity(string Address, string LegalIdentityId, EventHandlerAsync<LegalIdentityEventArgs> Callback, object State)
        {
            this.AssertAllowed();
 
            return this.client.SendIqSet(Address, "<obsoleteLegalIdentity id=\"" + XML.Encode(LegalIdentityId) + "\" xmlns=\"" +
                NamespaceLegalIdentitiesCurrent + "\"/>", async (Sender, e) =>
                {
                    LegalIdentity Identity = null;
                    XmlElement E;
 
                    if (e.Ok && !((E = e.FirstElement) is null) && E.LocalName == "identity")
                    {
                        Identity = LegalIdentity.Parse(E);
                        await this.UpdateSettings(Identity);
                    }
                    else
                        e.Ok = false;
 
                    await Callback.Raise(this, new LegalIdentityEventArgs(e, Identity));
                }, State);
        }
 
        public Task<LegalIdentity> ObsoleteLegalIdentityAsync(string LegalIdentityId)
        {
            return this.ObsoleteLegalIdentityAsync(this.GetTrustProvider(LegalIdentityId), LegalIdentityId);
        }
 
        public async Task<LegalIdentity> ObsoleteLegalIdentityAsync(string Address, string LegalIdentityId)
        {
            TaskCompletionSource<LegalIdentity> Result = new TaskCompletionSource<LegalIdentity>();
 
            await this.ObsoleteLegalIdentity(Address, LegalIdentityId, (Sender, e) =>
            {
                if (e.Ok)
                    Result.TrySetResult(e.Identity);
                else
                    Result.TrySetException(e.StanzaError ?? new Exception("Unable to obsolete legal identity."));
 
                return Task.CompletedTask;
 
            }, null);
 
            return await Result.Task;
        }
 
        #endregion
 
        #region Compromised Legal Identity
 
        public Task CompromisedLegalIdentity(string LegalIdentityId, EventHandlerAsync<LegalIdentityEventArgs> Callback, object State)
        {
            return this.CompromisedLegalIdentity(this.GetTrustProvider(LegalIdentityId), LegalIdentityId, Callback, State);
        }
 
        public Task CompromisedLegalIdentity(string Address, string LegalIdentityId, EventHandlerAsync<LegalIdentityEventArgs> Callback, object State)
        {
            this.AssertAllowed();
 
            return this.client.SendIqSet(Address, "<compromisedLegalIdentity id=\"" + XML.Encode(LegalIdentityId) + "\" xmlns=\"" +
                NamespaceLegalIdentitiesCurrent + "\"/>", async (Sender, e) =>
                {
                    LegalIdentity Identity = null;
                    XmlElement E;
 
                    if (e.Ok && !((E = e.FirstElement) is null) && E.LocalName == "identity")
                    {
                        Identity = LegalIdentity.Parse(E);
                        await this.UpdateSettings(Identity);
                    }
                    else
                        e.Ok = false;
 
                    await Callback.Raise(this, new LegalIdentityEventArgs(e, Identity));
                }, State);
        }
 
        public Task<LegalIdentity> CompromisedLegalIdentityAsync(string LegalIdentityId)
        {
            return this.CompromisedLegalIdentityAsync(this.GetTrustProvider(LegalIdentityId), LegalIdentityId);
        }
 
        public async Task<LegalIdentity> CompromisedLegalIdentityAsync(string Address, string LegalIdentityId)
        {
            TaskCompletionSource<LegalIdentity> Result = new TaskCompletionSource<LegalIdentity>();
 
            await this.CompromisedLegalIdentity(Address, LegalIdentityId, (Sender, e) =>
            {
                if (e.Ok)
                    Result.TrySetResult(e.Identity);
                else
                    Result.TrySetException(e.StanzaError ?? new Exception("Unable to compromise legal identity."));
 
                return Task.CompletedTask;
 
            }, null);
 
            return await Result.Task;
        }
 
        #endregion
 
        #region Signatures
 
        public Task Sign(byte[] Data, SignWith SignWith, EventHandlerAsync<SignatureEventArgs> Callback, object State)
        {
            return this.Sign(this.componentAddress, Data, SignWith, Callback, State);
        }
 
        public async Task Sign(string Address, byte[] Data, SignWith SignWith, EventHandlerAsync<SignatureEventArgs> Callback, object State)
        {
            this.AssertAllowed();
 
            byte[] Signature = null;
            LoadedKey KeyInfo = SignWith switch
            {
                SignWith.CurrentKeys => new LoadedKey(null, false, DateTime.MinValue),
                SignWith.LatestApprovedId => await this.GetLatestApprovedKey(true),
                _ => await this.GetLatestApprovedKey(false),
            };
            IE2eEndpoint Key = KeyInfo.Endpoint;
 
            if (Key is null)
            {
                KeyInfo.Dispose();
 
                await this.GetMatchingLocalKey(Address, async (Sender, e) =>
                {
                    if (e.Ok)
                        Signature = e.Key.Sign(Data);
 
                    await Callback.Raise(this, new SignatureEventArgs(e, Signature));
 
                }, State);
            }
            else
            {
                using (KeyInfo)
                {
                    Signature = Key.Sign(Data);
 
                    await Callback.Raise(this, new SignatureEventArgs(Key, Signature, 
                        State, KeyInfo.Timestamp));
                }
            }
        }
 
        public Task<byte[]> SignAsync(byte[] Data, SignWith SignWith)
        {
            return this.SignAsync(this.componentAddress, Data, SignWith);
        }
 
        public async Task<byte[]> SignAsync(string Address, byte[] Data, SignWith SignWith)
        {
            TaskCompletionSource<byte[]> Result = new TaskCompletionSource<byte[]>();
 
            await this.Sign(Address, Data, SignWith, (Sender, e) =>
            {
                if (e.Ok)
                    Result.TrySetResult(e.Signature);
                else
                    Result.TrySetException(e.StanzaError ?? new Exception("Unable to sign data."));
 
                return Task.CompletedTask;
 
            }, null);
 
            return await Result.Task;
        }
 
        public Task Sign(Stream Data, SignWith SignWith, EventHandlerAsync<SignatureEventArgs> Callback, object State)
        {
            return this.Sign(this.componentAddress, Data, SignWith, Callback, State);
        }
 
        public async Task Sign(string Address, Stream Data, SignWith SignWith, EventHandlerAsync<SignatureEventArgs> Callback, object State)
        {
            this.AssertAllowed();
 
            LoadedKey KeyInfo = SignWith == SignWith.CurrentKeys ?
                new LoadedKey(null, false, DateTime.MinValue)
                : await this.GetLatestApprovedKey(true);
            IE2eEndpoint Key = KeyInfo.Endpoint;
            byte[] Signature = null;
 
            if (Key is null)
            {
                KeyInfo.Dispose();
 
                await this.GetMatchingLocalKey(Address, async (Sender, e) =>
                {
                    if (e.Ok)
                        Signature = e.Key.Sign(Data);
 
                    await Callback.Raise(this, new SignatureEventArgs(e, Signature));
 
                }, State);
            }
            else
            {
                using (KeyInfo)
                {
                    Signature = Key.Sign(Data);
 
                    await Callback.Raise(this, new SignatureEventArgs(Key, Signature, 
                        State, KeyInfo.Timestamp));
                }
            }
        }
 
        public Task<byte[]> SignAsync(Stream Data, SignWith SignWith)
        {
            return this.SignAsync(this.componentAddress, Data, SignWith);
        }
 
        public async Task<byte[]> SignAsync(string Address, Stream Data, SignWith SignWith)
        {
            TaskCompletionSource<byte[]> Result = new TaskCompletionSource<byte[]>();
 
            await this.Sign(Address, Data, SignWith, (Sender, e) =>
            {
                if (e.Ok)
                    Result.TrySetResult(e.Signature);
                else
                    Result.TrySetException(e.StanzaError ?? new Exception("Unable to sign data."));
 
                return Task.CompletedTask;
 
            }, null);
 
            return await Result.Task;
        }
 
        #endregion
 
        #region Validating Signatures
 
        public Task ValidateSignature(string LegalId, byte[] Data, byte[] Signature, EventHandlerAsync<LegalIdentityEventArgs> Callback, object State)
        {
            return this.ValidateSignature(this.GetTrustProvider(LegalId), LegalId, Data, Signature, Callback, State);
        }
 
        public async Task ValidateSignature(string Address, string LegalId, byte[] Data, byte[] Signature,
            EventHandlerAsync<LegalIdentityEventArgs> Callback, object State)
        {
            EventHandlerAsync<ValidateSignatureEventArgs> h = ValidateLocalSignature;
            if (!(h is null))
            {
                ValidateSignatureEventArgs e = new ValidateSignatureEventArgs(LegalId, Data, Signature);
                await h.Raise(this, e, false);
 
                if (e.Valid.HasValue)
                {
                    if (!(Callback is null))
                    {
                        XmlDocument Doc = new XmlDocument();
                        XmlElement Empty = Doc.CreateElement("Local");
 
                        IqResultEventArgs e0 = new IqResultEventArgs(Empty, string.Empty, string.Empty, string.Empty, true, State)
                        {
                            Ok = e.Valid.Value
                        };
                        LegalIdentityEventArgs e2 = new LegalIdentityEventArgs(e0, e.Valid.Value ? e.Identity : null);
                        await Callback.Raise(this, e2);
                    }
 
                    return;
                }
            }
 
            StringBuilder Xml = new StringBuilder();
 
            Xml.Append("<validateSignature data=\"");
            Xml.Append(Convert.ToBase64String(Data));
 
            if (!string.IsNullOrEmpty(LegalId))
            {
                Xml.Append("\" id=\"");
                Xml.Append(XML.Encode(LegalId));
            }
 
            Xml.Append("\" s=\"");
            Xml.Append(Convert.ToBase64String(Signature));
 
            Xml.Append("\" xmlns=\"");
            Xml.Append(NamespaceLegalIdentitiesCurrent);
            Xml.Append("\"/>");
 
            await this.client.SendIqGet(Address, Xml.ToString(), async (Sender, e) =>
            {
                LegalIdentity Identity = null;
                XmlElement E;
 
                if (e.Ok && !((E = e.FirstElement) is null) && E.LocalName == "identity")
                    Identity = LegalIdentity.Parse(E);
                else
                    e.Ok = false;
 
                await Callback.Raise(this, new LegalIdentityEventArgs(e, Identity));
            }, State);
        }
 
        public static event EventHandlerAsync<ValidateSignatureEventArgs> ValidateLocalSignature = null;
 
        public Task<LegalIdentity> ValidateSignatureAsync(string LegalId, byte[] Data, byte[] Signature)
        {
            return this.ValidateSignatureAsync(this.GetTrustProvider(LegalId), LegalId, Data, Signature);
        }
 
        public async Task<LegalIdentity> ValidateSignatureAsync(string Address, string LegalId, byte[] Data, byte[] Signature)
        {
            TaskCompletionSource<LegalIdentity> Result = new TaskCompletionSource<LegalIdentity>();
 
            await this.ValidateSignature(Address, LegalId, Data, Signature, (Sender, e) =>
            {
                if (e.Ok)
                    Result.TrySetResult(e.Identity);
                else
                    Result.TrySetException(e.StanzaError ?? new Exception("Unable to verify signature."));
 
                return Task.CompletedTask;
 
            }, null);
 
            return await Result.Task;
        }
 
        public Task<KeyValuePair<LegalIdentity, Exception>> ValidateSignatureAsyncEx(string LegalId, byte[] Data, byte[] Signature)
        {
            return this.ValidateSignatureAsyncEx(this.GetTrustProvider(LegalId), LegalId, Data, Signature);
        }
 
        public async Task<KeyValuePair<LegalIdentity, Exception>> ValidateSignatureAsyncEx(string Address, string LegalId, byte[] Data, byte[] Signature)
        {
            TaskCompletionSource<KeyValuePair<LegalIdentity, Exception>> Result = new TaskCompletionSource<KeyValuePair<LegalIdentity, Exception>>();
 
            await this.ValidateSignature(Address, LegalId, Data, Signature, (Sender, e) =>
            {
                if (e.Ok)
                    Result.TrySetResult(new KeyValuePair<LegalIdentity, Exception>(e.Identity, null));
                else
                    Result.TrySetResult(new KeyValuePair<LegalIdentity, Exception>(null, e.StanzaError ?? new Exception("Unable to verify signature.")));
 
                return Task.CompletedTask;
 
            }, null);
 
            return await Result.Task;
        }
 
        #endregion
 
        #region Trust Chain
 
        public Task GetTrustChain(EventHandlerAsync<TrustChainEventArgs> Callback, object State)
        {
            return this.GetTrustChain(this.client.Domain, Callback, State);
        }
 
        public async Task GetTrustChain(string Domain, EventHandlerAsync<TrustChainEventArgs> Callback, object State)
        {
            StringBuilder Xml = new StringBuilder();
 
            Xml.Append("<getTrustChain xmlns=\"");
            Xml.Append(NamespaceLegalIdentitiesCurrent);
            Xml.Append("\"/>");
 
            await this.client.SendIqGet(Domain, Xml.ToString(), async (Sender, e) =>
            {
                ChunkedList<string> Brokers = null;
                XmlElement E;
 
                if (e.Ok && !((E = e.FirstElement) is null) && E.LocalName == "trustChain")
                {
                    Brokers = new ChunkedList<string>();
 
                    foreach (XmlNode N in E.ChildNodes)
                    {
                        if (N is XmlElement E2 &&
                            E2.LocalName == "broker" &&
                            IsNamespaceLegalIdentity(E2.NamespaceURI))
                        {
                            Brokers.Add(XML.Attribute(E2, "domain"));
                        }
                    }
                }
                else
                    e.Ok = false;
 
                await Callback.Raise(this, new TrustChainEventArgs(e, Brokers?.ToArray()));
            }, State);
        }
 
        public Task<string[]> GetTrustChainAsync()
        {
            return this.GetTrustChainAsync(this.client.Domain);
        }
 
        public async Task<string[]> GetTrustChainAsync(string Domain)
        {
            TaskCompletionSource<string[]> Result = new TaskCompletionSource<string[]>();
 
            await this.GetTrustChain(Domain, (Sender, e) =>
            {
                if (e.Ok)
                    Result.TrySetResult(e.Domains);
                else
                    Result.TrySetException(e.StanzaError ?? new Exception("Unable to get the trust chain of domains from " + Domain + "."));
 
                return Task.CompletedTask;
 
            }, null);
 
            return await Result.Task;
        }
 
        #endregion
 
        #region Create Contract
 
        public Task CreateContract(XmlElement ForMachines, HumanReadableText[] ForHumans, Role[] Roles,
            Part[] Parts, Parameter[] Parameters, ContractVisibility Visibility, ContractParts PartsMode, Duration? Duration,
            Duration? ArchiveRequired, Duration? ArchiveOptional, DateTime? SignAfter, DateTime? SignBefore, bool CanActAsTemplate,
            EventHandlerAsync<SmartContractEventArgs> Callback, object State)
        {
            return this.CreateContract(this.componentAddress, ForMachines, ForHumans, Roles, Parts, Parameters, Visibility, PartsMode,
                Duration, ArchiveRequired, ArchiveOptional, SignAfter, SignBefore, CanActAsTemplate, Callback, State);
        }
 
        public Task CreateContract(string Address, XmlElement ForMachines, HumanReadableText[] ForHumans, Role[] Roles,
            Part[] Parts, Parameter[] Parameters, ContractVisibility Visibility, ContractParts PartsMode, Duration? Duration,
            Duration? ArchiveRequired, Duration? ArchiveOptional, DateTime? SignAfter, DateTime? SignBefore, bool CanActAsTemplate,
            EventHandlerAsync<SmartContractEventArgs> Callback, object State)
        {
            return this.CreateContract(Address, ForMachines, ForHumans, Roles, Parts, Parameters,
                Visibility, PartsMode, Duration, ArchiveRequired, ArchiveOptional, SignAfter,
                SignBefore, CanActAsTemplate, null, Callback, State);
        }
 
        public async Task CreateContract(string Address, XmlElement ForMachines, HumanReadableText[] ForHumans, Role[] Roles,
            Part[] Parts, Parameter[] Parameters, ContractVisibility Visibility, ContractParts PartsMode, Duration? Duration,
            Duration? ArchiveRequired, Duration? ArchiveOptional, DateTime? SignAfter, DateTime? SignBefore, bool CanActAsTemplate,
            IParameterEncryptionAlgorithm Algorithm, EventHandlerAsync<SmartContractEventArgs> Callback, object State)
        {
            StringBuilder Xml = new StringBuilder();
 
            Xml.Append("<createContract xmlns=\"");
            Xml.Append(NamespaceSmartContractsCurrent);
            Xml.Append("\">");
 
            Contract Contract = new Contract()
            {
                Namespace = NamespaceSmartContractsCurrent,
                ForMachines = ForMachines,
                ForHumans = ForHumans,
                Roles = Roles,
                Parts = Parts,
                Parameters = Parameters,
                Visibility = Visibility,
                PartsMode = PartsMode,
                Duration = Duration,
                ArchiveRequired = ArchiveRequired,
                ArchiveOptional = ArchiveOptional,
                SignAfter = SignAfter,
                SignBefore = SignBefore,
                CanActAsTemplate = CanActAsTemplate
            };
 
            byte[] Nonce = Guid.NewGuid().ToByteArray();
            string NonceStr = Convert.ToBase64String(Nonce);
            SymmetricCipherAlgorithms EncryptionAlgorithm = Algorithm?.Algorithm ?? this.preferredEncryptionAlgorithm;
 
            if (Contract.HasEncryptedParameters)
            {
                Algorithm ??= await ParameterEncryptionAlgorithm.Create(EncryptionAlgorithm, this);
 
                Contract.EncryptEncryptedParameters(this.client.BareJID, Algorithm);
            }
 
            Contract.Serialize(Xml, false, false, false, false, false, false, false);
 
            if (Contract.HasTransientParameters)
            {
                Xml.Append("<transient>");
 
                foreach (Parameter Parameter in Contract.Parameters)
                {
                    if (Parameter.Protection == ProtectionLevel.Transient)
                    {
                        Parameter.Protection = ProtectionLevel.Normal;
                        Parameter.Serialize(Xml, true);
                        Parameter.Protection = ProtectionLevel.Transient;
                    }
                }
 
                Xml.Append("</transient>");
            }
 
            Xml.Append("</createContract>");
 
            await this.client.SendIqSet(Address, Xml.ToString(), this.ContractResponse, new object[] { Callback, State, Contract.HasEncryptedParameters, Algorithm?.Algorithm, Algorithm?.Key });
        }
 
        private async Task ContractResponse(object Sender, IqResultEventArgs e)
        {
            object[] P = (object[])e.State;
            EventHandlerAsync<SmartContractEventArgs> Callback = (EventHandlerAsync<SmartContractEventArgs>)P[0];
            Contract Contract = null;
            XmlElement E;
 
            if (e.Ok && !((E = e.FirstElement) is null) && E.LocalName == "contract")
            {
                ParsedContract Parsed = await Contract.Parse(E, this, false);
                Contract = Parsed?.Contract;
                if (Contract is null)
                    e.Ok = false;
                else if (Contract.HasEncryptedParameters)
                {
                    string CreatorJid = this.client.BareJID;
 
                    if (P.Length >= 5 &&
                        P[2] is bool HasEncryptedParameters &&
                        HasEncryptedParameters &&
                        P[3] is SymmetricCipherAlgorithms Algorithm &&
                        P[4] is byte[] Key)
                    {
                        await this.SaveContractSharedSecret(Contract.ContractId,
                            CreatorJid, Key, Algorithm, false);
                    }
                    else
                    {
                        Tuple<SymmetricCipherAlgorithms, string, byte[]> T = await this.TryLoadContractSharedSecret(Contract.ContractId);
 
                        if (HasEncryptedParameters = !(T is null))
                        {
                            Algorithm = T.Item1;
                            CreatorJid = T.Item2;
                            Key = T.Item3;
                        }
                        else
                        {
                            Algorithm = this.preferredEncryptionAlgorithm;
                            Key = null;
                        }
                    }
 
                    if (HasEncryptedParameters)
                    {
                        IParameterEncryptionAlgorithm AlgorithmInstance = await ParameterEncryptionAlgorithm.Create(
                            Contract.ContractId, Algorithm, this, CreatorJid, Key);
 
                        Contract.DecryptEncryptedParameters(CreatorJid, AlgorithmInstance);
                    }
                }
            }
            else
                e.Ok = false;
 
            e.State = P[1];
            await Callback.Raise(this, new SmartContractEventArgs(e, Contract));
        }
 
        public Task<Contract> CreateContractAsync(XmlElement ForMachines, HumanReadableText[] ForHumans, Role[] Roles,
            Part[] Parts, Parameter[] Parameters, ContractVisibility Visibility, ContractParts PartsMode, Duration? Duration,
            Duration? ArchiveRequired, Duration? ArchiveOptional, DateTime? SignAfter, DateTime? SignBefore, bool CanActAsTemplate)
        {
            return this.CreateContractAsync(this.componentAddress, ForMachines, ForHumans, Roles, Parts, Parameters, Visibility,
                PartsMode, Duration, ArchiveRequired, ArchiveOptional, SignAfter, SignBefore, CanActAsTemplate);
        }
 
        public async Task<Contract> CreateContractAsync(string Address, XmlElement ForMachines, HumanReadableText[] ForHumans, Role[] Roles,
            Part[] Parts, Parameter[] Parameters, ContractVisibility Visibility, ContractParts PartsMode, Duration? Duration,
            Duration? ArchiveRequired, Duration? ArchiveOptional, DateTime? SignAfter, DateTime? SignBefore, bool CanActAsTemplate)
        {
            TaskCompletionSource<Contract> Result = new TaskCompletionSource<Contract>();
 
            await this.CreateContract(Address, ForMachines, ForHumans, Roles, Parts, Parameters, Visibility, PartsMode, Duration,
                ArchiveRequired, ArchiveOptional, SignAfter, SignBefore, CanActAsTemplate, (Sender, e) =>
            {
                if (e.Ok)
                    Result.TrySetResult(e.Contract);
                else
                    Result.TrySetException(e.StanzaError ?? new Exception("Unable to create the contract."));
 
                return Task.CompletedTask;
 
