@agenticprimitives/key-custody 0.1.0-alpha.3 → 1.0.0-alpha.11

package/dist/kms/secp256k1-core.js

@@ -0,0 +1,209 @@
+// secp256k1 KMS signing core — the CONSUMER-SAFE, peer-dependency-free surface (spec 276 KCS-D1).
+//
+// This module contains the raw cryptography for turning a Cloud-KMS-style
+// secp256k1 asymmetric signature into an Ethereum-compatible 65-byte
+// `(r,s,v)` signature, plus SPKI public-key → address derivation. It is the
+// extract that lets an external consumer import the primitive instead of
+// inlining a copy (the demo-validator `kms-signer.ts` problem).
+//
+// HARD CONSTRAINT (enforced by test/unit/kms-core-import-graph.test.ts):
+//   This file and everything it imports MUST depend ONLY on `@noble/curves`,
+//   `@noble/hashes`, and Web/Node built-ins. NO `viem`, NO `@agenticprimitives/*`.
+//   That is the entire point — a standalone external app can import
+//   `@agenticprimitives/key-custody/kms-core` with no viem / audit / connect-auth peer install.
+//
+// The audited, viem-typed `GcpKmsSigner` (providers/gcp.ts) is a thin wrapper
+// over this core — one implementation, two surfaces (no second KMS path).
+import { secp256k1 } from '@noble/curves/secp256k1.js';
+import { keccak_256 } from '@noble/hashes/sha3.js';
+// ── secp256k1 constants ──────────────────────────────────────────────
+const SECP256K1_N = secp256k1.Point.Fn.ORDER;
+const SECP256K1_HALF_N = SECP256K1_N >> 1n;
+// ── hex / base64 / PEM helpers (viem-free) ───────────────────────────
+/** Bytes → `0x`-prefixed lowercase hex. Byte-for-byte compatible with viem's `bytesToHex`. */
+export function bytesToHex(bytes) {
+    let h = '';
+    for (let i = 0; i < bytes.length; i++)
+        h += bytes[i].toString(16).padStart(2, '0');
+    return `0x${h}`;
+}
+export function base64UrlEncode(bytes) {
+    let str = '';
+    for (let i = 0; i < bytes.length; i++)
+        str += String.fromCharCode(bytes[i]);
+    return btoa(str).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+export function base64Decode(s) {
+    const binary = atob(s);
+    const out = new Uint8Array(binary.length);
+    for (let i = 0; i < binary.length; i++)
+        out[i] = binary.charCodeAt(i);
+    return out;
+}
+export function base64Encode(bytes) {
+    let str = '';
+    for (let i = 0; i < bytes.length; i++)
+        str += String.fromCharCode(bytes[i]);
+    return btoa(str);
+}
+export function pemToDer(pem) {
+    const lines = pem
+        .split('\n')
+        .filter((l) => !l.startsWith('-----') && l.trim().length > 0)
+        .join('');
+    return base64Decode(lines);
+}
+// ── bigint <-> bytes ─────────────────────────────────────────────────
+function bytesToBigInt(bytes) {
+    let n = 0n;
+    for (const b of bytes)
+        n = (n << 8n) | BigInt(b);
+    return n;
+}
+export function bigIntTo32Bytes(n) {
+    const out = new Uint8Array(32);
+    let v = n;
+    for (let i = 31; i >= 0; i--) {
+        out[i] = Number(v & 0xffn);
+        v >>= 8n;
+    }
+    return out;
+}
+// ── DER ECDSA signature parsing ──────────────────────────────────────
+/** Parse a DER-encoded ECDSA signature → `(r, s)`. Range-validates `0 < r,s < n`
+ *  (audit F-7): a degenerate KMS response (r/s = 0 or ≥ n) is never valid — fail closed. */
+export function parseDerEcdsa(der) {
+    const at = (idx) => {
+        const b = der[idx];
+        if (b === undefined)
+            throw new Error(`DER: unexpected end of buffer at offset ${idx}`);
+        return b;
+    };
+    let i = 0;
+    if (at(i++) !== 0x30)
+        throw new Error('DER: expected SEQUENCE tag (0x30)');
+    // Skip length. Handle short and long form.
+    const lenByte = at(i++);
+    if (lenByte & 0x80) {
+        const lenBytes = lenByte & 0x7f;
+        i += lenBytes;
+    }
+    if (at(i++) !== 0x02)
+        throw new Error('DER: expected INTEGER tag for r');
+    const rLen = at(i++);
+    const rBytes = der.slice(i, i + rLen);
+    i += rLen;
+    if (at(i++) !== 0x02)
+        throw new Error('DER: expected INTEGER tag for s');
+    const sLen = at(i++);
+    const sBytes = der.slice(i, i + sLen);
+    const r = bytesToBigInt(rBytes);
+    const s = bytesToBigInt(sBytes);
+    if (r <= 0n || r >= SECP256K1_N || s <= 0n || s >= SECP256K1_N) {
+        throw new Error('DER: r/s out of range (require 0 < r,s < n)');
+    }
+    return { r, s };
+}
+/** spec-276 alias for {@link parseDerEcdsa}. */
+export const parseDerEcdsaSignature = parseDerEcdsa;
+/** Normalize `s` to its low-s form (EIP-2): malleability-canonical signatures only. */
+export function normalizeLowS(s) {
+    return s > SECP256K1_HALF_N ? SECP256K1_N - s : s;
+}
