Create a DID (Decentralized Identifier) record for an agent from its public key.

Required:
    entity_type: the kind of agent/entity, e.g. "AI Agent" or "Toolbox".
    pk:          the agent's raw Ed25519 public key as a hex string
                 (64 hex chars, as produced by keygen.generate_raw_keys()).
                 Validated: must decode to 32 bytes, else ValueError.
                 Stored in the DID document as publicKeyMultibase.
    pktype:      the public key algorithm label, e.g. "ed25519"; recorded
                 as the verification method's type.

Optional metadata (recorded as top-level fields on the returned record):
    description:  human-readable description, e.g. "AIassistant".
    protocol:     protocol the agent speaks, e.g. "MCP".
    transparency: transparency-log reference, e.g. "6GPDL".

Returns the DID record dict: containing its "id" (the DID).

Parameters:
    did: the DID to resolve, e.g. "did:ietf:...". If omitted/empty, returns
         a list of every DID document currently registered.

Returns the matching DID document (dict) when a DID is given, or a list of
all DID documents when none is given. Raises ValueError if the DID is unknown.

Parameters:
    subjectID: the DID of the subject the credential is about
               (as minted by get_did).
    content:   what the credential attests/grants, e.g. "callTools".
    keyType:   recorded as the proof's cryptosuite value, e.g. "Ed25519".
    signType:  signature scheme, e.g. "asy";
               (reserved; only asymmetric (Ed25519) signing is performed,
               so this value is not currently used.)
    usage:     intended use of the credential, e.g. "authorization".

The credential is signed by the server's issuer key over a canonical
serialization (sorted-key compact JSON with proof="").

Returns the stored Verifiable Credential.

Resolves the issuer's public key from its DID document in the DID registry
(so ANY issuer registered via get_did can be verified, not just this server),
rebuilds the exact bytes that were signed (the VC with 'proof' reset to ""),
checks the Ed25519 signature in proof.proofValue, then the validity window.

This confirms the credential is AUTHENTIC for its claimed issuer; it does NOT
assess whether that issuer is trusted or authorized (a separate concern).

Returns {"valid": bool, "issuer": ..., "subjectId": ..., "reason": ...}.
A credential is valid only if the signature checks out AND the current time
is within its validFrom/validUntil window.

Parameters:
    vc_id: the VC id to resolve. If omitted/empty, returns a list of every
           issued credential.

Returns the matching VC (dict) when a vc_id is given, or a list of all VCs
when none is given. Raises ValueError if the vc_id is unknown.

Parameters:
    subject: the subject DID (credentialSubject.id) whose credentials to list.

Returns a list of VCs whose credentialSubject.id matches `subject`
(an empty list if the subject holds none).