            }, null);
 
            return await Result.Task;
        }
 
        #endregion
 
        #region Create Contract From Template
 
        public Task CreateContract(string TemplateId, Part[] Parts, Parameter[] Parameters, ContractVisibility Visibility,
            ContractParts PartsMode, Duration? Duration, Duration? ArchiveRequired, Duration? ArchiveOptional, DateTime? SignAfter,
            DateTime? SignBefore, bool CanActAsTemplate, EventHandlerAsync<SmartContractEventArgs> Callback, object State)
        {
            return this.CreateContract(this.componentAddress, TemplateId, Parts, Parameters, Visibility, PartsMode, Duration,
                ArchiveRequired, ArchiveOptional, SignAfter, SignBefore, CanActAsTemplate, null, Callback, State);
        }
 
        public Task CreateContract(string Address, string TemplateId, Part[] Parts, Parameter[] Parameters, ContractVisibility Visibility,
            ContractParts PartsMode, Duration? Duration, Duration? ArchiveRequired, Duration? ArchiveOptional, DateTime? SignAfter,
            DateTime? SignBefore, bool CanActAsTemplate, EventHandlerAsync<SmartContractEventArgs> Callback, object State)
        {
            return this.CreateContract(Address, TemplateId, Parts, Parameters, Visibility,
                PartsMode, Duration, ArchiveRequired, ArchiveOptional, SignAfter,
                SignBefore, CanActAsTemplate, null, Callback, State);
        }
 
 
        public async Task CreateContract(string Address, string TemplateId, Part[] Parts, Parameter[] Parameters, ContractVisibility Visibility,
            ContractParts PartsMode, Duration? Duration, Duration? ArchiveRequired, Duration? ArchiveOptional, DateTime? SignAfter,
            DateTime? SignBefore, bool CanActAsTemplate, IParameterEncryptionAlgorithm Algorithm,
            EventHandlerAsync<SmartContractEventArgs> Callback, object State)
        {
            StringBuilder Xml = new StringBuilder();
            uint i, c = (uint)(Parameters?.Length ?? 0);
            bool HasEncryptedParameters = false;
 
            for (i = 0; i < c; i++)
            {
                Parameter P = Parameters[i];
 
                if (P.Protection == ProtectionLevel.Encrypted)
                {
                    HasEncryptedParameters = true;
                    break;
                }
            }
 
            byte[] Nonce = Guid.NewGuid().ToByteArray();
            string NonceStr = Convert.ToBase64String(Nonce);
            SymmetricCipherAlgorithms EncryptionAlgorithm = Algorithm?.Algorithm ?? this.preferredEncryptionAlgorithm;
 
            if (HasEncryptedParameters)
            {
                Algorithm ??= await ParameterEncryptionAlgorithm.Create(EncryptionAlgorithm, this);
 
                for (i = 0; i < c; i++)
                {
                    Parameter P = Parameters[i];
 
                    if (P.Protection == ProtectionLevel.Encrypted && P.ProtectedValue is null)
                        P.ProtectedValue = Algorithm.Encrypt(P.Name, P.ParameterType, i, this.client.BareJID, Nonce, P.ObjectValue is null ? null : P.StringValue);
                }
            }
 
            Xml.Append("<createContract xmlns=\"");
            Xml.Append(NamespaceSmartContractsCurrent);
            Xml.Append("\"><template archiveOpt=\"");
            Xml.Append(ArchiveOptional.ToString());
            Xml.Append("\" archiveReq=\"");
            Xml.Append(ArchiveRequired.ToString());
            Xml.Append("\" canActAsTemplate=\"");
            Xml.Append(CommonTypes.Encode(CanActAsTemplate));
            Xml.Append("\" duration=\"");
            Xml.Append(Duration.ToString());
            Xml.Append("\" id=\"");
            Xml.Append(XML.Encode(TemplateId));
            Xml.Append("\" nonce=\"");
            Xml.Append(NonceStr);
            Xml.Append('"');
 
            if (SignAfter.HasValue && SignAfter > DateTime.MinValue)
            {
                Xml.Append(" signAfter=\"");
                Xml.Append(XML.Encode(SignAfter.Value));
                Xml.Append('"');
            }
 
            if (SignBefore.HasValue && SignBefore < DateTime.MaxValue)
            {
                Xml.Append(" signBefore=\"");
                Xml.Append(XML.Encode(SignBefore.Value));
                Xml.Append('"');
            }
 
            Xml.Append(" visibility=\"");
            Xml.Append(Visibility.ToString());
            Xml.Append("\"><parts>");
 
            switch (PartsMode)
            {
                case ContractParts.Open:
                    Xml.Append("<open/>");
                    break;
 
                case ContractParts.TemplateOnly:
                    Xml.Append("<templateOnly/>");
                    break;
 
                case ContractParts.ExplicitlyDefined:
                    if (!(Parts is null))
                    {
                        foreach (Part Part in Parts)
                        {
                            Xml.Append("<part legalId=\"");
                            Xml.Append(XML.Encode(Part.LegalId));
                            Xml.Append("\" role=\"");
                            Xml.Append(XML.Encode(Part.Role));
                            Xml.Append("\"/>");
                        }
                    }
                    break;
            }
 
            Xml.Append("</parts>");
 
            LinkedList<Parameter> TransientParameters = null;
 
            if (!(Parameters is null) && Parameters.Length > 0)
            {
                Xml.Append("<parameters>");
 
                foreach (Parameter Parameter in Parameters)
                {
                    if (Parameter.Protection == ProtectionLevel.Transient)
                    {
                        Parameter.ProtectedValue ??= Guid.NewGuid().ToByteArray();
 
                        TransientParameters ??= new LinkedList<Parameter>();
                        TransientParameters.AddLast(Parameter);
                    }
 
                    Parameter.Serialize(Xml, true);
                }
 
                Xml.Append("</parameters>");
            }
 
            Xml.Append("</template>");
 
            if (!(TransientParameters is null))
            {
                Xml.Append("<transient>");
 
                foreach (Parameter Parameter in TransientParameters)
                {
                    Parameter.Protection = ProtectionLevel.Normal;
                    Parameter.Serialize(Xml, true);
                    Parameter.Protection = ProtectionLevel.Transient;
                }
 
                Xml.Append("</transient>");
            }
 
            Xml.Append("</createContract>");
 
            await this.client.SendIqSet(Address, Xml.ToString(), this.ContractResponse, new object[] { Callback, State, HasEncryptedParameters, Algorithm?.Algorithm, Algorithm?.Key });
        }
 
        public Task<Contract> CreateContractAsync(string TemplateId, Part[] Parts, Parameter[] Parameters, ContractVisibility Visibility,
            ContractParts PartsMode, Duration? Duration, Duration? ArchiveRequired, Duration? ArchiveOptional, DateTime? SignAfter,
            DateTime? SignBefore, bool CanActAsTemplate)
        {
            return this.CreateContractAsync(this.componentAddress, TemplateId, Parts, Parameters, Visibility,
                PartsMode, Duration, ArchiveRequired, ArchiveOptional, SignAfter, SignBefore, CanActAsTemplate);
        }
 
        public async Task<Contract> CreateContractAsync(string Address, string TemplateId, Part[] Parts, Parameter[] Parameters,
            ContractVisibility Visibility, ContractParts PartsMode, Duration? Duration, Duration? ArchiveRequired, Duration? ArchiveOptional,
            DateTime? SignAfter, DateTime? SignBefore, bool CanActAsTemplate)
        {
            TaskCompletionSource<Contract> Result = new TaskCompletionSource<Contract>();
 
            await this.CreateContract(Address, TemplateId, Parts, Parameters, Visibility, PartsMode, Duration,
                ArchiveRequired, ArchiveOptional, SignAfter, SignBefore, CanActAsTemplate, (Sender, e) =>
                {
                    if (e.Ok)
                        Result.TrySetResult(e.Contract);
                    else
                        Result.TrySetException(e.StanzaError ?? new Exception("Unable to create the contract."));
 
                    return Task.CompletedTask;
 
                }, null);
 
            return await Result.Task;
        }
 
        #endregion
 
        #region Get Created Contract References
 
        public Task GetCreatedContractReferences(EventHandlerAsync<IdReferencesEventArgs> Callback, object State)
        {
            return this.GetCreatedContractReferences(this.componentAddress, 0, int.MaxValue, Callback, State);
        }
 
        public Task GetCreatedContractReferences(string Address, EventHandlerAsync<IdReferencesEventArgs> Callback, object State)
        {
            return this.GetCreatedContractReferences(Address, 0, int.MaxValue, Callback, State);
        }
 
        public Task GetCreatedContractReferences(int Offset, int MaxCount, EventHandlerAsync<IdReferencesEventArgs> Callback, object State)
        {
            return this.GetCreatedContractReferences(this.componentAddress, Offset, MaxCount, Callback, State);
        }
 
        public Task GetCreatedContractReferences(string Address, int Offset, int MaxCount, EventHandlerAsync<IdReferencesEventArgs> Callback, object State)
        {
            if (Offset < 0)
                throw new ArgumentException("Offsets cannot be negative.", nameof(Offset));
 
            if (MaxCount <= 0)
                throw new ArgumentException("Must be postitive.", nameof(MaxCount));
 
            StringBuilder Xml = new StringBuilder();
 
            Xml.Append("<getCreatedContracts references='true' xmlns='");
            Xml.Append(NamespaceSmartContractsCurrent);
 
            if (Offset > 0)
            {
                Xml.Append("' offset='");
                Xml.Append(Offset.ToString());
            }
 
            if (MaxCount < int.MaxValue)
            {
                Xml.Append("' maxCount='");
                Xml.Append(MaxCount.ToString());
            }
 
            Xml.Append("'/>");
 
            return this.client.SendIqGet(Address, Xml.ToString(), this.IdReferencesResponse, new object[] { Callback, State });
        }
 
        private async Task IdReferencesResponse(object Sender, IqResultEventArgs e)
        {
            object[] P = (object[])e.State;
            EventHandlerAsync<IdReferencesEventArgs> Callback = (EventHandlerAsync<IdReferencesEventArgs>)P[0];
            XmlElement E = e.FirstElement;
            List<string> IDs = new List<string>();
 
            if (e.Ok && !(E is null))
            {
                foreach (XmlNode N in E.ChildNodes)
                {
                    if (N is XmlElement E2 && E2.LocalName == "ref")
                    {
                        string Id = XML.Attribute(E2, "id");
                        IDs.Add(Id);
                    }
                }
            }
            else
                e.Ok = false;
 
            e.State = P[1];
            await Callback.Raise(this, new IdReferencesEventArgs(e, IDs.ToArray()));
        }
 
        public Task<string[]> GetCreatedContractReferencesAsync()
        {
            return this.GetCreatedContractReferencesAsync(this.componentAddress, 0, int.MaxValue);
        }
 
        public Task<string[]> GetCreatedContractReferencesAsync(string Address)
        {
            return this.GetCreatedContractReferencesAsync(Address, 0, int.MaxValue);
        }
 
        public Task<string[]> GetCreatedContractReferencesAsync(int Offset, int MaxCount)
        {
            return this.GetCreatedContractReferencesAsync(this.componentAddress, Offset, MaxCount);
        }
 
        public async Task<string[]> GetCreatedContractReferencesAsync(string Address, int Offset, int MaxCount)
        {
            TaskCompletionSource<string[]> Result = new TaskCompletionSource<string[]>();
 
            await this.GetCreatedContractReferences(Address, Offset, MaxCount, (Sender, e) =>
                {
                    if (e.Ok)
                        Result.TrySetResult(e.References);
                    else
                        Result.TrySetException(e.StanzaError ?? new Exception("Unable to get created contract references."));
 
                    return Task.CompletedTask;
 
                }, null);
 
            return await Result.Task;
        }
 
        #endregion
 
        #region Get Created Contracts
 
        public Task GetCreatedContracts(EventHandlerAsync<ContractsEventArgs> Callback, object State)
        {
            return this.GetCreatedContracts(this.componentAddress, 0, int.MaxValue, Callback, State);
        }
 
        public Task GetCreatedContracts(string Address, EventHandlerAsync<ContractsEventArgs> Callback, object State)
        {
            return this.GetCreatedContracts(Address, 0, int.MaxValue, Callback, State);
        }
 
        public Task GetCreatedContracts(int Offset, int MaxCount, EventHandlerAsync<ContractsEventArgs> Callback, object State)
        {
            return this.GetCreatedContracts(this.componentAddress, Offset, MaxCount, Callback, State);
        }
 
        public Task GetCreatedContracts(string Address, int Offset, int MaxCount, EventHandlerAsync<ContractsEventArgs> Callback, object State)
        {
            if (Offset < 0)
                throw new ArgumentException("Offsets cannot be negative.", nameof(Offset));
 
            if (MaxCount <= 0)
                throw new ArgumentException("Must be postitive.", nameof(MaxCount));
 
            StringBuilder Xml = new StringBuilder();
 
            Xml.Append("<getCreatedContracts references='false' xmlns='");
            Xml.Append(NamespaceSmartContractsCurrent);
 
            if (Offset > 0)
            {
                Xml.Append("' offset='");
                Xml.Append(Offset.ToString());
            }
 
            if (MaxCount < int.MaxValue)
            {
                Xml.Append("' maxCount='");
                Xml.Append(MaxCount.ToString());
            }
 
            Xml.Append("'/>");
 
            return this.client.SendIqGet(Address, Xml.ToString(), this.ContractsResponse, new object[] { Callback, State });
        }
 
        private async Task ContractsResponse(object Sender, IqResultEventArgs e)
        {
            object[] P = (object[])e.State;
            EventHandlerAsync<ContractsEventArgs> Callback = (EventHandlerAsync<ContractsEventArgs>)P[0];
            XmlElement E = e.FirstElement;
            List<Contract> Contracts = new List<Contract>();
            List<string> References = new List<string>();
 
            if (e.Ok && !(E is null))
            {
                foreach (XmlNode N in E.ChildNodes)
                {
                    if (N is XmlElement E2)
                    {
                        switch (E2.LocalName)
                        {
                            case "contract":
                                ParsedContract ParsedContract = await Contract.Parse(E2, this, false);
 
                                if (!(ParsedContract is null))
                                    Contracts.Add(ParsedContract.Contract);
                                break;
 
                            case "ref":
                                string ContractId = XML.Attribute(E2, "id");
                                References.Add(ContractId);
                                break;
                        }
                    }
                }
            }
            else
                e.Ok = false;
 
            e.State = P[1];
            await Callback.Raise(this, new ContractsEventArgs(e, Contracts.ToArray(), References.ToArray()));
        }
 
        public Task<ContractsEventArgs> GetCreatedContractsAsync()
        {
            return this.GetCreatedContractsAsync(this.componentAddress, 0, int.MaxValue);
        }
 
        public Task<ContractsEventArgs> GetCreatedContractsAsync(string Address)
        {
            return this.GetCreatedContractsAsync(Address, 0, int.MaxValue);
        }
 
        public Task<ContractsEventArgs> GetCreatedContractsAsync(int Offset, int MaxCount)
        {
            return this.GetCreatedContractsAsync(this.componentAddress, Offset, MaxCount);
        }
 
        public async Task<ContractsEventArgs> GetCreatedContractsAsync(string Address, int Offset, int MaxCount)
        {
            TaskCompletionSource<ContractsEventArgs> Result = new TaskCompletionSource<ContractsEventArgs>();
 
            await this.GetCreatedContracts(Address, Offset, MaxCount, (Sender, e) =>
            {
                Result.TrySetResult(e);
                return Task.CompletedTask;
 
            }, null);
 
            return await Result.Task;
        }
 
        #endregion
 
        #region Sign Contract
 
        public Task SignContract(Contract Contract, string Role, bool Transferable, EventHandlerAsync<SmartContractEventArgs> Callback, object State)
        {
            return this.SignContract(this.GetTrustProvider(Contract.ContractId), Contract, Role, Transferable, Callback, State);
        }
 
        public async Task SignContract(string Address, Contract Contract, string Role, bool Transferable,
            EventHandlerAsync<SmartContractEventArgs> Callback, object State)
        {
            if (Contract.HasEncryptedParameters)
            {
                Tuple<SymmetricCipherAlgorithms, string, byte[]> T = await this.TryLoadContractSharedSecret(Contract.ContractId);
                if (!(T is null))
                {
                    IParameterEncryptionAlgorithm Algorithm = await ParameterEncryptionAlgorithm.Create(
                        Contract.ContractId, T.Item1, this, T.Item2, T.Item3);
 
                    Contract.EncryptEncryptedParameters(T.Item2, Algorithm);
                }
            }
 
            StringBuilder Xml = new StringBuilder();
            Contract.Serialize(Xml, false, false, false, false, false, false, false);
            byte[] Data = Encoding.UTF8.GetBytes(Xml.ToString());
 
            await this.Sign(Address, Data, SignWith.LatestApprovedId, async (Sender, e) =>
            {
                if (e.Ok)
                {
                    Xml.Clear();
                    Xml.Append("<signContract xmlns='");
                    Xml.Append(NamespaceSmartContractsCurrent);
                    Xml.Append("' id='");
                    Xml.Append(XML.Encode(Contract.ContractId));
                    Xml.Append("' role='");
                    Xml.Append(XML.Encode(Role));
 
                    if (Transferable)
                        Xml.Append("' transferable='true");
 
                    Xml.Append("' s='");
                    Xml.Append(Convert.ToBase64String(e.Signature));
                    Xml.Append("'/>");
 
                    await this.client.SendIqSet(Address, Xml.ToString(), this.ContractResponse, new object[] { Callback, State });
                }
                else
                    await Callback.Raise(this, new SmartContractEventArgs(e, null));
            }, State);
        }
 
        public Task<Contract> SignContractAsync(Contract Contract, string Role, bool Transferable)
        {
            return this.SignContractAsync(this.GetTrustProvider(Contract.ContractId), Contract, Role, Transferable);
        }
 
        public async Task<Contract> SignContractAsync(string Address, Contract Contract, string Role, bool Transferable)
        {
            TaskCompletionSource<Contract> Result = new TaskCompletionSource<Contract>();
 
            await this.SignContract(Address, Contract, Role, Transferable, (Sender, e) =>
            {
                if (e.Ok)
                    Result.TrySetResult(e.Contract);
                else
                    Result.TrySetException(e.StanzaError ?? new Exception("Unable to sign the contract."));
 
                return Task.CompletedTask;
 
            }, null);
 
            return await Result.Task;
        }
 
        #endregion
 
        #region Get Signed Contract References
 
        public Task GetSignedContractReferences(EventHandlerAsync<IdReferencesEventArgs> Callback, object State)
        {
            return this.GetSignedContractReferences(this.componentAddress, 0, int.MaxValue, Callback, State);
        }
 
        public Task GetSignedContractReferences(string Address, EventHandlerAsync<IdReferencesEventArgs> Callback, object State)
        {
            return this.GetSignedContractReferences(Address, 0, int.MaxValue, Callback, State);
        }
 
        public Task GetSignedContractReferences(string Address, int Offset, int MaxCount, EventHandlerAsync<IdReferencesEventArgs> Callback, object State)
        {
            if (Offset < 0)
                throw new ArgumentException("Offsets cannot be negative.", nameof(Offset));
 
            if (MaxCount <= 0)
                throw new ArgumentException("Must be postitive.", nameof(MaxCount));
 
            StringBuilder Xml = new StringBuilder();
 
            Xml.Append("<getSignedContracts references='true' xmlns='");
            Xml.Append(NamespaceSmartContractsCurrent);
 
            if (Offset > 0)
            {
                Xml.Append("' offset='");
                Xml.Append(Offset.ToString());
            }
 
            if (MaxCount < int.MaxValue)
            {
                Xml.Append("' maxCount='");
                Xml.Append(MaxCount.ToString());
            }
 
            Xml.Append("'/>");
 
            return this.client.SendIqGet(Address, Xml.ToString(), this.IdReferencesResponse, new object[] { Callback, State });
        }
 
        public Task<string[]> GetSignedContractReferencesAsync()
        {
            return this.GetSignedContractReferencesAsync(this.componentAddress, 0, int.MaxValue);
        }
 
        public Task<string[]> GetSignedContractReferencesAsync(int Offset, int MaxCount)
        {
            return this.GetSignedContractReferencesAsync(this.componentAddress, Offset, MaxCount);
        }
 
        public async Task<string[]> GetSignedContractReferencesAsync(string Address, int Offset, int MaxCount)
        {
            TaskCompletionSource<string[]> Result = new TaskCompletionSource<string[]>();
 
            await this.GetSignedContractReferences(Address, Offset, MaxCount, (Sender, e) =>
            {
                if (e.Ok)
                    Result.TrySetResult(e.References);
                else
                    Result.TrySetException(e.StanzaError ?? new Exception("Unable to get signed contract references."));
 
                return Task.CompletedTask;
 
