@agenticprimitives/key-custody 0.1.0-alpha.2 → 1.0.0-alpha.10

package/dist/kms/provision-gcp.d.ts

@@ -0,0 +1,56 @@
+import { type Hex } from './secp256k1-core.js';
+export interface ProvisionPlan {
+    project: string;
+    location: string;
+    keyRing: string;
+    /** Opaque signing-identity labels → one HSM secp256k1 key each. NO vertical names here. */
+    identities: string[];
+    /** Service-account email to grant `roles/cloudkms.signer`, scoped per key. */
+    runtimeServiceAccount: string;
+    /** secp256k1 in GCP requires HSM; SOFTWARE is rejected by GCP for this curve. Default HSM. */
+    protectionLevel?: 'HSM' | 'SOFTWARE';
+}
+export type StepKind = 'create-keyring' | 'create-key' | 'grant-iam';
+export interface GcloudStep {
+    id: string;
+    kind: StepKind;
+    description: string;
+    /** argv for `gcloud` (no shell string — avoids injection). */
+    argv: string[];
+    /** Present for create-key / grant-iam steps. */
+    identity?: string;
+    /** The key resource this step targets (create-key / grant-iam). */
+    cryptoKeyName?: string;
+}
+export interface StepExecutor {
+    /** Run a planned step. Return `{ alreadyExists: true }` to mark an idempotent skip
+     *  (the resource already existed); throw for any real failure. */
+    run(step: GcloudStep): Promise<{
+        stdout: string;
+        alreadyExists?: boolean;
+    }>;
+    /** Fetch a key version's SPKI PEM (for address verification) — via gcloud or REST. */
+    getPublicKeyPem(cryptoKeyVersionName: string): Promise<string>;
+}
+export interface ProvisionResult {
+    /** identity → full `…/cryptoKeyVersions/1` resource name. */
+    keyMap: Record<string, string>;
+    /** identity → derived EVM address (verify against expectations BEFORE wiring env). */
+    addresses: Record<string, Hex>;
+    granted: Array<{
+        key: string;
+        member: string;
+        role: 'roles/cloudkms.signer';
+    }>;
+    /** Step ids that were skipped because the resource already existed (idempotent re-run). */
+    alreadyExisted: string[];
+}
+/** First key version GCP creates for an asymmetric-signing key. */
+export declare function keyVersionName(plan: ProvisionPlan, identity: string): string;
+/** Emit the ordered gcloud steps for a provisioning plan. Pure — no execution. */
+export declare function planGcpProvision(plan: ProvisionPlan): GcloudStep[];
+/** Execute a provisioning plan through an injected executor. Idempotent: steps whose
+ *  resource already exists are skipped and reported. After create+grant, fetches each
+ *  key's public key and derives its EVM address so the operator can verify before wiring. */
+export declare function executeGcpProvision(plan: ProvisionPlan, exec: StepExecutor): Promise<ProvisionResult>;
+//# sourceMappingURL=provision-gcp.d.ts.map

package/dist/kms/provision-gcp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provision-gcp.d.ts","sourceRoot":"","sources":["../../src/kms/provision-gcp.ts"],"names":[],"mappings":"AAaA,OAAO,EAAsB,KAAK,GAAG,EAAE,MAAM,qBAAqB,CAAC;AAEnE,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,2FAA2F;IAC3F,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,8EAA8E;IAC9E,qBAAqB,EAAE,MAAM,CAAC;IAC9B,8FAA8F;IAC9F,eAAe,CAAC,EAAE,KAAK,GAAG,UAAU,CAAC;CACtC;AAED,MAAM,MAAM,QAAQ,GAAG,gBAAgB,GAAG,YAAY,GAAG,WAAW,CAAC;AAErE,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,QAAQ,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,8DAA8D;IAC9D,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,gDAAgD;IAChD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mEAAmE;IACnE,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,YAAY;IAC3B;sEACkE;IAClE,GAAG,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAC5E,sFAAsF;IACtF,eAAe,CAAC,oBAAoB,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAChE;AAED,MAAM,WAAW,eAAe;IAC9B,6DAA6D;IAC7D,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,sFAAsF;IACtF,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC/B,OAAO,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,uBAAuB,CAAA;KAAE,CAAC,CAAC;IAC/E,2FAA2F;IAC3F,cAAc,EAAE,MAAM,EAAE,CAAC;CAC1B;AAMD,mEAAmE;AACnE,wBAAgB,cAAc,CAAC,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE5E;AAED,kFAAkF;AAClF,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,aAAa,GAAG,UAAU,EAAE,CA2DlE;AAED;;6FAE6F;AAC7F,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,eAAe,CAAC,CAuB3G"}

package/dist/kms/provision-gcp.js

@@ -0,0 +1,107 @@
+// GCP Cloud KMS provisioning helper (spec 276 KCS-D3). Ports smart-agent's
+// G-PR-6 operator runbook into a reusable, peer-dependency-free primitive.
+//
+// PURE PLANNING + INJECTED EXECUTION: `planGcpProvision` emits the gcloud steps;
+// `executeGcpProvision` runs them through a caller-supplied `StepExecutor` (a
+// gcloud runner, a REST runner, or a test fake). The package never shells out
+// itself — that keeps it Workers-safe and unit-testable. The CLI (`bin/ap-provision-gcp.mjs`)
+// supplies a Node child_process executor.
+//
+// No vertical identity names are baked in — `identities` are opaque labels the
+// caller supplies (ADR-0021). Per-key (not per-keyring) IAM enforces master-key
+// separation (key-custody CLAUDE.md invariant).
+import { addressFromSpkiPem } from './secp256k1-core.js';
+function keyResourceName(plan, identity) {
+    return `projects/${plan.project}/locations/${plan.location}/keyRings/${plan.keyRing}/cryptoKeys/${identity}`;
+}
+/** First key version GCP creates for an asymmetric-signing key. */
+export function keyVersionName(plan, identity) {
+    return `${keyResourceName(plan, identity)}/cryptoKeyVersions/1`;
+}
+/** Emit the ordered gcloud steps for a provisioning plan. Pure — no execution. */
+export function planGcpProvision(plan) {
+    if (!plan.project || !plan.location || !plan.keyRing) {
+        throw new Error('planGcpProvision: project, location, and keyRing are required');
+    }
+    if (!plan.runtimeServiceAccount.includes('@')) {
+        throw new Error('planGcpProvision: runtimeServiceAccount must be a service-account email');
+    }
+    if (plan.identities.length === 0)
+        throw new Error('planGcpProvision: at least one identity is required');
+    const dupes = plan.identities.filter((id, i) => plan.identities.indexOf(id) !== i);
+    if (dupes.length)
+        throw new Error(`planGcpProvision: duplicate identities: ${[...new Set(dupes)].join(', ')}`);
+    const protection = (plan.protectionLevel ?? 'HSM').toLowerCase();
+    const steps = [
+        {
+            id: 'keyring',
+            kind: 'create-keyring',
+            description: `Create key ring ${plan.keyRing} in ${plan.location}`,
+            argv: ['kms', 'keyrings', 'create', plan.keyRing, '--location', plan.location, '--project', plan.project],
+        },
+    ];
+    for (const identity of plan.identities) {
+        if (!/^[a-zA-Z0-9_-]+$/.test(identity)) {
+            throw new Error(`planGcpProvision: identity "${identity}" must match [a-zA-Z0-9_-]+ (a GCP key id)`);
+        }
+        const cryptoKeyName = keyResourceName(plan, identity);
+        steps.push({
+            id: `key:${identity}`,
+            kind: 'create-key',
+            identity,
+            cryptoKeyName,
+            description: `Create HSM secp256k1 signing key ${identity}`,
+            argv: [
+                'kms', 'keys', 'create', identity,
+                '--keyring', plan.keyRing,
+                '--location', plan.location,
+                '--project', plan.project,
+                '--purpose', 'asymmetric-signing',
+                '--default-algorithm', 'ec-sign-secp256k1-sha256',
+                '--protection-level', protection,
+            ],
+        });
+        steps.push({
+            id: `iam:${identity}`,
+            kind: 'grant-iam',
+            identity,
+            cryptoKeyName,
+            description: `Grant roles/cloudkms.signer on ${identity} to ${plan.runtimeServiceAccount}`,
+            argv: [
+                'kms', 'keys', 'add-iam-policy-binding', identity,
+                '--keyring', plan.keyRing,
+                '--location', plan.location,
+                '--project', plan.project,
+                '--member', `serviceAccount:${plan.runtimeServiceAccount}`,
+                '--role', 'roles/cloudkms.signer',
+            ],
+        });
+    }
+    return steps;
+}
+/** Execute a provisioning plan through an injected executor. Idempotent: steps whose
+ *  resource already exists are skipped and reported. After create+grant, fetches each
+ *  key's public key and derives its EVM address so the operator can verify before wiring. */
+export async function executeGcpProvision(plan, exec) {
+    const steps = planGcpProvision(plan);
+    const alreadyExisted = [];
+    const granted = [];
+    for (const step of steps) {
+        const r = await exec.run(step);
+        if (r.alreadyExists)
+            alreadyExisted.push(step.id);
+        if (step.kind === 'grant-iam' && step.cryptoKeyName) {
+            granted.push({ key: step.cryptoKeyName, member: `serviceAccount:${plan.runtimeServiceAccount}`, role: 'roles/cloudkms.signer' });
+        }
+    }
+    const keyMap = {};
+    const addresses = {};
+    for (const identity of plan.identities) {
+        const versionName = keyVersionName(plan, identity);
+        keyMap[identity] = versionName;
+        const pem = await exec.getPublicKeyPem(versionName);
+        addresses[identity] = addressFromSpkiPem(pem);
+    }
+    return { keyMap, addresses, granted, alreadyExisted };
+}
+//# sourceMappingURL=provision-gcp.js.map

