@agenticprimitives/key-custody 0.1.0-alpha.3 → 1.0.0-alpha.11

package/dist/providers/gcp.js

@@ -1,270 +1,40 @@
-// GcpKmsSigner — production GCP Cloud KMS asymmetric-sign backend.
+// GcpKmsSigner / GcpKmsProvider — production GCP Cloud KMS backends.
 //
-// Cloudflare-Workers-compatible: drives the Cloud KMS REST API directly via
-// fetch + Web Crypto for JWT auth. The @google-cloud/kms SDK uses gRPC and
-// won't run on Workers; this implementation avoids gRPC entirely.
+// The signing CRYPTO + REST transport now live in the consumer-safe, peer-
+// dependency-free core (`../kms/secp256k1-core`, `../kms/gcp-transport`,
+// barrel `../kms/kms-core`) so external apps can import the primitive instead
+// of inlining it (spec 276). THIS file is the thin, audited, viem-typed
+// wrapper: it adds the `KmsAccountBackend` shape, viem `Address` typing, and
+// the optional audit sink (`key-custody.sign`). One implementation, two
+// surfaces — no second KMS path.
 //
-// Auth: service-account JSON → RS256 JWT (signed via crypto.subtle) →
-//   exchanged for an OAuth access token at oauth2.googleapis.com/token.
-//   Token cached with expiry buffer.
-//
-// Signing: POST cryptoKeyVersions/N:asymmetricSign with `digest.sha256`
-//   carrying our 32-byte keccak256 digest. Cloud KMS signs it as-is
-//   (does NOT re-hash) for `EC_SIGN_SECP256K1_SHA256` keys. Response is
-//   DER-encoded ECDSA (r,s). We:
-//     1. parse DER → (r, s)
-//     2. normalize s to low-s form (EIP-2)
-//     3. search recovery byte by trying v∈{27,28} against the known pubkey
-//       (Cloud KMS doesn't return the recovery bit)
-//
-// Public key: GET cryptoKeyVersions/N/publicKey returns PEM SPKI. We parse
-//   the trailing 65-byte uncompressed point (0x04||X||Y), compute
-//   keccak256(X||Y), take last 20 bytes → Ethereum address. Cached forever.
-//
-// GcpKmsProvider (envelope encryption via GCP KMS Encrypt/Decrypt) remains a
-// stub — that's a separate v0.2 follow-up. The signer covers the production
-// path for the agent's master-key requirement.
-import { secp256k1 } from '@noble/curves/secp256k1';
-import { keccak_256 } from '@noble/hashes/sha3';
-import { bytesToHex } from 'viem';
+// GcpKmsProvider (envelope encryption via GCP KMS Encrypt/Decrypt) is
+// IMPLEMENTED: it wraps/unwraps a per-row 32-byte data key with Cloud KMS
+// :encrypt/:decrypt under the AAD-bound EncryptionContext, and (spec 278 P0)
+// emits a `key-custody.envelope.{wrap,unwrap}` audit row per op (refs/hashes
+// only). It uses a DIFFERENT symmetric KMS key from the signer (master-key
+// separation). Residual per-person-KEK selection + person-SA AAD binding is
+// spec 278 (per-person vault key binding), not a crypto gap.
+import { keccak_256 } from '@noble/hashes/sha3.js';
+import { sha256 } from '@noble/hashes/sha2.js';
 import { buildEvent } from '@agenticprimitives/audit';
-import { canonicalContextBytes } from '../aad';
-// ─────────────────────────────────────────────────────────────────────
-// Constants
-// ─────────────────────────────────────────────────────────────────────
-const GOOGLE_TOKEN_URL = 'https://oauth2.googleapis.com/token';
-const CLOUDKMS_SCOPE = 'https://www.googleapis.com/auth/cloudkms';
-const CLOUDKMS_BASE = 'https://cloudkms.googleapis.com/v1/';
-const TOKEN_EXPIRY_BUFFER_SECONDS = 60;
-const SECP256K1_N = secp256k1.CURVE.n;
-const SECP256K1_HALF_N = SECP256K1_N >> 1n;
+import { canonicalContextBytes } from '../aad.js';
+import { bytesToHex, base64Decode, base64Encode, pemToDer, bigIntTo32Bytes, parseDerEcdsa, normalizeLowS, parseSpkiUncompressedSecp256k1PubKey, publicKeyToAddress, findRecoveryByte, } from '../kms/secp256k1-core.js';
+import { fetchAccessToken, callKms, createGcpKmsTransport, } from '../kms/gcp-transport.js';
+import { parseServiceAccountJson } from '../kms/key-map.js';
+// Re-export the consumer-safe helpers under their established names so existing
+// importers (unit tests + any downstream) keep resolving them from this module.
+// New code should prefer the `@agenticprimitives/key-custody/kms-core` subpath.
+export { base64UrlEncode, pemToDer, parseDerEcdsa, normalizeLowS, bigIntTo32Bytes, parseSpkiUncompressedSecp256k1PubKey, publicKeyToAddress, findRecoveryByte, } from '../kms/secp256k1-core.js';
+export { signJwt, fetchAccessToken } from '../kms/gcp-transport.js';
 // ─────────────────────────────────────────────────────────────────────
-// Base64 / PEM helpers
-// ─────────────────────────────────────────────────────────────────────
-export function base64UrlEncode(bytes) {
-    let str = '';
-    for (let i = 0; i < bytes.length; i++)
-        str += String.fromCharCode(bytes[i]);
-    return btoa(str).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
-}
-function base64Decode(s) {
-    const binary = atob(s);
-    const out = new Uint8Array(binary.length);
-    for (let i = 0; i < binary.length; i++)
-        out[i] = binary.charCodeAt(i);
-    return out;
-}
-function base64Encode(bytes) {
-    let str = '';
-    for (let i = 0; i < bytes.length; i++)
-        str += String.fromCharCode(bytes[i]);
-    return btoa(str);
-}
-export function pemToDer(pem) {
-    const lines = pem
-        .split('\n')
-        .filter((l) => !l.startsWith('-----') && l.trim().length > 0)
-        .join('');
-    return base64Decode(lines);
-}
-// ─────────────────────────────────────────────────────────────────────
-// JWT signing + token exchange
-// ─────────────────────────────────────────────────────────────────────
-export async function signJwt(serviceAccount, scope) {
-    const now = Math.floor(Date.now() / 1000);
-    const header = { alg: 'RS256', typ: 'JWT' };
-    const payload = {
-        iss: serviceAccount.client_email,
-        scope,
-        aud: GOOGLE_TOKEN_URL,
-        iat: now,
-        exp: now + 3600,
-    };
-    const encoder = new TextEncoder();
-    const headerB64 = base64UrlEncode(encoder.encode(JSON.stringify(header)));
-    const payloadB64 = base64UrlEncode(encoder.encode(JSON.stringify(payload)));
-    const signingInput = `${headerB64}.${payloadB64}`;
-    const keyDer = pemToDer(serviceAccount.private_key);
-    // Copy into a fresh ArrayBuffer so the typing satisfies BufferSource
-    // (TS lib.dom narrowed Uint8Array.buffer to ArrayBufferLike in 5.7).