            }, null);
 
            return await Result.Task;
        }
 
        #endregion
 
        #region Get Signed Contracts
 
        public Task GetSignedContracts(EventHandlerAsync<ContractsEventArgs> Callback, object State)
        {
            return this.GetSignedContracts(this.componentAddress, 0, int.MaxValue, Callback, State);
        }
 
        public Task GetSignedContracts(string Address, EventHandlerAsync<ContractsEventArgs> Callback, object State)
        {
            return this.GetSignedContracts(Address, 0, int.MaxValue, Callback, State);
        }
 
        public Task GetSignedContracts(int Offset, int MaxCount, EventHandlerAsync<ContractsEventArgs> Callback, object State)
        {
            return this.GetSignedContracts(this.componentAddress, Offset, MaxCount, Callback, State);
        }
 
        public Task GetSignedContracts(string Address, int Offset, int MaxCount, EventHandlerAsync<ContractsEventArgs> Callback, object State)
        {
            if (Offset < 0)
                throw new ArgumentException("Offsets cannot be negative.", nameof(Offset));
 
            if (MaxCount <= 0)
                throw new ArgumentException("Must be postitive.", nameof(MaxCount));
 
            StringBuilder Xml = new StringBuilder();
 
            Xml.Append("<getSignedContracts references='false' xmlns='");
            Xml.Append(NamespaceSmartContractsCurrent);
 
            if (Offset > 0)
            {
                Xml.Append("' offset='");
                Xml.Append(Offset.ToString());
            }
 
            if (MaxCount < int.MaxValue)
            {
                Xml.Append("' maxCount='");
                Xml.Append(MaxCount.ToString());
            }
 
            Xml.Append("'/>");
 
            return this.client.SendIqGet(Address, Xml.ToString(), this.ContractsResponse, new object[] { Callback, State });
        }
 
        public Task<ContractsEventArgs> GetSignedContractsAsync()
        {
            return this.GetSignedContractsAsync(this.componentAddress, 0, int.MaxValue);
        }
 
        public Task<ContractsEventArgs> GetSignedContractsAsync(int Offset, int MaxCount)
        {
            return this.GetSignedContractsAsync(this.componentAddress, Offset, MaxCount);
        }
 
        public async Task<ContractsEventArgs> GetSignedContractsAsync(string Address, int Offset, int MaxCount)
        {
            TaskCompletionSource<ContractsEventArgs> Result = new TaskCompletionSource<ContractsEventArgs>();
 
            await this.GetSignedContracts(Address, Offset, MaxCount, (Sender, e) =>
            {
                Result.TrySetResult(e);
                return Task.CompletedTask;
 
            }, null);
 
            return await Result.Task;
        }
 
        #endregion
 
        #region Contract Signature event
 
        private async Task ContractSignedMessageHandler(object Sender, MessageEventArgs e)
        {
            string ContractId = XML.Attribute(e.Content, "contractId");
            string LegalId = XML.Attribute(e.Content, "legalId");
            string Role = XML.Attribute(e.Content, "role");
            bool Signed = XML.Attribute(e.Content, "signed", false);
 
            if (XmppClient.GetDomain(ContractId) != e.From)
            {
                this.Error("Client signature message ignored. Source domain (" +
                    e.FromBareJID + ") not equal to contract domain (" +
                    ContractId + ").");
                return;
            }
 
            Contract Contract = null;
 
            foreach (XmlNode N in e.Content.ChildNodes)
            {
                if (N is XmlElement E && E.LocalName == "contract" && IsNamespaceSmartContract(E.NamespaceURI))
                {
                    ParsedContract ParsedContract = await Contract.Parse(E, this, false);
                    Contract = ParsedContract?.Contract;
                    break;
                }
            }
 
            if (Contract is null)
            {
                this.Error("Client signature message ignored. Unable to parse embedded contract.");
                return;
            }
 
            await this.ContractSigned.Raise(this, new ContractSignedEventArgs(ContractId, LegalId, Role, Signed, Contract));
        }
 
        public event EventHandlerAsync<ContractSignedEventArgs> ContractSigned = null;
 
        #endregion
 
        #region Get Contract
 
        public Task GetContract(string ContractId, EventHandlerAsync<SmartContractEventArgs> Callback, object State)
        {
            return this.GetContract(this.GetTrustProvider(ContractId), ContractId, Callback, State);
        }
 
        public Task GetContract(string Address, string ContractId, EventHandlerAsync<SmartContractEventArgs> Callback, object State)
        {
            StringBuilder Xml = new StringBuilder();
 
            Xml.Append("<getContract xmlns='");
            Xml.Append(NamespaceSmartContractsCurrent);
            Xml.Append("' id='");
            Xml.Append(XML.Encode(ContractId));
            Xml.Append("'/>");
 
            return this.client.SendIqGet(Address, Xml.ToString(), this.ContractResponse, new object[] { Callback, State });
        }
 
        public Task<Contract> GetContractAsync(string ContractId)
        {
            return this.GetContractAsync(this.GetTrustProvider(ContractId), ContractId);
        }
 
        public async Task<Contract> GetContractAsync(string Address, string ContractId)
        {
            TaskCompletionSource<Contract> Result = new TaskCompletionSource<Contract>();
 
            await this.GetContract(Address, ContractId, (Sender, e) =>
            {
                if (e.Ok)
                    Result.TrySetResult(e.Contract);
                else
                    Result.TrySetException(e.StanzaError ?? new Exception("Unable to get the contract."));
 
                return Task.CompletedTask;
 
            }, null);
 
            return await Result.Task;
        }
 
        #endregion
 
        #region Get Contracts
 
        public async Task GetContracts(string[] ContractIds, EventHandlerAsync<ContractsEventArgs> Callback, object State)
        {
            Dictionary<string, List<string>> ByTrustProvider = new Dictionary<string, List<string>>();
            string LastTrustProvider = string.Empty;
            List<string> LastList = null;
 
            foreach (string ContractId in ContractIds)
            {
                string TrustProvider = this.GetTrustProvider(ContractId);
 
                if (TrustProvider != LastTrustProvider || LastList is null)
                {
                    if (!ByTrustProvider.TryGetValue(TrustProvider, out LastList))
                    {
                        LastList = new List<string>();
                        ByTrustProvider[TrustProvider] = LastList;
                    }
 
                    LastTrustProvider = TrustProvider;
                }
 
                LastList.Add(ContractId);
            }
 
            List<Contract> Contracts = new List<Contract>();
            List<string> References = new List<string>();
            bool Ok = true;
            int NrLeft = ByTrustProvider.Count;
 
            foreach (KeyValuePair<string, List<string>> P in ByTrustProvider)
            {
                await this.GetContracts(P.Key, P.Value.ToArray(), async (Sender, e) =>
                {
                    lock (Contracts)
                    {
                        if (e.Ok)
                        {
                            Contracts.AddRange(e.Contracts);
                            References.AddRange(e.References);
                        }
                        else
                            Ok = false;
 
                        NrLeft--;
                        if (NrLeft > 0)
                            return;
                    }
 
                    ContractsEventArgs e2 = new ContractsEventArgs(e, Contracts.ToArray(), References.ToArray())
                    {
                        Ok = Ok
                    };
 
                    await Callback.Raise(this, e2);
 
                }, State);
            }
        }
 
        public Task GetContracts(string Address, string[] ContractIds, EventHandlerAsync<ContractsEventArgs> Callback, object State)
        {
            StringBuilder Xml = new StringBuilder();
 
            Xml.Append("<getContracts xmlns='");
            Xml.Append(NamespaceSmartContractsCurrent);
            Xml.Append("'>");
 
            foreach (string ContractId in ContractIds)
            {
                Xml.Append("<ref id='");
                Xml.Append(XML.Encode(ContractId));
                Xml.Append("'/>");
            }
 
            Xml.Append("</getContracts>");
 
            return this.client.SendIqGet(Address, Xml.ToString(), this.ContractsResponse, new object[] { Callback, State });
        }
 
        public async Task<ContractsEventArgs> GetContractsAsync(string[] ContractIds)
        {
            TaskCompletionSource<ContractsEventArgs> Result = new TaskCompletionSource<ContractsEventArgs>();
 
            await this.GetContracts(ContractIds, (Sender, e) =>
            {
                Result.TrySetResult(e);
                return Task.CompletedTask;
 
            }, null);
 
            return await Result.Task;
        }
 
        public async Task<ContractsEventArgs> GetContractsAsync(string Address, string[] ContractIds)
        {
            TaskCompletionSource<ContractsEventArgs> Result = new TaskCompletionSource<ContractsEventArgs>();
 
            await this.GetContracts(Address, ContractIds, (Sender, e) =>
            {
                Result.TrySetResult(e);
                return Task.CompletedTask;
 
            }, null);
 
            return await Result.Task;
        }
 
        #endregion
 
        #region Obsolete Contract
 
        public Task ObsoleteContract(string ContractId, EventHandlerAsync<SmartContractEventArgs> Callback, object State)
        {
            return this.ObsoleteContract(this.GetTrustProvider(ContractId), ContractId, Callback, State);
        }
 
        public Task ObsoleteContract(string Address, string ContractId,
            EventHandlerAsync<SmartContractEventArgs> Callback, object State)
        {
            StringBuilder Xml = new StringBuilder();
 
            Xml.Append("<obsoleteContract xmlns='");
            Xml.Append(NamespaceSmartContractsCurrent);
            Xml.Append("' id='");
            Xml.Append(XML.Encode(ContractId));
            Xml.Append("'/>");
 
            return this.client.SendIqSet(Address, Xml.ToString(), this.ContractResponse, new object[] { Callback, State });
        }
 
        public Task<Contract> ObsoleteContractAsync(string ContractId)
        {
            return this.ObsoleteContractAsync(this.GetTrustProvider(ContractId), ContractId);
        }
 
        public async Task<Contract> ObsoleteContractAsync(string Address, string ContractId)
        {
            TaskCompletionSource<Contract> Result = new TaskCompletionSource<Contract>();
 
            await this.ObsoleteContract(Address, ContractId, (Sender, e) =>
            {
                if (e.Ok)
                    Result.TrySetResult(e.Contract);
                else
                    Result.TrySetException(e.StanzaError ?? new Exception("Unable to obsolete the contract."));
 
                return Task.CompletedTask;
 
            }, null);
 
            return await Result.Task;
        }
 
        #endregion
 
        #region Delete Contract
 
        public Task DeleteContract(string ContractId, EventHandlerAsync<SmartContractEventArgs> Callback, object State)
        {
            return this.DeleteContract(this.GetTrustProvider(ContractId), ContractId, Callback, State);
        }
 
        public Task DeleteContract(string Address, string ContractId,
            EventHandlerAsync<SmartContractEventArgs> Callback, object State)
        {
            StringBuilder Xml = new StringBuilder();
 
            Xml.Append("<deleteContract xmlns='");
            Xml.Append(NamespaceSmartContractsCurrent);
            Xml.Append("' id='");
            Xml.Append(XML.Encode(ContractId));
            Xml.Append("'/>");
 
            return this.client.SendIqSet(Address, Xml.ToString(), this.ContractResponse, new object[] { Callback, State });
        }
 
        public Task<Contract> DeleteContractAsync(string ContractId)
        {
            return this.DeleteContractAsync(this.GetTrustProvider(ContractId), ContractId);
        }
 
        public async Task<Contract> DeleteContractAsync(string Address, string ContractId)
        {
            TaskCompletionSource<Contract> Result = new TaskCompletionSource<Contract>();
 
            await this.DeleteContract(Address, ContractId, (Sender, e) =>
            {
                if (e.Ok)
                    Result.TrySetResult(e.Contract);
                else
                    Result.TrySetException(e.StanzaError ?? new Exception("Unable to delete the contract."));
 
                return Task.CompletedTask;
 
            }, null);
 
            return await Result.Task;
        }
 
        #endregion
 
        #region Contract Created event
 
        private Task ContractCreatedMessageHandler(object Sender, MessageEventArgs e)
        {
            string ContractId = XML.Attribute(e.Content, "contractId");
 
            if (!this.IsFromTrustProvider(ContractId, e.From))
                return Task.CompletedTask;
 
            return this.ContractCreated.Raise(this, new ContractReferenceEventArgs(ContractId));
        }
 
        public event EventHandlerAsync<ContractReferenceEventArgs> ContractCreated = null;
 
        #endregion
 
        #region Contract Updated event
 
        private Task ContractUpdatedMessageHandler(object Sender, MessageEventArgs e)
        {
            string ContractId = XML.Attribute(e.Content, "contractId");
 
            if (!this.IsFromTrustProvider(ContractId, e.From))
                return Task.CompletedTask;
 
            return this.ContractUpdated.Raise(this, new ContractReferenceEventArgs(ContractId));
        }
 
        public event EventHandlerAsync<ContractReferenceEventArgs> ContractUpdated = null;
 
        #endregion
 
        #region Contract Deleted event
 
        private Task ContractDeletedMessageHandler(object Sender, MessageEventArgs e)
        {
            string ContractId = XML.Attribute(e.Content, "contractId");
 
            if (!this.IsFromTrustProvider(ContractId, e.From))
                return Task.CompletedTask;
 
            return this.ContractDeleted.Raise(this, new ContractReferenceEventArgs(ContractId));
        }
 
        public event EventHandlerAsync<ContractReferenceEventArgs> ContractDeleted = null;
 
        #endregion
 
        #region Update Contract
 
        public Task UpdateContract(Contract Contract, EventHandlerAsync<SmartContractEventArgs> Callback, object State)
        {
            return this.UpdateContract(this.GetTrustProvider(Contract.ContractId), Contract, Callback, State);
        }
 
        public async Task UpdateContract(string Address, Contract Contract,
            EventHandlerAsync<SmartContractEventArgs> Callback, object State)
        {
            if (Contract.HasEncryptedParameters)
            {
                Tuple<SymmetricCipherAlgorithms, string, byte[]> KeyInfo =
                    await this.TryLoadContractSharedSecret(Contract.ContractId);
 
                if (!(KeyInfo is null))
                {
                    IParameterEncryptionAlgorithm Algorithm = await ParameterEncryptionAlgorithm.Create(
                        Contract.ContractId, KeyInfo.Item1, this, KeyInfo.Item2, KeyInfo.Item3);
 
                    Contract.EncryptEncryptedParameters(this.client.BareJID, Algorithm);
                }
            }
 
            StringBuilder Xml = new StringBuilder();
 
            Xml.Append("<updateContract xmlns='");
            Xml.Append(NamespaceSmartContractsCurrent);
            Xml.Append("'>");
 
            Contract.Serialize(Xml, false, true, true, true, false, false, false);
 
            Xml.Append("</updateContract>");
 
            await this.client.SendIqSet(Address, Xml.ToString(), this.ContractResponse, new object[] { Callback, State });
        }
 
        public Task<Contract> UpdateContractAsync(Contract Contract)
        {
            return this.UpdateContractAsync(this.GetTrustProvider(Contract.ContractId), Contract);
        }
 
        public async Task<Contract> UpdateContractAsync(string Address, Contract Contract)
        {
            TaskCompletionSource<Contract> Result = new TaskCompletionSource<Contract>();
 
            await this.UpdateContract(Address, Contract, (Sender, e) =>
            {
                if (e.Ok)
                    Result.TrySetResult(e.Contract);
                else
                    Result.TrySetException(e.StanzaError ?? new Exception("Unable to update the contract."));
 
                return Task.CompletedTask;
 
            }, null);
 
            return await Result.Task;
        }
 
        #endregion
 
        #region Validate Contract
 
        public Task Validate(Contract Contract, EventHandlerAsync<ContractValidationEventArgs> Callback, object State)
        {
            return this.Validate(Contract, true, true, true, true, Callback, State);
        }
 
        public Task Validate(Contract Contract, bool ValidateState, EventHandlerAsync<ContractValidationEventArgs> Callback, object State)
        {
            return this.Validate(Contract, ValidateState, true, true, true, Callback, State);
        }
 
        public async Task Validate(Contract Contract, bool ValidateState, bool ValidateAttachments,
            bool ValidateIdentities, bool ValidateIdentityAttachments,
            EventHandlerAsync<ContractValidationEventArgs> Callback, object State)
        {
            if (Contract is null)
            {
                await this.ReturnStatus(ContractStatus.ContractUndefined, Callback, State);
                return;
            }
 
            if (ValidateState &&
                Contract.State != ContractState.Approved &&
                Contract.State != ContractState.BeingSigned &&
                Contract.State != ContractState.Signed)
            {
                await this.ReturnStatus(ContractStatus.NotApproved, Callback, State,
                    new KeyValuePair<string, object>("State", Contract.State));
                return;
            }
 
            DateTime UtcNow = DateTime.UtcNow;
 
            if (UtcNow < Contract.From.ToUniversalTime())
            {
                await this.ReturnStatus(ContractStatus.NotValidYet, Callback, State,
                    new KeyValuePair<string, object>("From", Contract.From));
                return;
            }
 
            if (UtcNow > Contract.To.ToUniversalTime())
            {
                await this.ReturnStatus(ContractStatus.NotValidAnymore, Callback, State,
                    new KeyValuePair<string, object>("To", Contract.To));
                return;
            }
 
            if (string.IsNullOrEmpty(Contract.Provider))
            {
                await this.ReturnStatus(ContractStatus.NoTrustProvider, Callback, State);
                return;
            }
 
            if (Contract.PartsMode == ContractParts.TemplateOnly)
            {
                await this.ReturnStatus(ContractStatus.TemplateOnly, Callback, State);
                return;
            }
 
            if (Contract.ClientSignatures is null || Contract.ClientSignatures.Length == 0)
            {
                await this.ReturnStatus(ContractStatus.NoClientSignatures, Callback, State);
                return;
            }
 
            if (!await Contract.IsLegallyBinding(false, this))
            {
                await this.ReturnStatus(ContractStatus.NotLegallyBinding, Callback, State);
                return;
            }
 
            if (!await IsHumanReadableWellDefined(Contract))
            {
                await this.ReturnStatus(ContractStatus.HumanReadableNotWellDefined, Callback, State);
                return;
            }
 
            if ((Contract.Parameters?.Length ?? 0) > 0)
            {
                try
                {
                    Variables Variables = new Variables()
                    {
                        { "Duration", Contract.Duration }
                    };
 
                    DateTime? FirstSignature = Contract.FirstSignatureAt;
                    if (FirstSignature.HasValue)
                    {
                        Variables["Now"] = FirstSignature.Value.ToLocalTime();
                        Variables["NowUtc"] = FirstSignature.Value.ToUniversalTime();
                    }
 
                    foreach (Parameter Parameter in Contract.Parameters)
                        Parameter.Populate(Variables);
 
                    ChunkedList<KeyValuePair<string, object>> Tags = null;
 
                    foreach (Parameter Parameter in Contract.Parameters)
                    {
                        if (!await Parameter.IsParameterValid(Variables, this))
                        {
                            Tags ??= new ChunkedList<KeyValuePair<string, object>>();
 
                            Tags.Add(new KeyValuePair<string, object>(Parameter.Name, Parameter.ErrorText));
                            if (Parameter.ErrorReason.HasValue)
                                Tags.Add(new KeyValuePair<string, object>(Parameter.Name + "_Reason", Parameter.ErrorReason.Value));
                        }
                    }
 
                    if (!(Tags is null))
                    {
                        await this.ReturnStatus(ContractStatus.ParameterValuesNotValid, Callback,
                            State, Tags.ToArray());
                        return;
                    }
                }
                catch (RecipientUnavailableException ex)
                {
                    await this.ReturnStatus(ContractStatus.NoResponse, Callback, State,
                        new KeyValuePair<string, object>("Error", ex.Message));
                    return;
                }
                catch (Exception ex)
                {
                    await this.ReturnStatus(ContractStatus.ParameterValuesNotValid, Callback, State,
                        new KeyValuePair<string, object>("Error", ex.Message));
                    return;
                }
            }
 
            if (string.IsNullOrEmpty(Contract.ForMachinesLocalName) ||
                string.IsNullOrEmpty(Contract.ForMachinesNamespace) ||
                Contract.ForMachines is null ||
                Contract.ForMachinesLocalName != Contract.ForMachines.LocalName ||
                Contract.ForMachinesNamespace != Contract.ForMachines.NamespaceURI)
            {
                await this.ReturnStatus(ContractStatus.MachineReadableNotWellDefined, Callback, State);
                return;
            }
 
            XmlDocument Doc;
 
            try
            {
                Doc = XML.ParseXml(Contract.ForMachines.OuterXml, true);
            }
            catch (Exception ex)
            {
                await this.ReturnStatus(ContractStatus.MachineReadableNotWellDefined, Callback, State,
                    new KeyValuePair<string, object>("Error", ex.Message));
                return;
            }
 
            Dictionary<string, XmlSchema> Schemas = new Dictionary<string, XmlSchema>();
            ChunkedList<XmlElement> ToCheck = new ChunkedList<XmlElement>
            {
                Doc.DocumentElement
            };
            XmlElement E;
            string LastNamespace = null;
            string Namespace;
            XmlSchema Schema;
 
            while (ToCheck.HasFirstItem)
            {
                E = ToCheck.RemoveFirst();
                Namespace = E.NamespaceURI;
                if (!string.IsNullOrEmpty(Namespace) && Namespace != LastNamespace)
                {
                    Schemas[Namespace] = null;
                    LastNamespace = Namespace;
                }
 
                if (E.HasAttributes)
                {
                    foreach (XmlAttribute Attr in E.Attributes)
                    {
                        Namespace = Attr.NamespaceURI;
 
                        if (!string.IsNullOrEmpty(Namespace) &&
                            Namespace != LastNamespace &&
                            Namespace != "http://www.w3.org/XML/1998/namespace" &&
                            Namespace != "http://www.w3.org/2000/xmlns/")
                        {
                            Schemas[Namespace] = null;  // Only change LastNamespace when element namespaces change.
                        }
                    }
                }
 
                foreach (XmlNode N in E.ChildNodes)
                {
                    if (N is XmlElement E2)
                        ToCheck.Add(E2);
                }
            }
 
            int NrSchemas = Schemas.Count;
            if (NrSchemas == 0 || !Schemas.ContainsKey(Contract.ForMachinesNamespace))
            {
                await this.ReturnStatus(ContractStatus.MachineReadableNotWellDefined, Callback, State,
                    new KeyValuePair<string, object>("Namespace", Contract.ForMachinesNamespace));
                return;
            }
 