package/dist/kms/provision-gcp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provision-gcp.js","sourceRoot":"","sources":["../../src/kms/provision-gcp.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,2EAA2E;AAC3E,EAAE;AACF,iFAAiF;AACjF,8EAA8E;AAC9E,8EAA8E;AAC9E,8FAA8F;AAC9F,0CAA0C;AAC1C,EAAE;AACF,+EAA+E;AAC/E,gFAAgF;AAChF,gDAAgD;AAEhD,OAAO,EAAE,kBAAkB,EAAY,MAAM,qBAAqB,CAAC;AA8CnE,SAAS,eAAe,CAAC,IAAmB,EAAE,QAAgB;IAC5D,OAAO,YAAY,IAAI,CAAC,OAAO,cAAc,IAAI,CAAC,QAAQ,aAAa,IAAI,CAAC,OAAO,eAAe,QAAQ,EAAE,CAAC;AAC/G,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,cAAc,CAAC,IAAmB,EAAE,QAAgB;IAClE,OAAO,GAAG,eAAe,CAAC,IAAI,EAAE,QAAQ,CAAC,sBAAsB,CAAC;AAClE,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,gBAAgB,CAAC,IAAmB;IAClD,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;IACnF,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,yEAAyE,CAAC,CAAC;IAC7F,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzG,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;IACnF,IAAI,KAAK,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC/G,MAAM,UAAU,GAAG,CAAC,IAAI,CAAC,eAAe,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;IAEjE,MAAM,KAAK,GAAiB;QAC1B;YACE,EAAE,EAAE,SAAS;YACb,IAAI,EAAE,gBAAgB;YACtB,WAAW,EAAE,mBAAmB,IAAI,CAAC,OAAO,OAAO,IAAI,CAAC,QAAQ,EAAE;YAClE,IAAI,EAAE,CAAC,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,CAAC,OAAO,EAAE,YAAY,EAAE,IAAI,CAAC,QAAQ,EAAE,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC;SAC1G;KACF,CAAC;IAEF,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACvC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CAAC,+BAA+B,QAAQ,4CAA4C,CAAC,CAAC;QACvG,CAAC;QACD,MAAM,aAAa,GAAG,eAAe,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACtD,KAAK,CAAC,IAAI,CAAC;YACT,EAAE,EAAE,OAAO,QAAQ,EAAE;YACrB,IAAI,EAAE,YAAY;YAClB,QAAQ;YACR,aAAa;YACb,WAAW,EAAE,oCAAoC,QAAQ,EAAE;YAC3D,IAAI,EAAE;gBACJ,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ;gBACjC,WAAW,EAAE,IAAI,CAAC,OAAO;gBACzB,YAAY,EAAE,IAAI,CAAC,QAAQ;gBAC3B,WAAW,EAAE,IAAI,CAAC,OAAO;gBACzB,WAAW,EAAE,oBAAoB;gBACjC,qBAAqB,EAAE,0BAA0B;gBACjD,oBAAoB,EAAE,UAAU;aACjC;SACF,CAAC,CAAC;QACH,KAAK,CAAC,IAAI,CAAC;YACT,EAAE,EAAE,OAAO,QAAQ,EAAE;YACrB,IAAI,EAAE,WAAW;YACjB,QAAQ;YACR,aAAa;YACb,WAAW,EAAE,kCAAkC,QAAQ,OAAO,IAAI,CAAC,qBAAqB,EAAE;YAC1F,IAAI,EAAE;gBACJ,KAAK,EAAE,MAAM,EAAE,wBAAwB,EAAE,QAAQ;gBACjD,WAAW,EAAE,IAAI,CAAC,OAAO;gBACzB,YAAY,EAAE,IAAI,CAAC,QAAQ;gBAC3B,WAAW,EAAE,IAAI,CAAC,OAAO;gBACzB,UAAU,EAAE,kBAAkB,IAAI,CAAC,qBAAqB,EAAE;gBAC1D,QAAQ,EAAE,uBAAuB;aAClC;SACF,CAAC,CAAC;IACL,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;6FAE6F;AAC7F,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,IAAmB,EAAE,IAAkB;IAC/E,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,cAAc,GAAa,EAAE,CAAC;IACpC,MAAM,OAAO,GAA+B,EAAE,CAAC;IAE/C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,CAAC,CAAC,aAAa;YAAE,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAClD,IAAI,IAAI,CAAC,IAAI,KAAK,WAAW,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACpD,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,aAAa,EAAE,MAAM,EAAE,kBAAkB,IAAI,CAAC,qBAAqB,EAAE,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC,CAAC;QACnI,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,MAAM,SAAS,GAAwB,EAAE,CAAC;IAC1C,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACvC,MAAM,WAAW,GAAG,cAAc,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACnD,MAAM,CAAC,QAAQ,CAAC,GAAG,WAAW,CAAC;QAC/B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC;QACpD,SAAS,CAAC,QAAQ,CAAC,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;IAChD,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC;AACxD,CAAC"}