+/** spec-276 alias for {@link normalizeLowS}. */
+export const toLowS = normalizeLowS;
+// ── SPKI public-key parsing + address derivation ─────────────────────
+/** Extract the trailing 65-byte uncompressed secp256k1 point (`0x04||X||Y`) from an SPKI DER blob. */
+export function parseSpkiUncompressedSecp256k1PubKey(spkiDer) {
+    if (spkiDer.length < 66) {
+        throw new Error(`SPKI too short to contain uncompressed secp256k1 pubkey: ${spkiDer.length} bytes`);
+    }
+    const tail = spkiDer.slice(spkiDer.length - 65);
+    const marker = tail[0];
+    if (marker !== 0x04) {
+        throw new Error(`SPKI does not end with uncompressed point marker (0x04). Wrong key algorithm? ` +
+            `Found 0x${(marker ?? 0).toString(16).padStart(2, '0')} at position ${spkiDer.length - 65}.`);
+    }
+    return tail;
+}
+/** `0x04||X||Y` (65 bytes) → EVM address (`keccak256(X||Y)[-20:]`). */
+export function publicKeyToAddress(pubKey65) {
+    const raw = pubKey65.slice(1);
+    const hash = keccak_256(raw);
+    return bytesToHex(hash.slice(12));
+}
+/** Convenience: SPKI PEM (the Cloud KMS `publicKey` response) → EVM address. */
+export function addressFromSpkiPem(pem) {
+    return publicKeyToAddress(parseSpkiUncompressedSecp256k1PubKey(pemToDer(pem)));
+}
+// ── recovery-byte search ─────────────────────────────────────────────
+function bytesEqual(a, b) {
+    if (a.length !== b.length)
+        return false;
+    for (let i = 0; i < a.length; i++)
+        if (a[i] !== b[i])
+            return false;
+    return true;
+}
+/** Cloud KMS does not return the recovery bit; recover it by trying v∈{27,28}
+ *  against the known uncompressed public key. Throws (redacted error) if neither matches. */
+export function findRecoveryByte(r, s, digest, knownPubKey65) {
+    const rBytes = bigIntTo32Bytes(r);
+    const sBytes = bigIntTo32Bytes(s);
+    const compact = new Uint8Array(64);
+    compact.set(rBytes, 0);
+    compact.set(sBytes, 32);
+    const attempts = [];
+    for (let recovery = 0; recovery < 2; recovery++) {
+        try {
+            const sig = secp256k1.Signature.fromBytes(compact).addRecoveryBit(recovery);
+            const recovered = sig.recoverPublicKey(digest).toBytes(false);
+            attempts.push(`v=${recovery + 27} recovered=${bytesToHex(recovered)}`);
+            if (bytesEqual(recovered, knownPubKey65))
+                return recovery + 27;
+        }
+        catch (e) {
+            attempts.push(`v=${recovery + 27} threw ${e instanceof Error ? e.message : String(e)}`);
+        }
+    }
+    // Redact operational fingerprints (digest/pubkey are chain-correlatable / long-lived
+    // identity) to keccak-prefix-8 — still actionable, no raw values leaked (PKG-KEY-CUSTODY-004).
+    const tag = (label, b) => `${label}=${bytesToHex(keccak_256(b)).slice(0, 8)}`;
+    // eslint-disable-next-line no-console
+    console.error('[gcp-kms findRecoveryByte] mismatch:', {
+        digestTag: tag('k', digest),
+        rTag: tag('k', rBytes),
+        sTag: tag('k', sBytes),
+        knownPubKeyTag: tag('k', knownPubKey65),
+        attempts,
+    });
+    throw new Error('Recovery byte search failed: neither v=27 nor v=28 recovers the known public key. ' + attempts.join(' | '));
+}
+/** spec-276 ordering of {@link findRecoveryByte}: `(digest, r, s, knownPubKey65)`. */
+export function recoverV(digest, r, s, knownPubKey65) {
+    return findRecoveryByte(r, s, digest, knownPubKey65);
+}
+/** Assemble an Ethereum 65-byte `(r,s,v)` signature as 0x hex. */
+export function assembleEthSignature(r, s, v) {
+    const sig65 = new Uint8Array(65);
+    sig65.set(bigIntTo32Bytes(r), 0);
+    sig65.set(bigIntTo32Bytes(s), 32);
+    sig65[64] = v;
+    return bytesToHex(sig65);
+}
+// ── high-level: digest → eth signature, transport injected ───────────
+/** Turn a raw KMS asymmetric-sign (DER output) into an Ethereum `(r,s,v)` signature.
+ *  Transport is INJECTED (`asymmetricSign`) so this stays peer-dependency-free and
+ *  testable: the caller supplies however it reaches Cloud KMS. Returns 0x-hex 65 bytes. */
+export async function signDigestWithKms(opts) {
+    if (opts.digest.length !== 32) {
+        throw new Error(`signDigestWithKms expects a 32-byte digest; got ${opts.digest.length}.`);
+    }
+    const pub65 = parseSpkiUncompressedSecp256k1PubKey(pemToDer(opts.publicKeyPem));
+    const der = await opts.asymmetricSign(opts.digest);
+    const { r, s: rawS } = parseDerEcdsa(der);
+    const s = normalizeLowS(rawS);
+    const v = recoverV(opts.digest, r, s, pub65);
+    return assembleEthSignature(r, s, v);
+}
+//# sourceMappingURL=secp256k1-core.js.map