            Tuple<XmlSchema, ContractStatus?, Exception> SchemaResult;
 
            SchemaResult = await this.LoadSchema(this.componentAddress, Contract.ForMachinesNamespace,
                Contract.ContentSchemaHashFunction, Contract.ContentSchemaDigest);
 
            if (SchemaResult.Item2.HasValue)
            {
                await this.ReturnStatus(SchemaResult.Item2.Value, Callback, State,
                    new KeyValuePair<string, object>("Error", SchemaResult.Item3?.Message ?? string.Empty),
                    new KeyValuePair<string, object>("Namespace", Contract.ForMachinesNamespace),
                    new KeyValuePair<string, object>("HashFunction", Contract.ContentSchemaHashFunction),
                    new KeyValuePair<string, object>("Digest", Convert.ToBase64String(Contract.ContentSchemaDigest)));
                return;
            }
            else if (SchemaResult.Item1 is null)
            {
                await this.ReturnStatus(ContractStatus.NoSchemaAccess, Callback, State);
                return;
            }
            else
            {
                Schema = SchemaResult.Item1;
                Schemas[Contract.ForMachinesNamespace] = Schema;
            }
 
            string[] Namespaces = new string[Schemas.Count];
            Schemas.Keys.CopyTo(Namespaces, 0);
 
            string ContractComponent;
            int i = Contract.ContractId.IndexOf('@');
            if (i < 0)
                ContractComponent = this.componentAddress;
            else
                ContractComponent = Contract.ContractId[(i + 1)..];
 
            foreach (string Namespace2 in Namespaces)
            {
                if (Schemas.TryGetValue(Namespace2, out Schema) && !(Schema is null))
                    continue;
 
                SchemaResult = await this.LoadSchema(this.componentAddress, Namespace2, null, null);
 
                if (SchemaResult.Item2.HasValue)
                {
                    await this.ReturnStatus(SchemaResult.Item2.Value, Callback, State,
                        new KeyValuePair<string, object>("Error", SchemaResult.Item3?.Message ?? string.Empty),
                        new KeyValuePair<string, object>("Namespace", Namespace2));
                    return;
                }
                else if (SchemaResult.Item1 is null)
                {
                    await this.ReturnStatus(ContractStatus.NoSchemaAccess, Callback, State,
                        new KeyValuePair<string, object>("Namespace", Namespace2));
                    return;
                }
                else
                {
                    Schema = SchemaResult.Item1;
                    Schemas[Namespace2] = Schema;
                }
            }
 
            try
            {
                XmlSchema[] Schemas2 = new XmlSchema[Schemas.Count];
                Schemas.Values.CopyTo(Schemas2, 0);
 
                XSL.Validate(string.Empty, Doc, Contract.ForMachinesLocalName, Contract.ForMachinesNamespace, Schemas2);
            }
            catch (XmlSchemaException ex)
            {
                // TODO: Remove
                Log.Alert(ex);
                Log.Debug("Unable to validate Machine-readable content. Following events record the contents of the operation.");
                Log.Debug("Error:\r\n\r\n```\r\n" + ex.Message + "\r\n```");
                Log.Debug("XML:\r\n\r\n```\r\n" + Doc.OuterXml + "\r\n```");
 
                foreach (KeyValuePair<string, XmlSchema> P in Schemas)
                {
                    using MemoryStream ms = new MemoryStream();
                    P.Value.Write(ms);
 
                    Log.Debug("`" + P.Key + "`\r\n\r\n```\r\n" +
                        Encoding.UTF8.GetString(ms.ToArray()) + "\r\n```");
                }
 
                Log.Debug("End of schemas.");
 
                await this.ReturnStatus(ContractStatus.FraudulentMachineReadable, Callback, State,
                    new KeyValuePair<string, object>("Error", ex.Message));
 
                return;
            }
            catch (Exception ex)
            {
                Log.Exception(ex);
 
                await this.ReturnStatus(ContractStatus.FraudulentMachineReadable, Callback, State,
                    new KeyValuePair<string, object>("Error", ex.Message));
 
                return;
            }
 
            StringBuilder Xml = new StringBuilder();
            Contract.Serialize(Xml, false, false, false, false, false, false, false);
            byte[] Data = Encoding.UTF8.GetBytes(Xml.ToString());
            Dictionary<string, LegalIdentity> Identities = new Dictionary<string, LegalIdentity>();
 
            if (ValidateIdentities)
            {
                foreach (ClientSignature Signature in Contract.ClientSignatures)
                {
                    if (Identities.ContainsKey(Signature.LegalId))
                        continue;
 
                    KeyValuePair<LegalIdentity, Exception> P = await this.ValidateSignatureAsyncEx(Signature.LegalId, Data, Signature.DigitalSignature);
                    LegalIdentity Identity = P.Key;
 
                    if (Identity is null)
                    {
                        if (P.Value is RecipientUnavailableException)
                        {
                            await this.ReturnStatus(ContractStatus.NoResponse, Callback, State,
                                new KeyValuePair<string, object>("LegalId", Signature.LegalId));
                        }
                        else if (!(P.Value is null))
                        {
                            await this.ReturnStatus(ContractStatus.ClientSignatureNotValidated, Callback, State,
                                new KeyValuePair<string, object>("LegalId", Signature.LegalId),
                                new KeyValuePair<string, object>("Exception", P.Value.GetType().FullName),
                                new KeyValuePair<string, object>("Message", P.Value.Message));
                        }
                        else
                        {
                            await this.ReturnStatus(ContractStatus.ClientSignatureInvalid, Callback, State,
                                new KeyValuePair<string, object>("LegalId", Signature.LegalId),
                                new KeyValuePair<string, object>("DataBase64", Convert.ToBase64String(Data)),
                                new KeyValuePair<string, object>("SignatureBase64", Convert.ToBase64String(Signature.DigitalSignature)));
                        }
                        return;
                    }
 
                    IdentityValidationEventArgs e = await this.ValidateAsync(Identity, true, ValidateIdentityAttachments);
                    if (e.Status != IdentityStatus.Valid)
                    {
                        await this.ReturnStatus(ContractStatus.ClientIdentityInvalid, Callback,
                            State, e.Tags.Join(
                                new KeyValuePair<string, object>("IdentityStatus", e.Status),
                                new KeyValuePair<string, object>("LegalId", Identity.Id)));
                        return;
                    }
 
                    Identities[Signature.LegalId] = Identity;
                }
            }
 
            if (ValidateAttachments && !(Contract.Attachments is null))
            {
                foreach (Attachment Attachment in Contract.Attachments)
                {
                    if (string.IsNullOrEmpty(Attachment.Url))
                    {
                        await this.ReturnStatus(ContractStatus.AttachmentLacksUrl, Callback, State,
                            new KeyValuePair<string, object>("AttachmentId", Attachment.Id));
                        return;
                    }
 
                    try
                    {
                        KeyValuePair<string, TemporaryFile> P = await this.GetAttachmentAsync(Attachment.Url, SignWith.LatestApprovedId, 30000);
                        bool? IsValid;
                        using TemporaryFile File = P.Value;
 
                        if (P.Key != Attachment.ContentType)
                        {
                            await this.ReturnStatus(ContractStatus.AttachmentInconsistency, Callback, State,
                                new KeyValuePair<string, object>("AttachmentId", Attachment.Id),
                                new KeyValuePair<string, object>("AttachmentUrl", Attachment.Url),
                                new KeyValuePair<string, object>("ExpectedContentType", Attachment.ContentType),
                                new KeyValuePair<string, object>("ContentType", P.Key));
                            return;
                        }
 
                        File.Position = 0;
 
                        if (Identities.TryGetValue(Attachment.LegalId, out LegalIdentity Identity))
                            IsValid = this.ValidateSignature(Identity, File, Attachment.Signature);
                        else
                        {
                            MemoryStream ms = new MemoryStream();
                            await File.CopyToAsync(ms);
                            Data = ms.ToArray();
 
                            try
                            {
                                Identity = await this.ValidateSignatureAsync(Attachment.LegalId, Data, Attachment.Signature);
                                Identities[Attachment.LegalId] = Identity;
                                IsValid = true;
                            }
                            catch (Exception)
                            {
                                IsValid = false;
                            }
                        }
 
                        if (IsValid.HasValue)
                        {
                            if (!IsValid.Value)
                            {
                                await this.ReturnStatus(ContractStatus.AttachmentSignatureInvalid, Callback, State,
                                    new KeyValuePair<string, object>("AttachmentId", Attachment.Id),
                                    new KeyValuePair<string, object>("AttachmentUrl", Attachment.Url),
                                    new KeyValuePair<string, object>("AttachmentSignatureBase64", Convert.ToBase64String(Attachment.Signature)));
                                return;
                            }
                        }
                        else
                        {
                            await this.ReturnStatus(ContractStatus.AttachmentSignatureInvalid, Callback, State,
                                new KeyValuePair<string, object>("AttachmentId", Attachment.Id),
                                new KeyValuePair<string, object>("AttachmentUrl", Attachment.Url),
                                new KeyValuePair<string, object>("KeyName", Identity.ClientKeyName));
                            return;
                        }
                    }
                    catch (Exception ex)
                    {
                        await this.ReturnStatus(ContractStatus.AttachmentUnavailable, Callback, State,
                            new KeyValuePair<string, object>("AttachmentId", Attachment.Id),
                            new KeyValuePair<string, object>("AttachmentUrl", Attachment.Url),
                            new KeyValuePair<string, object>("Error", ex.Message));
                        return;
                    }
                }
            }
 
            if (Contract.ServerSignature is null)
            {
                await this.ReturnStatus(ContractStatus.NoProviderSignature, Callback, State);
                return;
            }
 
            Xml.Clear();
            Contract.Serialize(Xml, false, true, true, true, true, false, false);
            Data = Encoding.UTF8.GetBytes(Xml.ToString());
 
            bool HasOldPublicKey = this.publicKeys.TryGetRecord(Contract.Provider,
                Contract.Updated, out _);
 
            await this.GetServerPublicKey(Contract.Provider, Contract.Updated, async (Sender, e) =>
            {
                if (e.Ok && !(e.Key is null))
                {
                    bool Valid = e.Key.Verify(Data, Contract.ServerSignature.DigitalSignature);
 
                    if (Valid)
                    {
                        await this.ReturnStatus(ContractStatus.Valid, Callback, State);
                        return;
                    }
 
                    if (!HasOldPublicKey)
                    {
                        await this.ReturnStatus(ContractStatus.ProviderSignatureInvalid, Callback, State,
                            new KeyValuePair<string, object>("Provider", Contract.Provider),
                            new KeyValuePair<string, object>("LocalName", e.Key.LocalName),
                            new KeyValuePair<string, object>("Namespace", e.Key.Namespace),
                            new KeyValuePair<string, object>("PublicKeyBase64", e.Key.PublicKeyBase64),
                            new KeyValuePair<string, object>("DataBase64", Convert.ToBase64String(Data)),
                            new KeyValuePair<string, object>("SignatureBase64", Convert.ToBase64String(Contract.ServerSignature.DigitalSignature)));
                        return;
                    }
 
                    this.publicKeys.Remove(Contract.Provider);
 
                    await this.GetServerPublicKey(Contract.Provider, Contract.Updated,
                        (sender2, e2) =>
                        {
                            if (e2.Ok && !(e2.Key is null))
                            {
                                if (e.Key.Equals(e2.Key))
                                {
                                    return this.ReturnStatus(ContractStatus.ProviderSignatureInvalid, Callback, State,
                                        new KeyValuePair<string, object>("Provider", Contract.Provider),
                                        new KeyValuePair<string, object>("LocalName", e.Key.LocalName),
                                        new KeyValuePair<string, object>("Namespace", e.Key.Namespace),
                                        new KeyValuePair<string, object>("PublicKeyBase64", e.Key.PublicKeyBase64),
                                        new KeyValuePair<string, object>("DataBase64", Convert.ToBase64String(Data)),
                                        new KeyValuePair<string, object>("SignatureBase64", Convert.ToBase64String(Contract.ServerSignature.DigitalSignature)));
                                }
 
                                Valid = e2.Key.Verify(Data, Contract.ServerSignature.DigitalSignature);
 
                                if (Valid)
                                    return this.ReturnStatus(ContractStatus.Valid, Callback, State);
                                else
                                    return this.ReturnStatus(ContractStatus.ProviderSignatureInvalid, Callback, State);
                            }
                            else
                            {
                                return this.ReturnStatus(ContractStatus.NoProviderPublicKey, Callback, State,
                                    new KeyValuePair<string, object>("Provider", Contract.Provider),
                                    new KeyValuePair<string, object>("ErrorText", e2.ErrorText));
                            }
 
                        }, State);
                }
                else
                {
                    await this.ReturnStatus(ContractStatus.NoProviderPublicKey, Callback, State,
                        new KeyValuePair<string, object>("Provider", Contract.Provider),
                        new KeyValuePair<string, object>("ErrorText", e.ErrorText));
                }
 
            }, State);
        }
 
        private async Task<Tuple<XmlSchema, ContractStatus?, Exception>> LoadSchema(string ContractComponent, string Namespace,
            HashFunction? HashFunction, byte[] SchemaDigest)
        {
            string SchemaKey = SchemaDigest is null ? Namespace : Namespace + "#" + Convert.ToBase64String(SchemaDigest);
            byte[] SchemaBin;
            XmlSchema Schema;
 
            lock (this.schemas)
            {
                if (this.schemas.TryGetValue(SchemaKey, out Tuple<byte[], XmlSchema, DateTime> P) &&
                    P.Item3 >= DateTime.UtcNow)
                {
                    return new Tuple<XmlSchema, ContractStatus?, Exception>(P.Item2, null, null);
                }
            }
 
            SchemaReferenceEventArgs e = new SchemaReferenceEventArgs(Namespace,
                SchemaDigest is null ? null : new SchemaDigest(HashFunction.Value, SchemaDigest));
 
            await GetLocalSchema.Raise(this, e, false);
 
            if (!(e.XmlSchema is null))
            {
                SchemaBin = e.XmlSchema;
                Schema = XSL.LoadSchema(SchemaBin, SchemaKey);
 
                lock (this.schemas)
                {
                    this.schemas[SchemaKey] = new Tuple<byte[], XmlSchema, DateTime>(SchemaBin, Schema, DateTime.UtcNow.AddDays(CacheSchemaDays));
                }
 
                return new Tuple<XmlSchema, ContractStatus?, Exception>(Schema, null, null);
            }
 
            if (string.IsNullOrEmpty(ContractComponent))
                ContractComponent = this.componentAddress;
 
            try
            {
                SchemaBin = await this.GetSchemaAsync(ContractComponent, Namespace,
                    SchemaDigest is null ? null : new SchemaDigest(HashFunction.Value, SchemaDigest));
            }
            catch (Exception ex)
            {
                return new Tuple<XmlSchema, ContractStatus?, Exception>(null, ContractStatus.NoSchemaAccess, ex);
            }
 
            if (!(SchemaDigest is null))
            {
                byte[] Digest = Hashes.ComputeHash(HashFunction.Value, SchemaBin);
 
                if (Convert.ToBase64String(Digest) != Convert.ToBase64String(SchemaDigest))
                    return new Tuple<XmlSchema, ContractStatus?, Exception>(null, ContractStatus.FraudulentSchema, null);
            }
 
            try
            {
                Schema = XSL.LoadSchema(SchemaBin, SchemaKey);
            }
            catch (Exception ex)
            {
                return new Tuple<XmlSchema, ContractStatus?, Exception>(null, ContractStatus.CorruptSchema, ex);
            }
 
            lock (this.schemas)
            {
                this.schemas[SchemaKey] = new Tuple<byte[], XmlSchema, DateTime>(SchemaBin, Schema, DateTime.UtcNow.AddDays(CacheSchemaDays));
            }
 
            return new Tuple<XmlSchema, ContractStatus?, Exception>(Schema, null, null);
        }
 
        public static event EventHandlerAsync<SchemaReferenceEventArgs> GetLocalSchema = null;
 
        private readonly Dictionary<string, Tuple<byte[], XmlSchema, DateTime>> schemas = new Dictionary<string, Tuple<byte[], XmlSchema, DateTime>>();
 
        private Task ReturnStatus(ContractStatus Status, EventHandlerAsync<ContractValidationEventArgs> Callback, object State,
            params KeyValuePair<string, object>[] Tags)
        {
            return Callback.Raise(this, new ContractValidationEventArgs(Status, State, Tags));
        }
 
        private static async Task<bool> IsHumanReadableWellDefined(HumanReadableText[] Texts)
        {
            if (Texts is null)
                return false;
 
            foreach (HumanReadableText Text in Texts)
            {
                if (!(await Text.IsWellDefined() is null))
                    return false;
            }
 
            return true;
        }
 
        private static async Task<bool> IsHumanReadableWellDefined(Contract Contract)
        {
            if (!await IsHumanReadableWellDefined(Contract.ForHumans))
                return false;
 
            if (!(Contract.Roles is null))
            {
                foreach (Role Role in Contract.Roles)
                {
                    if (!await IsHumanReadableWellDefined(Role.Descriptions))
                        return false;
                }
            }
 
            if (!(Contract.Parameters is null))
            {
                foreach (Parameter Parameter in Contract.Parameters)
                {
                    if (!await IsHumanReadableWellDefined(Parameter.Descriptions))
                        return false;
                }
            }
 
            return true;
        }
 
        public Task<ContractValidationEventArgs> ValidateAsync(Contract Contract)
        {
            return this.ValidateAsync(Contract, true, true, true, true);
        }
 
        public Task<ContractValidationEventArgs> ValidateAsync(Contract Contract, bool ValidateState)
        {
            return this.ValidateAsync(Contract, ValidateState, true, true, true);
        }
 
        public async Task<ContractValidationEventArgs> ValidateAsync(Contract Contract,
            bool ValidateState, bool ValidateAttachments,
            bool ValidateIdentities, bool ValidateIdentityAttachments)
        {
            TaskCompletionSource<ContractValidationEventArgs> Result = new TaskCompletionSource<ContractValidationEventArgs>();
 
            await this.Validate(Contract, ValidateState, ValidateAttachments,
                ValidateIdentities, ValidateIdentityAttachments, (Sender, e) =>
            {
                Result.TrySetResult(e);
                return Task.CompletedTask;
            }, null);
 
            return await Result.Task;
        }
 
        #endregion
 
        #region Can Sign As
 
        public async Task<bool> CanSignAs(CaseInsensitiveString ReferenceId, CaseInsensitiveString SignatoryId)
        {
            string ReferenceDomain = XmppClient.GetDomain(ReferenceId);
            string SignatoryDomain = XmppClient.GetDomain(SignatoryId);
 
            if (ReferenceDomain != SignatoryDomain)
                return false;
 
            TaskCompletionSource<bool> Result = new TaskCompletionSource<bool>();
            StringBuilder Xml = new StringBuilder();
 
            Xml.Append("<canSignAs xmlns='");
            Xml.Append(NamespaceLegalIdentitiesCurrent);
            Xml.Append("' referenceId='");
            Xml.Append(XML.Encode(ReferenceId));
            Xml.Append("' signatoryId='");
            Xml.Append(XML.Encode(SignatoryId));
            Xml.Append("'/>");
 
            await this.client.SendIqGet(ReferenceDomain, Xml.ToString(), (_, e) =>
            {
                Result.TrySetResult(e.Ok);
                return Task.CompletedTask;
            }, null);
 
            return await Result.Task;
        }
 
        #endregion
 
        #region SendContractProposal
 
        public Task SendContractProposal(Contract Contract, string Role, string To)
        {
            return this.SendContractProposal(Contract, Role, To, string.Empty);
        }
 
        public async Task SendContractProposal(Contract Contract, string Role, string To, string Message)
        {
            if (Contract.HasEncryptedParameters)
            {
                Tuple<SymmetricCipherAlgorithms, string, byte[]> T = await this.TryLoadContractSharedSecret(Contract.ContractId);
 
                if (!(T is null))
                {
                    await this.SendContractProposal(Contract.ContractId, Role, To, Message, T.Item3, T.Item1);
                    return;
                }
            }
 
            await this.SendContractProposal(Contract.ContractId, Role, To, Message, null, SymmetricCipherAlgorithms.Aes256);
        }
 
        public Task SendContractProposal(string ContractId, string Role, string To)
        {
            return this.SendContractProposal(ContractId, Role, To, string.Empty);
        }
 
        public Task SendContractProposal(string ContractId, string Role, string To, string Message)
        {
            return this.SendContractProposal(ContractId, Role, To, Message, null, SymmetricCipherAlgorithms.Aes256);
        }
 
        public async Task SendContractProposal(string ContractId, string Role, string To, string Message, byte[] Key,
            SymmetricCipherAlgorithms KeyAlgorithm)
        {
            StringBuilder Xml = new StringBuilder();
 
            Xml.Append("<contractProposal xmlns=\"");
            Xml.Append(NamespaceSmartContractsCurrent);
            Xml.Append("\" contractId=\"");
            Xml.Append(XML.Encode(ContractId));
            Xml.Append("\" role=\"");
            Xml.Append(XML.Encode(Role));
 
            if (!string.IsNullOrEmpty(Message))
            {
                Xml.Append("\" message=\"");
                Xml.Append(XML.Encode(Message));
            }
 