package/dist/kms/secp256k1-core.d.ts

@@ -0,0 +1,46 @@
+/** A 0x-prefixed lowercase hex string (structurally compatible with viem's `Hex`/`Address`). */
+export type Hex = `0x${string}`;
+/** Bytes → `0x`-prefixed lowercase hex. Byte-for-byte compatible with viem's `bytesToHex`. */
+export declare function bytesToHex(bytes: Uint8Array): Hex;
+export declare function base64UrlEncode(bytes: Uint8Array): string;
+export declare function base64Decode(s: string): Uint8Array;
+export declare function base64Encode(bytes: Uint8Array): string;
+export declare function pemToDer(pem: string): Uint8Array;
+export declare function bigIntTo32Bytes(n: bigint): Uint8Array;
+/** Parse a DER-encoded ECDSA signature → `(r, s)`. Range-validates `0 < r,s < n`
+ *  (audit F-7): a degenerate KMS response (r/s = 0 or ≥ n) is never valid — fail closed. */
+export declare function parseDerEcdsa(der: Uint8Array): {
+    r: bigint;
+    s: bigint;
+};
+/** spec-276 alias for {@link parseDerEcdsa}. */
+export declare const parseDerEcdsaSignature: typeof parseDerEcdsa;
+/** Normalize `s` to its low-s form (EIP-2): malleability-canonical signatures only. */
+export declare function normalizeLowS(s: bigint): bigint;
+/** spec-276 alias for {@link normalizeLowS}. */
+export declare const toLowS: typeof normalizeLowS;
+/** Extract the trailing 65-byte uncompressed secp256k1 point (`0x04||X||Y`) from an SPKI DER blob. */
+export declare function parseSpkiUncompressedSecp256k1PubKey(spkiDer: Uint8Array): Uint8Array;
+/** `0x04||X||Y` (65 bytes) → EVM address (`keccak256(X||Y)[-20:]`). */
+export declare function publicKeyToAddress(pubKey65: Uint8Array): Hex;
+/** Convenience: SPKI PEM (the Cloud KMS `publicKey` response) → EVM address. */
+export declare function addressFromSpkiPem(pem: string): Hex;
+/** Cloud KMS does not return the recovery bit; recover it by trying v∈{27,28}
+ *  against the known uncompressed public key. Throws (redacted error) if neither matches. */
+export declare function findRecoveryByte(r: bigint, s: bigint, digest: Uint8Array, knownPubKey65: Uint8Array): number;
+/** spec-276 ordering of {@link findRecoveryByte}: `(digest, r, s, knownPubKey65)`. */
+export declare function recoverV(digest: Uint8Array, r: bigint, s: bigint, knownPubKey65: Uint8Array): 27 | 28;
+/** Assemble an Ethereum 65-byte `(r,s,v)` signature as 0x hex. */
+export declare function assembleEthSignature(r: bigint, s: bigint, v: number): Hex;
+/** Turn a raw KMS asymmetric-sign (DER output) into an Ethereum `(r,s,v)` signature.
+ *  Transport is INJECTED (`asymmetricSign`) so this stays peer-dependency-free and
+ *  testable: the caller supplies however it reaches Cloud KMS. Returns 0x-hex 65 bytes. */
+export declare function signDigestWithKms(opts: {
+    /** The 32-byte keccak digest to sign. */
+    digest: Uint8Array;
+    /** The signing key's SPKI PEM (the Cloud KMS `publicKey` response `.pem`). Cached by the caller. */
+    publicKeyPem: string;
+    /** Calls Cloud KMS `:asymmetricSign` for the digest; returns the DER-encoded signature bytes. */
+    asymmetricSign: (digest: Uint8Array) => Promise<Uint8Array>;
+}): Promise<Hex>;
+//# sourceMappingURL=secp256k1-core.d.ts.map

package/dist/kms/secp256k1-core.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secp256k1-core.d.ts","sourceRoot":"","sources":["../../src/kms/secp256k1-core.ts"],"names":[],"mappings":"AAwBA,gGAAgG;AAChG,MAAM,MAAM,GAAG,GAAG,KAAK,MAAM,EAAE,CAAC;AAIhC,8FAA8F;AAC9F,wBAAgB,UAAU,CAAC,KAAK,EAAE,UAAU,GAAG,GAAG,CAIjD;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAIzD;AAED,wBAAgB,YAAY,CAAC,CAAC,EAAE,MAAM,GAAG,UAAU,CAKlD;AAED,wBAAgB,YAAY,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAItD;AAED,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAMhD;AAUD,wBAAgB,eAAe,CAAC,CAAC,EAAE,MAAM,GAAG,UAAU,CAQrD;AAID;4FAC4F;AAC5F,wBAAgB,aAAa,CAAC,GAAG,EAAE,UAAU,GAAG;IAAE,CAAC,EAAE,MAAM,CAAC;IAAC,CAAC,EAAE,MAAM,CAAA;CAAE,CA2BvE;AAED,gDAAgD;AAChD,eAAO,MAAM,sBAAsB,sBAAgB,CAAC;AAEpD,uFAAuF;AACvF,wBAAgB,aAAa,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAE/C;AAED,gDAAgD;AAChD,eAAO,MAAM,MAAM,sBAAgB,CAAC;AAIpC,sGAAsG;AACtG,wBAAgB,oCAAoC,CAAC,OAAO,EAAE,UAAU,GAAG,UAAU,CAapF;AAED,uEAAuE;AACvE,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,UAAU,GAAG,GAAG,CAI5D;AAED,gFAAgF;AAChF,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAEnD;AAUD;6FAC6F;AAC7F,wBAAgB,gBAAgB,CAC9B,CAAC,EAAE,MAAM,EACT,CAAC,EAAE,MAAM,EACT,MAAM,EAAE,UAAU,EAClB,aAAa,EAAE,UAAU,GACxB,MAAM,CA+BR;AAED,sFAAsF;AACtF,wBAAgB,QAAQ,CAAC,MAAM,EAAE,UAAU,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,UAAU,GAAG,EAAE,GAAG,EAAE,CAErG;AAED,kEAAkE;AAClE,wBAAgB,oBAAoB,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,GAAG,CAMzE;AAID;;2FAE2F;AAC3F,wBAAsB,iBAAiB,CAAC,IAAI,EAAE;IAC5C,yCAAyC;IACzC,MAAM,EAAE,UAAU,CAAC;IACnB,oGAAoG;IACpG,YAAY,EAAE,MAAM,CAAC;IACrB,iGAAiG;IACjG,cAAc,EAAE,CAAC,MAAM,EAAE,UAAU,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;CAC7D,GAAG,OAAO,CAAC,GAAG,CAAC,CAUf"}

