@agenticprimitives/key-custody 0.1.0-alpha.3 → 1.0.0-alpha.11

package/dist/kms/key-map.d.ts

@@ -0,0 +1,13 @@
+import type { ServiceAccount } from './gcp-transport.js';
+/** Parse Google service-account credentials from a raw JSON string, base64-encoded
+ *  JSON, or an already-parsed object. Fail closed if `client_email`/`private_key` are absent. */
+export declare function parseServiceAccountJson(input: string | object): ServiceAccount;
+/** A validated `identity → cryptoKeyVersion resource name` map. */
+export type SignerKeyMap = Record<string, string>;
+/** Parse + validate a signer key-map (JSON string, base64-JSON, or object). Every value MUST be a
+ *  full `…/cryptoKeyVersions/<N>` resource name — a bare key name would fail at first sign with a
+ *  confusing error, so reject it here, loudly. Rejects an empty map. */
+export declare function parseSignerKeyMap(input: string | object): SignerKeyMap;
+/** True iff `name` is a full Cloud KMS key VERSION resource name. */
+export declare function isCryptoKeyVersionName(name: string): boolean;
+//# sourceMappingURL=key-map.d.ts.map

package/dist/kms/key-map.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"key-map.d.ts","sourceRoot":"","sources":["../../src/kms/key-map.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAuBzD;iGACiG;AACjG,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,cAAc,CAU9E;AAED,mEAAmE;AACnE,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAElD;;wEAEwE;AACxE,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,YAAY,CAetE;AAED,qEAAqE;AACrE,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE5D"}

package/dist/kms/key-map.js

@@ -0,0 +1,65 @@
+// Loose service-account + signer-key-map parsing (spec 276 KCS-D4). Peer-dep-free.
+//
+// External apps hand-rolled both of these and got the failure modes subtly
+// wrong (silent defaults, accepting a key NAME where a key VERSION is required).
+// They are generic, so they live here — one parse path, loud failure (ADR-0013).
+/** A full Cloud KMS key VERSION resource name (what a signer needs — not the bare key). */
+const KEY_VERSION_RE = /^projects\/[^/]+\/locations\/[^/]+\/keyRings\/[^/]+\/cryptoKeys\/[^/]+\/cryptoKeyVersions\/\d+$/;
+function coerceJsonObject(input, label) {
+    if (typeof input === 'object' && input !== null)
+        return input;
+    if (typeof input !== 'string')
+        throw new Error(`${label}: expected a JSON string or object`);
+    const s = input.trim();
+    if (!s)
+        throw new Error(`${label}: empty input`);
+    try {
+        return JSON.parse(s);
+    }
+    catch {
+        // The common second shape: base64-encoded JSON (env vars / secret stores).
+        try {
+            return JSON.parse(atob(s));
+        }
+        catch {
+            throw new Error(`${label}: not valid JSON or base64-encoded JSON`);
+        }
+    }
+}
+/** Parse Google service-account credentials from a raw JSON string, base64-encoded
+ *  JSON, or an already-parsed object. Fail closed if `client_email`/`private_key` are absent. */
+export function parseServiceAccountJson(input) {
+    const obj = coerceJsonObject(input, 'parseServiceAccountJson');
+    if (typeof obj.client_email !== 'string' || typeof obj.private_key !== 'string') {
+        throw new Error('parseServiceAccountJson: missing client_email or private_key');
+    }
+    return {
+        client_email: obj.client_email,
+        private_key: obj.private_key,
+        project_id: typeof obj.project_id === 'string' ? obj.project_id : undefined,
+    };
+}
+/** Parse + validate a signer key-map (JSON string, base64-JSON, or object). Every value MUST be a
+ *  full `…/cryptoKeyVersions/<N>` resource name — a bare key name would fail at first sign with a
+ *  confusing error, so reject it here, loudly. Rejects an empty map. */
+export function parseSignerKeyMap(input) {
+    const obj = coerceJsonObject(input, 'parseSignerKeyMap');
+    if (Array.isArray(obj))
+        throw new Error('parseSignerKeyMap: expected an object map, got an array');
+    const out = {};
+    for (const [identity, value] of Object.entries(obj)) {
+        if (typeof value !== 'string' || !KEY_VERSION_RE.test(value)) {
+            throw new Error(`parseSignerKeyMap: identity "${identity}" must map to a full ` +
+                `projects/.../cryptoKeyVersions/<N> resource name; got ${JSON.stringify(value)}`);
+        }
+        out[identity] = value;
+    }
+    if (Object.keys(out).length === 0)
+        throw new Error('parseSignerKeyMap: empty map');
+    return out;
+}
+/** True iff `name` is a full Cloud KMS key VERSION resource name. */
+export function isCryptoKeyVersionName(name) {
+    return KEY_VERSION_RE.test(name);
+}
+//# sourceMappingURL=key-map.js.map

package/dist/kms/key-map.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"key-map.js","sourceRoot":"","sources":["../../src/kms/key-map.ts"],"names":[],"mappings":"AAAA,mFAAmF;AACnF,EAAE;AACF,2EAA2E;AAC3E,iFAAiF;AACjF,iFAAiF;AAIjF,2FAA2F;AAC3F,MAAM,cAAc,GAClB,iGAAiG,CAAC;AAEpG,SAAS,gBAAgB,CAAC,KAAsB,EAAE,KAAa;IAC7D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAgC,CAAC;IACzF,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,oCAAoC,CAAC,CAAC;IAC7F,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IACvB,IAAI,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,eAAe,CAAC,CAAC;IACjD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,CAA4B,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,2EAA2E;QAC3E,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAA4B,CAAC;QACxD,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,yCAAyC,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;AACH,CAAC;AAED;iGACiG;AACjG,MAAM,UAAU,uBAAuB,CAAC,KAAsB;IAC5D,MAAM,GAAG,GAAG,gBAAgB,CAAC,KAAK,EAAE,yBAAyB,CAAC,CAAC;IAC/D,IAAI,OAAO,GAAG,CAAC,YAAY,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;QAChF,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;IAClF,CAAC;IACD,OAAO;QACL,YAAY,EAAE,GAAG,CAAC,YAAY;QAC9B,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,UAAU,EAAE,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;KAC5E,CAAC;AACJ,CAAC;AAKD;;wEAEwE;AACxE,MAAM,UAAU,iBAAiB,CAAC,KAAsB;IACtD,MAAM,GAAG,GAAG,gBAAgB,CAAC,KAAK,EAAE,mBAAmB,CAAC,CAAC;IACzD,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IACnG,MAAM,GAAG,GAAiB,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACpD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7D,MAAM,IAAI,KAAK,CACb,gCAAgC,QAAQ,uBAAuB;gBAC7D,yDAAyD,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CACnF,CAAC;QACJ,CAAC;QACD,GAAG,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC;IACxB,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IACnF,OAAO,GAAG,CAAC;AACb,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,sBAAsB,CAAC,IAAY;IACjD,OAAO,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACnC,CAAC"}