            Xml.Append('"');
 
            if (Key is null)
            {
                Xml.Append("/>");
 
                if (EndpointSecurity.TryGetEndpointSecurity(this.client, out EndpointSecurity E2ee))
                {
                    await E2ee.SendMessage(this.client, E2ETransmission.NormalIfNotE2E, QoSLevel.Unacknowledged, MessageType.Normal,
                        string.Empty, To, Xml.ToString(), string.Empty, string.Empty, string.Empty, string.Empty, string.Empty, null, null);
                }
                else
                {
                    await this.client.SendMessage(MessageType.Normal, To, Xml.ToString(), string.Empty, string.Empty, string.Empty,
                        string.Empty, string.Empty);
                }
            }
            else
            {
                Xml.Append("><sharedSecret key=\"");
                Xml.Append(Convert.ToBase64String(Key));
                Xml.Append("\" algorithm=\"");
 
                switch (KeyAlgorithm)
                {
                    case SymmetricCipherAlgorithms.Aes256:
                        Xml.Append("aes");
                        break;
 
                    case SymmetricCipherAlgorithms.ChaCha20:
                        Xml.Append("cha");
                        break;
 
                    case SymmetricCipherAlgorithms.AeadChaCha20Poly1305:
                        Xml.Append("acp");
                        break;
 
                    default:
                        throw new ArgumentException("Algorithm not recognized.", nameof(KeyAlgorithm));
                }
 
                Xml.Append("\"/></contractProposal>");
 
                if (!EndpointSecurity.TryGetEndpointSecurity(this.client, out EndpointSecurity E2ee))
                    throw new InvalidOperationException("End-to-End encryption not enabled.");
 
                if (XmppClient.GetBareJID(To) == To)
                {
                    RosterItem Item = this.client[To]
                        ?? throw new ArgumentException("Recipient not in roster.", nameof(To));
 
                    To = Item.LastPresenceFullJid;
                    if (string.IsNullOrEmpty(To))
                        throw new ArgumentException("Recipient not online.", nameof(To));
                }
 
                await E2ee.SendMessage(this.client, E2ETransmission.AssertE2E, QoSLevel.Unacknowledged, MessageType.Normal,
                    string.Empty, To, Xml.ToString(), string.Empty, string.Empty, string.Empty, string.Empty, string.Empty, null, null);
            }
        }
 
        private async Task ContractProposalMessageHandler(object Sender, MessageEventArgs e)
        {
            string ContractId = XML.Attribute(e.Content, "contractId");
            string Role = XML.Attribute(e.Content, "role");
            string Message = XML.Attribute(e.Content, "message");
            byte[] Key = null;
            SymmetricCipherAlgorithms KeyAlgorithm = SymmetricCipherAlgorithms.Aes256;
 
            foreach (XmlNode N in e.Content.ChildNodes)
            {
                if (N is XmlElement E && E.LocalName == "sharedSecret" && E.NamespaceURI == e.Content.NamespaceURI)
                {
                    if (!e.UsesE2eEncryption)
                    {
                        this.client.Error("Confidential Proposal not sent using end-to-end encryption. Message discarded.");
                        return;
                    }
 
                    try
                    {
                        Key = Convert.FromBase64String(XML.Attribute(E, "key"));
                    }
                    catch (Exception)
                    {
                        this.client.Error("Invalid base64-encoded shared secret. Message discarded.");
                        return;
                    }
 
                    string Cipher = XML.Attribute(E, "algorithm");
 
                    switch (Cipher)
                    {
                        case "aes":
                            KeyAlgorithm = SymmetricCipherAlgorithms.Aes256;
                            break;
 
                        case "cha":
                            KeyAlgorithm = SymmetricCipherAlgorithms.ChaCha20;
                            break;
 
                        case "acp":
                            KeyAlgorithm = SymmetricCipherAlgorithms.AeadChaCha20Poly1305;
                            break;
 
                        default:
                            this.client.Error("Unrecognized key algorithm. Message discarded.");
                            return;
                    }
                }
            }
 
            if (!(Key is null))
                await this.SaveContractSharedSecret(ContractId, e.FromBareJID, Key, KeyAlgorithm, true);
 
            await this.ContractProposalReceived.Raise(this, new ContractProposalEventArgs(e, ContractId, Role, Message, Key, KeyAlgorithm));
        }
 
        internal async Task<bool> SaveContractSharedSecret(string ContractId, string CreatorJid, byte[] Key,
            SymmetricCipherAlgorithms KeyAlgorithm, bool OnlyIfNew)
        {
            if (OnlyIfNew)
            {
                ContractSharedSecretState State = await this.GetContractStateAsync(ContractId);
 
                if (!(State is null) && State.HasSharedSecret)
                    return false;
 
                if (!(await this.TryLoadLegacyContractSharedSecretAsync(ContractId, true) is null))
                    return false;
            }
 
            return await this.UpsertContractStateAsync(ContractId, CreatorJid, Key, KeyAlgorithm);
        }
 
        internal async Task<Tuple<SymmetricCipherAlgorithms, string, byte[]>> TryLoadContractSharedSecret(string ContractId)
        {
            ContractSharedSecretState State = await this.GetContractStateAsync(ContractId);
            Tuple<SymmetricCipherAlgorithms, string, byte[]> Result = this.TryLoadContractSharedSecret(State);
 
            if (!(Result is null))
                return Result;
 
            if (!(State is null))
                return null;
 
            return await this.TryLoadLegacyContractSharedSecretAsync(ContractId, true);
        }
 
        public event EventHandlerAsync<ContractProposalEventArgs> ContractProposalReceived = null;
 
        #endregion
 
        #region Get Schemas
 
        public Task GetSchemas(EventHandlerAsync<SchemaReferencesEventArgs> Callback, object State)
        {
            return this.GetSchemas(this.componentAddress, Callback, State);
        }
 
        public Task GetSchemas(string Address, EventHandlerAsync<SchemaReferencesEventArgs> Callback, object State)
        {
            return this.client.SendIqGet(Address, "<getSchemas xmlns='" + NamespaceSmartContractsCurrent + "'/>",
                async (Sender, e) =>
                {
                    XmlElement E = e.FirstElement;
                    List<SchemaReference> Schemas = new List<SchemaReference>();
 
                    if (e.Ok && !(E is null) && E.LocalName == "schemas")
                    {
                        foreach (XmlNode N in E.ChildNodes)
                        {
                            if (N is XmlElement E2 && E2.LocalName == "schemaRef")
                            {
                                string Namespace = XML.Attribute(E2, "namespace");
                                List<SchemaDigest> Digests = new List<SchemaDigest>();
 
                                foreach (XmlNode N2 in E2.ChildNodes)
                                {
                                    if (N2 is XmlElement E3 && E3.LocalName == "digest")
                                    {
                                        if (!Enum.TryParse(XML.Attribute(E3, "function"), out HashFunction Function))
                                            continue;
 
                                        byte[] Digest = Convert.FromBase64String(E3.InnerText);
 
                                        Digests.Add(new SchemaDigest(Function, Digest));
                                    }
                                }
 
                                Schemas.Add(new SchemaReference(Namespace, Digests.ToArray()));
                            }
                        }
                    }
                    else
                        e.Ok = false;
 
                    await Callback.Raise(this, new SchemaReferencesEventArgs(e, Schemas.ToArray()));
 
                }, State);
        }
 
        public Task<SchemaReference[]> GetSchemasAsync()
        {
            return this.GetSchemasAsync(this.componentAddress);
        }
 
        public async Task<SchemaReference[]> GetSchemasAsync(string Address)
        {
            TaskCompletionSource<SchemaReference[]> Result = new TaskCompletionSource<SchemaReference[]>();
 
            await this.GetSchemas(Address, (Sender, e) =>
            {
                if (e.Ok)
                    Result.TrySetResult(e.References);
                else
                    Result.TrySetException(e.StanzaError ?? new Exception("Unable to get schemas."));
 
                return Task.CompletedTask;
 
            }, null);
 
            return await Result.Task;
        }
 
        #endregion
 
        #region Get Schema
 
        public Task GetSchema(string Namespace, EventHandlerAsync<SchemaEventArgs> Callback, object State)
        {
            return this.GetSchema(this.componentAddress, Namespace, null, Callback, State);
        }
 
        public Task GetSchema(string Namespace, SchemaDigest Digest, EventHandlerAsync<SchemaEventArgs> Callback, object State)
        {
            return this.GetSchema(this.componentAddress, Namespace, Digest, Callback, State);
        }
 
        public Task GetSchema(string Address, string Namespace, EventHandlerAsync<SchemaEventArgs> Callback, object State)
        {
            return this.GetSchema(Address, Namespace, null, Callback, State);
        }
 
        public async Task GetSchema(string Address, string Namespace, SchemaDigest Digest, EventHandlerAsync<SchemaEventArgs> Callback, object State)
        {
            SchemaReferenceEventArgs e = new SchemaReferenceEventArgs(Namespace, Digest);
            await GetLocalSchema.Raise(this, e, false);
 
            if (!(e.XmlSchema is null))
            {
                if (!(Callback is null))
                {
                    XmlDocument Doc = new XmlDocument();
                    XmlElement Empty = Doc.CreateElement("Local");
 
                    IqResultEventArgs e0 = new IqResultEventArgs(Empty, string.Empty, string.Empty, string.Empty, true, State);
                    SchemaEventArgs e2 = new SchemaEventArgs(e0, e.XmlSchema);
                    await Callback.Raise(this, e2);
                }
 
                return;
            }
 
            StringBuilder Xml = new StringBuilder();
 
            Xml.Append("<getSchema xmlns='");
            Xml.Append(NamespaceSmartContractsCurrent);
            Xml.Append("' namespace='");
            Xml.Append(XML.Encode(Namespace));
 
            if (Digest is null)
                Xml.Append("'/>");
            else
            {
                Xml.Append("'><digest function='");
                Xml.Append(Digest.Function.ToString());
                Xml.Append("'>");
                Xml.Append(Convert.ToBase64String(Digest.Digest));
                Xml.Append("</digest></getSchema>");
            }
 
            await this.client.SendIqGet(Address, Xml.ToString(),
                async (Sender, e) =>
                {
                    XmlElement E = e.FirstElement;
                    byte[] Schema = null;
 
                    if (e.Ok && !(E is null) && E.LocalName == "schema")
                        Schema = Convert.FromBase64String(E.InnerText);
                    else
                        e.Ok = false;
 
                    await Callback.Raise(this, new SchemaEventArgs(e, Schema));
 
                }, State);
        }
 
        public Task<byte[]> GetSchemaAsync(string Namespace)
        {
            return this.GetSchemaAsync(this.componentAddress, Namespace, null);
        }
 
        public Task<byte[]> GetSchemaAsync(string Namespace, SchemaDigest Digest)
        {
            return this.GetSchemaAsync(this.componentAddress, Namespace, Digest);
        }
 
        public Task<byte[]> GetSchemaAsync(string Address, string Namespace)
        {
            return this.GetSchemaAsync(Address, Namespace, null);
        }
 
        public async Task<byte[]> GetSchemaAsync(string Address, string Namespace, SchemaDigest Digest)
        {
            TaskCompletionSource<byte[]> Result = new TaskCompletionSource<byte[]>();
 
            await this.GetSchema(Address, Namespace, Digest, (Sender, e) =>
            {
                if (e.Ok)
                    Result.TrySetResult(e.Schema);
                else
                    Result.TrySetException(e.StanzaError ?? new Exception("Unable to get schema."));
 
                return Task.CompletedTask;
 
            }, null);
 
            return await Result.Task;
        }
 
        #endregion
 
        #region Get Legal Identities of a contract
 
        public Task GetContractLegalIdentities(string ContractId, EventHandlerAsync<LegalIdentitiesEventArgs> Callback, object State)
        {
            return this.GetContractLegalIdentities(this.GetTrustProvider(ContractId), ContractId, false, true, Callback, State);
        }
 
        public Task GetContractLegalIdentities(string ContractId, bool Current, bool Historic, EventHandlerAsync<LegalIdentitiesEventArgs> Callback, object State)
        {
            return this.GetContractLegalIdentities(this.GetTrustProvider(ContractId), ContractId, Current, Historic, Callback, State);
        }
 
        public Task GetContractLegalIdentities(string Address, string ContractId, EventHandlerAsync<LegalIdentitiesEventArgs> Callback, object State)
        {
            return this.GetContractLegalIdentities(Address, ContractId, false, true, Callback, State);
        }
 
        public Task GetContractLegalIdentities(string Address, string ContractId, bool Current, bool Historic, EventHandlerAsync<LegalIdentitiesEventArgs> Callback, object State)
        {
            StringBuilder Xml = new StringBuilder();
 
            Xml.Append("<getLegalIdentities xmlns='");
            Xml.Append(NamespaceSmartContractsCurrent);
            Xml.Append("' contractId='");
            Xml.Append(XML.Encode(ContractId));
            Xml.Append("' current='");
            Xml.Append(CommonTypes.Encode(Current));
            Xml.Append("' historic='");
            Xml.Append(CommonTypes.Encode(Historic));
            Xml.Append("'/>");
 
            return this.client.SendIqGet(Address, Xml.ToString(), this.IdentitiesResponse, new object[] { Callback, State });
        }
 
        public Task<LegalIdentity[]> GetContractLegalIdentitiesAsync(string ContractId)
        {
            return this.GetContractLegalIdentitiesAsync(this.GetTrustProvider(ContractId), ContractId, false, true);
        }
 
        public Task<LegalIdentity[]> GetContractLegalIdentitiesAsync(string ContractId, bool Current, bool Historic)
        {
            return this.GetContractLegalIdentitiesAsync(this.GetTrustProvider(ContractId), ContractId, Current, Historic);
        }
 
        public Task<LegalIdentity[]> GetContractLegalIdentitiesAsync(string Address, string ContractId)
        {
            return this.GetContractLegalIdentitiesAsync(Address, ContractId, false, true);
        }
 
        public async Task<LegalIdentity[]> GetContractLegalIdentitiesAsync(string Address, string ContractId, bool Current, bool Historic)
        {
            TaskCompletionSource<LegalIdentity[]> Result = new TaskCompletionSource<LegalIdentity[]>();
 
            await this.GetContractLegalIdentities(Address, ContractId, Current, Historic, (Sender, e) =>
            {
                if (e.Ok)
                    Result.TrySetResult(e.Identities);
                else
                    Result.TrySetException(e.StanzaError ?? new Exception("Unable to get legal identities."));
 
                return Task.CompletedTask;
 
            }, null);
 
            return await Result.Task;
        }
 
        #endregion
 
        #region Get Network Identities of a contract
 
        public Task GetContractNetworkIdentities(string ContractId, EventHandlerAsync<NetworkIdentitiesEventArgs> Callback, object State)
        {
            return this.GetContractNetworkIdentities(this.GetTrustProvider(ContractId), ContractId, Callback, State);
        }
 
        public Task GetContractNetworkIdentities(string Address, string ContractId, EventHandlerAsync<NetworkIdentitiesEventArgs> Callback, object State)
        {
            StringBuilder Xml = new StringBuilder();
 
            Xml.Append("<getNetworkIdentities xmlns='");
            Xml.Append(NamespaceSmartContractsCurrent);
            Xml.Append("' contractId='");
            Xml.Append(XML.Encode(ContractId));
            Xml.Append("'/>");
 
            return this.client.SendIqGet(Address, Xml.ToString(), async (Sender, e) =>
            {
                NetworkIdentity[] Identities = null;
                XmlElement E;
 
                if (e.Ok && !((E = e.FirstElement) is null) && E.LocalName == "networkIdentities")
                {
                    List<NetworkIdentity> IdentitiesList = new List<NetworkIdentity>();
 
                    foreach (XmlNode N in E.ChildNodes)
                    {
                        if (N is XmlElement E2 && E2.LocalName == "networkIdentity")
                        {
                            string BareJid = XML.Attribute(E2, "bareJid");
                            string LegalId = XML.Attribute(E2, "legalId");
 
                            IdentitiesList.Add(new NetworkIdentity(BareJid, LegalId));
                        }
                    }
 
                    Identities = IdentitiesList.ToArray();
                }
                else
                    e.Ok = false;
 
                await Callback.Raise(this, new NetworkIdentitiesEventArgs(e, Identities));
            }, State);
        }
 
        public Task<NetworkIdentity[]> GetContractNetworkIdentitiesAsync(string ContractId)
        {
            return this.GetContractNetworkIdentitiesAsync(this.GetTrustProvider(ContractId), ContractId);
        }
 
        public async Task<NetworkIdentity[]> GetContractNetworkIdentitiesAsync(string Address, string ContractId)
        {
            TaskCompletionSource<NetworkIdentity[]> Result = new TaskCompletionSource<NetworkIdentity[]>();
 
            await this.GetContractNetworkIdentities(Address, ContractId, (Sender, e) =>
            {
                if (e.Ok)
                    Result.TrySetResult(e.Identities);
                else
                    Result.TrySetException(e.StanzaError ?? new Exception("Unable to get network identities."));
 
                return Task.CompletedTask;
 
            }, null);
 
            return await Result.Task;
        }
 
        #endregion
 
        #region Search Public Contracts
 
        public Task Search(SearchFilter[] Filter, EventHandlerAsync<SearchResultEventArgs> Callback, object State)
        {
            return this.Search(this.componentAddress, 0, int.MaxValue, Filter, Callback, State);
        }
 
        public Task Search(string Address, SearchFilter[] Filter, EventHandlerAsync<SearchResultEventArgs> Callback, object State)
        {
            return this.Search(Address, 0, int.MaxValue, Filter, Callback, State);
        }
 
        public Task Search(int Offset, int MaxCount, SearchFilter[] Filter, EventHandlerAsync<SearchResultEventArgs> Callback, object State)
        {
            return this.Search(this.componentAddress, Offset, MaxCount, Filter, Callback, State);
        }
 
        public Task Search(string Address, int Offset, int MaxCount, SearchFilter[] Filter, EventHandlerAsync<SearchResultEventArgs> Callback, object State)
        {
            if (Offset < 0)
                throw new ArgumentException("Offsets cannot be negative.", nameof(Offset));
 
            if (MaxCount <= 0)
                throw new ArgumentException("Must be postitive.", nameof(MaxCount));
 
            StringBuilder Xml = new StringBuilder();
 
            Xml.Append("<searchPublicContracts xmlns='");
            Xml.Append(NamespaceSmartContractsCurrent);
 
            if (Offset > 0)
            {
                Xml.Append("' offset='");
                Xml.Append(Offset.ToString());
            }
 
            if (MaxCount < int.MaxValue)
            {
                Xml.Append("' maxCount='");
                Xml.Append(MaxCount.ToString());
            }
 
            Xml.Append("'>");
 
            Filter = (SearchFilter[])Filter.Clone();
            Array.Sort(Filter, (f1, f2) => f1.Order - f2.Order);
 
            int PrevOrder = 0;
            int PrevOrderCount = 0;
            int Order;
 
            foreach (SearchFilter F in Filter)
            {
                Order = F.Order;
                if (Order != PrevOrder)
                {
                    PrevOrder = Order;
                    PrevOrderCount = 1;
                }
                else
                {
                    PrevOrderCount++;
                    if (PrevOrderCount >= F.MaxOccurs)
                    {
                        throw new ArgumentException("Maximum number of occurrences of " + F.GetType().FullName + " in a search is " +
                            F.MaxOccurs.ToString() + ".", nameof(Filter));
                    }
                }
 
                F.Serialize(Xml);
            }
 
            Xml.Append("</searchPublicContracts>");
 
            return this.client.SendIqGet(Address, Xml.ToString(), async (Sender, e) =>
            {
                XmlElement E = e.FirstElement;
                List<string> IDs = null;
                bool More = false;
 
                if (e.Ok && !(E is null) && E.LocalName == "searchResult")
                {
                    More = XML.Attribute(E, "more", false);
                    IDs = new List<string>();
 
                    foreach (XmlNode N in E.ChildNodes)
                    {
                        if (N is XmlElement E2 && E2.LocalName == "ref")
                        {
                            string Id = XML.Attribute(E2, "id");
                            IDs.Add(Id);
                        }
                    }
                }
                else
                    e.Ok = false;
 
                await Callback.Raise(this, new SearchResultEventArgs(e, Offset, MaxCount, More, IDs?.ToArray()));
            }, State);
        }
 
        public Task<SearchResultEventArgs> SearchAsync(SearchFilter[] Filter)
        {
            return this.SearchAsync(this.componentAddress, 0, int.MaxValue, Filter);
        }
 
        public Task<SearchResultEventArgs> SearchAsync(string Address, SearchFilter[] Filter)
        {
            return this.SearchAsync(Address, 0, int.MaxValue, Filter);
        }
 
        public Task<SearchResultEventArgs> SearchAsync(int Offset, int MaxCount, SearchFilter[] Filter)
        {
            return this.SearchAsync(this.componentAddress, Offset, MaxCount, Filter);
        }
 
        public async Task<SearchResultEventArgs> SearchAsync(string Address, int Offset, int MaxCount, SearchFilter[] Filter)
        {
            TaskCompletionSource<SearchResultEventArgs> Result = new TaskCompletionSource<SearchResultEventArgs>();
 
            await this.Search(Address, Offset, MaxCount, Filter, (Sender, e) =>
            {
                Result.TrySetResult(e);
                return Task.CompletedTask;
            }, null);
 
            return await Result.Task;
        }
 
        #endregion
 
        #region Identity petitions
 
        public Task PetitionIdentityAsync(string LegalId, string PetitionId, string Purpose)
        {
            return this.PetitionIdentityAsync(this.GetTrustProvider(LegalId), LegalId, PetitionId, Purpose, null, null, null);
        }
 
        public Task PetitionIdentityAsync(string Address, string LegalId, string PetitionId, string Purpose)
        {
            return this.PetitionIdentityAsync(Address, LegalId, PetitionId, Purpose, null, null, null);
        }
 
        public Task PetitionIdentityAsync(string Address, string LegalId, string PetitionId, string Purpose, string ContextXml)
        {
            return this.PetitionIdentityAsync(Address, LegalId, PetitionId, Purpose, ContextXml, null, null);
        }
 
        public Task PetitionIdentityAsync(string LegalId, string PetitionId, string Purpose,
            string[] Properties, string[] Attachments)
        {
            return this.PetitionIdentityAsync(this.GetTrustProvider(LegalId), LegalId, PetitionId, Purpose, null,
                Properties, Attachments);
        }
 
        public Task PetitionIdentityAsync(string Address, string LegalId, string PetitionId, string Purpose,
            string[] Properties, string[] Attachments)
        {
            return this.PetitionIdentityAsync(Address, LegalId, PetitionId, Purpose, null,
                Properties, Attachments);
        }
 
        public async Task PetitionIdentityAsync(string Address, string LegalId, string PetitionId, string Purpose, string ContextXml,
            string[] Properties, string[] Attachments)
        {
            StringBuilder Xml = new StringBuilder();
            byte[] Nonce = this.RandomBytes(32);
 
            string NonceStr = Convert.ToBase64String(Nonce);
            byte[] Data = Encoding.UTF8.GetBytes(PetitionId + ":" + LegalId + ":" + Purpose + ":" + NonceStr + ":" + this.client.BareJID.ToLower());
            byte[] Signature = await this.SignAsync(Data, SignWith.LatestApprovedId);
 