package/dist/kms/secp256k1-core.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secp256k1-core.js","sourceRoot":"","sources":["../../src/kms/secp256k1-core.ts"],"names":[],"mappings":"AAAA,kGAAkG;AAClG,EAAE;AACF,0EAA0E;AAC1E,qEAAqE;AACrE,4EAA4E;AAC5E,yEAAyE;AACzE,gEAAgE;AAChE,EAAE;AACF,yEAAyE;AACzE,6EAA6E;AAC7E,mFAAmF;AACnF,oEAAoE;AACpE,gGAAgG;AAChG,EAAE;AACF,8EAA8E;AAC9E,0EAA0E;AAE1E,OAAO,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAEnD,wEAAwE;AACxE,MAAM,WAAW,GAAG,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC;AAC7C,MAAM,gBAAgB,GAAG,WAAW,IAAI,EAAE,CAAC;AAK3C,wEAAwE;AAExE,8FAA8F;AAC9F,MAAM,UAAU,UAAU,CAAC,KAAiB;IAC1C,IAAI,CAAC,GAAG,EAAE,CAAC;IACX,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,CAAC,IAAI,KAAK,CAAC,CAAC,CAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACpF,OAAO,KAAK,CAAC,EAAE,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAiB;IAC/C,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;IAC7E,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC9E,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,CAAS;IACpC,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACvB,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC1C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,GAAG,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IACtE,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,KAAiB;IAC5C,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;IAC7E,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,GAAW;IAClC,MAAM,KAAK,GAAG,GAAG;SACd,KAAK,CAAC,IAAI,CAAC;SACX,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;SAC5D,IAAI,CAAC,EAAE,CAAC,CAAC;IACZ,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC;AAC7B,CAAC;AAED,wEAAwE;AAExE,SAAS,aAAa,CAAC,KAAiB;IACtC,IAAI,CAAC,GAAG,EAAE,CAAC;IACX,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IACjD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,CAAS;IACvC,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IAC/B,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,KAAK,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7B,GAAG,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC;QAC3B,CAAC,KAAK,EAAE,CAAC;IACX,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,wEAAwE;AAExE;4FAC4F;AAC5F,MAAM,UAAU,aAAa,CAAC,GAAe;IAC3C,MAAM,EAAE,GAAG,CAAC,GAAW,EAAU,EAAE;QACjC,MAAM,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;QACnB,IAAI,CAAC,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,GAAG,EAAE,CAAC,CAAC;QACvF,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;IACF,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IAC3E,2CAA2C;IAC3C,MAAM,OAAO,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;IACxB,IAAI,OAAO,GAAG,IAAI,EAAE,CAAC;QACnB,MAAM,QAAQ,GAAG,OAAO,GAAG,IAAI,CAAC;QAChC,CAAC,IAAI,QAAQ,CAAC;IAChB,CAAC;IACD,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACzE,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;IACrB,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;IACtC,CAAC,IAAI,IAAI,CAAC;IACV,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACzE,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;IACrB,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;IACtC,MAAM,CAAC,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IAChC,MAAM,CAAC,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IAChC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,WAAW,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,WAAW,EAAE,CAAC;QAC/D,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;AAClB,CAAC;AAED,gDAAgD;AAChD,MAAM,CAAC,MAAM,sBAAsB,GAAG,aAAa,CAAC;AAEpD,uFAAuF;AACvF,MAAM,UAAU,aAAa,CAAC,CAAS;IACrC,OAAO,CAAC,GAAG,gBAAgB,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACpD,CAAC;AAED,gDAAgD;AAChD,MAAM,CAAC,MAAM,MAAM,GAAG,aAAa,CAAC;AAEpC,wEAAwE;AAExE,sGAAsG;AACtG,MAAM,UAAU,oCAAoC,CAAC,OAAmB;IACtE,IAAI,OAAO,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,4DAA4D,OAAO,CAAC,MAAM,QAAQ,CAAC,CAAC;IACtG,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACvB,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CACb,gFAAgF;YAC9E,WAAW,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,gBAAgB,OAAO,CAAC,MAAM,GAAG,EAAE,GAAG,CAC/F,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,kBAAkB,CAAC,QAAoB;IACrD,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC9B,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAC7B,OAAO,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;AACpC,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,kBAAkB,CAAC,GAAW;IAC5C,OAAO,kBAAkB,CAAC,oCAAoC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AACjF,CAAC;AAED,wEAAwE;AAExE,SAAS,UAAU,CAAC,CAAa,EAAE,CAAa;IAC9C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;IACnE,OAAO,IAAI,CAAC;AACd,CAAC;AAED;6FAC6F;AAC7F,MAAM,UAAU,gBAAgB,CAC9B,CAAS,EACT,CAAS,EACT,MAAkB,EAClB,aAAyB;IAEzB,MAAM,MAAM,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC;IAClC,MAAM,OAAO,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IACnC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACvB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACxB,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,IAAI,QAAQ,GAAG,CAAC,EAAE,QAAQ,GAAG,CAAC,EAAE,QAAQ,EAAE,EAAE,CAAC;QAChD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,SAAS,CAAC,SAAS,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;YAC5E,MAAM,SAAS,GAAG,GAAG,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAC9D,QAAQ,CAAC,IAAI,CAAC,KAAK,QAAQ,GAAG,EAAE,cAAc,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YACvE,IAAI,UAAU,CAAC,SAAS,EAAE,aAAa,CAAC;gBAAE,OAAO,QAAQ,GAAG,EAAE,CAAC;QACjE,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,QAAQ,CAAC,IAAI,CAAC,KAAK,QAAQ,GAAG,EAAE,UAAU,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC1F,CAAC;IACH,CAAC;IACD,qFAAqF;IACrF,+FAA+F;IAC/F,MAAM,GAAG,GAAG,CAAC,KAAa,EAAE,CAAa,EAAU,EAAE,CAAC,GAAG,KAAK,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;IAC1G,sCAAsC;IACtC,OAAO,CAAC,KAAK,CAAC,sCAAsC,EAAE;QACpD,SAAS,EAAE,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC;QAC3B,IAAI,EAAE,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC;QACtB,IAAI,EAAE,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC;QACtB,cAAc,EAAE,GAAG,CAAC,GAAG,EAAE,aAAa,CAAC;QACvC,QAAQ;KACT,CAAC,CAAC;IACH,MAAM,IAAI,KAAK,CACb,oFAAoF,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAC5G,CAAC;AACJ,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,QAAQ,CAAC,MAAkB,EAAE,CAAS,EAAE,CAAS,EAAE,aAAyB;IAC1F,OAAO,gBAAgB,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,aAAa,CAAY,CAAC;AAClE,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,oBAAoB,CAAC,CAAS,EAAE,CAAS,EAAE,CAAS;IAClE,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IACjC,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IACjC,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAClC,KAAK,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;IACd,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC;AAC3B,CAAC;AAED,wEAAwE;AAExE;;2FAE2F;AAC3F,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAOvC;IACC,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,mDAAmD,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;IAC5F,CAAC;IACD,MAAM,KAAK,GAAG,oCAAoC,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;IAChF,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACnD,MAAM,EAAE,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IAC1C,MAAM,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;IAC7C,OAAO,oBAAoB,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;AACvC,CAAC"}