package/dist/kms/kms-core.d.ts

@@ -0,0 +1,4 @@
+export { type Hex, bytesToHex, base64UrlEncode, base64Decode, base64Encode, pemToDer, bigIntTo32Bytes, parseDerEcdsa, parseDerEcdsaSignature, normalizeLowS, toLowS, parseSpkiUncompressedSecp256k1PubKey, publicKeyToAddress, addressFromSpkiPem, findRecoveryByte, recoverV, assembleEthSignature, signDigestWithKms, } from './secp256k1-core.js';
+export { type ServiceAccount, type CachedToken, type GcpKmsTransport, signJwt, fetchAccessToken, callKms, createGcpKmsTransport, gcpSignDigest, } from './gcp-transport.js';
+export { type SignerKeyMap, parseServiceAccountJson, parseSignerKeyMap, isCryptoKeyVersionName, } from './key-map.js';
+//# sourceMappingURL=kms-core.d.ts.map

package/dist/kms/kms-core.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"kms-core.d.ts","sourceRoot":"","sources":["../../src/kms/kms-core.ts"],"names":[],"mappings":"AAWA,OAAO,EACL,KAAK,GAAG,EACR,UAAU,EACV,eAAe,EACf,YAAY,EACZ,YAAY,EACZ,QAAQ,EACR,eAAe,EACf,aAAa,EACb,sBAAsB,EACtB,aAAa,EACb,MAAM,EACN,oCAAoC,EACpC,kBAAkB,EAClB,kBAAkB,EAClB,gBAAgB,EAChB,QAAQ,EACR,oBAAoB,EACpB,iBAAiB,GAClB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,KAAK,cAAc,EACnB,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,OAAO,EACP,gBAAgB,EAChB,OAAO,EACP,qBAAqB,EACrB,aAAa,GACd,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,KAAK,YAAY,EACjB,uBAAuB,EACvB,iBAAiB,EACjB,sBAAsB,GACvB,MAAM,cAAc,CAAC"}

package/dist/kms/kms-core.js

@@ -0,0 +1,14 @@
+// @agenticprimitives/key-custody/kms-core — the consumer-safe KMS signing surface (spec 276).
+//
+// Import this (NOT the package barrel) when you only need to sign a digest with
+// a Cloud KMS secp256k1 key. Its transitive deps are ONLY `@noble/curves` +
+// `@noble/hashes` — no `viem`, no `@agenticprimitives/audit`/`connect-auth`
+// peers. This exists so apps never inline the KMS signer again (the
+// demo-validator `kms-signer.ts` problem; ADR-0013 — one primitive, not copies).
+//
+// The audited, viem-typed `GcpKmsSigner` (the package barrel) is a thin wrapper
+// over exactly this code.
+export { bytesToHex, base64UrlEncode, base64Decode, base64Encode, pemToDer, bigIntTo32Bytes, parseDerEcdsa, parseDerEcdsaSignature, normalizeLowS, toLowS, parseSpkiUncompressedSecp256k1PubKey, publicKeyToAddress, addressFromSpkiPem, findRecoveryByte, recoverV, assembleEthSignature, signDigestWithKms, } from './secp256k1-core.js';
+export { signJwt, fetchAccessToken, callKms, createGcpKmsTransport, gcpSignDigest, } from './gcp-transport.js';
+export { parseServiceAccountJson, parseSignerKeyMap, isCryptoKeyVersionName, } from './key-map.js';
+//# sourceMappingURL=kms-core.js.map

package/dist/kms/kms-core.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"kms-core.js","sourceRoot":"","sources":["../../src/kms/kms-core.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAC9F,EAAE;AACF,gFAAgF;AAChF,4EAA4E;AAC5E,4EAA4E;AAC5E,oEAAoE;AACpE,iFAAiF;AACjF,EAAE;AACF,gFAAgF;AAChF,0BAA0B;AAE1B,OAAO,EAEL,UAAU,EACV,eAAe,EACf,YAAY,EACZ,YAAY,EACZ,QAAQ,EACR,eAAe,EACf,aAAa,EACb,sBAAsB,EACtB,aAAa,EACb,MAAM,EACN,oCAAoC,EACpC,kBAAkB,EAClB,kBAAkB,EAClB,gBAAgB,EAChB,QAAQ,EACR,oBAAoB,EACpB,iBAAiB,GAClB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAIL,OAAO,EACP,gBAAgB,EAChB,OAAO,EACP,qBAAqB,EACrB,aAAa,GACd,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAEL,uBAAuB,EACvB,iBAAiB,EACjB,sBAAsB,GACvB,MAAM,cAAc,CAAC"}