            Xml.Append("<petitionIdentity xmlns='");
            Xml.Append(NamespaceLegalIdentitiesCurrent);
            Xml.Append("' id='");
            Xml.Append(XML.Encode(LegalId));
            Xml.Append("' pid='");
            Xml.Append(XML.Encode(PetitionId));
            Xml.Append("' purpose='");
            Xml.Append(XML.Encode(Purpose));
            Xml.Append("' nonce='");
            Xml.Append(NonceStr);
            Xml.Append("' s='");
            Xml.Append(Convert.ToBase64String(Signature));
 
            if (string.IsNullOrEmpty(ContextXml))
                Xml.Append("'/>");
            else
            {
                Xml.Append("'>");
                AppendHints(Xml, Properties, Attachments);
                Xml.Append(ContextXml);
                Xml.Append("</petitionIdentity>");
            }
 
            await this.client.IqSetAsync(Address, Xml.ToString());
        }
 
        private static void AppendHints(StringBuilder Xml, string[] Properties, string[] Attachments)
        {
            if (!(Properties is null))
            {
                Xml.Append("<properties>");
 
                foreach (string Property in Properties)
                {
                    Xml.Append("<property>");
                    Xml.Append(XML.Encode(Property));
                    Xml.Append("</property>");
                }
 
                Xml.Append("</properties>");
            }
 
            if (!(Attachments is null))
            {
                Xml.Append("<attachments>");
 
                foreach (string Attachment in Attachments)
                {
                    Xml.Append("<attachment>");
                    Xml.Append(XML.Encode(Attachment));
                    Xml.Append("</attachment>");
                }
 
                Xml.Append("</attachments>");
            }
        }
 
        public Task PetitionIdentityResponseAsync(string LegalId, string PetitionId, string RequestorFullJid, bool Response)
        {
            return this.PetitionIdentityResponseAsync(this.GetTrustProvider(LegalId), LegalId, PetitionId, RequestorFullJid, Response, null);
        }
 
        public Task PetitionIdentityResponseAsync(string LegalId, string PetitionId, string RequestorFullJid, bool Response, string ContextXml)
        {
            return this.PetitionIdentityResponseAsync(this.GetTrustProvider(LegalId), LegalId, PetitionId, RequestorFullJid, Response, ContextXml);
        }
 
        public Task PetitionIdentityResponseAsync(string Address, string LegalId, string PetitionId, string RequestorFullJid, bool Response)
        {
            return this.PetitionIdentityResponseAsync(Address, LegalId, PetitionId, RequestorFullJid, Response, null);
        }
 
        public async Task PetitionIdentityResponseAsync(string Address, string LegalId, string PetitionId, string RequestorFullJid, bool Response,
            string ContextXml)
        {
            StringBuilder Xml = new StringBuilder();
 
            Xml.Append("<petitionIdentityResponse xmlns='");
            Xml.Append(NamespaceLegalIdentitiesCurrent);
            Xml.Append("' id='");
            Xml.Append(XML.Encode(LegalId));
            Xml.Append("' pid='");
            Xml.Append(XML.Encode(PetitionId));
            Xml.Append("' jid='");
            Xml.Append(XML.Encode(RequestorFullJid));
            Xml.Append("' response='");
            Xml.Append(CommonTypes.Encode(Response));
 
            if (string.IsNullOrEmpty(ContextXml))
                Xml.Append("'/>");
            else
            {
                Xml.Append("'>");
                Xml.Append(ContextXml);
                Xml.Append("</petitionIdentityResponse>");
            }
 
            await this.client.IqSetAsync(Address, Xml.ToString());
        }
 
        private async Task PetitionIdentityMessageHandler(object Sender, MessageEventArgs e)
        {
            string LegalId = XML.Attribute(e.Content, "id");
            string PetitionId = XML.Attribute(e.Content, "pid");
            string Purpose = XML.Attribute(e.Content, "purpose");
            string From = XML.Attribute(e.Content, "from");
            string ClientEndpoint = XML.Attribute(e.Content, "clientEp");
 
            if (!TryGetContext(e.Content, out XmlElement Context, out string _,
                out string[] Properties, out string[] Attachments, out LegalIdentity Identity))
            {
                this.client.Error("Invalid context. Ignoring message.");
                return;
            }
 
            if (Identity is null)
            {
                this.client.Error("No identity in message. Ignoring message.");
                return;
            }
 
            if (string.Compare(e.FromBareJID, this.componentAddress, true) == 0)
            {
                await this.Validate(Identity, false, async (sender2, e2) =>
                {
                    if (e2.Status != IdentityStatus.Valid)
                    {
                        this.client.Error("Invalid legal identity received and discarded.");
 
                        Log.Warning("Invalid legal identity received and discarded.", this.client.BareJID, e.From,
                            new KeyValuePair<string, object>("Status", e2.Status));
                        return;
                    }
 
                    await this.PetitionForIdentityReceived.Raise(this, new LegalIdentityPetitionEventArgs(e,
                        Identity, From, LegalId, PetitionId, Purpose, ClientEndpoint, Context, Properties, Attachments));
                }, null);
            }
        }
 
        private static bool TryGetContext(XmlElement Query, out XmlElement Context,
            out string Content, out string[] Properties, out string[] Attachments,
            out LegalIdentity Identity)
        {
            ChunkedList<string> PropertyList = null;
            ChunkedList<string> AttachmentList = null;
            bool IsIdentityNamespace = IsNamespaceLegalIdentity(Query.NamespaceURI);
            bool IsContractNamespace = IsNamespaceSmartContract(Query.NamespaceURI);
            Context = null;
            Properties = null;
            Attachments = null;
            Content = null;
            Identity = null;
 
            foreach (XmlNode N in Query)
            {
                if (!(N is XmlElement E))
                    continue;
 
                if (IsIdentityNamespace)
                {
                    if (!IsNamespaceLegalIdentity(E.NamespaceURI))
                        continue;
                }
                else if (IsContractNamespace)
                {
                    if (!IsNamespaceSmartContract(E.NamespaceURI))
                        continue;
                }
                else
                {
                    if (E.NamespaceURI != Query.NamespaceURI)
                        continue;
                }
 
                switch (E.LocalName)
                {
                    case "identity":
                        Identity = LegalIdentity.Parse(E);
                        continue;
 
                    case "content":
                        if (string.IsNullOrEmpty(Content))
                        {
                            Content = E.InnerText;
                            continue;
                        }
                        else
                            return false;
 
                    case "properties":
                        foreach (XmlNode N2 in E.ChildNodes)
                        {
                            if (!(N2 is XmlElement E2))
                                continue;
 
                            if (E2.LocalName == "property")
                            {
                                PropertyList ??= new ChunkedList<string>();
                                PropertyList.Add(E2.InnerText);
                            }
                            else
                                return false;
                        }
                        continue;
 
                    case "attachments":
                        foreach (XmlNode N2 in E.ChildNodes)
                        {
                            if (!(N2 is XmlElement E2))
                                continue;
 
                            if (E2.LocalName == "attachment")
                            {
                                AttachmentList ??= new ChunkedList<string>();
                                AttachmentList.Add(E2.InnerText);
                            }
                            else
                                return false;
                        }
                        continue;
                }
 
                if (Context is null)
                    Context = E;
                else
                    return false;
                break;
            }
 
            Properties = PropertyList?.ToArray();
            Attachments = AttachmentList?.ToArray();
 
            return true;
        }
 
        public event EventHandlerAsync<LegalIdentityPetitionEventArgs> PetitionForIdentityReceived = null;
 
        private async Task PetitionIdentityResponseMessageHandler(object Sender, MessageEventArgs e)
        {
            string PetitionId = XML.Attribute(e.Content, "pid");
            bool Response = XML.Attribute(e.Content, "response", false);
            string ClientEndpoint = XML.Attribute(e.Content, "clientEp");
            LegalIdentity Identity = null;
            XmlElement Context = null;
 
            foreach (XmlNode N in e.Content.ChildNodes)
            {
                if (N is XmlElement E)
                {
                    if (E.LocalName == "identity" && E.NamespaceURI == e.Content.NamespaceURI)
                        Identity = LegalIdentity.Parse(E);
                    else if (!(Context is null))
                        return;
                    else
                        Context = E;
                }
            }
 
            if (!Response || string.Compare(e.FromBareJID, Identity?.Provider ?? string.Empty, true) == 0)
                await this.PetitionedIdentityResponseReceived.Raise(this, new LegalIdentityPetitionResponseEventArgs(e, Identity, PetitionId, Response, ClientEndpoint, Context));
        }
 
        public event EventHandlerAsync<LegalIdentityPetitionResponseEventArgs> PetitionedIdentityResponseReceived = null;
 
        #endregion
 
        #region Signature petitions
 
        public Task PetitionSignatureAsync(string LegalId, byte[] Content, string PetitionId, string Purpose)
        {
            return this.PetitionSignatureAsync(this.GetTrustProvider(LegalId), LegalId, Content, PetitionId, Purpose, false, null, null, null);
        }
 
        public Task PetitionSignatureAsync(string Address, string LegalId, byte[] Content, string PetitionId, string Purpose)
        {
            return this.PetitionSignatureAsync(Address, LegalId, Content, PetitionId, Purpose, false, null, null, null);
        }
 
        public Task PetitionSignatureAsync(string Address, string LegalId, byte[] Content, string PetitionId, string Purpose, string ContextXml)
        {
            return this.PetitionSignatureAsync(Address, LegalId, Content, PetitionId, Purpose, false, ContextXml, null, null);
        }
 
        public Task PetitionSignatureAsync(string LegalId, byte[] Content, string PetitionId, string Purpose,
            string[] Properties, string[] Attachments)
        {
            return this.PetitionSignatureAsync(this.GetTrustProvider(LegalId), LegalId, Content, PetitionId, Purpose, false, null,
                Properties, Attachments);
        }
 
        public Task PetitionSignatureAsync(string Address, string LegalId, byte[] Content, string PetitionId, string Purpose,
            string[] Properties, string[] Attachments)
        {
            return this.PetitionSignatureAsync(Address, LegalId, Content, PetitionId, Purpose, false, null,
                Properties, Attachments);
        }
 
        public Task PetitionSignatureAsync(string Address, string LegalId, byte[] Content, string PetitionId, string Purpose, string ContextXml,
            string[] Properties, string[] Attachments)
        {
            return this.PetitionSignatureAsync(Address, LegalId, Content, PetitionId, Purpose, false, ContextXml,
                Properties, Attachments);
        }
 
        private async Task PetitionSignatureAsync(string Address, string LegalId, byte[] Content, string PetitionId,
            string Purpose, bool PeerReview, string ContextXml, string[] Properties, string[] Attachments)
        {
            if (this.contentPerPid.TryGetValue(PetitionId, out KeyValuePair<byte[], bool> Rec))
            {
                if (Convert.ToBase64String(Content) == Convert.ToBase64String(Rec.Key) && PeerReview == Rec.Value)
                    return;
 
                throw new InvalidOperationException("Petition ID must be unique for outstanding petitions.");
            }
 
            this.contentPerPid[PetitionId] = new KeyValuePair<byte[], bool>(Content, PeerReview);
 
            StringBuilder Xml = new StringBuilder();
            byte[] Nonce = this.RandomBytes(32);
 
            string NonceStr = Convert.ToBase64String(Nonce);
            string ContentStr = Convert.ToBase64String(Content);
            byte[] Data = Encoding.UTF8.GetBytes(PetitionId + ":" + LegalId + ":" + Purpose + ":" + NonceStr + ":" + this.client.BareJID.ToLower() + ":" + ContentStr);
            byte[] Signature = await this.SignAsync(Data, PeerReview ? SignWith.CurrentKeys : SignWith.LatestApprovedId);
 
            Xml.Append("<petitionSignature xmlns='");
            Xml.Append(NamespaceLegalIdentitiesCurrent);
            Xml.Append("' id='");
            Xml.Append(XML.Encode(LegalId));
            Xml.Append("' pid='");
            Xml.Append(XML.Encode(PetitionId));
            Xml.Append("' purpose='");
            Xml.Append(XML.Encode(Purpose));
            Xml.Append("' nonce='");
            Xml.Append(NonceStr);
            Xml.Append("' s='");
            Xml.Append(Convert.ToBase64String(Signature));
            Xml.Append("'>");
            AppendHints(Xml, Properties, Attachments);
 
            if (!string.IsNullOrEmpty(ContentStr))
            {
                Xml.Append("<content>");
                Xml.Append(ContentStr);
                Xml.Append("</content>");
            }
 
            if (!string.IsNullOrEmpty(ContextXml))
                Xml.Append(ContextXml);
 
            Xml.Append("</petitionSignature>");
 
            await this.client.IqSetAsync(Address, Xml.ToString());
        }
 
        public Task PetitionSignatureResponseAsync(string LegalId, byte[] Content,
            byte[] Signature, string PetitionId, string RequestorFullJid, bool Response)
        {
            return this.PetitionSignatureResponseAsync(this.GetTrustProvider(LegalId), LegalId, Content, Signature, PetitionId,
                RequestorFullJid, Response, null);
        }
 
        public Task PetitionSignatureResponseAsync(string LegalId, byte[] Content,
            byte[] Signature, string PetitionId, string RequestorFullJid, bool Response, string ContextXml)
        {
            return this.PetitionSignatureResponseAsync(this.GetTrustProvider(LegalId), LegalId, Content, Signature, PetitionId,
                RequestorFullJid, Response, ContextXml);
        }
 
        public Task PetitionSignatureResponseAsync(string Address, string LegalId, byte[] Content, byte[] Signature,
            string PetitionId, string RequestorFullJid, bool Response)
        {
            return this.PetitionSignatureResponseAsync(Address, LegalId, Content, Signature, PetitionId, RequestorFullJid, Response, null);
        }
 
        public async Task PetitionSignatureResponseAsync(string Address, string LegalId, byte[] Content, byte[] Signature,
            string PetitionId, string RequestorFullJid, bool Response, string ContextXml)
        {
            StringBuilder Xml = new StringBuilder();
 
            Xml.Append("<petitionSignatureResponse xmlns='");
            Xml.Append(NamespaceLegalIdentitiesCurrent);
            Xml.Append("' id='");
            Xml.Append(XML.Encode(LegalId));
            Xml.Append("' pid='");
            Xml.Append(XML.Encode(PetitionId));
            Xml.Append("' jid='");
            Xml.Append(XML.Encode(RequestorFullJid));
            Xml.Append("' response='");
            Xml.Append(CommonTypes.Encode(Response));
            Xml.Append("'><content>");
            Xml.Append(Convert.ToBase64String(Content));
            Xml.Append("</content><signature>");
            Xml.Append(Convert.ToBase64String(Signature));
            Xml.Append("</signature>");
 
            if (!string.IsNullOrEmpty(ContextXml))
                Xml.Append(ContextXml);
 
            Xml.Append("</petitionSignatureResponse>");
 
            await this.client.IqSetAsync(Address, Xml.ToString());
        }
 
        private async Task PetitionSignatureMessageHandler(object Sender, MessageEventArgs e)
        {
            string LegalId = XML.Attribute(e.Content, "id");
            string PetitionId = XML.Attribute(e.Content, "pid");
            string Purpose = XML.Attribute(e.Content, "purpose");
            string From = XML.Attribute(e.Content, "from");
            string ClientEndpoint = XML.Attribute(e.Content, "clientEp");
            byte[] Content;
            bool PeerReview = false;
 
            if (!TryGetContext(e.Content, out XmlElement Context, out string ContentStr,
                out string[] Properties, out string[] Attachments, out LegalIdentity Identity))
            {
                this.client.Error("Invalid context. Ignoring message.");
                return;
            }
 
            if (string.IsNullOrEmpty(ContentStr))
            {
                this.client.Error("No content in message to sign. Ignoring message.");
                return;
            }
 
            try
            {
                Content = Convert.FromBase64String(ContentStr);
            }
            catch (Exception)
            {
                this.client.Error("Invalid BASE64-encoded content in message to sign. Ignoring message.");
                return;
            }
 
            if (Identity is null)
            {
                string s = Encoding.UTF8.GetString(Content);
                if (s.StartsWith("<identity") && s.EndsWith("</identity>"))
                {
                    try
                    {
                        XmlDocument Doc = XML.ParseXml(s);
 
                        if (Doc.DocumentElement.LocalName == "identity")
                        {
                            LegalIdentity TempId = LegalIdentity.Parse(Doc.DocumentElement);
 
                            if (TempId.State == IdentityState.Created &&
                                string.Compare(TempId[PersonalInformation.JidTag], XmppClient.GetBareJID(From), true) == 0)
                            {
                                Identity = TempId;
                                PeerReview = true;
                            }
                        }
                    }
                    catch (Exception)
                    {
                        // Ignore
                    }
                }
 
                if (Identity is null)
                    return;
            }
 
            if (string.Compare(e.FromBareJID, this.componentAddress, true) != 0 &&
                string.Compare(e.FromBareJID, XmppClient.GetDomain(Identity.Id), true) != 0)
            {
                return;
            }
 
            EventHandlerAsync<SignaturePetitionEventArgs> h = PeerReview ? this.PetitionForPeerReviewIDReceived : this.PetitionForSignatureReceived;
 
            await this.Validate(Identity, false, async (sender2, e2) =>
            {
                if (e2.Status != IdentityStatus.Valid && e2.Status != IdentityStatus.NoProviderSignature)
                {
                    this.client.Error("Invalid legal identity received and discarded.");
 
                    Log.Warning("Invalid legal identity received and discarded.", this.client.BareJID, e.From,
                        new KeyValuePair<string, object>("Status", e2.Status));
 
                    return;
                }
 
                await h.Raise(this, new SignaturePetitionEventArgs(e, Identity, From, LegalId,
                    PetitionId, Purpose, Content, ClientEndpoint, Context, Properties, Attachments));
 
            }, null);
        }
 
        public event EventHandlerAsync<SignaturePetitionEventArgs> PetitionForSignatureReceived = null;
 
        private async Task PetitionSignatureResponseMessageHandler(object Sender, MessageEventArgs e)
        {
            string PetitionId = XML.Attribute(e.Content, "pid");
            bool Response = XML.Attribute(e.Content, "response", false);
            string ClientEndpoint = XML.Attribute(e.Content, "clientEp");
            string SignatureStr = string.Empty;
            byte[] Signature = null;
            LegalIdentity Identity = null;
            XmlElement Context = null;
 
            foreach (XmlNode N in e.Content.ChildNodes)
            {
                if (N is XmlElement E)
                {
                    switch (E.LocalName)
                    {
                        case "identity":
                            Identity = LegalIdentity.Parse(E);
                            break;
 
                        case "signature":
                            SignatureStr = E.InnerText;
                            Signature = Convert.FromBase64String(SignatureStr);
                            break;
 
                        default:
                            if (!(Context is null))
                                return;
 
                            Context = E;
                            break;
                    }
                }
            }
 
            if (!this.contentPerPid.TryGetValue(PetitionId, out KeyValuePair<byte[], bool> P))
            {
                this.client.Warning("Petition ID not recognized: " + PetitionId + ".  Response ignored.");
                return;
            }
 
            EventHandlerAsync<SignaturePetitionResponseEventArgs> h = P.Value ? this.PetitionedPeerReviewIDResponseReceived : this.PetitionedSignatureResponseReceived;
 
            if (Response)
            {
                if (Identity is null)
                {
                    this.client.Warning("Identity missing. Response ignored.");
                    return;
                }
 
                if (Signature is null)
                {
                    this.client.Warning("Signature missing. Response ignored.");
                    return;
                }
 
                bool? Result = this.ValidateSignature(Identity, P.Key, Signature);
                if (!Result.HasValue)
                {
                    this.client.Warning("Unable to validate signature. Response ignored.");
                    return;
                }
 
                if (!Result.Value)
                {
                    this.client.Warning("Invalid signature. Response ignored.");
                    return;
                }
            }
 
            if (!Response || string.Compare(e.FromBareJID, Identity?.Provider ?? string.Empty, true) == 0)
            {
                try
                {
                    this.Client.Information(h.Method.Name);
 
                    await h.Raise(this, new SignaturePetitionResponseEventArgs(e, Identity, PetitionId, Signature, Response, ClientEndpoint, Context));
                }
                finally
                {
                    this.contentPerPid.Remove(PetitionId);
                }
            }
            else
                this.client.Warning("Sender invalid. Response ignored.");
        }
 
        public event EventHandlerAsync<SignaturePetitionResponseEventArgs> PetitionedSignatureResponseReceived = null;
 