package/dist/kms/secp256k1-core.js

@@ -0,0 +1,209 @@
+// secp256k1 KMS signing core — the CONSUMER-SAFE, peer-dependency-free surface (spec 276 KCS-D1).
+//
+// This module contains the raw cryptography for turning a Cloud-KMS-style
+// secp256k1 asymmetric signature into an Ethereum-compatible 65-byte
+// `(r,s,v)` signature, plus SPKI public-key → address derivation. It is the
+// extract that lets an external consumer import the primitive instead of
+// inlining a copy (the demo-validator `kms-signer.ts` problem).
+//
+// HARD CONSTRAINT (enforced by test/unit/kms-core-import-graph.test.ts):
+//   This file and everything it imports MUST depend ONLY on `@noble/curves`,
+//   `@noble/hashes`, and Web/Node built-ins. NO `viem`, NO `@agenticprimitives/*`.
+//   That is the entire point — a standalone external app can import
+//   `@agenticprimitives/key-custody/kms-core` with no viem / audit / connect-auth peer install.
+//
+// The audited, viem-typed `GcpKmsSigner` (providers/gcp.ts) is a thin wrapper
+// over this core — one implementation, two surfaces (no second KMS path).
+import { secp256k1 } from '@noble/curves/secp256k1.js';
+import { keccak_256 } from '@noble/hashes/sha3.js';
+// ── secp256k1 constants ──────────────────────────────────────────────
+const SECP256K1_N = secp256k1.Point.Fn.ORDER;
+const SECP256K1_HALF_N = SECP256K1_N >> 1n;
+// ── hex / base64 / PEM helpers (viem-free) ───────────────────────────
+/** Bytes → `0x`-prefixed lowercase hex. Byte-for-byte compatible with viem's `bytesToHex`. */
+export function bytesToHex(bytes) {
+    let h = '';
+    for (let i = 0; i < bytes.length; i++)
+        h += bytes[i].toString(16).padStart(2, '0');
+    return `0x${h}`;
+}
+export function base64UrlEncode(bytes) {
+    let str = '';
+    for (let i = 0; i < bytes.length; i++)
+        str += String.fromCharCode(bytes[i]);
+    return btoa(str).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+export function base64Decode(s) {
+    const binary = atob(s);
+    const out = new Uint8Array(binary.length);
+    for (let i = 0; i < binary.length; i++)
+        out[i] = binary.charCodeAt(i);
+    return out;
+}
+export function base64Encode(bytes) {
+    let str = '';
+    for (let i = 0; i < bytes.length; i++)
+        str += String.fromCharCode(bytes[i]);
+    return btoa(str);
+}
+export function pemToDer(pem) {
+    const lines = pem
+        .split('\n')
+        .filter((l) => !l.startsWith('-----') && l.trim().length > 0)
+        .join('');
+    return base64Decode(lines);
+}
+// ── bigint <-> bytes ─────────────────────────────────────────────────
+function bytesToBigInt(bytes) {
+    let n = 0n;
+    for (const b of bytes)
+        n = (n << 8n) | BigInt(b);
+    return n;
+}
+export function bigIntTo32Bytes(n) {
+    const out = new Uint8Array(32);
+    let v = n;
+    for (let i = 31; i >= 0; i--) {
+        out[i] = Number(v & 0xffn);
+        v >>= 8n;
+    }
+    return out;
+}
+// ── DER ECDSA signature parsing ──────────────────────────────────────
+/** Parse a DER-encoded ECDSA signature → `(r, s)`. Range-validates `0 < r,s < n`
+ *  (audit F-7): a degenerate KMS response (r/s = 0 or ≥ n) is never valid — fail closed. */
+export function parseDerEcdsa(der) {
+    const at = (idx) => {
+        const b = der[idx];
+        if (b === undefined)
+            throw new Error(`DER: unexpected end of buffer at offset ${idx}`);
+        return b;
+    };
+    let i = 0;
+    if (at(i++) !== 0x30)
+        throw new Error('DER: expected SEQUENCE tag (0x30)');
+    // Skip length. Handle short and long form.
+    const lenByte = at(i++);
+    if (lenByte & 0x80) {
+        const lenBytes = lenByte & 0x7f;
+        i += lenBytes;
+    }
+    if (at(i++) !== 0x02)
+        throw new Error('DER: expected INTEGER tag for r');
+    const rLen = at(i++);
+    const rBytes = der.slice(i, i + rLen);
+    i += rLen;
+    if (at(i++) !== 0x02)
+        throw new Error('DER: expected INTEGER tag for s');
+    const sLen = at(i++);
+    const sBytes = der.slice(i, i + sLen);
+    const r = bytesToBigInt(rBytes);
+    const s = bytesToBigInt(sBytes);
+    if (r <= 0n || r >= SECP256K1_N || s <= 0n || s >= SECP256K1_N) {
+        throw new Error('DER: r/s out of range (require 0 < r,s < n)');
+    }
+    return { r, s };
+}
+/** spec-276 alias for {@link parseDerEcdsa}. */
+export const parseDerEcdsaSignature = parseDerEcdsa;
+/** Normalize `s` to its low-s form (EIP-2): malleability-canonical signatures only. */
+export function normalizeLowS(s) {
+    return s > SECP256K1_HALF_N ? SECP256K1_N - s : s;
+}
+/** spec-276 alias for {@link normalizeLowS}. */
+export const toLowS = normalizeLowS;
+// ── SPKI public-key parsing + address derivation ─────────────────────
+/** Extract the trailing 65-byte uncompressed secp256k1 point (`0x04||X||Y`) from an SPKI DER blob. */
+export function parseSpkiUncompressedSecp256k1PubKey(spkiDer) {
+    if (spkiDer.length < 66) {
+        throw new Error(`SPKI too short to contain uncompressed secp256k1 pubkey: ${spkiDer.length} bytes`);
+    }
+    const tail = spkiDer.slice(spkiDer.length - 65);
+    const marker = tail[0];
+    if (marker !== 0x04) {
+        throw new Error(`SPKI does not end with uncompressed point marker (0x04). Wrong key algorithm? ` +
+            `Found 0x${(marker ?? 0).toString(16).padStart(2, '0')} at position ${spkiDer.length - 65}.`);
+    }
+    return tail;
+}
+/** `0x04||X||Y` (65 bytes) → EVM address (`keccak256(X||Y)[-20:]`). */
+export function publicKeyToAddress(pubKey65) {
+    const raw = pubKey65.slice(1);
+    const hash = keccak_256(raw);
+    return bytesToHex(hash.slice(12));
+}
+/** Convenience: SPKI PEM (the Cloud KMS `publicKey` response) → EVM address. */
+export function addressFromSpkiPem(pem) {
+    return publicKeyToAddress(parseSpkiUncompressedSecp256k1PubKey(pemToDer(pem)));
+}
+// ── recovery-byte search ─────────────────────────────────────────────
+function bytesEqual(a, b) {
+    if (a.length !== b.length)
+        return false;
+    for (let i = 0; i < a.length; i++)
+        if (a[i] !== b[i])
+            return false;
+    return true;
+}
+/** Cloud KMS does not return the recovery bit; recover it by trying v∈{27,28}
+ *  against the known uncompressed public key. Throws (redacted error) if neither matches. */
+export function findRecoveryByte(r, s, digest, knownPubKey65) {
+    const rBytes = bigIntTo32Bytes(r);
+    const sBytes = bigIntTo32Bytes(s);
+    const compact = new Uint8Array(64);
+    compact.set(rBytes, 0);
+    compact.set(sBytes, 32);
+    const attempts = [];
+    for (let recovery = 0; recovery < 2; recovery++) {
+        try {
+            const sig = secp256k1.Signature.fromBytes(compact).addRecoveryBit(recovery);
+            const recovered = sig.recoverPublicKey(digest).toBytes(false);
+            attempts.push(`v=${recovery + 27} recovered=${bytesToHex(recovered)}`);
+            if (bytesEqual(recovered, knownPubKey65))
+                return recovery + 27;
+        }
+        catch (e) {
+            attempts.push(`v=${recovery + 27} threw ${e instanceof Error ? e.message : String(e)}`);
+        }
+    }
+    // Redact operational fingerprints (digest/pubkey are chain-correlatable / long-lived
+    // identity) to keccak-prefix-8 — still actionable, no raw values leaked (PKG-KEY-CUSTODY-004).
+    const tag = (label, b) => `${label}=${bytesToHex(keccak_256(b)).slice(0, 8)}`;
+    // eslint-disable-next-line no-console
+    console.error('[gcp-kms findRecoveryByte] mismatch:', {
+        digestTag: tag('k', digest),
+        rTag: tag('k', rBytes),
+        sTag: tag('k', sBytes),
+        knownPubKeyTag: tag('k', knownPubKey65),
+        attempts,
+    });
+    throw new Error('Recovery byte search failed: neither v=27 nor v=28 recovers the known public key. ' + attempts.join(' | '));
+}
+/** spec-276 ordering of {@link findRecoveryByte}: `(digest, r, s, knownPubKey65)`. */
+export function recoverV(digest, r, s, knownPubKey65) {
+    return findRecoveryByte(r, s, digest, knownPubKey65);
+}
+/** Assemble an Ethereum 65-byte `(r,s,v)` signature as 0x hex. */
+export function assembleEthSignature(r, s, v) {
+    const sig65 = new Uint8Array(65);
+    sig65.set(bigIntTo32Bytes(r), 0);
+    sig65.set(bigIntTo32Bytes(s), 32);
+    sig65[64] = v;
+    return bytesToHex(sig65);
+}
+// ── high-level: digest → eth signature, transport injected ───────────
+/** Turn a raw KMS asymmetric-sign (DER output) into an Ethereum `(r,s,v)` signature.
+ *  Transport is INJECTED (`asymmetricSign`) so this stays peer-dependency-free and
+ *  testable: the caller supplies however it reaches Cloud KMS. Returns 0x-hex 65 bytes. */
+export async function signDigestWithKms(opts) {
+    if (opts.digest.length !== 32) {
+        throw new Error(`signDigestWithKms expects a 32-byte digest; got ${opts.digest.length}.`);
+    }
+    const pub65 = parseSpkiUncompressedSecp256k1PubKey(pemToDer(opts.publicKeyPem));
+    const der = await opts.asymmetricSign(opts.digest);
+    const { r, s: rawS } = parseDerEcdsa(der);
+    const s = normalizeLowS(rawS);
+    const v = recoverV(opts.digest, r, s, pub65);
+    return assembleEthSignature(r, s, v);
+}
+//# sourceMappingURL=secp256k1-core.js.map