-    const keyBuffer = new ArrayBuffer(keyDer.byteLength);
-    new Uint8Array(keyBuffer).set(keyDer);
-    const key = await globalThis.crypto.subtle.importKey('pkcs8', keyBuffer, { name: 'RSASSA-PKCS1-v1_5', hash: 'SHA-256' }, false, ['sign']);
-    const signature = await globalThis.crypto.subtle.sign({ name: 'RSASSA-PKCS1-v1_5' }, key, encoder.encode(signingInput));
-    return `${signingInput}.${base64UrlEncode(new Uint8Array(signature))}`;
-}
-export async function fetchAccessToken(serviceAccount) {
-    const assertion = await signJwt(serviceAccount, CLOUDKMS_SCOPE);
-    const body = `grant_type=${encodeURIComponent('urn:ietf:params:oauth:grant-type:jwt-bearer')}&assertion=${encodeURIComponent(assertion)}`;
-    const res = await fetch(GOOGLE_TOKEN_URL, {
-        method: 'POST',
-        headers: { 'content-type': 'application/x-www-form-urlencoded' },
-        body,
-    });
-    if (!res.ok) {
-        const text = await res.text();
-        throw new Error(`GCP token exchange failed: HTTP ${res.status}: ${text.slice(0, 300)}`);
-    }
-    const json = (await res.json());
-    if (!json.access_token || typeof json.expires_in !== 'number') {
-        throw new Error('GCP token exchange: response missing access_token or expires_in');
-    }
-    return {
-        accessToken: json.access_token,
-        expiresAt: Math.floor(Date.now() / 1000) + json.expires_in - TOKEN_EXPIRY_BUFFER_SECONDS,
-    };
-}
-// ─────────────────────────────────────────────────────────────────────
-// Cloud KMS REST calls
-// ─────────────────────────────────────────────────────────────────────
-async function callKms(token, pathRelativeToBase, options = { method: 'GET' }) {
-    const url = `${CLOUDKMS_BASE}${pathRelativeToBase}`;
-    const init = {
-        method: options.method,
-        headers: {
-            authorization: `Bearer ${token}`,
-            ...(options.body ? { 'content-type': 'application/json' } : {}),
-        },
-    };
-    if (options.body)
-        init.body = JSON.stringify(options.body);
-    const res = await fetch(url, init);
-    if (!res.ok) {
-        const text = await res.text();
-        // Don't leak the Authorization header. URL path is safe to include.
-        throw new Error(`Cloud KMS API error: HTTP ${res.status} on ${pathRelativeToBase}: ${text.slice(0, 300)}`);
-    }
-    return (await res.json());
-}
-// ─────────────────────────────────────────────────────────────────────
-// SPKI public-key parsing (uncompressed secp256k1 point extraction)
-// ─────────────────────────────────────────────────────────────────────
-export function parseSpkiUncompressedSecp256k1PubKey(spkiDer) {
-    // The SPKI structure ends with a BIT STRING containing the public key.
-    // For secp256k1, the public key is 65 bytes: 0x04 || X(32) || Y(32).
-    // The BIT STRING wrapping adds a single zero "unused bits" byte before
-    // the 0x04 marker. So the last 66 bytes of the DER should be:
-    //   [0x00 (unused bits)] [0x04 (uncompressed marker)] [X 32 bytes] [Y 32 bytes]
-    if (spkiDer.length < 66) {
-        throw new Error(`SPKI too short to contain uncompressed secp256k1 pubkey: ${spkiDer.length} bytes`);
-    }
-    const tail = spkiDer.slice(spkiDer.length - 65);
-    const marker = tail[0];
-    if (marker !== 0x04) {
-        throw new Error(`SPKI does not end with uncompressed point marker (0x04). Wrong key algorithm? ` +
-            `Found 0x${(marker ?? 0).toString(16).padStart(2, '0')} at position ${spkiDer.length - 65}.`);
-    }
-    return tail;
-}
-export function publicKeyToAddress(pubKey65) {
-    // pubKey65: 0x04 || X(32) || Y(32). Strip prefix; keccak256 over X||Y; last 20 bytes.
-    const raw = pubKey65.slice(1);
-    const hash = keccak_256(raw);
-    return bytesToHex(hash.slice(12));
-}
-// ─────────────────────────────────────────────────────────────────────
-// DER signature parsing + low-s + recovery byte search
-// ─────────────────────────────────────────────────────────────────────
-export function parseDerEcdsa(der) {
-    const at = (idx) => {
-        const b = der[idx];
-        if (b === undefined)
-            throw new Error(`DER: unexpected end of buffer at offset ${idx}`);
-        return b;
-    };
-    let i = 0;
-    if (at(i++) !== 0x30)
-        throw new Error('DER: expected SEQUENCE tag (0x30)');
-    // Skip length. Handle short and long form.
-    const lenByte = at(i++);
-    if (lenByte & 0x80) {
-        const lenBytes = lenByte & 0x7f;
-        i += lenBytes;
-    }
-    if (at(i++) !== 0x02)
-        throw new Error('DER: expected INTEGER tag for r');
-    const rLen = at(i++);
-    const rBytes = der.slice(i, i + rLen);
-    i += rLen;
-    if (at(i++) !== 0x02)
-        throw new Error('DER: expected INTEGER tag for s');
-    const sLen = at(i++);
-    const sBytes = der.slice(i, i + sLen);
-    const r = bytesToBigInt(rBytes);
-    const s = bytesToBigInt(sBytes);
-    // Range-validate (audit F-7): a malformed/compromised KMS response with
-    // r/s = 0 or ≥ n is never a valid ECDSA signature — fail closed here
-    // rather than letting a degenerate value flow into recovery.
-    if (r <= 0n || r >= SECP256K1_N || s <= 0n || s >= SECP256K1_N) {
-        throw new Error('DER: r/s out of range (require 0 < r,s < n)');
-    }
-    return { r, s };
-}
-function bytesToBigInt(bytes) {
-    let n = 0n;
-    for (const b of bytes)
-        n = (n << 8n) | BigInt(b);
-    return n;
-}
-export function bigIntTo32Bytes(n) {
-    const out = new Uint8Array(32);
-    let v = n;
-    for (let i = 31; i >= 0; i--) {
-        out[i] = Number(v & 0xffn);
-        v >>= 8n;
-    }
-    return out;
-}
-export function normalizeLowS(s) {
-    return s > SECP256K1_HALF_N ? SECP256K1_N - s : s;
-}
-function bytesEqual(a, b) {
-    if (a.length !== b.length)
-        return false;
-    for (let i = 0; i < a.length; i++)
-        if (a[i] !== b[i])
-            return false;
-    return true;
-}
-export function findRecoveryByte(r, s, digest, knownPubKey65) {
-    const rBytes = bigIntTo32Bytes(r);
-    const sBytes = bigIntTo32Bytes(s);
-    const compact = new Uint8Array(64);
-    compact.set(rBytes, 0);
-    compact.set(sBytes, 32);
-    const attempts = [];
-    for (let recovery = 0; recovery < 2; recovery++) {
-        try {
-            const sig = secp256k1.Signature.fromCompact(compact).addRecoveryBit(recovery);
-            const recovered = sig.recoverPublicKey(digest).toRawBytes(false);
-            attempts.push(`v=${recovery + 27} recovered=${bytesToHex(recovered)}`);
-            if (bytesEqual(recovered, knownPubKey65))
-                return recovery + 27;
-        }
-        catch (e) {
-            attempts.push(`v=${recovery + 27} threw ${e instanceof Error ? e.message : String(e)}`);
-        }
-    }
-    // eslint-disable-next-line no-console
-    console.error('[gcp-kms findRecoveryByte] mismatch:', {
-        digest: bytesToHex(digest),
-        r: bytesToHex(rBytes),
-        s: bytesToHex(sBytes),
-        knownPubKey: bytesToHex(knownPubKey65),
-        attempts,
-    });
-    throw new Error('Recovery byte search failed: neither v=27 nor v=28 recovers the known public key. ' +
-        attempts.join(' | '));
-}
-// ─────────────────────────────────────────────────────────────────────
-// GcpKmsSigner — the public class
+// GcpKmsSigner — the public class (thin wrapper over the kms-core)
 // ─────────────────────────────────────────────────────────────────────
 export class GcpKmsSigner {
     provider = 'gcp-kms';
     keyName;
-    serviceAccount;
+    transport;
     auditSink;
-    cachedToken;
     cachedPubKey65;
     cachedAddress;
     constructor(opts) {
@@ -277,47 +47,28 @@ export class GcpKmsSigner {
         if (!jsonStr) {
             throw new Error('GcpKmsSigner: GCP_SERVICE_ACCOUNT_JSON (service-account JSON string) is required.');
         }
+        // Backlog B4: accept the SAME formats parseServiceAccountJson does (single-line JSON OR
+        // base64-encoded JSON) so one secret value satisfies both the kms-core validator and this
+        // backend — base64 dodges the literal-newline paste hazard (B5).