package/dist/kms-viem-account.d.ts

@@ -1,4 +1,4 @@
 import { type LocalAccount } from 'viem';
-import type { KmsAccountBackend } from './types';
+import type { KmsAccountBackend } from './types.js';
 export declare function createKmsViemAccount(backend: KmsAccountBackend): Promise<LocalAccount>;
 //# sourceMappingURL=kms-viem-account.d.ts.map

package/dist/kms-viem-account.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"kms-viem-account.d.ts","sourceRoot":"","sources":["../src/kms-viem-account.ts"],"names":[],"mappings":"AAqBA,OAAO,EASL,KAAK,YAAY,EAElB,MAAM,MAAM,CAAC;AACd,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AA0BjD,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,YAAY,CAAC,CAwC5F"}
+{"version":3,"file":"kms-viem-account.d.ts","sourceRoot":"","sources":["../src/kms-viem-account.ts"],"names":[],"mappings":"AAqBA,OAAO,EASL,KAAK,YAAY,EAElB,MAAM,MAAM,CAAC;AACd,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AA0BpD,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,YAAY,CAAC,CAwC5F"}

package/dist/providers/aws.d.ts

@@ -1,12 +1,15 @@
-import type { A2AKeyProvider, KmsAccountBackend } from '../types';
+import type { A2AKeyProvider, KmsAccountBackend } from '../types.js';
 import type { Address } from '@agenticprimitives/types';
+export declare const AWS_KMS_NOT_IMPLEMENTED: string;
 export declare class AwsKmsProvider implements A2AKeyProvider {
     readonly keyVersion = "aws-kms:not-implemented";
+    constructor();
     generateSessionDataKey(): Promise<never>;
     decryptSessionDataKey(): Promise<never>;
 }
 export declare class AwsKmsSigner implements KmsAccountBackend {
     readonly provider: "aws-kms";
+    constructor();
     signA2AAction(): Promise<never>;
     getSignerAddress(): Promise<Address>;
 }