package/dist/kms/secp256k1-core.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secp256k1-core.js","sourceRoot":"","sources":["../../src/kms/secp256k1-core.ts"],"names":[],"mappings":"AAAA,kGAAkG;AAClG,EAAE;AACF,0EAA0E;AAC1E,qEAAqE;AACrE,4EAA4E;AAC5E,yEAAyE;AACzE,gEAAgE;AAChE,EAAE;AACF,yEAAyE;AACzE,6EAA6E;AAC7E,mFAAmF;AACnF,oEAAoE;AACpE,gGAAgG;AAChG,EAAE;AACF,8EAA8E;AAC9E,0EAA0E;AAE1E,OAAO,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAEnD,wEAAwE;AACxE,MAAM,WAAW,GAAG,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC;AAC7C,MAAM,gBAAgB,GAAG,WAAW,IAAI,EAAE,CAAC;AAK3C,wEAAwE;AAExE,8FAA8F;AAC9F,MAAM,UAAU,UAAU,CAAC,KAAiB;IAC1C,IAAI,CAAC,GAAG,EAAE,CAAC;IACX,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,CAAC,IAAI,KAAK,CAAC,CAAC,CAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACpF,OAAO,KAAK,CAAC,EAAE,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAiB;IAC/C,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;IAC7E,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC9E,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,CAAS;IACpC,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACvB,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC1C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,GAAG,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IACtE,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,KAAiB;IAC5C,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;IAC7E,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,GAAW;IAClC,MAAM,KAAK,GAAG,GAAG;SACd,KAAK,CAAC,IAAI,CAAC;SACX,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;SAC5D,IAAI,CAAC,EAAE,CAAC,CAAC;IACZ,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC;AAC7B,CAAC;AAED,wEAAwE;AAExE,SAAS,aAAa,CAAC,KAAiB;IACtC,IAAI,CAAC,GAAG,EAAE,CAAC;IACX,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IACjD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,CAAS;IACvC,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IAC/B,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,KAAK,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7B,GAAG,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC;QAC3B,CAAC,KAAK,EAAE,CAAC;IACX,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,wEAAwE;AAExE;4FAC4F;AAC5F,MAAM,UAAU,aAAa,CAAC,GAAe;IAC3C,MAAM,EAAE,GAAG,CAAC,GAAW,EAAU,EAAE;QACjC,MAAM,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;QACnB,IAAI,CAAC,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,GAAG,EAAE,CAAC,CAAC;QACvF,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;IACF,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IAC3E,2CAA2C;IAC3C,MAAM,OAAO,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;IACxB,IAAI,OAAO,GAAG,IAAI,EAAE,CAAC;QACnB,MAAM,QAAQ,GAAG,OAAO,GAAG,IAAI,CAAC;QAChC,CAAC,IAAI,QAAQ,CAAC;IAChB,CAAC;IACD,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACzE,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;IACrB,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;IACtC,CAAC,IAAI,IAAI,CAAC;IACV,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACzE,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;IACrB,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;IACtC,MAAM,CAAC,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IAChC,MAAM,CAAC,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IAChC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,WAAW,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,WAAW,EAAE,CAAC;QAC/D,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;AAClB,CAAC;AAED,gDAAgD;AAChD,MAAM,CAAC,MAAM,sBAAsB,GAAG,aAAa,CAAC;AAEpD,uFAAuF;AACvF,MAAM,UAAU,aAAa,CAAC,CAAS;IACrC,OAAO,CAAC,GAAG,gBAAgB,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACpD,CAAC;AAED,gDAAgD;AAChD,MAAM,CAAC,MAAM,MAAM,GAAG,aAAa,CAAC;AAEpC,wEAAwE;AAExE,sGAAsG;AACtG,MAAM,UAAU,oCAAoC,CAAC,OAAmB;IACtE,IAAI,OAAO,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,4DAA4D,OAAO,CAAC,MAAM,QAAQ,CAAC,CAAC;IACtG,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACvB,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CACb,gFAAgF;YAC9E,WAAW,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,gBAAgB,OAAO,CAAC,MAAM,GAAG,EAAE,GAAG,CAC/F,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,kBAAkB,CAAC,QAAoB;IACrD,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC9B,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAC7B,OAAO,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;AACpC,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,kBAAkB,CAAC,GAAW;IAC5C,OAAO,kBAAkB,CAAC,oCAAoC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AACjF,CAAC;AAED,wEAAwE;AAExE,SAAS,UAAU,CAAC,CAAa,EAAE,CAAa;IAC9C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;IACnE,OAAO,IAAI,CAAC;AACd,CAAC;AAED;6FAC6F;AAC7F,MAAM,UAAU,gBAAgB,CAC9B,CAAS,EACT,CAAS,EACT,MAAkB,EAClB,aAAyB;IAEzB,MAAM,MAAM,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC;IAClC,MAAM,OAAO,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IACnC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACvB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACxB,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,IAAI,QAAQ,GAAG,CAAC,EAAE,QAAQ,GAAG,CAAC,EAAE,QAAQ,EAAE,EAAE,CAAC;QAChD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,SAAS,CAAC,SAAS,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;YAC5E,MAAM,SAAS,GAAG,GAAG,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAC9D,QAAQ,CAAC,IAAI,CAAC,KAAK,QAAQ,GAAG,EAAE,cAAc,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YACvE,IAAI,UAAU,CAAC,SAAS,EAAE,aAAa,CAAC;gBAAE,OAAO,QAAQ,GAAG,EAAE,CAAC;QACjE,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,QAAQ,CAAC,IAAI,CAAC,KAAK,QAAQ,GAAG,EAAE,UAAU,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC1F,CAAC;IACH,CAAC;IACD,qFAAqF;IACrF,+FAA+F;IAC/F,MAAM,GAAG,GAAG,CAAC,KAAa,EAAE,CAAa,EAAU,EAAE,CAAC,GAAG,KAAK,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;IAC1G,sCAAsC;IACtC,OAAO,CAAC,KAAK,CAAC,sCAAsC,EAAE;QACpD,SAAS,EAAE,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC;QAC3B,IAAI,EAAE,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC;QACtB,IAAI,EAAE,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC;QACtB,cAAc,EAAE,GAAG,CAAC,GAAG,EAAE,aAAa,CAAC;QACvC,QAAQ;KACT,CAAC,CAAC;IACH,MAAM,IAAI,KAAK,CACb,oFAAoF,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAC5G,CAAC;AACJ,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,QAAQ,CAAC,MAAkB,EAAE,CAAS,EAAE,CAAS,EAAE,aAAyB;IAC1F,OAAO,gBAAgB,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,aAAa,CAAY,CAAC;AAClE,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,oBAAoB,CAAC,CAAS,EAAE,CAAS,EAAE,CAAS;IAClE,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IACjC,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACjC,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAClC,KAAK,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;IACd,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC;AAC3B,CAAC;AAED,wEAAwE;AAExE;;2FAE2F;AAC3F,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAOvC;IACC,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,mDAAmD,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;IAC5F,CAAC;IACD,MAAM,KAAK,GAAG,oCAAoC,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;IAChF,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACnD,MAAM,EAAE,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAC1C,MAAM,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;IAC7C,OAAO,oBAAoB,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;AACvC,CAAC"}