         let parsed;
         try {
-            parsed = JSON.parse(jsonStr);
+            parsed = parseServiceAccountJson(jsonStr);
         }
-        catch {
-            throw new Error('GcpKmsSigner: GCP_SERVICE_ACCOUNT_JSON is not valid JSON.');
+        catch (e) {
+            throw new Error(`GcpKmsSigner: GCP_SERVICE_ACCOUNT_JSON invalid — ${e instanceof Error ? e.message : String(e)}`);
         }
         if (!parsed.client_email || !parsed.private_key) {
             throw new Error('GcpKmsSigner: service-account JSON missing client_email or private_key.');
         }
         this.keyName = keyName;
-        this.serviceAccount = parsed;
-    }
-    async getAccessToken() {
-        const now = Math.floor(Date.now() / 1000);
-        if (this.cachedToken && this.cachedToken.expiresAt > now) {
-            return this.cachedToken.accessToken;
-        }
-        this.cachedToken = await fetchAccessToken(this.serviceAccount);
-        return this.cachedToken.accessToken;
+        this.transport = createGcpKmsTransport(parsed);
     }
     async getPublicKeyBytes() {
         if (this.cachedPubKey65)
             return this.cachedPubKey65;
-        const token = await this.getAccessToken();
-        const res = await callKms(token, `${this.keyName}/publicKey`);
-        // Algorithm guard: signatures from any other curve (e.g. P-256) won't
-        // recover to an Ethereum-compatible pubkey. Catch the mistake at first
-        // pubkey fetch instead of producing nonsense signatures later.
-        if (res.algorithm !== 'EC_SIGN_SECP256K1_SHA256') {
-            throw new Error(`GcpKmsSigner: key ${this.keyName} has algorithm "${res.algorithm}", but ` +
-                `EC_SIGN_SECP256K1_SHA256 is required for Ethereum-compatible signing. ` +
-                `Recreate with: gcloud kms keys create <NAME> --purpose=asymmetric-signing ` +
-                `--default-algorithm=ec-sign-secp256k1-sha256 --protection-level=hsm. ` +
-                `Note: secp256k1 in GCP requires --protection-level=hsm; Software is not ` +
-                `supported. The Console dropdown greys out secp256k1 when Software is ` +
-                `selected. GCP doesn't allow changing the algorithm or protection level ` +
-                `of an existing key.`);
-        }
-        const spkiDer = pemToDer(res.pem);
-        this.cachedPubKey65 = parseSpkiUncompressedSecp256k1PubKey(spkiDer);
+        // The transport asserts the EC_SIGN_SECP256K1_SHA256 algorithm at fetch time.
+        const pem = await this.transport.getPublicKeyPem(this.keyName);
+        this.cachedPubKey65 = parseSpkiUncompressedSecp256k1PubKey(pemToDer(pem));
         return this.cachedPubKey65;
     }
     async getSignerAddress() {
@@ -331,13 +82,9 @@ export class GcpKmsSigner {
         if (input.digest.length !== 32) {
             throw new Error(`GcpKmsSigner.signA2AAction expects a 32-byte digest; got ${input.digest.length}.`);
         }
-        const [token, pubKey] = await Promise.all([this.getAccessToken(), this.getPublicKeyBytes()]);
-        const res = await callKms(token, `${this.keyName}:asymmetricSign`, {
-            method: 'POST',
-            body: { digest: { sha256: base64Encode(input.digest) } },
-        });
-        const derBytes = base64Decode(res.signature);
-        const parsed = parseDerEcdsa(derBytes);
+        const pubKey = await this.getPublicKeyBytes();
+        const der = await this.transport.asymmetricSign(this.keyName, input.digest);
+        const parsed = parseDerEcdsa(der);
         const s = normalizeLowS(parsed.s);
         const v = findRecoveryByte(parsed.r, s, input.digest, pubKey);
         const sig65 = new Uint8Array(65);
@@ -345,8 +92,7 @@ export class GcpKmsSigner {
         sig65.set(bigIntTo32Bytes(s), 32);
         sig65[64] = v;
         const signerAddress = await this.getSignerAddress();
-        // Audit emit. Per key-custody CLAUDE.md invariant:
-        //   raw sessionId MUST NEVER be logged — hash it.
+        // Audit emit. Per key-custody CLAUDE.md invariant: raw sessionId MUST NEVER be logged — hash it.
         if (this.auditSink) {
             const ctx = input.auditContext ?? {};
             try {
@@ -370,28 +116,14 @@ export class GcpKmsSigner {
                 /* fail-soft */
             }
         }
-        return {
-            signature: sig65,
-            keyId: this.keyName,
-            signerAddress,
-        };
+        return { signature: sig65, keyId: this.keyName, signerAddress };
     }
 }
 /**
- * H7-F.4 / PKG-KEY-CUSTODY-008 closure — derive `keyVersion` from the
- * GCP encryption response instead of a hardcoded string. The GCP KMS
- * `encrypt` endpoint returns `name` = the full versioned resource path
- * (`projects/<P>/locations/<L>/keyRings/<R>/cryptoKeys/<K>/cryptoKeyVersions/<V>`).
- * The version suffix is what GCP uses to identify the actual key version
- * that encrypted the ciphertext.
- *
- * Previously this class returned `'gcp-kms:v1'` regardless of the actual
- * rotation state — so on a GCP key rotation (under the same cryptoKey
- * NAME, different VERSION), any encrypted payload was still tagged with
- * the meaningless `'gcp-kms:v1'` marker. The `decryptSessionDataKey`
- * equality check then incorrectly accepted ciphertext from BOTH the old
- * and the new key version as if they were the same, with no audit trail
- * of which version produced which.
+ * H7-F.4 / PKG-KEY-CUSTODY-008 — derive `keyVersion` from the GCP encrypt
+ * response (`name` = the full versioned resource path) instead of a hardcoded
+ * string, so a GCP key rotation is reflected in the marker rather than being
+ * silently conflated with the old version.
  */
 function parseCryptoKeyVersion(responseName) {
     if (!responseName)
@@ -400,14 +132,11 @@ function parseCryptoKeyVersion(responseName) {
     return m ? `gcp-kms:v${m[1]}` : null;
 }
 export class GcpKmsProvider {
-    /**
-     * H7-F.4: this default is now ONLY used when the GCP encrypt response
-     * doesn't carry a `name` field (test fixtures + offline mocks). Real
-     * runs derive `keyVersion` from the response per call.