package/dist/providers/aws.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"aws.d.ts","sourceRoot":"","sources":["../../src/providers/aws.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAClE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AAIxD,qBAAa,cAAe,YAAW,cAAc;IACnD,QAAQ,CAAC,UAAU,6BAA6B;IAC1C,sBAAsB,IAAI,OAAO,CAAC,KAAK,CAAC;IACxC,qBAAqB,IAAI,OAAO,CAAC,KAAK,CAAC;CAC9C;AAED,qBAAa,YAAa,YAAW,iBAAiB;IACpD,QAAQ,CAAC,QAAQ,EAAG,SAAS,CAAU;IACjC,aAAa,IAAI,OAAO,CAAC,KAAK,CAAC;IAC/B,gBAAgB,IAAI,OAAO,CAAC,OAAO,CAAC;CAC3C"}
+{"version":3,"file":"aws.d.ts","sourceRoot":"","sources":["../../src/providers/aws.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACrE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AAExD,eAAO,MAAM,uBAAuB,QAEyE,CAAC;AAE9G,qBAAa,cAAe,YAAW,cAAc;IACnD,QAAQ,CAAC,UAAU,6BAA6B;;IAG1C,sBAAsB,IAAI,OAAO,CAAC,KAAK,CAAC;IACxC,qBAAqB,IAAI,OAAO,CAAC,KAAK,CAAC;CAC9C;AAED,qBAAa,YAAa,YAAW,iBAAiB;IACpD,QAAQ,CAAC,QAAQ,EAAG,SAAS,CAAU;;IAGjC,aAAa,IAAI,OAAO,CAAC,KAAK,CAAC;IAC/B,gBAAgB,IAAI,OAAO,CAAC,OAAO,CAAC;CAC3C"}

package/dist/providers/aws.js

@@ -1,14 +1,24 @@
-// AwsKmsProvider / AwsKmsSigner — production AWS KMS backends.
-// Stubs in v0 demo; full implementation lands in v0.1.
-const NOT_IMPLEMENTED = 'AwsKmsProvider / AwsKmsSigner not yet implemented in v0; use LocalAesProvider for the demo.';
+// AwsKmsProvider / AwsKmsSigner — AWS KMS backend (NOT YET IMPLEMENTED).
+//
+// AUDIT N-2: these must FAIL FAST. Previously the classes constructed cleanly and threw only on the
+// first signing/encryption call — a deferred-failure footgun: an operator who selects `aws-kms` for a
+// real deployment boots fine and explodes on the first hot-path op. Per the package's "fail-closed at
+// boot" invariant (CLAUDE.md security invariants), construction now throws. Only `gcp-kms` is
+// production-ready (spec 214 §5 is single-chain GCP-KMS); `aws-kms` is reserved, not wired.
+export const AWS_KMS_NOT_IMPLEMENTED = '[key-custody] aws-kms backend is not implemented. Use backend "gcp-kms" for real deploys ' +
+    '(the only production-ready KMS, spec 214 §5) or "local-aes" for dev. `aws-kms` is reserved but not wired.';
 export class AwsKmsProvider {
     keyVersion = 'aws-kms:not-implemented';
-    async generateSessionDataKey() { throw new Error(NOT_IMPLEMENTED); }
-    async decryptSessionDataKey() { throw new Error(NOT_IMPLEMENTED); }
+    // Fail fast at construction (N-2) rather than on the first generate/decrypt call.
+    constructor() { throw new Error(AWS_KMS_NOT_IMPLEMENTED); }
+    async generateSessionDataKey() { throw new Error(AWS_KMS_NOT_IMPLEMENTED); }
+    async decryptSessionDataKey() { throw new Error(AWS_KMS_NOT_IMPLEMENTED); }
 }
 export class AwsKmsSigner {
     provider = 'aws-kms';
-    async signA2AAction() { throw new Error(NOT_IMPLEMENTED); }
-    async getSignerAddress() { throw new Error(NOT_IMPLEMENTED); }
+    // Fail fast at construction (N-2) rather than on the first sign/getSignerAddress call.
+    constructor() { throw new Error(AWS_KMS_NOT_IMPLEMENTED); }
+    async signA2AAction() { throw new Error(AWS_KMS_NOT_IMPLEMENTED); }
+    async getSignerAddress() { throw new Error(AWS_KMS_NOT_IMPLEMENTED); }
 }
 //# sourceMappingURL=aws.js.map