package/dist/kms/provision-gcp.d.ts

@@ -0,0 +1,89 @@
+import { type Hex } from './secp256k1-core.js';
+/** Key purpose. `asymmetric-signing` = secp256k1 EVM signer (default). `encrypt-decrypt` =
+ *  symmetric KEK for envelope wrapping (spec 277/278 per-person vault key). */
+export type KeyPurpose = 'asymmetric-signing' | 'encrypt-decrypt';
+export interface ProvisionPlan {
+    project: string;
+    location: string;
+    keyRing: string;
+    /** Signing/KEK identity labels — arbitrary (dotted agent names ok); sanitized to key ids (B2). */
+    identities: string[];
+    /** Service-account email to grant the per-key IAM role. */
+    runtimeServiceAccount: string;
+    /** secp256k1 requires HSM; SOFTWARE is rejected by GCP for that curve. Default HSM. */
+    protectionLevel?: 'HSM' | 'SOFTWARE';
+    /** Default `asymmetric-signing`. `encrypt-decrypt` mints a symmetric KEK (spec 278 vault key). */
+    purpose?: KeyPurpose;
+    /** Per-key IAM role (B3). Default: `roles/cloudkms.signerVerifier` for signing,
+     *  `roles/cloudkms.cryptoKeyEncrypterDecrypter` for encrypt-decrypt. */
+    iamRole?: string;
+}
+export type StepKind = 'create-keyring' | 'create-key' | 'grant-iam';
+/** REST-executor parameters carried alongside the gcloud `argv` so both executors work. */
+export interface ProvisionStepRest {
+    project: string;
+    location: string;
+    keyRing: string;
+    keyId?: string;
+    purpose?: KeyPurpose;
+    protectionLevel?: 'HSM' | 'SOFTWARE';
+    role?: string;
+    member?: string;
+}
+export interface ProvisionStep {
+    id: string;
+    kind: StepKind;
+    description: string;
+    /** argv for `gcloud` (no shell string — avoids injection). */
+    argv: string[];
+    /** The ORIGINAL identity label (create-key / grant-iam). */
+    identity?: string;
+    /** The sanitized GCP key id used in the resource name. */
+    keyId?: string;
+    /** The key resource this step targets (create-key / grant-iam). */
+    cryptoKeyName?: string;
+    /** Structured params the REST executor uses (the gcloud executor uses `argv`). */
+    rest: ProvisionStepRest;
+}
+/** @deprecated name — kept for back-compat; use `ProvisionStep`. */
+export type GcloudStep = ProvisionStep;
+export interface StepExecutor {
+    /** Run a planned step. Return `{ alreadyExists: true }` for an idempotent skip; throw on real failure. */
+    run(step: ProvisionStep): Promise<{
+        stdout: string;
+        alreadyExists?: boolean;
+    }>;
+    /** Fetch a key version's SPKI PEM (asymmetric keys only — for address verification). */
+    getPublicKeyPem(cryptoKeyVersionName: string): Promise<string>;
+}
+export interface ProvisionResult {
+    /** identity (ORIGINAL label) → key resource: `…/cryptoKeyVersions/1` for signing keys,
+     *  the version-less `…/cryptoKeys/<id>` for encrypt-decrypt KEKs (what the provider wants). */
+    keyMap: Record<string, string>;
+    /** identity → derived EVM address (signing keys only; verify BEFORE wiring env). */
+    addresses: Record<string, Hex>;
+    granted: Array<{
+        key: string;
+        member: string;
+        role: string;
+    }>;
+    /** Step ids skipped because the resource already existed (idempotent re-run). */
+    alreadyExisted: string[];
+}
+/** Sanitize an arbitrary identity label to a GCP cryptoKey id ([a-zA-Z0-9_-], ≤63) (B2). */
+export declare function sanitizeKeyId(identity: string): string;
+/** First key version GCP creates (asymmetric keys — the version is what you sign with). */
+export declare function keyVersionName(plan: ProvisionPlan, keyId: string): string;
+/** Emit the ordered steps for a provisioning plan. Pure — no execution. */
+export declare function planGcpProvision(plan: ProvisionPlan): ProvisionStep[];
+/** Execute a provisioning plan through an injected executor. Idempotent: steps whose resource
+ *  already exists are skipped + reported. For asymmetric keys, fetches each key's public key and
+ *  derives its EVM address (verify before wiring); encrypt-decrypt KEKs have no public key, so the
+ *  keyMap points at the version-less cryptoKey resource and no address is derived. */
+export declare function executeGcpProvision(plan: ProvisionPlan, exec: StepExecutor): Promise<ProvisionResult>;
+/** Build a Cloud KMS REST StepExecutor from a service-account JSON (single-line or base64 — B4).
+ *  Zero gcloud dependency; SA-JWT → KMS REST. Idempotent (409 ALREADY_EXISTS → skip). */
+export declare function createGcpRestStepExecutor(opts: {
+    serviceAccountJson: string | object;
+}): StepExecutor;
+//# sourceMappingURL=provision-gcp.d.ts.map

package/dist/kms/provision-gcp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provision-gcp.d.ts","sourceRoot":"","sources":["../../src/kms/provision-gcp.ts"],"names":[],"mappings":"AAaA,OAAO,EAAsB,KAAK,GAAG,EAAE,MAAM,qBAAqB,CAAC;AAInE;+EAC+E;AAC/E,MAAM,MAAM,UAAU,GAAG,oBAAoB,GAAG,iBAAiB,CAAC;AAElE,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,kGAAkG;IAClG,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,2DAA2D;IAC3D,qBAAqB,EAAE,MAAM,CAAC;IAC9B,uFAAuF;IACvF,eAAe,CAAC,EAAE,KAAK,GAAG,UAAU,CAAC;IACrC,kGAAkG;IAClG,OAAO,CAAC,EAAE,UAAU,CAAC;IACrB;4EACwE;IACxE,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,MAAM,QAAQ,GAAG,gBAAgB,GAAG,YAAY,GAAG,WAAW,CAAC;AAErE,2FAA2F;AAC3F,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,UAAU,CAAC;IACrB,eAAe,CAAC,EAAE,KAAK,GAAG,UAAU,CAAC;IACrC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,QAAQ,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,8DAA8D;IAC9D,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,4DAA4D;IAC5D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,0DAA0D;IAC1D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mEAAmE;IACnE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,kFAAkF;IAClF,IAAI,EAAE,iBAAiB,CAAC;CACzB;AACD,oEAAoE;AACpE,MAAM,MAAM,UAAU,GAAG,aAAa,CAAC;AAEvC,MAAM,WAAW,YAAY;IAC3B,0GAA0G;IAC1G,GAAG,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAC/E,wFAAwF;IACxF,eAAe,CAAC,oBAAoB,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAChE;AAED,MAAM,WAAW,eAAe;IAC9B;mGAC+F;IAC/F,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,oFAAoF;IACpF,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC/B,OAAO,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC9D,iFAAiF;IACjF,cAAc,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED,4FAA4F;AAC5F,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAWtD;AAMD,2FAA2F;AAC3F,wBAAgB,cAAc,CAAC,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAEzE;AAQD,2EAA2E;AAC3E,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,aAAa,GAAG,aAAa,EAAE,CAgFrE;AAED;;;sFAGsF;AACtF,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,eAAe,CAAC,CA8B3G;AASD;yFACyF;AACzF,wBAAgB,yBAAyB,CAAC,IAAI,EAAE;IAAE,kBAAkB,EAAE,MAAM,GAAG,MAAM,CAAA;CAAE,GAAG,YAAY,CAyDrG"}