-     */
+    /** Only used when the GCP encrypt response doesn't carry a `name` (test fixtures). */
     keyVersion = 'gcp-kms:unknown';
     keyName;
     serviceAccount;
+    auditSink;
     cachedToken;
     constructor(opts) {
         const keyName = opts?.cryptoKeyName ?? process.env.GCP_KMS_ENCRYPT_KEY_NAME;
@@ -418,18 +147,47 @@ export class GcpKmsProvider {
         if (!jsonStr) {
             throw new Error('GcpKmsProvider: GCP_SERVICE_ACCOUNT_JSON (service-account JSON string) is required.');
         }
+        // Backlog B4: accept single-line JSON OR base64-encoded JSON (parseServiceAccountJson), so the
+        // SAME GCP_SERVICE_ACCOUNT_JSON secret satisfies the signer, this envelope provider, and the
+        // kms-core validator — base64 dodges the literal-newline paste hazard (B5).
         let parsed;
         try {
-            parsed = JSON.parse(jsonStr);
+            parsed = parseServiceAccountJson(jsonStr);
         }
-        catch {
-            throw new Error('GcpKmsProvider: GCP_SERVICE_ACCOUNT_JSON is not valid JSON.');
+        catch (e) {
+            throw new Error(`GcpKmsProvider: GCP_SERVICE_ACCOUNT_JSON invalid — ${e instanceof Error ? e.message : String(e)}`);
         }
         if (!parsed.client_email || !parsed.private_key) {
             throw new Error('GcpKmsProvider: service-account JSON missing client_email or private_key.');
         }
         this.keyName = keyName;
         this.serviceAccount = parsed;
+        this.auditSink = opts?.auditSink;
+    }
+    /**
+     * Emit an envelope-op audit row (spec 278 P0). Refs/hashes ONLY — the AAD is
+     * hashed (never logged raw, since it can carry owner/resource identifiers),
+     * and the data key / plaintext never appear. Fail-soft.
+     */
+    async emitEnvelopeAudit(action, aadBytes, keyVersion) {
+        if (!this.auditSink)
+            return;
+        try {
+            await this.auditSink.write(buildEvent({
+                action,
+                outcome: 'success',
+                actor: { type: 'system', id: 'gcp-kms-provider' },
+                subject: { type: 'vault-data-key', id: keyVersion },
+                context: {
+                    keyId: this.keyName,
+                    keyVersion,
+                    aadHash: bytesToHex(sha256(aadBytes)),
+                },
+            }));
+        }
+        catch {
+            /* fail-soft — an audit failure must not break the crypto op */
+        }
     }
     async getAccessToken() {
         const now = Math.floor(Date.now() / 1000);
@@ -452,25 +210,14 @@ export class GcpKmsProvider {
             },
         });
         const encryptedDataKey = base64Decode(res.ciphertext);
-        // H7-F.4: derive keyVersion from the response. GCP returns the full
-        // versioned cryptoKeyVersions/<N> resource path in `name`. When
-        // absent (test fixtures), fall back to the legacy 'gcp-kms:unknown'
-        // marker so callers can spot misconfigured mocks.
         const keyVersion = parseCryptoKeyVersion(res.name) ?? this.keyVersion;
-        return {
-            plaintextDataKey,
-            encryptedDataKey,
-            keyId: this.keyName,
-            keyVersion,
-        };
+        await this.emitEnvelopeAudit('key-custody.envelope.wrap', aadBytes, keyVersion);
+        return { plaintextDataKey, encryptedDataKey, keyId: this.keyName, keyVersion };
     }
     async decryptSessionDataKey(input) {
-        // H7-F.4: validate the `keyVersion` MARKER shape (must be
-        // 'gcp-kms:v<N>' or 'gcp-kms:unknown'). GCP's decrypt endpoint
-        // itself resolves the actual version from the ciphertext metadata,
-        // so the marker is operational ("which version produced this
-        // payload?") rather than a security gate. A null / arbitrary string
-        // here is a signal of cross-backend confusion — fail fast.
+        // The marker is operational ("which version produced this payload?"), not a
+        // security gate (GCP resolves the version from the ciphertext). A null /
+        // arbitrary value signals cross-backend confusion — fail fast.
         if (!/^gcp-kms:(v\d+|unknown)$/.test(input.keyVersion)) {
             throw new Error(`GcpKmsProvider: input.keyVersion "${input.keyVersion}" doesn't match the expected ` +
                 `'gcp-kms:v<N>' or 'gcp-kms:unknown' shape (H7-F.4).`);
@@ -484,7 +231,9 @@ export class GcpKmsProvider {
                 additionalAuthenticatedData: base64Encode(aadBytes),
             },
         });
-        return base64Decode(res.plaintext);
+        const plaintextDataKey = base64Decode(res.plaintext);
+        await this.emitEnvelopeAudit('key-custody.envelope.unwrap', aadBytes, input.keyVersion);
+        return plaintextDataKey;
     }
 }
 //# sourceMappingURL=gcp.js.map

package/dist/providers/gcp.js.map

@@ -1 +1 @@
-{"version":3,"file":"gcp.js","sourceRoot":"","sources":["../../src/providers/gcp.ts"],"names":[],"mappings":"AAAA,mEAAmE;AACnE,EAAE;AACF,4EAA4E;AAC5E,2EAA2E;AAC3E,kEAAkE;AAClE,EAAE;AACF,sEAAsE;AACtE,wEAAwE;AACxE,qCAAqC;AACrC,EAAE;AACF,wEAAwE;AACxE,oEAAoE;AACpE,wEAAwE;AACxE,iCAAiC;AACjC,4BAA4B;AAC5B,2CAA2C;AAC3C,2EAA2E;AAC3E,oDAAoD;AACpD,EAAE;AACF,2EAA2E;AAC3E,kEAAkE;AAClE,4EAA4E;AAC5E,EAAE;AACF,6EAA6E;AAC7E,4EAA4E;AAC5E,+CAA+C;AAE/C,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,UAAU,EAAgB,MAAM,MAAM,CAAC;AAChD,OAAO,EAAE,UAAU,EAAkB,MAAM,0BAA0B,CAAC;AAEtE,OAAO,EAAE,qBAAqB,EAAE,MAAM,QAAQ,CAAC;AAE/C,wEAAwE;AACxE,YAAY;AACZ,wEAAwE;AAExE,MAAM,gBAAgB,GAAG,qCAAqC,CAAC;AAC/D,MAAM,cAAc,GAAG,0CAA0C,CAAC;AAClE,MAAM,aAAa,GAAG,qCAAqC,CAAC;AAC5D,MAAM,2BAA2B,GAAG,EAAE,CAAC;AACvC,MAAM,WAAW,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;AACtC,MAAM,gBAAgB,GAAG,WAAW,IAAI,EAAE,CAAC;AAwC3C,wEAAwE;AACxE,uBAAuB;AACvB,wEAAwE;AAExE,MAAM,UAAU,eAAe,CAAC,KAAiB;IAC/C,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;IAC7E,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,YAAY,CAAC,CAAS;IAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACvB,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC1C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,GAAG,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IACtE,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,YAAY,CAAC,KAAiB;IACrC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;IAC7E,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,GAAW;IAClC,MAAM,KAAK,GAAG,GAAG;SACd,KAAK,CAAC,IAAI,CAAC;SACX,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;SAC5D,IAAI,CAAC,EAAE,CAAC,CAAC;IACZ,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC;AAC7B,CAAC;AAED,wEAAwE;AACxE,+BAA+B;AAC/B,wEAAwE;AAExE,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