package/dist/providers/aws.js.map

@@ -1 +1 @@
-{"version":3,"file":"aws.js","sourceRoot":"","sources":["../../src/providers/aws.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAC/D,uDAAuD;AAKvD,MAAM,eAAe,GAAG,6FAA6F,CAAC;AAEtH,MAAM,OAAO,cAAc;IAChB,UAAU,GAAG,yBAAyB,CAAC;IAChD,KAAK,CAAC,sBAAsB,KAAqB,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;IACpF,KAAK,CAAC,qBAAqB,KAAqB,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;CACpF;AAED,MAAM,OAAO,YAAY;IACd,QAAQ,GAAG,SAAkB,CAAC;IACvC,KAAK,CAAC,aAAa,KAAqB,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;IAC3E,KAAK,CAAC,gBAAgB,KAAuB,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;CACjF"}
+{"version":3,"file":"aws.js","sourceRoot":"","sources":["../../src/providers/aws.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,EAAE;AACF,oGAAoG;AACpG,sGAAsG;AACtG,sGAAsG;AACtG,8FAA8F;AAC9F,4FAA4F;AAK5F,MAAM,CAAC,MAAM,uBAAuB,GAClC,2FAA2F;IAC3F,2GAA2G,CAAC;AAE9G,MAAM,OAAO,cAAc;IAChB,UAAU,GAAG,yBAAyB,CAAC;IAChD,kFAAkF;IAClF,gBAAgB,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC;IAC3D,KAAK,CAAC,sBAAsB,KAAqB,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC;IAC5F,KAAK,CAAC,qBAAqB,KAAqB,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC;CAC5F;AAED,MAAM,OAAO,YAAY;IACd,QAAQ,GAAG,SAAkB,CAAC;IACvC,uFAAuF;IACvF,gBAAgB,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC;IAC3D,KAAK,CAAC,aAAa,KAAqB,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC;IACnF,KAAK,CAAC,gBAAgB,KAAuB,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC,CAAC,CAAC;CACzF"}

package/dist/providers/gcp.d.ts

@@ -1,17 +1,8 @@
-import { type Address } from 'viem';
+import type { Address } from 'viem';
 import { type AuditSink } from '@agenticprimitives/audit';
-import type { A2AKeyProvider, KmsAccountBackend } from '../types';
-interface ServiceAccount {
-    client_email: string;
-    /** PEM-encoded PKCS#8 RSA private key. */
-    private_key: string;
-    project_id?: string;
-}
-interface CachedToken {
-    accessToken: string;
-    /** Unix seconds at which the token must be refreshed (already minus buffer). */
-    expiresAt: number;
-}
+import type { A2AKeyProvider, KmsAccountBackend } from '../types.js';
+export { base64UrlEncode, pemToDer, parseDerEcdsa, normalizeLowS, bigIntTo32Bytes, parseSpkiUncompressedSecp256k1PubKey, publicKeyToAddress, findRecoveryByte, } from '../kms/secp256k1-core.js';
+export { signJwt, fetchAccessToken } from '../kms/gcp-transport.js';
 export interface GcpKmsSignerOpts {
     /**
      * Full Cloud KMS resource name of the key version to sign with, e.g.
@@ -22,31 +13,16 @@ export interface GcpKmsSignerOpts {
     /** Raw JSON string of the service-account key file. */
     serviceAccountJson: string;
 }
-export declare function base64UrlEncode(bytes: Uint8Array): string;
-export declare function pemToDer(pem: string): Uint8Array;
-export declare function signJwt(serviceAccount: ServiceAccount, scope: string): Promise<string>;
-export declare function fetchAccessToken(serviceAccount: ServiceAccount): Promise<CachedToken>;
-export declare function parseSpkiUncompressedSecp256k1PubKey(spkiDer: Uint8Array): Uint8Array;
-export declare function publicKeyToAddress(pubKey65: Uint8Array): Address;
-export declare function parseDerEcdsa(der: Uint8Array): {
-    r: bigint;
-    s: bigint;
-};
-export declare function bigIntTo32Bytes(n: bigint): Uint8Array;
-export declare function normalizeLowS(s: bigint): bigint;
-export declare function findRecoveryByte(r: bigint, s: bigint, digest: Uint8Array, knownPubKey65: Uint8Array): number;
 export declare class GcpKmsSigner implements KmsAccountBackend {
     readonly provider: "gcp-kms";
     private readonly keyName;
-    private readonly serviceAccount;
+    private readonly transport;
     private readonly auditSink?;
-    private cachedToken?;
     private cachedPubKey65?;
     private cachedAddress?;
     constructor(opts?: Partial<GcpKmsSignerOpts> & {
         auditSink?: AuditSink;
     });
-    private getAccessToken;
     private getPublicKeyBytes;
     getSignerAddress(): Promise<Address>;
     signA2AAction(input: {
@@ -71,18 +47,30 @@ export interface GcpKmsProviderOpts {
     cryptoKeyName: string;
     /** Raw JSON string of the service-account key file. */
     serviceAccountJson: string;
-}
-export declare class GcpKmsProvider implements A2AKeyProvider {
     /**
-     * H7-F.4: this default is now ONLY used when the GCP encrypt response
-     * doesn't carry a `name` field (test fixtures + offline mocks). Real
-     * runs derive `keyVersion` from the response per call.
+     * Optional audit sink (spec 278 P0). When set, each envelope op emits a
+     * `key-custody.envelope.{wrap,unwrap}` row carrying refs/hashes ONLY
+     * (`keyId`, `keyVersion`, `aadHash`) — never the data key or plaintext.
+     * Fail-soft: an audit failure never breaks the crypto op.
      */
+    auditSink?: AuditSink;
+}
+export declare class GcpKmsProvider implements A2AKeyProvider {
+    /** Only used when the GCP encrypt response doesn't carry a `name` (test fixtures). */
     readonly keyVersion = "gcp-kms:unknown";
     private readonly keyName;
     private readonly serviceAccount;
+    private readonly auditSink?;
     private cachedToken?;
-    constructor(opts?: Partial<GcpKmsProviderOpts>);
+    constructor(opts?: Partial<GcpKmsProviderOpts> & {
+        auditSink?: AuditSink;
+    });
+    /**
+     * Emit an envelope-op audit row (spec 278 P0). Refs/hashes ONLY — the AAD is
+     * hashed (never logged raw, since it can carry owner/resource identifiers),
+     * and the data key / plaintext never appear. Fail-soft.
+     */
+    private emitEnvelopeAudit;
     private getAccessToken;
     generateSessionDataKey(input: {
         aadContext: Record<string, string>;
@@ -99,5 +87,4 @@ export declare class GcpKmsProvider implements A2AKeyProvider {
         keyVersion: string;
     }): Promise<Uint8Array>;
 }
-export {};
 //# sourceMappingURL=gcp.d.ts.map