package/dist/providers/aws.d.ts

@@ -1,12 +1,15 @@
 import type { A2AKeyProvider, KmsAccountBackend } from '../types';
 import type { Address } from '@agenticprimitives/types';
+export declare const AWS_KMS_NOT_IMPLEMENTED: string;
 export declare class AwsKmsProvider implements A2AKeyProvider {
     readonly keyVersion = "aws-kms:not-implemented";
+    constructor();
     generateSessionDataKey(): Promise<never>;
     decryptSessionDataKey(): Promise<never>;
 }
 export declare class AwsKmsSigner implements KmsAccountBackend {
     readonly provider: "aws-kms";
+    constructor();
     signA2AAction(): Promise<never>;
     getSignerAddress(): Promise<Address>;
 }

package/dist/providers/aws.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"aws.d.ts","sourceRoot":"","sources":["../../src/providers/aws.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAClE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AAIxD,qBAAa,cAAe,YAAW,cAAc;IACnD,QAAQ,CAAC,UAAU,6BAA6B;IAC1C,sBAAsB,IAAI,OAAO,CAAC,KAAK,CAAC;IACxC,qBAAqB,IAAI,OAAO,CAAC,KAAK,CAAC;CAC9C;AAED,qBAAa,YAAa,YAAW,iBAAiB;IACpD,QAAQ,CAAC,QAAQ,EAAG,SAAS,CAAU;IACjC,aAAa,IAAI,OAAO,CAAC,KAAK,CAAC;IAC/B,gBAAgB,IAAI,OAAO,CAAC,OAAO,CAAC;CAC3C"}
+{"version":3,"file":"aws.d.ts","sourceRoot":"","sources":["../../src/providers/aws.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAClE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AAExD,eAAO,MAAM,uBAAuB,QAEyE,CAAC;AAE9G,qBAAa,cAAe,YAAW,cAAc;IACnD,QAAQ,CAAC,UAAU,6BAA6B;;IAG1C,sBAAsB,IAAI,OAAO,CAAC,KAAK,CAAC;IACxC,qBAAqB,IAAI,OAAO,CAAC,KAAK,CAAC;CAC9C;AAED,qBAAa,YAAa,YAAW,iBAAiB;IACpD,QAAQ,CAAC,QAAQ,EAAG,SAAS,CAAU;;IAGjC,aAAa,IAAI,OAAO,CAAC,KAAK,CAAC;IAC/B,gBAAgB,IAAI,OAAO,CAAC,OAAO,CAAC;CAC3C"}

package/dist/providers/aws.js

@@ -1,14 +1,24 @@
-// AwsKmsProvider / AwsKmsSigner — production AWS KMS backends.
-// Stubs in v0 demo; full implementation lands in v0.1.
-const NOT_IMPLEMENTED = 'AwsKmsProvider / AwsKmsSigner not yet implemented in v0; use LocalAesProvider for the demo.';
+// AwsKmsProvider / AwsKmsSigner — AWS KMS backend (NOT YET IMPLEMENTED).
+//
+// AUDIT N-2: these must FAIL FAST. Previously the classes constructed cleanly and threw only on the
+// first signing/encryption call — a deferred-failure footgun: an operator who selects `aws-kms` for a
+// real deployment boots fine and explodes on the first hot-path op. Per the package's "fail-closed at
+// boot" invariant (CLAUDE.md security invariants), construction now throws. Only `gcp-kms` is
+// production-ready (spec 214 §5 is single-chain GCP-KMS); `aws-kms` is reserved, not wired.
+export const AWS_KMS_NOT_IMPLEMENTED = '[key-custody] aws-kms backend is not implemented. Use backend "gcp-kms" for real deploys ' +
+    '(the only production-ready KMS, spec 214 §5) or "local-aes" for dev. `aws-kms` is reserved but not wired.';
 export class AwsKmsProvider {
     keyVersion = 'aws-kms:not-implemented';
-    async generateSessionDataKey() { throw new Error(NOT_IMPLEMENTED); }
-    async decryptSessionDataKey() { throw new Error(NOT_IMPLEMENTED); }
+    // Fail fast at construction (N-2) rather than on the first generate/decrypt call.
+    constructor() { throw new Error(AWS_KMS_NOT_IMPLEMENTED); }
+    async generateSessionDataKey() { throw new Error(AWS_KMS_NOT_IMPLEMENTED); }
+    async decryptSessionDataKey() { throw new Error(AWS_KMS_NOT_IMPLEMENTED); }
 }
 export class AwsKmsSigner {
     provider = 'aws-kms';
-    async signA2AAction() { throw new Error(NOT_IMPLEMENTED); }
-    async getSignerAddress() { throw new Error(NOT_IMPLEMENTED); }
+    // Fail fast at construction (N-2) rather than on the first sign/getSignerAddress call.
+    constructor() { throw new Error(AWS_KMS_NOT_IMPLEMENTED); }
+    async signA2AAction() { throw new Error(AWS_KMS_NOT_IMPLEMENTED); }
+    async getSignerAddress() { throw new Error(AWS_KMS_NOT_IMPLEMENTED); }
 }
 //# sourceMappingURL=aws.js.map