,cAA8B,EAAE,KAAa;IACzE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;IAC5C,MAAM,OAAO,GAAG;QACd,GAAG,EAAE,cAAc,CAAC,YAAY;QAChC,KAAK;QACL,GAAG,EAAE,gBAAgB;QACrB,GAAG,EAAE,GAAG;QACR,GAAG,EAAE,GAAG,GAAG,IAAI;KAChB,CAAC;IACF,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,MAAM,SAAS,GAAG,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAC1E,MAAM,UAAU,GAAG,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAC5E,MAAM,YAAY,GAAG,GAAG,SAAS,IAAI,UAAU,EAAE,CAAC;IAElD,MAAM,MAAM,GAAG,QAAQ,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;IACpD,qEAAqE;IACrE,qEAAqE;IACrE,MAAM,SAAS,GAAG,IAAI,WAAW,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACrD,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACtC,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAClD,OAAO,EACP,SAAS,EACT,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,SAAS,EAAE,EAC9C,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAC;IACF,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CACnD,EAAE,IAAI,EAAE,mBAAmB,EAAE,EAC7B,GAAG,EACH,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAC7B,CAAC;IACF,OAAO,GAAG,YAAY,IAAI,eAAe,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;AACzE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,cAA8B;IACnE,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC;IAChE,MAAM,IAAI,GAAG,cAAc,kBAAkB,CAAC,6CAA6C,CAAC,cAAc,kBAAkB,CAAC,SAAS,CAAC,EAAE,CAAC;IAC1I,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,gBAAgB,EAAE;QACxC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAChE,IAAI;KACL,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,mCAAmC,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IAC1F,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAmD,CAAC;IAClF,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;QAC9D,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;IACrF,CAAC;IACD,OAAO;QACL,WAAW,EAAE,IAAI,CAAC,YAAY;QAC9B,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,UAAU,GAAG,2BAA2B;KACzF,CAAC;AACJ,CAAC;AAED,wEAAwE;AACxE,uBAAuB;AACvB,wEAAwE;AAExE,KAAK,UAAU,OAAO,CACpB,KAAa,EACb,kBAA0B,EAC1B,UAAsD,EAAE,MAAM,EAAE,KAAK,EAAE;IAEvE,MAAM,GAAG,GAAG,GAAG,aAAa,GAAG,kBAAkB,EAAE,CAAC;IACpD,MAAM,IAAI,GAAgB;QACxB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,KAAK,EAAE;YAChC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChE;KACF,CAAC;IACF,IAAI,OAAO,CAAC,IAAI;QAAE,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACnC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,oEAAoE;QACpE,MAAM,IAAI,KAAK,CAAC,6BAA6B,GAAG,CAAC,MAAM,OAAO,kBAAkB,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IAC7G,CAAC;IACD,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAM,CAAC;AACjC,CAAC;AAED,wEAAwE;AACxE,oEAAoE;AACpE,wEAAwE;AAExE,MAAM,UAAU,oCAAoC,CAAC,OAAmB;IACtE,uEAAuE;IACvE,qEAAqE;IACrE,uEAAuE;IACvE,8DAA8D;IAC9D,gFAAgF;IAChF,IAAI,OAAO,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,4DAA4D,OAAO,CAAC,MAAM,QAAQ,CAAC,CAAC;IACtG,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;IAChD,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACvB,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CACb,gFAAgF;YAC9E,WAAW,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,gBAAgB,OAAO,CAAC,MAAM,GAAG,EAAE,GAAG,CAC/F,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,QAAoB;IACrD,sFAAsF;IACtF,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC9B,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAC7B,OAAO,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAY,CAAC;AAC/C,CAAC;AAED,wEAAwE;AACxE,uDAAuD;AACvD,wEAAwE;AAExE,MAAM,UAAU,aAAa,CAAC,GAAe;IAC3C,MAAM,EAAE,GAAG,CAAC,GAAW,EAAU,EAAE;QACjC,MAAM,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;QACnB,IAAI,CAAC,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,GAAG,EAAE,CAAC,CAAC;QACvF,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;IACF,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IAC3E,2CAA2C;IAC3C,MAAM,OAAO,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;IACxB,IAAI,OAAO,GAAG,IAAI,EAAE,CAAC;QACnB,MAAM,QAAQ,GAAG,OAAO,GAAG,IAAI,CAAC;QAChC,CAAC,IAAI,QAAQ,CAAC;IAChB,CAAC;IACD,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACzE,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;IACrB,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;IACtC,CAAC,IAAI,IAAI,CAAC;IACV,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACzE,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;IACrB,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;IACtC,MAAM,CAAC,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IAChC,MAAM,CAAC,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IAChC,wEAAwE;IACxE,qEAAqE;IACrE,6DAA6D;IAC7D,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,WAAW,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,WAAW,EAAE,CAAC;QAC/D,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACjE,CAAC;IACD,OAAO,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC;AAClB,CAAC;AAED,SAAS,aAAa,CAAC,KAAiB;IACtC,IAAI,CAAC,GAAG,EAAE,CAAC;IACX,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IACjD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,CAAS;IACvC,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IAC/B,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,KAAK,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7B,GAAG,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC;QAC3B,CAAC,KAAK,EAAE,CAAC;IACX,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,CAAS;IACrC,OAAO,CAAC,GAAG,gBAAgB,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACpD,CAAC;AAED,SAAS,UAAU,CAAC,CAAa,EAAE,CAAa;IAC9C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;IACnE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,CAAS,EACT,CAAS,EACT,MAAkB,EAClB,aAAyB;IAEzB,MAAM,MAAM,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC;IAClC,MAAM,OAAO,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IACnC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACvB,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACxB,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,IAAI,QAAQ,GAAG,CAAC,EAAE,QAAQ,GAAG,CAAC,EAAE,QAAQ,EAAE,EAAE,CAAC;QAChD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,SAAS,CAAC,SAAS,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;YAC9E,MAAM,SAAS,GAAG,GAAG,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;YACjE,QAAQ,CAAC,IAAI,CAAC,KAAK,QAAQ,GAAG,EAAE,cAAc,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YACvE,IAAI,UAAU,CAAC,SAAS,EAAE,aAAa,CAAC;gBAAE,OAAO,QAAQ,GAAG,EAAE,CAAC;QACjE,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,QAAQ,CAAC,IAAI,CAAC,KAAK,QAAQ,GAAG,EAAE,UAAU,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC1F,CAAC;IACH,CAAC;IACD,sCAAsC;IACtC,OAAO,CAAC,KAAK,CAAC,sCAAsC,EAAE;QACpD,