package/dist/providers/gcp.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gcp.d.ts","sourceRoot":"","sources":["../../src/providers/gcp.ts"],"names":[],"mappings":"AA6BA,OAAO,EAAc,KAAK,OAAO,EAAE,MAAM,MAAM,CAAC;AAChD,OAAO,EAAc,KAAK,SAAS,EAAE,MAAM,0BAA0B,CAAC;AACtE,OAAO,KAAK,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAkBlE,UAAU,cAAc;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,0CAA0C;IAC1C,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,UAAU,WAAW;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,gFAAgF;IAChF,SAAS,EAAE,MAAM,CAAC;CACnB;AAYD,MAAM,WAAW,gBAAgB;IAC/B;;;;OAIG;IACH,oBAAoB,EAAE,MAAM,CAAC;IAC7B,uDAAuD;IACvD,kBAAkB,EAAE,MAAM,CAAC;CAC5B;AAMD,wBAAgB,eAAe,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAIzD;AAeD,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAMhD;AAMD,wBAAsB,OAAO,CAAC,cAAc,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAiC5F;AAED,wBAAsB,gBAAgB,CAAC,cAAc,EAAE,cAAc,GAAG,OAAO,CAAC,WAAW,CAAC,CAoB3F;AAiCD,wBAAgB,oCAAoC,CAAC,OAAO,EAAE,UAAU,GAAG,UAAU,CAkBpF;AAED,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,UAAU,GAAG,OAAO,CAKhE;AAMD,wBAAgB,aAAa,CAAC,GAAG,EAAE,UAAU,GAAG;IAAE,CAAC,EAAE,MAAM,CAAC;IAAC,CAAC,EAAE,MAAM,CAAA;CAAE,CA8BvE;AAQD,wBAAgB,eAAe,CAAC,CAAC,EAAE,MAAM,GAAG,UAAU,CAQrD;AAED,wBAAgB,aAAa,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAE/C;AAQD,wBAAgB,gBAAgB,CAC9B,CAAC,EAAE,MAAM,EACT,CAAC,EAAE,MAAM,EACT,MAAM,EAAE,UAAU,EAClB,aAAa,EAAE,UAAU,GACxB,MAAM,CA6BR;AAMD,qBAAa,YAAa,YAAW,iBAAiB;IACpD,QAAQ,CAAC,QAAQ,EAAG,SAAS,CAAU;IACvC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAiB;IAChD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAY;IACvC,OAAO,CAAC,WAAW,CAAC,CAAc;IAClC,OAAO,CAAC,cAAc,CAAC,CAAa;IACpC,OAAO,CAAC,aAAa,CAAC,CAAU;gBAEpB,IAAI,CAAC,EAAE,OAAO,CAAC,gBAAgB,CAAC,GAAG;QAAE,SAAS,CAAC,EAAE,SAAS,CAAA;KAAE;YAyB1D,cAAc;YASd,iBAAiB;IAwBzB,gBAAgB,IAAI,OAAO,CAAC,OAAO,CAAC;IAOpC,aAAa,CAAC,KAAK,EAAE;QACzB,MAAM,EAAE,UAAU,CAAC;QACnB,YAAY,CAAC,EAAE;YAAE,MAAM,CAAC,EAAE,MAAM,CAAC;YAAC,SAAS,CAAC,EAAE,MAAM,CAAC;YAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;KAC3E,GAAG,OAAO,CAAC;QAAE,SAAS,EAAE,UAAU,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,OAAO,CAAA;KAAE,CAAC;CAsD9E;AAmBD,MAAM,WAAW,kBAAkB;IACjC;;;;OAIG;IACH,aAAa,EAAE,MAAM,CAAC;IACtB,uDAAuD;IACvD,kBAAkB,EAAE,MAAM,CAAC;CAC5B;AAiCD,qBAAa,cAAe,YAAW,cAAc;IACnD;;;;OAIG;IACH,QAAQ,CAAC,UAAU,qBAAqB;IACxC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAiB;IAChD,OAAO,CAAC,WAAW,CAAC,CAAc;gBAEtB,IAAI,CAAC,EAAE,OAAO,CAAC,kBAAkB,CAAC;YAwBhC,cAAc;IAStB,sBAAsB,CAAC,KAAK,EAAE;QAClC