        #endregion
 
        #region Peer Review of IDs
 
        public Task PetitionPeerReviewIDAsync(string LegalId, LegalIdentity Identity, string PetitionId, string Purpose)
        {
            return this.PetitionPeerReviewIDAsync(this.GetTrustProvider(LegalId), LegalId, Identity, PetitionId, Purpose);
        }
 
        public Task PetitionPeerReviewIDAsync(string Address, string LegalId, LegalIdentity Identity, string PetitionId, string Purpose)
        {
            StringBuilder Xml = new StringBuilder();
            Identity.Serialize(Xml, true, true, true, true, true, true, true);
            byte[] Content = Encoding.UTF8.GetBytes(Xml.ToString());
 
            return this.PetitionSignatureAsync(Address, LegalId, Content, PetitionId, Purpose, true, null, null, null);
        }
 
        public event EventHandlerAsync<SignaturePetitionEventArgs> PetitionForPeerReviewIDReceived = null;
 
        public event EventHandlerAsync<SignaturePetitionResponseEventArgs> PetitionedPeerReviewIDResponseReceived = null;
 
        public async Task<LegalIdentity> AddPeerReviewIDAttachment(LegalIdentity Identity,
            LegalIdentity ReviewerLegalIdentity, byte[] PeerSignature)
        {
            StringBuilder Xml = new StringBuilder();
 
            Xml.Append("<peerReview s='");
            Xml.Append(Convert.ToBase64String(PeerSignature));
            Xml.Append("' tp='");
            Xml.Append(XML.Encode(DateTime.UtcNow));
            Xml.Append("' xmlns='");
            Xml.Append(NamespaceLegalIdentitiesCurrent);
            Xml.Append("'><reviewed>");
            Identity.Serialize(Xml, true, true, true, true, true, true, true);
            Xml.Append("</reviewed><reviewer>");
            ReviewerLegalIdentity.Serialize(Xml, true, true, true, true, true, true, true);
            Xml.Append("</reviewer></peerReview>");
 
            byte[] Data = Encoding.UTF8.GetBytes(Xml.ToString());
            string FileName = ReviewerLegalIdentity.Id + ".xml";
            string ContentType = "text/xml; charset=utf-8";
 
            return await this.UploadLegalIdAttachmentAsync(Identity.Id, FileName, Data, ContentType);
        }
 
        #endregion
 
        #region Contract petitions
 
        public Task PetitionContractAsync(string ContractId, string PetitionId, string Purpose)
        {
            return this.PetitionContractAsync(this.GetTrustProvider(ContractId), ContractId, PetitionId, Purpose, null);
        }
 
        public Task PetitionContractAsync(string Address, string ContractId, string PetitionId, string Purpose)
        {
            return this.PetitionContractAsync(Address, ContractId, PetitionId, Purpose, null);
        }
 
        public async Task PetitionContractAsync(string Address, string ContractId, string PetitionId, string Purpose, string ContextXml)
        {
            StringBuilder Xml = new StringBuilder();
            byte[] Nonce = this.RandomBytes(32);
 
            string NonceStr = Convert.ToBase64String(Nonce);
            byte[] Data = Encoding.UTF8.GetBytes(PetitionId + ":" + ContractId + ":" + Purpose + ":" + NonceStr + ":" + this.client.BareJID.ToLower());
            byte[] Signature = await this.SignAsync(Data, SignWith.LatestApprovedId);
 
            Xml.Append("<petitionContract xmlns='");
            Xml.Append(NamespaceSmartContractsCurrent);
            Xml.Append("' id='");
            Xml.Append(XML.Encode(ContractId));
            Xml.Append("' pid='");
            Xml.Append(XML.Encode(PetitionId));
            Xml.Append("' purpose='");
            Xml.Append(XML.Encode(Purpose));
            Xml.Append("' nonce='");
            Xml.Append(NonceStr);
            Xml.Append("' s='");
            Xml.Append(Convert.ToBase64String(Signature));
 
            if (string.IsNullOrEmpty(ContextXml))
                Xml.Append("'/>");
            else
            {
                Xml.Append("'>");
                Xml.Append(ContextXml);
                Xml.Append("</petitionContract>");
            }
 
            await this.client.IqSetAsync(Address, Xml.ToString());
        }
 
        public Task PetitionContractResponseAsync(string ContractId, string PetitionId, string RequestorFullJid, bool Response)
        {
            return this.PetitionContractResponseAsync(this.GetTrustProvider(ContractId), ContractId, PetitionId, RequestorFullJid, Response, null);
        }
 
        public Task PetitionContractResponseAsync(string ContractId, string PetitionId, string RequestorFullJid, bool Response, string ContextXml)
        {
            return this.PetitionContractResponseAsync(this.GetTrustProvider(ContractId), ContractId, PetitionId, RequestorFullJid, Response, ContextXml);
        }
 
        public Task PetitionContractResponseAsync(string Address, string ContractId, string PetitionId, string RequestorFullJid, bool Response)
        {
            return this.PetitionContractResponseAsync(Address, ContractId, PetitionId, RequestorFullJid, Response, null);
        }
 
        public async Task PetitionContractResponseAsync(string Address, string ContractId, string PetitionId, string RequestorFullJid,
            bool Response, string ContextXml)
        {
            StringBuilder Xml = new StringBuilder();
 
            Xml.Append("<petitionContractResponse xmlns='");
            Xml.Append(NamespaceSmartContractsCurrent);
            Xml.Append("' id='");
            Xml.Append(XML.Encode(ContractId));
            Xml.Append("' pid='");
            Xml.Append(XML.Encode(PetitionId));
            Xml.Append("' jid='");
            Xml.Append(XML.Encode(RequestorFullJid));
            Xml.Append("' response='");
            Xml.Append(CommonTypes.Encode(Response));
 
            if (string.IsNullOrEmpty(ContextXml))
                Xml.Append("'/>");
            else
            {
                Xml.Append("'>");
                Xml.Append(ContextXml);
                Xml.Append("</petitionContractResponse>");
            }
 
            await this.client.IqSetAsync(Address, Xml.ToString());
        }
 
        private async Task PetitionContractMessageHandler(object Sender, MessageEventArgs e)
        {
            string ContractId = XML.Attribute(e.Content, "id");
            string PetitionId = XML.Attribute(e.Content, "pid");
            string Purpose = XML.Attribute(e.Content, "purpose");
            string From = XML.Attribute(e.Content, "from");
            string ClientEndpoint = XML.Attribute(e.Content, "clientEp");
            int i = ContractId.IndexOf('@');
 
            if (!TryGetContext(e.Content, out XmlElement Context, out string ContentStr,
                out string[] Properties, out string[] Attachments, out LegalIdentity Identity))
            {
                this.client.Error("Invalid context. Ignoring message.");
                return;
            }
 
            if (Identity is null)
            {
                this.client.Error("No identity in message. Ignoring message.");
                return;
            }
 
            if (!this.IsFromTrustProvider(ContractId, e.FromBareJID))
            {
                this.client.Error("Contract not hosted on trust provider. Ignoring message.");
                return;
            }
 
            await this.Validate(Identity, false, async (sender2, e2) =>
            {
                if (e2.Status != IdentityStatus.Valid)
                {
                    this.client.Error("Invalid identity received and discarded.");
 
                    Log.Warning("Invalid identity received and discarded.", this.client.BareJID, e.From,
                        new KeyValuePair<string, object>("Status", e2.Status));
                    return;
                }
 
                await this.PetitionForContractReceived.Raise(this, new ContractPetitionEventArgs(e,
                    Identity, From, ContractId, PetitionId, Purpose, ClientEndpoint, Context, Properties, Attachments));
 
            }, null);
        }
 
        public event EventHandlerAsync<ContractPetitionEventArgs> PetitionForContractReceived = null;
 
        private async Task PetitionContractResponseMessageHandler(object Sender, MessageEventArgs e)
        {
            string PetitionId = XML.Attribute(e.Content, "pid");
            bool Response = XML.Attribute(e.Content, "response", false);
            string ClientEndpoint = XML.Attribute(e.Content, "clientEp");
            Contract Contract = null;
            XmlElement Context = null;
 
            foreach (XmlNode N in e.Content.ChildNodes)
            {
                if (!(N is XmlElement E))
                    continue;
 
                if (E.LocalName == "contract" && E.NamespaceURI == e.Content.NamespaceURI)
                {
                    ParsedContract Parsed = await Contract.Parse(E, this, false);
                    Contract = Parsed?.Contract;
                }
                else if (!(Context is null))
                    return;
                else
                    Context = E;
            }
 
            if (!Response || string.Compare(e.FromBareJID, Contract?.Provider ?? string.Empty, true) == 0)
                await this.PetitionedContractResponseReceived.Raise(this, new ContractPetitionResponseEventArgs(e, Contract, PetitionId, Response, ClientEndpoint, Context));
        }
 
        public event EventHandlerAsync<ContractPetitionResponseEventArgs> PetitionedContractResponseReceived = null;
 
        #endregion
 
        #region Attachments
 
        [Obsolete("To avoid security issues, use the UploadLegalIdAttachmentAsync method instead.")]
        public Task AddLegalIdAttachment(string LegalId, string GetUrl, byte[] Signature, EventHandlerAsync<LegalIdentityEventArgs> Callback, object State)
        {
            return this.AddLegalIdAttachmentPrivate(LegalId, GetUrl, Signature, Callback, State);
        }
 
        private Task AddLegalIdAttachmentPrivate(string LegalId, string GetUrl, byte[] Signature, EventHandlerAsync<LegalIdentityEventArgs> Callback, object State)
        {
            StringBuilder Xml = new StringBuilder();
 
            Xml.Append("<addAttachment xmlns='");
            Xml.Append(NamespaceLegalIdentitiesCurrent);
            Xml.Append("' id='");
            Xml.Append(XML.Encode(LegalId));
            Xml.Append("' getUrl='");
            Xml.Append(XML.Encode(GetUrl));
            Xml.Append("' s='");
            Xml.Append(Convert.ToBase64String(Signature));
            Xml.Append("'/>");
 
            return this.client.SendIqSet(this.componentAddress, Xml.ToString(), async (Sender, e) =>
            {
                LegalIdentity Identity = null;
                XmlElement E;
 
                if (e.Ok && !((E = e.FirstElement) is null) && E.LocalName == "identity")
                    Identity = LegalIdentity.Parse(E);
                else
                    e.Ok = false;
 
                await Callback.Raise(this, new LegalIdentityEventArgs(e, Identity));
            }, State);
        }
 
        [Obsolete("To avoid security issues, use the UploadLegalIdAttachmentAsync method instead.")]
        public Task<LegalIdentity> AddLegalIdAttachmentAsync(string LegalId, string GetUrl, byte[] Signature)
        {
            return this.AddLegalIdAttachmentAsyncPrivate(LegalId, GetUrl, Signature);
        }
 
        private async Task<LegalIdentity> AddLegalIdAttachmentAsyncPrivate(string LegalId, string GetUrl, byte[] Signature)
        {
            TaskCompletionSource<LegalIdentity> Result = new TaskCompletionSource<LegalIdentity>();
 
            await this.AddLegalIdAttachmentPrivate(LegalId, GetUrl, Signature, (Sender, e) =>
            {
                if (e.Ok)
                    Result.TrySetResult(e.Identity);
                else
                    Result.TrySetException(e.StanzaError ?? new Exception("Unable to add attachment."));
 
                return Task.CompletedTask;
 
            }, null);
 
            return await Result.Task;
        }
 
        public async Task<LegalIdentity> UploadLegalIdAttachmentAsync(string LegalId,
            string FileName, byte[] Data, string ContentType)
        {
            using MemoryStream ms = new MemoryStream(Data);
            return await this.UploadLegalIdAttachmentAsync(LegalId, FileName, ms, ContentType);
        }
 
        public async Task<LegalIdentity> UploadLegalIdAttachmentAsync(string LegalId,
            string FileName, Stream Data, string ContentType)
        {
            if (!this.client.TryGetExtension(out HttpFileUploadClient HttpFileUploadClient))
                throw new InvalidOperationException("No HTTP File Upload extension added to the XMPP Client.");
 
            byte[] Signature = await this.SignAsync(Data, SignWith.CurrentKeys);
 
            try
            {
                await HttpFileUploadClient.PrepareFileUpload(FileName, ContentType, Data.Length,
                    FilePurpose.InternalTransfer);
            }
            catch (Exception ex)
            {
                Log.Warning("File upload preparation failed: " + ex.Message,
                    HttpFileUploadClient.FileUploadJid,
                    new KeyValuePair<string, object>("LegalId", LegalId),
                    new KeyValuePair<string, object>("FileName", FileName),
                    new KeyValuePair<string, object>("ContentType", ContentType),
                    new KeyValuePair<string, object>("Size", Data.Length));
            }
 
            HttpFileUploadEventArgs e2 = await HttpFileUploadClient.RequestUploadSlotAsync(FileName,
                ContentType, Data.Length);
 
            if (!e2.Ok)
            {
                throw new IOException("Unable to upload attachment " + FileName + " to broker: " +
                    e2.ErrorText);
            }
 
            await e2.PUT(Data, ContentType, 10000); // Will set position to 0.
 
            return await this.AddLegalIdAttachmentAsyncPrivate(LegalId, e2.GetUrl, Signature);
        }
 
        [Obsolete("To avoid security issues, use the UploadContractAttachmentAsync method instead.")]
        public Task AddContractAttachment(string ContractId, string GetUrl, byte[] Signature, EventHandlerAsync<SmartContractEventArgs> Callback, object State)
        {
            return this.AddContractAttachmentPrivate(ContractId, GetUrl, Signature, Callback, State);
        }
 
        private Task AddContractAttachmentPrivate(string ContractId, string GetUrl, byte[] Signature, EventHandlerAsync<SmartContractEventArgs> Callback, object State)
        {
            StringBuilder Xml = new StringBuilder();
 
            Xml.Append("<addAttachment xmlns='");
            Xml.Append(NamespaceSmartContractsCurrent);
            Xml.Append("' contractId='");
            Xml.Append(XML.Encode(ContractId));
            Xml.Append("' getUrl='");
            Xml.Append(XML.Encode(GetUrl));
            Xml.Append("' s='");
            Xml.Append(Convert.ToBase64String(Signature));
            Xml.Append("'/>");
 
            return this.client.SendIqSet(this.componentAddress, Xml.ToString(), async (Sender, e) =>
            {
                Contract Contract = null;
                XmlElement E;
 
                if (e.Ok && !((E = e.FirstElement) is null) && E.LocalName == "contract")
                {
                    ParsedContract Parsed = await Contract.Parse(E, this, false);
                    if (Parsed is null)
                        e.Ok = false;
                    else
                        Contract = Parsed.Contract;
                }
                else
                    e.Ok = false;
 
                await Callback.Raise(this, new SmartContractEventArgs(e, Contract));
            }, State);
        }
 
        [Obsolete("To avoid security issues, use the UploadContractAttachmentAsync method instead.")]
        public Task<Contract> AddContractAttachmentAsync(string ContractId, string GetUrl, byte[] Signature)
        {
            return this.AddContractAttachmentAsyncPrivate(ContractId, GetUrl, Signature);
        }
 
        private async Task<Contract> AddContractAttachmentAsyncPrivate(string ContractId, string GetUrl, byte[] Signature)
        {
            TaskCompletionSource<Contract> Result = new TaskCompletionSource<Contract>();
 
            await this.AddContractAttachmentPrivate(ContractId, GetUrl, Signature, (Sender, e) =>
            {
                if (e.Ok)
                    Result.TrySetResult(e.Contract);
                else
                    Result.TrySetException(e.StanzaError ?? new Exception("Unable to add attachment."));
 
                return Task.CompletedTask;
 
            }, null);
 
            return await Result.Task;
        }
 
        public async Task<Contract> UploadContractAttachmentAsync(string ContractId,
            string FileName, byte[] Data, string ContentType)
        {
            using MemoryStream ms = new MemoryStream(Data);
            return await this.UploadContractAttachmentAsync(ContractId, FileName, ms, ContentType);
        }
 
        public async Task<Contract> UploadContractAttachmentAsync(string ContractId,
            string FileName, Stream Data, string ContentType)
        {
            if (!this.client.TryGetExtension(out HttpFileUploadClient HttpFileUploadClient))
                throw new InvalidOperationException("No HTTP File Upload extension added to the XMPP Client.");
 
            byte[] Signature = await this.SignAsync(Data, SignWith.CurrentKeys);
 
            try
            {
                await HttpFileUploadClient.PrepareFileUpload(FileName, ContentType, Data.Length,
                    FilePurpose.InternalTransfer);
            }
            catch (Exception ex)
            {
                Log.Warning("File upload preparation failed: " + ex.Message,
                    HttpFileUploadClient.FileUploadJid,
                    new KeyValuePair<string, object>("ContractId", ContractId),
                    new KeyValuePair<string, object>("FileName", FileName),
                    new KeyValuePair<string, object>("ContentType", ContentType),
                    new KeyValuePair<string, object>("Size", Data.Length));
            }
 
            HttpFileUploadEventArgs e2 = await HttpFileUploadClient.RequestUploadSlotAsync(FileName,
                ContentType, Data.Length);
 
            if (!e2.Ok)
                throw new IOException("Unable to upload attachment " + FileName + " to broker.");
 
            await e2.PUT(Data, ContentType, 10000); // Will set position to 0.
 
            return await this.AddContractAttachmentAsyncPrivate(ContractId, e2.GetUrl, Signature);
        }
 
        public Task<KeyValuePair<string, TemporaryFile>> GetAttachmentAsync(string Url, SignWith SignWith)
        {
            return this.GetAttachmentAsync(Url, SignWith, 30000);
        }
 
        public async Task<KeyValuePair<string, TemporaryFile>> GetAttachmentAsync(string Url, SignWith SignWith, int Timeout)
        {
            using HttpClient HttpClient = new HttpClient()
            {
                Timeout = TimeSpan.FromMilliseconds(Timeout)
            };
            HttpRequestMessage Request;
            HttpResponseMessage Response = null;
 
            Request = new HttpRequestMessage()
            {
                RequestUri = new Uri(Url),
                Method = HttpMethod.Get
            };
 
            try
            {
                Response = await HttpClient.SendAsync(Request);
 
                if (Response.StatusCode == System.Net.HttpStatusCode.Unauthorized &&
                    !(Response.Headers.WwwAuthenticate is null))
                {
                    foreach (AuthenticationHeaderValue Header in Response.Headers.WwwAuthenticate)
                    {
                        if (Header.Scheme == "NeuroFoundation.Sign")
                        {
                            KeyValuePair<string, string>[] Parameters = CommonTypes.ParseFieldValues(Header.Parameter);
                            string Realm = null;
                            string NonceStr = null;
                            byte[] Nonce = null;
 
                            foreach (KeyValuePair<string, string> P in Parameters)
                            {
                                switch (P.Key)
                                {
                                    case "realm":
                                        Realm = P.Value;
                                        break;
 
                                    case "n":
                                        NonceStr = P.Value;
                                        Nonce = Convert.FromBase64String(NonceStr);
                                        break;
                                }
                            }
 
                            if (!string.IsNullOrEmpty(Realm) && !string.IsNullOrEmpty(NonceStr))
                            {
                                byte[] Signature = await this.SignAsync(Nonce, SignWith);
                                StringBuilder sb = new StringBuilder();
 
                                sb.Append("jid=\"");
                                sb.Append(this.client.FullJID);
                                sb.Append("\", realm=\"");
                                sb.Append(Realm);
                                sb.Append("\", n=\"");
                                sb.Append(NonceStr);
                                sb.Append("\", s=\"");
                                sb.Append(Convert.ToBase64String(Signature));
                                sb.Append('"');
 
                                Request.Dispose();
                                Request = new HttpRequestMessage()
                                {
                                    RequestUri = new Uri(Url),
                                    Method = HttpMethod.Get
                                };
 
                                Request.Headers.Authorization = new AuthenticationHeaderValue(Header.Scheme, sb.ToString());
 
                                Response.Dispose();
                                Response = null;
                                Response = await HttpClient.SendAsync(Request);
                            }
                            break;
                        }
                    }
                }
 
                if (!Response.IsSuccessStatusCode)
                {
                    ContentResponse Temp = await Content.Getters.WebGetter.ProcessResponse(Response, Request.RequestUri);
                    Temp.AssertOk();
                }
 
                string ContentType = Response.Content.Headers.ContentType.ToString();
                TemporaryFile File = new TemporaryFile();
                try
                {
                    await Response.Content.CopyToAsync(File);
                }
                catch (Exception ex)
                {
                    File.Dispose();
                    File = null;
 
                    ExceptionDispatchInfo.Capture(ex).Throw();
                }
 
                return new KeyValuePair<string, TemporaryFile>(ContentType, File);
            }
            finally
            {
                Request?.Dispose();
                Response?.Dispose();
            }
        }
 
        public Task RemoveLegalIdAttachment(string AttachmentId, EventHandlerAsync<LegalIdentityEventArgs> Callback, object State)
        {
            StringBuilder Xml = new StringBuilder();
 
            Xml.Append("<removeAttachment xmlns='");
            Xml.Append(NamespaceLegalIdentitiesCurrent);
            Xml.Append("' attachmentId='");
            Xml.Append(XML.Encode(AttachmentId));
            Xml.Append("'/>");
 
            return this.client.SendIqSet(this.componentAddress, Xml.ToString(), async (Sender, e) =>
            {
                LegalIdentity Identity = null;
                XmlElement E;
 
                if (e.Ok && !((E = e.FirstElement) is null) && E.LocalName == "identity")
                    Identity = LegalIdentity.Parse(E);
                else
                    e.Ok = false;
 
                await Callback.Raise(this, new LegalIdentityEventArgs(e, Identity));
            }, State);
        }
 
        public async Task<LegalIdentity> RemoveLegalIdAttachmentAsync(string AttachmentId)
        {
            TaskCompletionSource<LegalIdentity> Result = new TaskCompletionSource<LegalIdentity>();
 
            await this.RemoveLegalIdAttachment(AttachmentId, (Sender, e) =>
            {
                if (e.Ok)
                    Result.TrySetResult(e.Identity);
                else
                    Result.TrySetException(e.StanzaError ?? new Exception("Unable to remove attachment."));
 
                return Task.CompletedTask;
 