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC;QAC1B,CAAC,EAAE,UAAU,CAAC,MAAM,CAAC;QACrB,CAAC,EAAE,UAAU,CAAC,MAAM,CAAC;QACrB,WAAW,EAAE,UAAU,CAAC,aAAa,CAAC;QACtC,QAAQ;KACT,CAAC,CAAC;IACH,MAAM,IAAI,KAAK,CACb,oFAAoF;QAClF,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CACvB,CAAC;AACJ,CAAC;AAED,wEAAwE;AACxE,kCAAkC;AAClC,wEAAwE;AAExE,MAAM,OAAO,YAAY;IACd,QAAQ,GAAG,SAAkB,CAAC;IACtB,OAAO,CAAS;IAChB,cAAc,CAAiB;IAC/B,SAAS,CAAa;IAC/B,WAAW,CAAe;IAC1B,cAAc,CAAc;IAC5B,aAAa,CAAW;IAEhC,YAAY,IAA4D;QACtE,MAAM,OAAO,GAAG,IAAI,EAAE,oBAAoB,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;QAC3E,MAAM,OAAO,GAAG,IAAI,EAAE,kBAAkB,IAAI,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC;QACjF,IAAI,CAAC,SAAS,GAAG,IAAI,EAAE,SAAS,CAAC;QACjC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CACb,4HAA4H,CAC7H,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,mFAAmF,CAAC,CAAC;QACvG,CAAC;QACD,IAAI,MAAsB,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAmB,CAAC;QACjD,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;QAC/E,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,YAAY,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CAAC,yEAAyE,CAAC,CAAC;QAC7F,CAAC;QACD,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC;IAC/B,CAAC;IAEO,KAAK,CAAC,cAAc;QAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,WAAW,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC;YACzD,OAAO,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC;QACtC,CAAC;QACD,IAAI,CAAC,WAAW,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC/D,OAAO,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC;IACtC,CAAC;IAEO,KAAK,CAAC,iBAAiB;QAC7B,IAAI,IAAI,CAAC,cAAc;YAAE,OAAO,IAAI,CAAC,cAAc,CAAC;QACpD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAC1C,MAAM,GAAG,GAAG,MAAM,OAAO,CAAoB,KAAK,EAAE,GAAG,IAAI,CAAC,OAAO,YAAY,CAAC,CAAC;QACjF,sEAAsE;QACtE,uEAAuE;QACvE,+DAA+D;QAC/D,IAAI,GAAG,CAAC,SAAS,KAAK,0BAA0B,EAAE,CAAC;YACjD,MAAM,IAAI,KAAK,CACb,qBAAqB,IAAI,CAAC,OAAO,mBAAmB,GAAG,CAAC,SAAS,SAAS;gBACxE,wEAAwE;gBACxE,4EAA4E;gBAC5E,uEAAuE;gBACvE,0EAA0E;gBAC1E,uEAAuE;gBACvE,yEAAyE;gBACzE,qBAAqB,CACxB,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,CAAC,cAAc,GAAG,oCAAoC,CAAC,OAAO,CAAC,CAAC;QACpE,OAAO,IAAI,CAAC,cAAc,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,gBAAgB;QACpB,IAAI,IAAI,CAAC,aAAa;YAAE,OAAO,IAAI,CAAC,aAAa,CAAC;QAClD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC3C,IAAI,CAAC,aAAa,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;QAC7C,OAAO,IAAI,CAAC,aAAa,CAAC;IAC5B,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,KAGnB;QACC,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,4DAA4D,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;QACtG,CAAC;QACD,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,IAAI,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC;QAE7F,MAAM,GAAG,GAAG,MAAM,OAAO,CAAyB,KAAK,EAAE,GAAG,IAAI,CAAC,OAAO,iBAAiB,EAAE;YACzF,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,YAAY,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE;SACzD,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;QACvC,MAAM,CAAC,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAClC,MAAM,CAAC,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAE9D,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;QACjC,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACxC,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAClC,KAAK,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;QAEd,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACpD,mDAAmD;QACnD,kDAAkD;QAClD,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,MAAM,GAAG,GAAG,KAAK,CAAC,YAAY,IAAI,EAAE,CAAC;YACrC,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CACxB,UAAU,CAAC;oBACT,MAAM,EAAE,kBAAkB;oBAC1B,OAAO,EAAE,SAAS;oBAClB,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,gBAAgB,EAAE;oBAC/C,OAAO,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,EAAE,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE;oBAC9D,OAAO,EAAE;wBACP,KAAK,EAAE,IAAI,CAAC,OAAO;wBACnB,aAAa;wBACb,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,IAAI;wBAC1B,QAAQ,EAAE,GAAG,CAAC,QAAQ,IAAI,IAAI;wBAC9B,WAAW,EAAE,GAAG,CAAC,SAAS;4BACxB,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;4BAC9E,CAAC,CAAC,IAAI;qBACT;iBACF,CAAC,CACH,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,eAAe;YACjB,CAAC;QACH,CAAC;QAED,OAAO;YACL,SAAS,EAAE,KAAK;YAChB,KAAK,EAAE,IAAI,CAAC,OAAO;YACnB,aAAa;SACd,CAAC;IACJ,CAAC;CACF;AAuCD;;;;;;;;;;;;;;;GAeG;AACH,SAAS,qBAAqB,CAAC,YAAgC;IAC7D,IAAI,CAAC,YAAY;QAAE,OAAO,IAAI,CAAC;IAC/B,MAAM,CAAC,GAAG,6BAA6B,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC3D,OAAO,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACvC,CAAC;AAED,MAAM,OAAO,cAAc;IACzB;;;;OAIG;IACM,UAAU,GAAG,iBAAiB,CAAC;IACvB,OAAO,CAAS;IAChB,cAAc,CAAiB;IACxC,WAAW,CAAe;IAElC,YAAY,IAAkC;QAC5C,MAAM,OAAO,GAAG,IAAI,EAAE,aAAa,IAAI,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC;QAC5E,MAAM,OAAO,GAAG,IAAI,EAAE,kBAAkB,IAAI,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC;QACjF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CACb,gHAAgH,CACjH,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,qFAAqF,CAAC,CAAC;QACzG,CAAC;QACD,IAAI,MAAsB,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAmB,CAAC;QACjD,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;QACjF,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,YAAY,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CAAC,2EAA2E,CAAC,CAAC;QAC/F,CAAC;QACD,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC;IAC/B,CAAC;IAEO,KAAK,CAAC,cAAc;QAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,WAAW,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC;YACzD,OAAO,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC;QACtC,CAAC;QACD,IAAI,CAAC,WAAW,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC/D,OAAO,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC;IACtC,CAAC;IAED,KAAK,CAAC,sBAAsB,CAAC,KAE5B;QAMC,MAAM,gBAAgB,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;QAC5C,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,gBAAgB,CAAC,CAAC;QACpD,MAAM,QAAQ,GAAG,qBAAqB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAEzD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAC1C,MAAM,GAAG,GAAG,MAAM,OAAO,CAAkB,KAAK,EAAE,GAAG,IAAI,CAAC,OAAO,UAAU,EAAE;YAC3E,MAAM,EAAE,MAAM;YACd,IAAI,EAAE;gBACJ,SAAS,EAAE,YAAY,CAAC,gBAAgB,CAAC;gBACzC,2BAA2B,EAAE,YAAY,CAAC,QAAQ,CAAC;aACpD;SACF,CAAC,CAAC;QACH,MAAM,gBAAgB,GAAG,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAEtD,oEAAoE;QACpE,gEAAgE;QAChE,oEAAoE;QACpE,kDAAkD;QAClD,MAAM,UAAU,GAAG,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC;QAEtE,OAAO;YACL,gBAAgB;YAChB,gBAAgB;YAChB,KAAK,EAAE,IAAI,CAAC,OAAO;YACnB,UAAU;SACX,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,qBAAqB,CAAC,KAK3B;QACC,0DAA0D;QAC1D,+DAA+D;QAC/D,mEAAmE;QACnE,6DAA6D;QAC7D,oEAAoE;QACpE,2DAA2D;QAC3D,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;YACvD,MAAM,IAAI,KAAK,CACb,qCAAqC,KAAK,CAAC,UAAU,+BAA+B;gBAClF,qDAAqD,CACxD,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG,qBAAqB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACzD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAC1C,MAAM,GAAG,GAAG,MAAM,OAAO,CAAkB,KAAK,EAAE,GAAG,IAAI,CAAC,OAAO,UAAU,EAAE;YAC3E,MAAM,EAAE,MAAM;YACd,IAAI,EAAE;gBACJ,UAAU,EAAE,YAAY,CAAC,KAAK,CAAC,gBAAgB,CAAC;gBAChD,2BAA2B,EAAE,YAAY,CAAC,QAAQ,CAAC;aACpD;SACF,CAAC,CAAC;QACH,OAAO,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACrC,CAAC;CACF"}