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KACpC,GAAG,OAAO,CAAC;QACV,gBAAgB,EAAE,UAAU,CAAC;QAC7B,gBAAgB,EAAE,UAAU,CAAC;QAC7B,KAAK,EAAE,MAAM,CAAC;QACd,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC;IA6BI,qBAAqB,CAAC,KAAK,EAAE;QACjC,gBAAgB,EAAE,UAAU,CAAC;QAC7B,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACnC,KAAK,EAAE,MAAM,CAAC;QACd,UAAU,EAAE,MAAM,CAAC;KACpB,GAAG,OAAO,CAAC,UAAU,CAAC;CAwBxB"}
+{"version":3,"file":"gcp.d.ts","sourceRoot":"","sources":["../../src/providers/gcp.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AACpC,OAAO,EAAc,KAAK,SAAS,EAAE,MAAM,0BAA0B,CAAC;AACtE,OAAO,KAAK,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AA2BrE,OAAO,EACL,eAAe,EACf,QAAQ,EACR,aAAa,EACb,aAAa,EACb,eAAe,EACf,oCAAoC,EACpC,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAEpE,MAAM,WAAW,gBAAgB;IAC/B;;;;OAIG;IACH,oBAAoB,EAAE,MAAM,CAAC;IAC7B,uDAAuD;IACvD,kBAAkB,EAAE,MAAM,CAAC;CAC5B;AAMD,qBAAa,YAAa,YAAW,iBAAiB;IACpD,QAAQ,CAAC,QAAQ,EAAG,SAAS,CAAU;IACvC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAkB;IAC5C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAY;IACvC,OAAO,CAAC,cAAc,CAAC,CAAa;IACpC,OAAO,CAAC,aAAa,CAAC,CAAU;gBAEpB,IAAI,CAAC,EAAE,OAAO,CAAC,gBAAgB,CAAC,GAAG;QAAE,SAAS,CAAC,EAAE,SAAS,CAAA;KAAE;YA4B1D,iBAAiB;IAQzB,gBAAgB,IAAI,OAAO,CAAC,OAAO,CAAC;IAOpC,aAAa,CAAC,KAAK,EAAE;QACzB,MAAM,EAAE,UAAU,CAAC;QACnB,YAAY,CAAC,EAAE;YAAE,MAAM,CAAC,EAAE,MAAM,CAAC;YAAC,SAAS,CAAC,EAAE,MAAM,CAAC;YAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;KAC3E,GAAG,OAAO,CAAC;QAAE,SAAS,EAAE,UAAU,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,OAAO,CAAA;KAAE,CAAC;CA4C9E;AAeD,MAAM,WAAW,kBAAkB;IACjC;;;;OAIG;IACH,aAAa,EAAE,MAAM,CAAC;IACtB,uDAAuD;IACvD,kBAAkB,EAAE,MAAM,CAAC;IAC3B;;;;;OAKG;IACH,SAAS,CAAC,EAAE,SAAS,CAAC;CACvB;AAuBD,qBAAa,cAAe,YAAW,cAAc;IACnD,sFAAsF;IACtF,QAAQ,CAAC,UAAU,qBAAqB;IACxC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAiB;IAChD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAY;IACvC,OAAO,CAAC,WAAW,CAAC,CAAc;gBAEtB,IAAI,CAAC,EAAE,OAAO,CAAC,kBAAkB,CAAC,GAAG;QAAE,SAAS,CAAC,EAAE,SAAS,CAAA;KAAE;IA4B1E;;;;OAIG;YACW,iBAAiB;YAyBjB,cAAc;IAStB,sBAAsB,CAAC,KAAK,EAAE;QAClC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KACpC,GAAG,OAAO,CAAC;QACV,gBAAgB,EAAE,UAAU,CAAC;QAC7B,gBAAgB,EAAE,UAAU,CAAC;QAC7B,KAAK,EAAE,MAAM,CAAC;QACd,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC;IAoBI,qBAAqB,CAAC,KAAK,EAAE;QACjC,gBAAgB,EAAE,UAAU,CAAC;QAC7B,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACnC,KAAK,EAAE,MAAM,CAAC;QACd,UAAU,EAAE,MAAM,CAAC;KACpB,GAAG,OAAO,CAAC,UAAU,CAAC;CAuBxB"}