            }, null);
 
            return await Result.Task;
        }
 
        public Task RemoveContractAttachment(string AttachmentId, EventHandlerAsync<SmartContractEventArgs> Callback, object State)
        {
            StringBuilder Xml = new StringBuilder();
 
            Xml.Append("<removeAttachment xmlns='");
            Xml.Append(NamespaceSmartContractsCurrent);
            Xml.Append("' attachmentId='");
            Xml.Append(XML.Encode(AttachmentId));
            Xml.Append("'/>");
 
            return this.client.SendIqSet(this.componentAddress, Xml.ToString(), async (Sender, e) =>
            {
                Contract Contract = null;
                XmlElement E;
 
                if (e.Ok && !((E = e.FirstElement) is null) && E.LocalName == "contract")
                {
                    ParsedContract Parsed = await Contract.Parse(E, this, false);
                    if (Parsed is null)
                        e.Ok = false;
                    else
                        Contract = Parsed.Contract;
                }
                else
                    e.Ok = false;
 
                await Callback.Raise(this, new SmartContractEventArgs(e, Contract));
            }, State);
        }
 
        public async Task<Contract> RemoveContractAttachmentAsync(string AttachmentId)
        {
            TaskCompletionSource<Contract> Result = new TaskCompletionSource<Contract>();
 
            await this.RemoveContractAttachment(AttachmentId, (Sender, e) =>
            {
                if (e.Ok)
                    Result.TrySetResult(e.Contract);
                else
                    Result.TrySetException(e.StanzaError ?? new Exception("Unable to remove attachment."));
 
                return Task.CompletedTask;
 
            }, null);
 
            return await Result.Task;
        }
 
        #endregion
 
        #region Encryption
 
        public (byte[], byte[]) Encrypt(byte[] Message, byte[] Nonce, byte[] RecipientPublicKey, string RecipientPublicKeyName)
        {
            return this.Encrypt(Message, Nonce, RecipientPublicKey, RecipientPublicKeyName, string.Empty);
        }
 
        public (byte[], byte[]) Encrypt(byte[] Message, byte[] Nonce, byte[] RecipientPublicKey, string RecipientPublicKeyName,
            string RecipientPublicKeyNamespace)
        {
            IE2eEndpoint LocalEndpoint = this.keys.FindLocalEndpoint(RecipientPublicKeyName, RecipientPublicKeyNamespace)
                ?? throw new NotSupportedException("Unable to find matching local key.");
 
            IE2eEndpoint RemoteEndpoint = LocalEndpoint.CreatePublic(RecipientPublicKey);
            Aes256 SymmetricCipher = new Aes256();
            byte[] LocalPublicKey = LocalEndpoint.PublicKey;
            byte[] Secret = LocalEndpoint.GetSharedSecretForEncryption(RemoteEndpoint,
                SymmetricCipher, out byte[] KeyCipherText);
            int KeyCipherTextLen = KeyCipherText is null ? 0 : KeyCipherText.Length;
            byte[] Digest = Hashes.ComputeSHA256Hash(Secret);
            byte[] NonceDigest = Hashes.ComputeSHA256Hash(Nonce);
            byte[] Key = new byte[16];
            byte[] IV = new byte[16];
            byte[] Encrypted;
            byte[] ToEncrypt;
            int i, j, c;
 
            for (i = 0; i < 32; i++)
                Digest[i] ^= NonceDigest[i];
 
            i = Message.Length;
            c = 0;
 
            do
            {
                i >>= 7;
                c++;
            }
            while (i > 0);
 
            i = c + Message.Length;
            c = (i + 15) & ~0xf;
 
            ToEncrypt = new byte[c];
            i = Message.Length;
            j = 0;
 
            do
            {
                ToEncrypt[j] = (byte)(i & 127);
                i >>= 7;
                if (i > 0)
                    ToEncrypt[j] |= 0x80;
 
                j++;
            }
            while (i > 0);
 
            Buffer.BlockCopy(Message, 0, ToEncrypt, j, Message.Length);
            j += Message.Length;
 
            if (j < c)
                this.rnd.GetBytes(ToEncrypt, j, c - j);
 
            Buffer.BlockCopy(Digest, 0, Key, 0, 16);
            Buffer.BlockCopy(Digest, 16, IV, 0, 16);
 
            lock (this.aes)
            {
                using ICryptoTransform Aes = this.aes.CreateEncryptor(Key, IV);
                Encrypted = Aes.TransformFinalBlock(ToEncrypt, 0, c);
            }
 
            if (LocalEndpoint.SharedSecretUseCipherText)
            {
                c = 0;
                i = KeyCipherTextLen;
 
                do
                {
                    i >>= 7;
                    c++;
                }
                while (i > 0);
 
                c += KeyCipherTextLen + Encrypted.Length;
 
                byte[] Encrypted2 = new byte[c];
 
                i = KeyCipherTextLen;
                j = 0;
 
                do
                {
                    Encrypted2[j] = (byte)(i & 127);
                    i >>= 7;
                    if (i > 0)
                        Encrypted2[j] |= 0x80;
 
                    j++;
                }
                while (i > 0);
 
                Buffer.BlockCopy(KeyCipherText, 0, Encrypted2, j, KeyCipherTextLen);
                j += KeyCipherTextLen;
 
                Buffer.BlockCopy(Encrypted, 0, Encrypted2, j, Encrypted.Length);
 
                Encrypted = Encrypted2;
            }
            else if (KeyCipherTextLen > 0)
                throw new InvalidOperationException("Shared secret ciphertexts not supported.");
 
            return (Encrypted, LocalPublicKey);
        }
 
        public byte[] DecryptReceivedMessage(byte[] EncryptedMessage, byte[] SenderPublicKey,
            byte[] Nonce)
        {
            IE2eEndpoint[] LocalEndpoints = this.keys?.FindCompatibleLocalEndpoints(SenderPublicKey) ?? Array.Empty<IE2eEndpoint>();
            ChunkedList<Exception> Exceptions = null;
 
            foreach (IE2eEndpoint LocalEndpoint in LocalEndpoints)
            {
                try
                {
                    IE2eEndpoint RemoteEndpoint = LocalEndpoint.CreatePublic(SenderPublicKey);
                    byte[] KeyCipherText;
                    int i, j, c;
                    byte b;
 
                    i = 0;
                    c = 0;
 
                    if (LocalEndpoint.SharedSecretUseCipherText)
                    {
                        do
                        {
                            b = EncryptedMessage[i++];
                            c <<= 7;
                            c |= b & 0x7f;
                        }
                        while ((b & 0x80) != 0);
 
                        if (c < 0 || c > EncryptedMessage.Length - i)
                            throw new InvalidOperationException("Unable to decrypt message.");
 
                        KeyCipherText = new byte[c];
                        Buffer.BlockCopy(EncryptedMessage, 0, KeyCipherText, 0, c);
                    }
                    else
                        KeyCipherText = null;
 
                    byte[] Secret = LocalEndpoint.GetSharedSecretForDecryption(RemoteEndpoint, KeyCipherText);
                    byte[] Digest = Hashes.ComputeSHA256Hash(Secret);
                    byte[] NonceDigest = Hashes.ComputeSHA256Hash(Nonce);
                    byte[] Key = new byte[16];
                    byte[] IV = new byte[16];
                    byte[] Decrypted;
 
                    for (j = 0; j < 32; j++)
                        Digest[j] ^= NonceDigest[j];
 
                    Buffer.BlockCopy(Digest, 0, Key, 0, 16);
                    Buffer.BlockCopy(Digest, 16, IV, 0, 16);
 
                    lock (this.aes)
                    {
                        using ICryptoTransform Aes = this.aes.CreateDecryptor(Key, IV);
                        Decrypted = Aes.TransformFinalBlock(EncryptedMessage, i, EncryptedMessage.Length - i);
                    }
 
                    i = 0;
                    c = 0;
                    do
                    {
                        b = Decrypted[i++];
                        c <<= 7;
                        c |= b & 0x7f;
                    }
                    while ((b & 0x80) != 0);
 
                    if (c < 0 || c > Decrypted.Length - i)
                    {
                        Exceptions ??= new ChunkedList<Exception>();
                        Exceptions.Add(new InvalidOperationException("Unable to decrypt message."));
                        continue;
                    }
 
                    byte[] Message = new byte[c];
 
                    Buffer.BlockCopy(Decrypted, i, Message, 0, c);
 
                    return Message;
                }
                catch (Exception ex)
                {
                    Exceptions ??= new ChunkedList<Exception>();
                    Exceptions.Add(ex);
                }
            }
 
            if (Exceptions is null)
                throw new NotSupportedException("No compatible local key found.");
            else if (Exceptions.Count == 1)
                throw Exceptions.FirstItem;
            else
                throw new AggregateException(Exceptions.ToArray());
        }
 
        public byte[] DecryptSentMessage(byte[] EncryptedMessage, byte[] SenderPublicKey,
            byte[] Nonce)
        {
            IE2eEndpoint LocalEndpoint = this.keys.FindLocalEndpoint(SenderPublicKey);
            IE2eEndpoint RemoteEndpoint = LocalEndpoint.CreatePublic(SenderPublicKey);
            byte[] KeyCipherText;
            int i, j, c;
            byte b;
 
            i = 0;
            c = 0;
 
            if (LocalEndpoint.SharedSecretUseCipherText)
            {
                do
                {
                    b = EncryptedMessage[i++];
                    c <<= 7;
                    c |= b & 0x7f;
                }
                while ((b & 0x80) != 0);
 
                if (c < 0 || c > EncryptedMessage.Length - i)
                    throw new InvalidOperationException("Unable to decrypt message.");
 
                KeyCipherText = new byte[c];
                Buffer.BlockCopy(EncryptedMessage, 0, KeyCipherText, 0, c);
            }
 
            IE2eSymmetricCipher SymmetricCipher = new Aes256();
            byte[] Secret = LocalEndpoint.GetSharedSecretForEncryption(RemoteEndpoint, SymmetricCipher, out _);
            byte[] Digest = Hashes.ComputeSHA256Hash(Secret);
            byte[] NonceDigest = Hashes.ComputeSHA256Hash(Nonce);
            byte[] Key = new byte[16];
            byte[] IV = new byte[16];
            byte[] Decrypted;
 
            for (j = 0; j < 32; j++)
                Digest[j] ^= NonceDigest[j];
 
            Buffer.BlockCopy(Digest, 0, Key, 0, 16);
            Buffer.BlockCopy(Digest, 16, IV, 0, 16);
 
            lock (this.aes)
            {
                using ICryptoTransform Aes = this.aes.CreateDecryptor(Key, IV);
                Decrypted = Aes.TransformFinalBlock(EncryptedMessage, i, EncryptedMessage.Length - i);
            }
 
            i = 0;
            c = 0;
            do
            {
                b = Decrypted[i++];
                c <<= 7;
                c |= b & 0x7f;
            }
            while ((b & 0x80) != 0);
 
            if (c < 0 || c > Decrypted.Length - i)
                throw new InvalidOperationException("Unable to decrypt message.");
 
            byte[] Message = new byte[c];
 
            Buffer.BlockCopy(Decrypted, i, Message, 0, c);
 
            return Message;
        }
 
        #endregion
 
        #region Explicit authorization of access to Legal IDs
 
        public Task AuthorizeAccessToId(string LegalId, string RemoteId, bool Authorized, EventHandlerAsync<IqResultEventArgs> Callback, object State)
        {
            return this.AuthorizeAccessToId(this.GetTrustProvider(LegalId), LegalId, RemoteId, Authorized, Callback, State);
        }
 
        public Task AuthorizeAccessToId(string Address, string LegalId, string RemoteId, bool Authorized, EventHandlerAsync<IqResultEventArgs> Callback, object State)
        {
            StringBuilder Xml = new StringBuilder();
 
            Xml.Append("<authorizeAccess xmlns='");
            Xml.Append(NamespaceLegalIdentitiesCurrent);
            Xml.Append("' id='");
            Xml.Append(XML.Encode(LegalId));
            Xml.Append("' remoteId='");
            Xml.Append(XML.Encode(RemoteId));
            Xml.Append("' auth='");
            Xml.Append(CommonTypes.Encode(Authorized));
            Xml.Append("'/>");
 
            return this.client.SendIqSet(Address, Xml.ToString(), Callback, State);
        }
 
        public Task AuthorizeAccessToIdAsync(string LegalId, string RemoteId, bool Authorized)
        {
            return this.AuthorizeAccessToIdAsync(this.GetTrustProvider(LegalId), LegalId, RemoteId, Authorized);
        }
 
        public async Task AuthorizeAccessToIdAsync(string Address, string LegalId, string RemoteId, bool Authorized)
        {
            TaskCompletionSource<bool> Result = new TaskCompletionSource<bool>();
 
            await this.AuthorizeAccessToId(Address, LegalId, RemoteId, Authorized, (Sender, e) =>
            {
                if (e.Ok)
                    Result.TrySetResult(true);
                else
                    Result.TrySetException(e.StanzaError ?? new Exception("Unable to authorize access to legal identity."));
 
                return Task.CompletedTask;
 
            }, null);
 
            await Result.Task;
        }
 
        #endregion
 
        #region Explicit authorization of access to Contracts
 
        public Task AuthorizeAccessToContract(string ContractId, string RemoteId, bool Authorized, EventHandlerAsync<IqResultEventArgs> Callback, object State)
        {
            return this.AuthorizeAccessToContract(this.GetTrustProvider(ContractId), ContractId, RemoteId, Authorized, Callback, State);
        }
 
        public Task AuthorizeAccessToContract(string Address, string ContractId, string RemoteId, bool Authorized, EventHandlerAsync<IqResultEventArgs> Callback, object State)
        {
            StringBuilder Xml = new StringBuilder();
 
            Xml.Append("<authorizeAccess xmlns='");
            Xml.Append(NamespaceSmartContractsCurrent);
            Xml.Append("' id='");
            Xml.Append(XML.Encode(ContractId));
            Xml.Append("' remoteId='");
            Xml.Append(XML.Encode(RemoteId));
            Xml.Append("' auth='");
            Xml.Append(CommonTypes.Encode(Authorized));
            Xml.Append("'/>");
 
            return this.client.SendIqSet(Address, Xml.ToString(), Callback, State);
        }
 
        public Task AuthorizeAccessToContractAsync(string ContractId, string RemoteId, bool Authorized)
        {
            return this.AuthorizeAccessToContractAsync(this.GetTrustProvider(ContractId), ContractId, RemoteId, Authorized);
        }
 
        public async Task AuthorizeAccessToContractAsync(string Address, string ContractId, string RemoteId, bool Authorized)
        {
            TaskCompletionSource<bool> Result = new TaskCompletionSource<bool>();
 
            await this.AuthorizeAccessToContract(Address, ContractId, RemoteId, Authorized, (Sender, e) =>
            {
                if (e.Ok)
                    Result.TrySetResult(true);
                else
                    Result.TrySetException(e.StanzaError ?? new Exception("Unable to authorize access to legal identity."));
 
                return Task.CompletedTask;
 
            }, null);
 
            await Result.Task;
        }
 
        #endregion
 
        #region Peer-review service providers
 
        public Task GetPeerReviewIdServiceProviders(EventHandlerAsync<ServiceProvidersEventArgs<ServiceProviderWithLegalId>> Callback, object State)
        {
            return this.GetPeerReviewIdServiceProviders(this.componentAddress, Callback, State);
        }
 
        public Task GetPeerReviewIdServiceProviders(string ComponentAddress,
            EventHandlerAsync<ServiceProvidersEventArgs<ServiceProviderWithLegalId>> Callback, object State)
        {
            StringBuilder Xml = new StringBuilder();
 
            Xml.Append("<reviewIdProviders xmlns='");
            Xml.Append(NamespaceLegalIdentitiesCurrent);
            Xml.Append("'/>");
 
            return this.client.SendIqGet(ComponentAddress, Xml.ToString(), async (Sender, e) =>
            {
                List<ServiceProviderWithLegalId> Providers = null;
                XmlElement E;
 
                if (e.Ok &&
                    !((E = e.FirstElement) is null) &&
                    E.LocalName == "providers")
                {
                    Providers = new List<ServiceProviderWithLegalId>();
 
                    foreach (XmlNode N in E.ChildNodes)
                    {
                        if (N is XmlElement E2 && E2.LocalName == "provider")
                        {
                            ServiceProviderWithLegalId Provider = this.ParseServiceProviderWithLegalId(E2);
 
                            if (!(Provider is null))
                                Providers.Add(Provider);
                        }
                    }
                }
                else
                    e.Ok = false;
 
                await Callback.Raise(this, new ServiceProvidersEventArgs<ServiceProviderWithLegalId>(e, Providers?.ToArray()));
 
            }, State);
        }
 
        private ServiceProviderWithLegalId ParseServiceProviderWithLegalId(XmlElement Xml)
        {
            string Id = null;
            string Type = null;
            string Name = null;
            string IconUrl = null;
            string LegalId = null;
            int IconWidth = -1;
            int IconHeight = -1;
            bool External = false;
 
            foreach (XmlAttribute Attr in Xml.Attributes)
            {
                switch (Attr.Name)
                {
                    case "id":
                        Id = Attr.Value;
                        break;
 
                    case "type":
                        Type = Attr.Value;
                        break;
 
                    case "name":
                        Name = Attr.Value;
                        break;
 
                    case "iconUrl":
                        IconUrl = Attr.Value;
                        break;
 
                    case "iconWidth":
                        if (!int.TryParse(Attr.Value, out IconWidth))
                            return null;
                        break;
 
                    case "iconHeight":
                        if (!int.TryParse(Attr.Value, out IconHeight))
                            return null;
                        break;
 
                    case "legalId":
                        LegalId = Attr.Value;
                        break;
 
                    case "external":
                        if (!CommonTypes.TryParse(Attr.Value, out External))
                            return null;
                        break;
                }
            }
 
            if (Id is null || Type is null || Name is null)
                return null;
 
            if (string.IsNullOrEmpty(IconUrl))
                return new ServiceProviderWithLegalId(Id, Type, Name, LegalId, External);
            else
            {
                if (IconWidth < 0 || IconHeight < 0)
                    return null;
 
                return new ServiceProviderWithLegalId(Id, Type, Name, LegalId, External, IconUrl, IconWidth, IconHeight);
            }
        }
 
        public Task<ServiceProviderWithLegalId[]> GetPeerReviewIdServiceProvidersAsync()
        {
            return this.GetPeerReviewIdServiceProvidersAsync(this.componentAddress);
        }
 
        public async Task<ServiceProviderWithLegalId[]> GetPeerReviewIdServiceProvidersAsync(string ComponentAddress)
        {
            TaskCompletionSource<ServiceProviderWithLegalId[]> Providers = new TaskCompletionSource<ServiceProviderWithLegalId[]>();
 
            await this.GetPeerReviewIdServiceProviders(ComponentAddress, (Sender, e) =>
            {
                if (e.Ok)
                    Providers.TrySetResult(e.ServiceProviders);
                else
                    Providers.TrySetException(e.StanzaError ?? new Exception("Unable to get service providers."));
 
                return Task.CompletedTask;
 
            }, null);
 
            return await Providers.Task;
        }
 
        #endregion
 
        #region Select Peer-review service
 
        public Task SelectPeerReviewService(string Provider, string ServiceId, EventHandlerAsync<IqResultEventArgs> Callback, object State)
        {
            return this.SelectPeerReviewService(this.componentAddress, Provider, ServiceId, Callback, State);
        }
 
        public Task SelectPeerReviewService(string ComponentAddress, string Provider, string ServiceId,
            EventHandlerAsync<IqResultEventArgs> Callback, object State)
        {
            StringBuilder Xml = new StringBuilder();
 
            Xml.Append("<selectReviewService xmlns='");
            Xml.Append(NamespaceLegalIdentitiesCurrent);
            Xml.Append("' provider='");
            Xml.Append(XML.Encode(Provider));
            Xml.Append("' serviceId='");
            Xml.Append(XML.Encode(ServiceId));
            Xml.Append("'/>");
 
            return this.client.SendIqSet(ComponentAddress, Xml.ToString(), Callback, State);
        }
 
        public Task SelectPeerReviewServiceAsync(string Provider, string ServiceId)
        {
            return this.SelectPeerReviewServiceAsync(this.componentAddress, Provider, ServiceId);
        }
 
        public async Task SelectPeerReviewServiceAsync(string ComponentAddress, string Provider, string ServiceId)
        {
            TaskCompletionSource<bool> Providers = new TaskCompletionSource<bool>();
 
            await this.SelectPeerReviewService(ComponentAddress, Provider, ServiceId, (Sender, e) =>
            {
                if (e.Ok)
                    Providers.TrySetResult(true);
                else
                    Providers.TrySetException(e.StanzaError ?? new Exception("Unable to select peer review service."));
 
                return Task.CompletedTask;
 
            }, null);
 
            await Providers.Task;
        }
 
        #endregion
 
        #region Petition Client URL event
 
        private Task PetitionClientUrlEventHandler(object Sender, MessageEventArgs e)
        {
            string PetitionId = XML.Attribute(e.Content, "pid");
            string Url = XML.Attribute(e.Content, "url");
 
            return this.PetitionClientUrlReceived.Raise(this, new PetitionClientUrlEventArgs(e, PetitionId, Url));
        }
 
        public event EventHandlerAsync<PetitionClientUrlEventArgs> PetitionClientUrlReceived;
 
        #endregion
    }
}