package/dist/providers/aws.js.map

@@ -1 +1 @@
-{"version":3,"file":"aws.js","sourceRoot":"","sources":["../../src/providers/aws.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAC/D,uDAAuD;AAKvD,MAAM,eAAe,GAAG,6FAA6F,CAAC;AAEtH,MAAM,OAAO,cAAc;IAChB,UAAU,GAAG,yBAAyB,CAAC;IAChD,KAAK,CAAC,sBAAsB,KAAqB,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;IACpF,KAAK,CAAC,qBAAqB,KAAqB,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;CACpF;AAED,MAAM,OAAO,YAAY;IACd,QAAQ,GAAG,SAAkB,CAAC;IACvC,KAAK,CAAC,aAAa,KAAqB,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;IAC3E,KAAK,CAAC,gBAAgB,KAAuB,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;CACjF"}
+{"version":3,"file":"aws.js","sourceRoot":"","sources":["../../src/providers/aws.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,EAAE;AACF,oGAAoG;AACpG,sGAAsG;AACtG,sGAAsG;AACtG,8FAA8F;AAC9F,4FAA4F;AAK5F,MAAM,CAAC,MAAM,uBAAuB,GAClC,2FAA2F;IAC3F,2GAA2G,CAAC;AAE9G,MAAM,OAAO,cAAc;IAChB,UAAU,GAAG,yBAAyB,CAAC;IAChD,kFAAkF;IAClF,gBAAgB,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC;IAC3D,KAAK,CAAC,sBAAsB,KAAqB,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC;IAC5F,KAAK,CAAC,qBAAqB,KAAqB,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC;CAC5F;AAED,MAAM,OAAO,YAAY;IACd,QAAQ,GAAG,SAAkB,CAAC;IACvC,uFAAuF;IACvF,gBAAgB,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC;IAC3D,KAAK,CAAC,aAAa,KAAqB,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC;IACnF,KAAK,CAAC,gBAAgB,KAAuB,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC;CACzF"}

package/dist/providers/gcp.d.ts

@@ -1,17 +1,8 @@
-import { type Address } from 'viem';
+import type { Address } from 'viem';
 import { type AuditSink } from '@agenticprimitives/audit';
 import type { A2AKeyProvider, KmsAccountBackend } from '../types';
-interface ServiceAccount {
-    client_email: string;
-    /** PEM-encoded PKCS#8 RSA private key. */
-    private_key: string;
-    project_id?: string;
-}
-interface CachedToken {
-    accessToken: string;
-    /** Unix seconds at which the token must be refreshed (already minus buffer). */
-    expiresAt: number;
-}
+export { base64UrlEncode, pemToDer, parseDerEcdsa, normalizeLowS, bigIntTo32Bytes, parseSpkiUncompressedSecp256k1PubKey, publicKeyToAddress, findRecoveryByte, } from '../kms/secp256k1-core.js';
+export { signJwt, fetchAccessToken } from '../kms/gcp-transport.js';
 export interface GcpKmsSignerOpts {
     /**
      * Full Cloud KMS resource name of the key version to sign with, e.g.
@@ -22,31 +13,16 @@ export interface GcpKmsSignerOpts {
     /** Raw JSON string of the service-account key file. */
     serviceAccountJson: string;
 }
-export declare function base64UrlEncode(bytes: Uint8Array): string;
-export declare function pemToDer(pem: string): Uint8Array;
-export declare function signJwt(serviceAccount: ServiceAccount, scope: string): Promise<string>;
-export declare function fetchAccessToken(serviceAccount: ServiceAccount): Promise<CachedToken>;
-export declare function parseSpkiUncompressedSecp256k1PubKey(spkiDer: Uint8Array): Uint8Array;
-export declare function publicKeyToAddress(pubKey65: Uint8Array): Address;
-export declare function parseDerEcdsa(der: Uint8Array): {
-    r: bigint;
-    s: bigint;
-};
-export declare function bigIntTo32Bytes(n: bigint): Uint8Array;
-export declare function normalizeLowS(s: bigint): bigint;
-export declare function findRecoveryByte(r: bigint, s: bigint, digest: Uint8Array, knownPubKey65: Uint8Array): number;
 export declare class GcpKmsSigner implements KmsAccountBackend {
     readonly provider: "gcp-kms";
     private readonly keyName;
-    private readonly serviceAccount;
+    private readonly transport;
     private readonly auditSink?;
-    private cachedToken?;
     private cachedPubKey65?;
     private cachedAddress?;
     constructor(opts?: Partial<GcpKmsSignerOpts> & {
         auditSink?: AuditSink;
     });
-    private getAccessToken;
     private getPublicKeyBytes;
     getSignerAddress(): Promise<Address>;
     signA2AAction(input: {
@@ -73,11 +49,7 @@ export interface GcpKmsProviderOpts {
     serviceAccountJson: string;
 }
 export declare class GcpKmsProvider implements A2AKeyProvider {
-    /**
-     * H7-F.4: this default is now ONLY used when the GCP encrypt response
-     * doesn't carry a `name` field (test fixtures + offline mocks). Real
-     * runs derive `keyVersion` from the response per call.
-     */
+    /** Only used when the GCP encrypt response doesn't carry a `name` (test fixtures). */
     readonly keyVersion = "gcp-kms:unknown";
     private readonly keyName;
     private readonly serviceAccount;
@@ -99,5 +71,4 @@ export declare class GcpKmsProvider implements A2AKeyProvider {
         keyVersion: string;
     }): Promise<Uint8Array>;
 }
-export {};
 //# sourceMappingURL=gcp.d.ts.map