package/dist/kms/provision-gcp.js

@@ -0,0 +1,229 @@
+// GCP Cloud KMS provisioning helper (spec 276 KCS-D3 + upstream backlog B1/B2/B3).
+//
+// PURE PLANNING + INJECTED EXECUTION: `planGcpProvision` emits the ordered steps;
+// `executeGcpProvision` runs them through a `StepExecutor`. Two executors ship:
+//   - `createGcpRestStepExecutor` — gcloud-FREE: SA-JWT → Cloud KMS REST (B1).
+//     Works on Workers (no gRPC SDK); a "drop the SA key and run" path.
+//   - the CLI (`bin/ap-provision-gcp.mjs`) supplies a Node child_process gcloud runner.
+//
+// B2: `identities` are arbitrary labels (dotted agent names ok); each is sanitized to a
+// GCP key id internally, and the result maps are keyed by the ORIGINAL label.
+// B3: the granted IAM role is configurable (default derives from the key purpose).
+// Per-key (not per-keyring) IAM enforces master-key separation (CLAUDE.md invariant).
+import { addressFromSpkiPem } from './secp256k1-core.js';
+import { fetchAccessToken, callKms } from './gcp-transport.js';
+import { parseServiceAccountJson } from './key-map.js';
+/** Sanitize an arbitrary identity label to a GCP cryptoKey id ([a-zA-Z0-9_-], ≤63) (B2). */
+export function sanitizeKeyId(identity) {
+    // Trim leading/trailing '-' with linear string ops — NOT a regex. The `/^-+|-+$/g`
+    // alternation is ReDoS-prone (polynomial on a long run of '-'); a scan is O(n).
+    const collapsed = identity.replace(/[^a-zA-Z0-9_-]/g, '-');
+    let start = 0;
+    let end = collapsed.length;
+    while (start < end && collapsed[start] === '-')
+        start++;
+    while (end > start && collapsed[end - 1] === '-')
+        end--;
+    const id = collapsed.slice(start, end).slice(0, 63);
+    if (!id)
+        throw new Error(`sanitizeKeyId: identity "${identity}" sanitizes to an empty key id`);
+    return id;
+}
+function keyResourceName(plan, keyId) {
+    return `projects/${plan.project}/locations/${plan.location}/keyRings/${plan.keyRing}/cryptoKeys/${keyId}`;
+}
+/** First key version GCP creates (asymmetric keys — the version is what you sign with). */
+export function keyVersionName(plan, keyId) {
+    return `${keyResourceName(plan, keyId)}/cryptoKeyVersions/1`;
+}
+function defaultRole(purpose) {
+    return purpose === 'encrypt-decrypt'
+        ? 'roles/cloudkms.cryptoKeyEncrypterDecrypter'
+        : 'roles/cloudkms.signerVerifier';
+}
+/** Emit the ordered steps for a provisioning plan. Pure — no execution. */
+export function planGcpProvision(plan) {
+    if (!plan.project || !plan.location || !plan.keyRing) {
+        throw new Error('planGcpProvision: project, location, and keyRing are required');
+    }
+    if (!plan.runtimeServiceAccount.includes('@')) {
+        throw new Error('planGcpProvision: runtimeServiceAccount must be a service-account email');
+    }
+    if (plan.identities.length === 0)
+        throw new Error('planGcpProvision: at least one identity is required');
+    const dupes = plan.identities.filter((id, i) => plan.identities.indexOf(id) !== i);
+    if (dupes.length)
+        throw new Error(`planGcpProvision: duplicate identities: ${[...new Set(dupes)].join(', ')}`);
+    const purpose = plan.purpose ?? 'asymmetric-signing';
+    const protection = (plan.protectionLevel ?? 'HSM').toLowerCase();
+    const role = plan.iamRole ?? defaultRole(purpose);
+    const gcloudPurpose = purpose === 'encrypt-decrypt' ? 'encryption' : 'asymmetric-signing';
+    const gcloudAlgo = purpose === 'encrypt-decrypt' ? 'google-symmetric-encryption' : 'ec-sign-secp256k1-sha256';
+    // B2: map ORIGINAL identity → sanitized keyId; reject collisions (two labels → one key id).
+    const keyIdByIdentity = new Map();
+    const seen = new Map();
+    for (const identity of plan.identities) {
+        const keyId = sanitizeKeyId(identity);
+        const prior = seen.get(keyId);
+        if (prior && prior !== identity) {
+            throw new Error(`planGcpProvision: identities "${prior}" and "${identity}" both sanitize to key id "${keyId}"`);
+        }
+        seen.set(keyId, identity);
+        keyIdByIdentity.set(identity, keyId);
+    }
+    const steps = [
+        {
+            id: 'keyring',
+            kind: 'create-keyring',
+            description: `Create key ring ${plan.keyRing} in ${plan.location}`,
+            argv: ['kms', 'keyrings', 'create', plan.keyRing, '--location', plan.location, '--project', plan.project],
+            rest: { project: plan.project, location: plan.location, keyRing: plan.keyRing },
+        },
+    ];
+    for (const identity of plan.identities) {
+        const keyId = keyIdByIdentity.get(identity);
+        const cryptoKeyName = keyResourceName(plan, keyId);
+        steps.push({
+            id: `key:${identity}`,
+            kind: 'create-key',
+            identity,
+            keyId,
+            cryptoKeyName,
+            description: `Create ${protection.toUpperCase()} ${purpose} key ${keyId} (for "${identity}")`,
+            argv: [
+                'kms', 'keys', 'create', keyId,
+                '--keyring', plan.keyRing,
+                '--location', plan.location,
+                '--project', plan.project,
+                '--purpose', gcloudPurpose,
+                '--default-algorithm', gcloudAlgo,
+                '--protection-level', protection,
+            ],
+            rest: { project: plan.project, location: plan.location, keyRing: plan.keyRing, keyId, purpose, protectionLevel: plan.protectionLevel ?? 'HSM' },
+        });
+        steps.push({
+            id: `iam:${identity}`,
+            kind: 'grant-iam',
+            identity,
+            keyId,
+            cryptoKeyName,
+            description: `Grant ${role} on ${keyId} to ${plan.runtimeServiceAccount}`,
+            argv: [
+                'kms', 'keys', 'add-iam-policy-binding', keyId,
+                '--keyring', plan.keyRing,
+                '--location', plan.location,
+                '--project', plan.project,
+                '--member', `serviceAccount:${plan.runtimeServiceAccount}`,
+                '--role', role,
+            ],
+            rest: { project: plan.project, location: plan.location, keyRing: plan.keyRing, keyId, role, member: plan.runtimeServiceAccount },
+        });
+    }
+    return steps;
+}
+/** Execute a provisioning plan through an injected executor. Idempotent: steps whose resource
+ *  already exists are skipped + reported. For asymmetric keys, fetches each key's public key and
+ *  derives its EVM address (verify before wiring); encrypt-decrypt KEKs have no public key, so the
+ *  keyMap points at the version-less cryptoKey resource and no address is derived. */
+export async function executeGcpProvision(plan, exec) {
+    const purpose = plan.purpose ?? 'asymmetric-signing';
+    const role = plan.iamRole ?? defaultRole(purpose);
+    const steps = planGcpProvision(plan);
+    const alreadyExisted = [];
+    const granted = [];
+    for (const step of steps) {
+        const r = await exec.run(step);
+        if (r.alreadyExists)
+            alreadyExisted.push(step.id);
+        if (step.kind === 'grant-iam' && step.cryptoKeyName) {
+            granted.push({ key: step.cryptoKeyName, member: `serviceAccount:${plan.runtimeServiceAccount}`, role });
+        }
+    }
+    const keyMap = {};
+    const addresses = {};
+    for (const identity of plan.identities) {
+        const keyId = sanitizeKeyId(identity);
+        if (purpose === 'encrypt-decrypt') {
+            // The envelope provider's `kmsKeyRef` is the version-less cryptoKey resource.
+            keyMap[identity] = keyResourceName(plan, keyId);
+        }
+        else {
+            const versionName = keyVersionName(plan, keyId);
+            keyMap[identity] = versionName;
+            addresses[identity] = addressFromSpkiPem(await exec.getPublicKeyPem(versionName));
+        }
+    }
+    return { keyMap, addresses, granted, alreadyExisted };
+}
+// ─── B1: gcloud-free REST StepExecutor ─────────────────────────────────────
+const GCP_PURPOSE = { 'asymmetric-signing': 'ASYMMETRIC_SIGN', 'encrypt-decrypt': 'ENCRYPT_DECRYPT' };
+const GCP_ALGORITHM = { 'asymmetric-signing': 'EC_SIGN_SECP256K1_SHA256', 'encrypt-decrypt': 'GOOGLE_SYMMETRIC_ENCRYPTION' };
+/** Build a Cloud KMS REST StepExecutor from a service-account JSON (single-line or base64 — B4).
+ *  Zero gcloud dependency; SA-JWT → KMS REST. Idempotent (409 ALREADY_EXISTS → skip). */
+export function createGcpRestStepExecutor(opts) {
+    const sa = parseServiceAccountJson(opts.serviceAccountJson);
+    let cached;
+    async function token() {
+        const now = Math.floor(Date.now() / 1000);
+        if (!cached || cached.expiresAt <= now)
+            cached = await fetchAccessToken(sa);
+        return cached.accessToken;
+    }
+    const isConflict = (e) => e instanceof Error && /HTTP 409|ALREADY_EXISTS/i.test(e.message);
+    return {
+        async run(step) {
+            const t = await token();
+            const r = step.rest;
+            const loc = `projects/${r.project}/locations/${r.location}`;
+            if (step.kind === 'create-keyring') {
+                try {
+                    await callKms(t, `${loc}/keyRings?keyRingId=${encodeURIComponent(r.keyRing)}`, { method: 'POST', body: {} });
+                    return { stdout: 'keyring created' };
+                }
+                catch (e) {
+                    if (isConflict(e))
+                        return { stdout: 'keyring exists', alreadyExists: true };
+                    throw e;
+                }
+            }
+            if (step.kind === 'create-key') {
+                const purpose = r.purpose ?? 'asymmetric-signing';
+                try {
+                    await callKms(t, `${loc}/keyRings/${encodeURIComponent(r.keyRing)}/cryptoKeys?cryptoKeyId=${encodeURIComponent(r.keyId)}`, {
+                        method: 'POST',
+                        body: {
+                            purpose: GCP_PURPOSE[purpose],
+                            versionTemplate: { algorithm: GCP_ALGORITHM[purpose], protectionLevel: (r.protectionLevel ?? 'HSM') },
+                        },
+                    });
+                    return { stdout: 'key created' };
+                }
+                catch (e) {
+                    if (isConflict(e))
+                        return { stdout: 'key exists', alreadyExists: true };
+                    throw e;
+                }
+            }
+            // grant-iam: read-modify-write the key's IAM policy (idempotent; member added once).
+            const keyPath = `${loc}/keyRings/${encodeURIComponent(r.keyRing)}/cryptoKeys/${encodeURIComponent(r.keyId)}`;
+            const policy = await callKms(t, `${keyPath}:getIamPolicy`, { method: 'GET' });
+            const member = `serviceAccount:${r.member}`;
+            const bindings = policy.bindings ?? [];
+            let binding = bindings.find((b) => b.role === r.role);
+            if (!binding) {
+                binding = { role: r.role, members: [] };
+                bindings.push(binding);
+            }
+            if (binding.members.includes(member))
+                return { stdout: 'iam binding already present', alreadyExists: true };
+            binding.members.push(member);
+            await callKms(t, `${keyPath}:setIamPolicy`, { method: 'POST', body: { policy: { ...policy, bindings } } });
+            return { stdout: 'iam granted' };
+        },
+        async getPublicKeyPem(cryptoKeyVersionName) {
+            const res = await callKms(await token(), `${cryptoKeyVersionName}/publicKey`, { method: 'GET' });
+            return res.pem;
+        },
+    };
+}
+//# sourceMappingURL=provision-gcp.js.map