+{"version":3,"file":"gcp.js","sourceRoot":"","sources":["../../src/providers/gcp.ts"],"names":[],"mappings":"AAAA,qEAAqE;AACrE,EAAE;AACF,2EAA2E;AAC3E,yEAAyE;AACzE,8EAA8E;AAC9E,wEAAwE;AACxE,6EAA6E;AAC7E,wEAAwE;AACxE,iCAAiC;AACjC,EAAE;AACF,sEAAsE;AACtE,0EAA0E;AAC1E,6EAA6E;AAC7E,6EAA6E;AAC7E,2EAA2E;AAC3E,4EAA4E;AAC5E,6DAA6D;AAE7D,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAE/C,OAAO,EAAE,UAAU,EAAkB,MAAM,0BAA0B,CAAC;AAEtE,OAAO,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC;AAClD,OAAO,EACL,UAAU,EACV,YAAY,EACZ,YAAY,EACZ,QAAQ,EACR,eAAe,EACf,aAAa,EACb,aAAa,EACb,oCAAoC,EACpC,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAIL,gBAAgB,EAChB,OAAO,EACP,qBAAqB,GACtB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAE5D,gFAAgF;AAChF,gFAAgF;AAChF,gFAAgF;AAChF,OAAO,EACL,eAAe,EACf,QAAQ,EACR,aAAa,EACb,aAAa,EACb,eAAe,EACf,oCAAoC,EACpC,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAapE,wEAAwE;AACxE,mEAAmE;AACnE,wEAAwE;AAExE,MAAM,OAAO,YAAY;IACd,QAAQ,GAAG,SAAkB,CAAC;IACtB,OAAO,CAAS;IAChB,SAAS,CAAkB;IAC3B,SAAS,CAAa;IAC/B,cAAc,CAAc;IAC5B,aAAa,CAAW;IAEhC,YAAY,IAA4D;QACtE,MAAM,OAAO,GAAG,IAAI,EAAE,oBAAoB,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;QAC3E,MAAM,OAAO,GAAG,IAAI,EAAE,kBAAkB,IAAI,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC;QACjF,IAAI,CAAC,SAAS,GAAG,IAAI,EAAE,SAAS,CAAC;QACjC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CACb,4HAA4H,CAC7H,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,mFAAmF,CAAC,CAAC;QACvG,CAAC;QACD,wFAAwF;QACxF,0FAA0F;QAC1F,iEAAiE;QACjE,IAAI,MAAsB,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;QAC5C,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACpH,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,YAAY,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CAAC,yEAAyE,CAAC,CAAC;QAC7F,CAAC;QACD,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,SAAS,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;IACjD,CAAC;IAEO,KAAK,CAAC,iBAAiB;QAC7B,IAAI,IAAI,CAAC,cAAc;YAAE,OAAO,IAAI,CAAC,cAAc,CAAC;QACpD,8EAA8E;QAC9E,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC/D,IAAI,CAAC,cAAc,GAAG,oCAAoC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1E,OAAO,IAAI,CAAC,cAAc,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,gBAAgB;QACpB,IAAI,IAAI,CAAC,aAAa;YAAE,OAAO,IAAI,CAAC,aAAa,CAAC;QAClD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC3C,IAAI,CAAC,aAAa,GAAG,kBAAkB,CAAC,GAAG,CAAY,CAAC;QACxD,OAAO,IAAI,CAAC,aAAa,CAAC;IAC5B,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,KAGnB;QACC,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,4DAA4D,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;QACtG,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC9C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAC5E,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QAClC,MAAM,CAAC,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAClC,MAAM,CAAC,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAE9D,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;QACjC,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACxC,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAClC,KAAK,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;QAEd,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACpD,iGAAiG;QACjG,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,MAAM,GAAG,GAAG,KAAK,CAAC,YAAY,IAAI,EAAE,CAAC;YACrC,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CACxB,UAAU,CAAC;oBACT,MAAM,EAAE,kBAAkB;oBAC1B,OAAO,EAAE,SAAS;oBAClB,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,gBAAgB,EAAE;oBAC/C,OAAO,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,EAAE,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE;oBAC9D,OAAO,EAAE;wBACP,KAAK,EAAE,IAAI,CAAC,OAAO;wBACnB,aAAa;wBACb,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,IAAI;wBAC1B,QAAQ,EAAE,GAAG,CAAC,QAAQ,IAAI,IAAI;wBAC9B,WAAW,EAAE,GAAG,CAAC,SAAS;4BACxB,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;4BAC9E,CAAC,CAAC,IAAI;qBACT;iBACF,CAAC,CACH,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,eAAe;YACjB,CAAC;QACH,CAAC;QAED,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,aAAa,EAAE,CAAC;IAClE,CAAC;CACF;AA0CD;;;;;GAKG;AACH,SAAS,qBAAqB,CAAC,YAAgC;IAC7D,IAAI,CAAC,YAAY;QAAE,OAAO,IAAI,CAAC;IAC/B,MAAM,CAAC,GAAG,6BAA6B,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC3D,OAAO,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACvC,CAAC;AAED,MAAM,OAAO,cAAc;IACzB,sFAAsF;IAC7E,UAAU,GAAG,iBAAiB,CAAC;IACvB,OAAO,CAAS;IAChB,cAAc,CAAiB;IAC/B,SAAS,CAAa;IAC/B,WAAW,CAAe;IAElC,YAAY,IAA8D;QACxE,MAAM,OAAO,GAAG,IAAI,EAAE,aAAa,IAAI,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC;QAC5E,MAAM,OAAO,GAAG,IAAI,EAAE,kBAAkB,IAAI,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC;QACjF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CACb,gHAAgH,CACjH,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,qFAAqF,CAAC,CAAC;QACzG,CAAC;QACD,+FAA+F;QAC/F,6FAA6F;QAC7F,4EAA4E;QAC5E,IAAI,MAAsB,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;QAC5C,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACtH,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,YAAY,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CAAC,2EAA2E,CAAC,CAAC;QAC/F,CAAC;QACD,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC;QAC7B,IAAI,CAAC,SAAS,GAAG,IAAI,EAAE,SAAS,CAAC;IACnC,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,iBAAiB,CAC7B,MAAmE,EACnE,QAAoB,EACpB,UAAkB;QAElB,IAAI,CAAC,IAAI,CAAC,SAAS;YAAE,OAAO;QAC5B,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CACxB,UAAU,CAAC;gBACT,MAAM;gBACN,OAAO,EAAE,SAAS;gBAClB,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,kBAAkB,EAAE;gBACjD,OAAO,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,EAAE,EAAE,UAAU,EAAE;gBACnD,OAAO,EAAE;oBACP,KAAK,EAAE,IAAI,CAAC,OAAO;oBACnB,UAAU;oBACV,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;iBACtC;aACF,CAAC,CACH,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,+DAA+D;QACjE,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