package/dist/providers/gcp.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gcp.d.ts","sourceRoot":"","sources":["../../src/providers/gcp.ts"],"names":[],"mappings":"AA6BA,OAAO,EAAc,KAAK,OAAO,EAAE,MAAM,MAAM,CAAC;AAChD,OAAO,EAAc,KAAK,SAAS,EAAE,MAAM,0BAA0B,CAAC;AACtE,OAAO,KAAK,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAkBlE,UAAU,cAAc;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,0CAA0C;IAC1C,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,UAAU,WAAW;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,gFAAgF;IAChF,SAAS,EAAE,MAAM,CAAC;CACnB;AAYD,MAAM,WAAW,gBAAgB;IAC/B;;;;OAIG;IACH,oBAAoB,EAAE,MAAM,CAAC;IAC7B,uDAAuD;IACvD,kBAAkB,EAAE,MAAM,CAAC;CAC5B;AAMD,wBAAgB,eAAe,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAIzD;AAeD,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAMhD;AAMD,wBAAsB,OAAO,CAAC,cAAc,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAiC5F;AAED,wBAAsB,gBAAgB,CAAC,cAAc,EAAE,cAAc,GAAG,OAAO,CAAC,WAAW,CAAC,CAoB3F;AAiCD,wBAAgB,oCAAoC,CAAC,OAAO,EAAE,UAAU,GAAG,UAAU,CAkBpF;AAED,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,UAAU,GAAG,OAAO,CAKhE;AAMD,wBAAgB,aAAa,CAAC,GAAG,EAAE,UAAU,GAAG;IAAE,CAAC,EAAE,MAAM,CAAC;IAAC,CAAC,EAAE,MAAM,CAAA;CAAE,CA8BvE;AAQD,wBAAgB,eAAe,CAAC,CAAC,EAAE,MAAM,GAAG,UAAU,CAQrD;AAED,wBAAgB,aAAa,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAE/C;AAQD,wBAAgB,gBAAgB,CAC9B,CAAC,EAAE,MAAM,EACT,CAAC,EAAE,MAAM,EACT,MAAM,EAAE,UAAU,EAClB,aAAa,EAAE,UAAU,GACxB,MAAM,CA6BR;AAMD,qBAAa,YAAa,YAAW,iBAAiB;IACpD,QAAQ,CAAC,QAAQ,EAAG,SAAS,CAAU;IACvC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAiB;IAChD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAY;IACvC,OAAO,CAAC,WAAW,CAAC,CAAc;IAClC,OAAO,CAAC,cAAc,CAAC,CAAa;IACpC,OAAO,CAAC,aAAa,CAAC,CAAU;gBAEpB,IAAI,CAAC,EAAE,OAAO,CAAC,gBAAgB,CAAC,GAAG;QAAE,SAAS,CAAC,EAAE,SAAS,CAAA;KAAE;YAyB1D,cAAc;YASd,iBAAiB;IAwBzB,gBAAgB,IAAI,OAAO,CAAC,OAAO,CAAC;IAOpC,aAAa,CAAC,KAAK,EAAE;QACzB,MAAM,EAAE,UAAU,CAAC;QACnB,YAAY,CAAC,EAAE;YAAE,MAAM,CAAC,EAAE,MAAM,CAAC;YAAC,SAAS,CAAC,EAAE,MAAM,CAAC;YAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;KAC3E,GAAG,OAAO,CAAC;QAAE,SAAS,EAAE,UAAU,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,OAAO,CAAA;KAAE,CAAC;CAsD9E;AAmBD,MAAM,WAAW,kBAAkB;IACjC;;;;OAIG;IACH,aAAa,EAAE,MAAM,CAAC;IACtB,uDAAuD;IACvD,kBAAkB,EAAE,MAAM,CAAC;CAC5B;AAiCD,qBAAa,cAAe,YAAW,cAAc;IACnD;;;;OAIG;IACH,QAAQ,CAAC,UAAU,qBAAqB;IACxC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAiB;IAChD,OAAO,CAAC,WAAW,CAAC,CAAc;gBAEtB,IAAI,CAAC,EAAE,OAAO,CAAC,kBAAkB,CAAC;YAwBhC,cAAc;IAStB,sBAAsB,CAAC,KAAK,EAAE;QAClC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KACpC,GAAG,OAAO,CAAC;QACV,gBAAgB,EAAE,UAAU,CAAC;QAC7B,gBAAgB,EAAE,UAAU,CAAC;QAC7B,KAAK,EAAE,MAAM,CAAC;QACd,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC;IA6BI,qBAAqB,CAAC,KAAK,EAAE;QACjC,gBAAgB,EAAE,UAAU,CAAC;QAC7B,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACnC,KAAK,EAAE,MAAM,CAAC;QACd,UAAU,EAAE,MAAM,CAAC;KACpB,GAAG,OAAO,CAAC,UAAU,CAAC;CAwBxB"}
+{"version":3,"file":"gcp.d.ts","sourceRoot":"","sources":["../../src/providers/gcp.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AACpC,OAAO,EAAc,KAAK,SAAS,EAAE,MAAM,0BAA0B,CAAC;AACtE,OAAO,KAAK,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AA0BlE,OAAO,EACL,eAAe,EACf,QAAQ,EACR,aAAa,EACb,aAAa,EACb,eAAe,EACf,oCAAoC,EACpC,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAEpE,MAAM,WAAW,gBAAgB;IAC/B;;;;OAIG;IACH,oBAAoB,EAAE,MAAM,CAAC;IAC7B,uDAAuD;IACvD,kBAAkB,EAAE,MAAM,CAAC;CAC5B;AAMD,qBAAa,YAAa,YAAW,iBAAiB;IACpD,QAAQ,CAAC,QAAQ,EAAG,SAAS,CAAU;IACvC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAkB;IAC5C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAY;IACvC,OAAO,CAAC,cAAc,CAAC,CAAa;IACpC,OAAO,CAAC,aAAa,CAAC,CAAU;gBAEpB,IAAI,CAAC,EAAE,OAAO,CAAC,gBAAgB,CAAC,GAAG;QAAE,SAAS,CAAC,EAAE,SAAS,CAAA;KAAE;YAyB1D,iBAAiB;IAQzB,gBAAgB,IAAI,OAAO,CAAC,OAAO,CAAC;IAOpC,aAAa,CAAC,KAAK,EAAE;QACzB,MAAM,EAAE,UAAU,CAAC;QACnB,YAAY,CAAC,EAAE;YAAE,MAAM,CAAC,EAAE,MAAM,CAAC;YAAC,SAAS,CAAC,EAAE,MAAM,CAAC;YAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;KAC3E,GAAG,OAAO,CAAC;QAAE,SAAS,EAAE,UAAU,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,OAAO,CAAA;KAAE,CAAC;CA4C9E;AAeD,MAAM,WAAW,kBAAkB;IACjC;;;;OAIG;IACH,aAAa,EAAE,MAAM,CAAC;IACtB,uDAAuD;IACvD,kBAAkB,EAAE,MAAM,CAAC;CAC5B;AAuBD,qBAAa,cAAe,YAAW,cAAc;IACnD,sFAAsF;IACtF,QAAQ,CAAC,UAAU,qBAAqB;IACxC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAiB;IAChD,OAAO,CAAC,WAAW,CAAC,CAAc;gBAEtB,IAAI,CAAC,EAAE,OAAO,CAAC,kBAAkB,CAAC;YAwBhC,cAAc;IAStB,sBAAsB,CAAC,KAAK,EAAE;QAClC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KACpC,GAAG,OAAO,CAAC;QACV,gBAAgB,EAAE,UAAU,CAAC;QAC7B,gBAAgB,EAAE,UAAU,CAAC;QAC7B,KAAK,EAAE,MAAM,CAAC;QACd,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC;IAmBI,qBAAqB,CAAC,KAAK,EAAE;QACjC,gBAAgB,EAAE,UAAU,CAAC;QAC7B,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACnC,KAAK,EAAE,MAAM,CAAC;QACd,UAAU,EAAE,MAAM,CAAC;KACpB,GAAG,OAAO,CAAC,UAAU,CAAC;CAqBxB"}