package/dist/kms/provision-gcp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provision-gcp.js","sourceRoot":"","sources":["../../src/kms/provision-gcp.ts"],"names":[],"mappings":"AAAA,mFAAmF;AACnF,EAAE;AACF,kFAAkF;AAClF,gFAAgF;AAChF,+EAA+E;AAC/E,wEAAwE;AACxE,wFAAwF;AACxF,EAAE;AACF,wFAAwF;AACxF,8EAA8E;AAC9E,mFAAmF;AACnF,sFAAsF;AAEtF,OAAO,EAAE,kBAAkB,EAAY,MAAM,qBAAqB,CAAC;AACnE,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAoB,MAAM,oBAAoB,CAAC;AACjF,OAAO,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC;AAyEvD,4FAA4F;AAC5F,MAAM,UAAU,aAAa,CAAC,QAAgB;IAC5C,mFAAmF;IACnF,gFAAgF;IAChF,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC;IAC3D,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,GAAG,GAAG,SAAS,CAAC,MAAM,CAAC;IAC3B,OAAO,KAAK,GAAG,GAAG,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,GAAG;QAAE,KAAK,EAAE,CAAC;IACxD,OAAO,GAAG,GAAG,KAAK,IAAI,SAAS,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,GAAG;QAAE,GAAG,EAAE,CAAC;IACxD,MAAM,EAAE,GAAG,SAAS,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACpD,IAAI,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,QAAQ,gCAAgC,CAAC,CAAC;IAC/F,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,eAAe,CAAC,IAAmB,EAAE,KAAa;IACzD,OAAO,YAAY,IAAI,CAAC,OAAO,cAAc,IAAI,CAAC,QAAQ,aAAa,IAAI,CAAC,OAAO,eAAe,KAAK,EAAE,CAAC;AAC5G,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,cAAc,CAAC,IAAmB,EAAE,KAAa;IAC/D,OAAO,GAAG,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,sBAAsB,CAAC;AAC/D,CAAC;AAED,SAAS,WAAW,CAAC,OAAmB;IACtC,OAAO,OAAO,KAAK,iBAAiB;QAClC,CAAC,CAAC,4CAA4C;QAC9C,CAAC,CAAC,+BAA+B,CAAC;AACtC,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,gBAAgB,CAAC,IAAmB;IAClD,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;IACnF,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,yEAAyE,CAAC,CAAC;IAC7F,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzG,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;IACnF,IAAI,KAAK,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAE/G,MAAM,OAAO,GAAe,IAAI,CAAC,OAAO,IAAI,oBAAoB,CAAC;IACjE,MAAM,UAAU,GAAG,CAAC,IAAI,CAAC,eAAe,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;IACjE,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,IAAI,WAAW,CAAC,OAAO,CAAC,CAAC;IAClD,MAAM,aAAa,GAAG,OAAO,KAAK,iBAAiB,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,oBAAoB,CAAC;IAC1F,MAAM,UAAU,GAAG,OAAO,KAAK,iBAAiB,CAAC,CAAC,CAAC,6BAA6B,CAAC,CAAC,CAAC,0BAA0B,CAAC;IAE9G,4FAA4F;IAC5F,MAAM,eAAe,GAAG,IAAI,GAAG,EAAkB,CAAC;IAClD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IACvC,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;QACtC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC9B,IAAI,KAAK,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,iCAAiC,KAAK,UAAU,QAAQ,8BAA8B,KAAK,GAAG,CAAC,CAAC;QAClH,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QAC1B,eAAe,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACvC,CAAC;IAED,MAAM,KAAK,GAAoB;QAC7B;YACE,EAAE,EAAE,SAAS;YACb,IAAI,EAAE,gBAAgB;YACtB,WAAW,EAAE,mBAAmB,IAAI,CAAC,OAAO,OAAO,IAAI,CAAC,QAAQ,EAAE;YAClE,IAAI,EAAE,CAAC,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,CAAC,OAAO,EAAE,YAAY,EAAE,IAAI,CAAC,QAAQ,EAAE,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC;YACzG,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE;SAChF;KACF,CAAC;IAEF,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAE,CAAC;QAC7C,MAAM,aAAa,GAAG,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACnD,KAAK,CAAC,IAAI,CAAC;YACT,EAAE,EAAE,OAAO,QAAQ,EAAE;YACrB,IAAI,EAAE,YAAY;YAClB,QAAQ;YACR,KAAK;YACL,aAAa;YACb,WAAW,EAAE,UAAU,UAAU,CAAC,WAAW,EAAE,IAAI,OAAO,QAAQ,KAAK,UAAU,QAAQ,IAAI;YAC7F,IAAI,EAAE;gBACJ,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK;gBAC9B,WAAW,EAAE,IAAI,CAAC,OAAO;gBACzB,YAAY,EAAE,IAAI,CAAC,QAAQ;gBAC3B,WAAW,EAAE,IAAI,CAAC,OAAO;gBACzB,WAAW,EAAE,aAAa;gBAC1B,qBAAqB,EAAE,UAAU;gBACjC,oBAAoB,EAAE,UAAU;aACjC;YACD,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,eAAe,EAAE,IAAI,CAAC,eAAe,IAAI,KAAK,EAAE;SAChJ,CAAC,CAAC;QACH,KAAK,CAAC,IAAI,CAAC;YACT,EAAE,EAAE,OAAO,QAAQ,EAAE;YACrB,IAAI,EAAE,WAAW;YACjB,QAAQ;YACR,KAAK;YACL,aAAa;YACb,WAAW,EAAE,SAAS,IAAI,OAAO,KAAK,OAAO,IAAI,CAAC,qBAAqB,EAAE;YACzE,IAAI,EAAE;gBACJ,KAAK,EAAE,MAAM,EAAE,wBAAwB,EAAE,KAAK;gBAC9C,WAAW,EAAE,IAAI,CAAC,OAAO;gBACzB,YAAY,EAAE,IAAI,CAAC,QAAQ;gBAC3B,WAAW,EAAE,IAAI,CAAC,OAAO;gBACzB,UAAU,EAAE,kBAAkB,IAAI,CAAC,qBAAqB,EAAE;gBAC1D,QAAQ,EAAE,IAAI;aACf;YACD,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,qBAAqB,EAAE;SACjI,CAAC,CAAC;IACL,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;sFAGsF;AACtF,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,IAAmB,EAAE,IAAkB;IAC/E,MAAM,OAAO,GAAe,IAAI,CAAC,OAAO,IAAI,oBAAoB,CAAC;IACjE,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,IAAI,WAAW,CAAC,OAAO,CAAC,CAAC;IAClD,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,cAAc,GAAa,EAAE,CAAC;IACpC,MAAM,OAAO,GAA+B,EAAE,CAAC;IAE/C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,CAAC,CAAC,aAAa;YAAE,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAClD,IAAI,IAAI,CAAC,IAAI,KAAK,WAAW,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACpD,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,aAAa,EAAE,MAAM,EAAE,kBAAkB,IAAI,CAAC,qBAAqB,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1G,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,MAAM,SAAS,GAAwB,EAAE,CAAC;IAC1C,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;QACtC,IAAI,OAAO,KAAK,iBAAiB,EAAE,CAAC;YAClC,8EAA8E;YAC9E,MAAM,CAAC,QAAQ,CAAC,GAAG,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAClD,CAAC;aAAM,CAAC;YACN,MAAM,WAAW,GAAG,cAAc,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YAChD,MAAM,CAAC,QAAQ,CAAC,GAAG,WAAW,CAAC;YAC/B,SAAS,CAAC,QAAQ,CAAC,GAAG,kBAAkB,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC,CAAC;QACpF,CAAC;IACH,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC;AACxD,CAAC;AAED,8EAA8E;AAE9E,MAAM,WAAW,GAAG,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,iBAAiB,EAAW,CAAC;AAC/G,MAAM,aAAa,GAAG,EAAE,oBAAoB,EAAE,0BAA0B,EAAE,iBAAiB,EAAE,6BAA6B,EAAW,CAAC;AAItI;yFACyF;AACzF,MAAM,UAAU,yBAAyB,CAAC,IAA6C;IACrF,MAAM,EAAE,GAAG,uBAAuB,CAAC,IAAI,CAAC,kBAA4B,CAAC,CAAC;IACtE,IAAI,MAA+B,CAAC;IACpC,KAAK,UAAU,KAAK;QAClB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,SAAS,IAAI,GAAG;YAAE,MAAM,GAAG,MAAM,gBAAgB,CAAC,EAAE,CAAC,CAAC;QAC5E,OAAO,MAAM,CAAC,WAAW,CAAC;IAC5B,CAAC;IACD,MAAM,UAAU,GAAG,CAAC,CAAU,EAAW,EAAE,CAAC,CAAC,YAAY,KAAK,IAAI,0BAA0B,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAE7G,OAAO;QACL,KAAK,CAAC,GAAG,CAAC,IAAmB;YAC3B,MAAM,CAAC,GAAG,MAAM,KAAK,EAAE,CAAC;YACxB,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC;YACpB,MAAM,GAAG,GAAG,YAAY,CAAC,CAAC,OAAO,cAAc,CAAC,CAAC,QAAQ,EAAE,CAAC;YAC5D,IAAI,IAAI,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;gBACnC,IAAI,CAAC;oBACH,MAAM,OAAO,CAAC,CAAC,EAAE,GAAG,GAAG,uBAAuB,kBAAkB,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;oBAC7G,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;gBACvC,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,IAAI,UAAU,CAAC,CAAC,CAAC;wBAAE,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;oBAC5E,MAAM,CAAC,CAAC;gBACV,CAAC;YACH,CAAC;YACD,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBAC/B,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,IAAI,oBAAoB,CAAC;gBAClD,IAAI,CAAC;oBACH,MAAM,OAAO,CAAC,CAAC,EAAE,GAAG,GAAG,aAAa,kBAAkB,CAAC,CAAC,CAAC,OAAO,CAAC,2BAA2B,kBAAkB,CAAC,CAAC,CAAC,KAAM,CAAC,EAAE,EAAE;wBAC1H,MAAM,EAAE,MAAM;wBACd,IAAI,EAAE;4BACJ,OAAO,EAAE,WAAW,CAAC,OAAO,CAAC;4BAC7B,eAAe,EAAE,EAAE,SAAS,EAAE,aAAa,CAAC,OAAO,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,eAAe,IAAI,KAAK,CAAC,EAAE;yBACtG;qBACF,CAAC,CAAC;oBACH,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;gBACnC,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,IAAI,UAAU,CAAC,CAAC,CAAC;wBAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;oBACxE,MAAM,CAAC,CAAC;gBACV,CAAC;YACH,CAAC;YACD,qFAAqF;YACrF,MAAM,OAAO,GAAG,GAAG,GAAG,aAAa,kBAAkB,CAAC,CAAC,CAAC,OAAO,CAAC,eAAe,kBAAkB,CAAC,CAAC,CAAC,KAAM,CAAC,EAAE,CAAC;YAC9G,MAAM,MAAM,GAAG,MAAM,OAAO,CAAe,CAAC,EAAE,GAAG,OAAO,eAAe,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YAC5F,MAAM,MAAM,GAAG,kBAAkB,CAAC,CAAC,MAAM,EAAE,CAAC;YAC5C,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC;YACvC,IAAI,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC;YACtD,IAAI,CAAC,OAAO,EAAE,CAAC;gBAAC,OAAO,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,IAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;gBAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAAC,CAAC;YACnF,IAAI,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAAE,OAAO,EAAE,MAAM,EAAE,6BAA6B,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;YAC5G,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC7B,MAAM,OAAO,CAAC,CAAC,EAAE,GAAG,OAAO,eAAe,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;YAC3G,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;QACnC,CAAC;QACD,KAAK,CAAC,eAAe,CAAC,oBAA4B;YAChD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAkB,MAAM,KAAK,EAAE,EAAE,GAAG,oBAAoB,YAAY,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YAClH,OAAO,GAAG,CAAC,GAAG,CAAC;QACjB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/kms/secp256k1-core.d.ts