,cAAc;QAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,WAAW,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC;YACzD,OAAO,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC;QACtC,CAAC;QACD,IAAI,CAAC,WAAW,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC/D,OAAO,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC;IACtC,CAAC;IAED,KAAK,CAAC,sBAAsB,CAAC,KAE5B;QAMC,MAAM,gBAAgB,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;QAC5C,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,gBAAgB,CAAC,CAAC;QACpD,MAAM,QAAQ,GAAG,qBAAqB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAEzD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAC1C,MAAM,GAAG,GAAG,MAAM,OAAO,CAAkB,KAAK,EAAE,GAAG,IAAI,CAAC,OAAO,UAAU,EAAE;YAC3E,MAAM,EAAE,MAAM;YACd,IAAI,EAAE;gBACJ,SAAS,EAAE,YAAY,CAAC,gBAAgB,CAAC;gBACzC,2BAA2B,EAAE,YAAY,CAAC,QAAQ,CAAC;aACpD;SACF,CAAC,CAAC;QACH,MAAM,gBAAgB,GAAG,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACtD,MAAM,UAAU,GAAG,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC;QAEtE,MAAM,IAAI,CAAC,iBAAiB,CAAC,2BAA2B,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;QAChF,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,CAAC;IACjF,CAAC;IAED,KAAK,CAAC,qBAAqB,CAAC,KAK3B;QACC,4EAA4E;QAC5E,yEAAyE;QACzE,+DAA+D;QAC/D,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;YACvD,MAAM,IAAI,KAAK,CACb,qCAAqC,KAAK,CAAC,UAAU,+BAA+B;gBAClF,qDAAqD,CACxD,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG,qBAAqB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACzD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAC1C,MAAM,GAAG,GAAG,MAAM,OAAO,CAAkB,KAAK,EAAE,GAAG,IAAI,CAAC,OAAO,UAAU,EAAE;YAC3E,MAAM,EAAE,MAAM;YACd,IAAI,EAAE;gBACJ,UAAU,EAAE,YAAY,CAAC,KAAK,CAAC,gBAAgB,CAAC;gBAChD,2BAA2B,EAAE,YAAY,CAAC,QAAQ,CAAC;aACpD;SACF,CAAC,CAAC;QACH,MAAM,gBAAgB,GAAG,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACrD,MAAM,IAAI,CAAC,iBAAiB,CAAC,6BAA6B,EAAE,QAAQ,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QACxF,OAAO,gBAAgB,CAAC;IAC1B,CAAC;CACF"}

package/dist/providers/local.d.ts

@@ -1,5 +1,5 @@
 import { hexToBytes, bytesToHex, toHex, type Address, type Hex } from 'viem';
-import type { A2AKeyProvider, KmsAccountBackend } from '../types';
+import type { A2AKeyProvider, KmsAccountBackend } from '../types.js';
 import { type AuditSink } from '@agenticprimitives/audit';
 export declare class LocalAesProvider implements A2AKeyProvider {
     readonly keyVersion = "local-v1";
@@ -10,7 +10,7 @@ export declare class LocalAesProvider implements A2AKeyProvider {
     generateSessionDataKey(input: {
         aadContext: Record<string, string>;
     }): Promise<{
-        plaintextDataKey: Uint8Array<ArrayBufferLike>;
+        plaintextDataKey: Uint8Array<ArrayBufferLike> & Uint8Array<ArrayBuffer>;
         encryptedDataKey: Uint8Array<ArrayBufferLike>;
         keyId: string;
         keyVersion: string;
@@ -20,13 +20,13 @@ export declare class LocalAesProvider implements A2AKeyProvider {
         aadContext: Record<string, string>;
         keyId: string;
         keyVersion: string;
-    }): Promise<Uint8Array<ArrayBufferLike>>;
+    }): Promise<Uint8Array<ArrayBufferLike> & Uint8Array<ArrayBuffer>>;
     generateMac(input: {
         canonicalMessage: Uint8Array;
         service: string;
         audience: string;
     }): Promise<{
-        mac: Uint8Array<ArrayBufferLike>;
+        mac: Uint8Array<ArrayBufferLike> & Uint8Array<ArrayBuffer>;
         keyId: string;
     }>;
 }

package/dist/providers/local.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"local.d.ts","sourceRoot":"","sources":["../../src/providers/local.ts"],"names":[],"mappings":"AAoBA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,OAAO,EAAE,KAAK,GAAG,EAAE,MAAM,MAAM,CAAC;AAC7E,OAAO,KAAK,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAElE,OAAO,EAAc,KAAK,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAiHtE,qBAAa,gBAAiB,YAAW,cAAc;IACrD,QAAQ,CAAC,UAAU,cAAc;IACjC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAa;gBAExB,IAAI,CAAC,EAAE;QAAE,gBAAgB,CAAC,EAAE,MAAM,CAAA;KAAE;IAe1C,sBAAsB,CAAC,KAAK,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE;;;;;;IAiBpE,qBAAqB,CAAC,KAAK,EAAE;QACjC,gBAAgB,EAAE,UAAU,CAAC;QAC7B,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACnC,KAAK,EAAE,MAAM,CAAC;QACd,UAAU,EAAE,MAAM,CAAC;KACpB;IAmBK,WAAW,CAAC,KAAK,EAAE;QAAE,gBAAgB,EAAE,UAAU,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE;;;;CAW7F;AAED,qBAAa,oBAAqB,YAAW,iBAAiB;IAC5D,QAAQ,CAAC,QAAQ,EAAG,WAAW,CAAU;IACzC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAa;IAClC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAU;IAC/B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAY;gBAE3B,IAAI,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,SAAS,CAAA;KAAE;IAQ9D,aAAa,CAAC,KAAK,EAAE;QACzB,MAAM,EAAE,UAAU,CAAC;QACnB,YAAY,CAAC,EAAE;YAAE,MAAM,CAAC,EAAE,MAAM,CAAC;YAAC,SAAS,CAAC,EAAE,MAAM,CAAC;YAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;KAC3E;;;;;IA8CK,gBAAgB,IAAI,OAAO,CAAC,OAAO,CAAC;IAI1C,yEAAyE;IACzE,UAAU,IAAI,OAAO;CAGtB;AAaD,YAAY,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC"}
+{"version":3,"file":"local.d.ts","sourceRoot":"","sources":["../../src/providers/local.ts"],"names":[],"mappings":"AAoBA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,OAAO,EAAE,KAAK,GAAG,EAAE,MAAM,MAAM,CAAC;AAC7E,OAAO,KAAK,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAErE,OAAO,EAAc,KAAK,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAiHtE,qBAAa,gBAAiB,YAAW,cAAc;IACrD,QAAQ,CAAC,UAAU,cAAc;IACjC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAa;gBAExB,IAAI,CAAC,EAAE;QAAE,gBAAgB,CAAC,EAAE,MAAM,CAAA;KAAE;IAe1C,sBAAsB,CAAC,KAAK,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE;;;;;;IAiBpE,qBAAqB,CAAC,KAAK,EAAE;QACjC,gBAAgB,EAAE,UAAU,CAAC;QAC7B,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACnC,KAAK,EAAE,MAAM,CAAC;QACd,UAAU,EAAE,MAAM,CAAC;KACpB;IAmBK,WAAW,CAAC,KAAK,EAAE;QAAE,gBAAgB,EAAE,UAAU,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE;;;;CAW7F;AAED,qBAAa,oBAAqB,YAAW,iBAAiB;IAC5D,QAAQ,CAAC,QAAQ,EAAG,WAAW,CAAU;IACzC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAa;IAClC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAU;IAC/B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAY;gBAE3B,IAAI,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,SAAS,CAAA;KAAE;IAQ9D,aAAa,CAAC,KAAK,EAAE;QACzB,MAAM,EAAE,UAAU,CAAC;QACnB,YAAY,CAAC,EAAE;YAAE,MAAM,CAAC,EAAE,MAAM,CAAC;YAAC,SAAS,CAAC,EAAE,MAAM,CAAC;YAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;KAC3E;;;;;IA2DK,gBAAgB,IAAI,OAAO,CAAC,OAAO,CAAC;IAI1C,yEAAyE;IACzE,UAAU,IAAI,OAAO;CAGtB;AAaD,YAAY,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC"}