@@ -0,0 +1,46 @@
+/** A 0x-prefixed lowercase hex string (structurally compatible with viem's `Hex`/`Address`). */
+export type Hex = `0x${string}`;
+/** Bytes → `0x`-prefixed lowercase hex. Byte-for-byte compatible with viem's `bytesToHex`. */
+export declare function bytesToHex(bytes: Uint8Array): Hex;
+export declare function base64UrlEncode(bytes: Uint8Array): string;
+export declare function base64Decode(s: string): Uint8Array;
+export declare function base64Encode(bytes: Uint8Array): string;
+export declare function pemToDer(pem: string): Uint8Array;
+export declare function bigIntTo32Bytes(n: bigint): Uint8Array;
+/** Parse a DER-encoded ECDSA signature → `(r, s)`. Range-validates `0 < r,s < n`
+ *  (audit F-7): a degenerate KMS response (r/s = 0 or ≥ n) is never valid — fail closed. */
+export declare function parseDerEcdsa(der: Uint8Array): {
+    r: bigint;
+    s: bigint;
+};
+/** spec-276 alias for {@link parseDerEcdsa}. */
+export declare const parseDerEcdsaSignature: typeof parseDerEcdsa;
+/** Normalize `s` to its low-s form (EIP-2): malleability-canonical signatures only. */
+export declare function normalizeLowS(s: bigint): bigint;
+/** spec-276 alias for {@link normalizeLowS}. */
+export declare const toLowS: typeof normalizeLowS;
+/** Extract the trailing 65-byte uncompressed secp256k1 point (`0x04||X||Y`) from an SPKI DER blob. */
+export declare function parseSpkiUncompressedSecp256k1PubKey(spkiDer: Uint8Array): Uint8Array;
+/** `0x04||X||Y` (65 bytes) → EVM address (`keccak256(X||Y)[-20:]`). */
+export declare function publicKeyToAddress(pubKey65: Uint8Array): Hex;
+/** Convenience: SPKI PEM (the Cloud KMS `publicKey` response) → EVM address. */
+export declare function addressFromSpkiPem(pem: string): Hex;
+/** Cloud KMS does not return the recovery bit; recover it by trying v∈{27,28}
+ *  against the known uncompressed public key. Throws (redacted error) if neither matches. */
+export declare function findRecoveryByte(r: bigint, s: bigint, digest: Uint8Array, knownPubKey65: Uint8Array): number;
+/** spec-276 ordering of {@link findRecoveryByte}: `(digest, r, s, knownPubKey65)`. */
+export declare function recoverV(digest: Uint8Array, r: bigint, s: bigint, knownPubKey65: Uint8Array): 27 | 28;
+/** Assemble an Ethereum 65-byte `(r,s,v)` signature as 0x hex. */
+export declare function assembleEthSignature(r: bigint, s: bigint, v: number): Hex;
+/** Turn a raw KMS asymmetric-sign (DER output) into an Ethereum `(r,s,v)` signature.
+ *  Transport is INJECTED (`asymmetricSign`) so this stays peer-dependency-free and
+ *  testable: the caller supplies however it reaches Cloud KMS. Returns 0x-hex 65 bytes. */
+export declare function signDigestWithKms(opts: {
+    /** The 32-byte keccak digest to sign. */
+    digest: Uint8Array;
+    /** The signing key's SPKI PEM (the Cloud KMS `publicKey` response `.pem`). Cached by the caller. */
+    publicKeyPem: string;
+    /** Calls Cloud KMS `:asymmetricSign` for the digest; returns the DER-encoded signature bytes. */
+    asymmetricSign: (digest: Uint8Array) => Promise<Uint8Array>;
+}): Promise<Hex>;
+//# sourceMappingURL=secp256k1-core.d.ts.map

package/dist/kms/secp256k1-core.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secp256k1-core.d.ts","sourceRoot":"","sources":["../../src/kms/secp256k1-core.ts"],"names":[],"mappings":"AAwBA,gGAAgG;AAChG,MAAM,MAAM,GAAG,GAAG,KAAK,MAAM,EAAE,CAAC;AAIhC,8FAA8F;AAC9F,wBAAgB,UAAU,CAAC,KAAK,EAAE,UAAU,GAAG,GAAG,CAIjD;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAIzD;AAED,wBAAgB,YAAY,CAAC,CAAC,EAAE,MAAM,GAAG,UAAU,CAKlD;AAED,wBAAgB,YAAY,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAItD;AAED,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAMhD;AAUD,wBAAgB,eAAe,CAAC,CAAC,EAAE,MAAM,GAAG,UAAU,CAQrD;AAID;4FAC4F;AAC5F,wBAAgB,aAAa,CAAC,GAAG,EAAE,UAAU,GAAG;IAAE,CAAC,EAAE,MAAM,CAAC;IAAC,CAAC,EAAE,MAAM,CAAA;CAAE,CA2BvE;AAED,gDAAgD;AAChD,eAAO,MAAM,sBAAsB,sBAAgB,CAAC;AAEpD,uFAAuF;AACvF,wBAAgB,aAAa,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAE/C;AAED,gDAAgD;AAChD,eAAO,MAAM,MAAM,sBAAgB,CAAC;AAIpC,sGAAsG;AACtG,wBAAgB,oCAAoC,CAAC,OAAO,EAAE,UAAU,GAAG,UAAU,CAapF;AAED,uEAAuE;AACvE,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,UAAU,GAAG,GAAG,CAI5D;AAED,gFAAgF;AAChF,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAEnD;AAUD;6FAC6F;AAC7F,wBAAgB,gBAAgB,CAC9B,CAAC,EAAE,MAAM,EACT,CAAC,EAAE,MAAM,EACT,MAAM,EAAE,UAAU,EAClB,aAAa,EAAE,UAAU,GACxB,MAAM,CA+BR;AAED,sFAAsF;AACtF,wBAAgB,QAAQ,CAAC,MAAM,EAAE,UAAU,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,UAAU,GAAG,EAAE,GAAG,EAAE,CAErG;AAED,kEAAkE;AAClE,wBAAgB,oBAAoB,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,GAAG,CAMzE;AAID;;2FAE2F;AAC3F,wBAAsB,iBAAiB,CAAC,IAAI,EAAE;IAC5C,yCAAyC;IACzC,MAAM,EAAE,UAAU,CAAC;IACnB,oGAAoG;IACpG,YAAY,EAAE,MAAM,CAAC;IACrB,iGAAiG;IACjG,cAAc,EAAE,CAAC,MAAM,EAAE,UAAU,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;CAC7D,GAAG,OAAO,CAAC,GAAG,CAAC,CAUf"}