@agenticprimitives/key-custody 1.0.0-alpha.10 → 1.0.0-alpha.12

package/bin/ap-provision-gcp.mjs

@@ -1,16 +1,26 @@
 #!/usr/bin/env node
-// ap-provision-gcp — provision GCP Cloud KMS secp256k1 signing keys for a set of
-// signing identities, grant the runtime service account roles/cloudkms.signer
-// per key, and print the identity → key-version map + derived EVM addresses
-// (spec 276 KCS-D3). Thin Node wrapper over @agenticprimitives/key-custody/provision-gcp.
+// ap-provision-gcp — provision GCP Cloud KMS keys for a set of identities, grant the
+// runtime service account a per-key IAM role, and print the identity → key map (+
+// derived EVM addresses for signing keys) (spec 276 KCS-D3). Thin Node wrapper over
+// @agenticprimitives/key-custody/provision-gcp.
 //
+//   # secp256k1 signing keys (default):
 //   ap-provision-gcp \
 //     --project my-proj --location us-east1 --keyring my-ring \
 //     --service-account runtime@my-proj.iam.gserviceaccount.com \
 //     --identities signer-a,signer-b [--protection HSM] [--dry-run]
 //
-// --dry-run prints the gcloud steps without executing. Requires `gcloud` on PATH
-// (authenticated) for a real run.
+//   # symmetric per-person vault KEKs (spec 278) — identities are person SA addresses:
+//   ap-provision-gcp --purpose encrypt-decrypt \
+//     --project my-proj --location us-east1 --keyring vault-keks \
+//     --service-account demo-mcp-runtime@my-proj.iam.gserviceaccount.com \
+//     --identities 0xPersonSA1,0xPersonSA2
+//
+// --purpose encrypt-decrypt mints GOOGLE_SYMMETRIC_ENCRYPTION KEKs + grants the runtime SA
+// roles/cloudkms.cryptoKeyEncrypterDecrypter per key; the printed keyMap entry (the version-less
+// cryptoKey resource) is the `kmsKeyRef` the spec-278 VaultKeyBinding carries. --iam-role
+// overrides the granted role. --dry-run prints the gcloud steps without executing. Requires
+// `gcloud` on PATH (authenticated) for a real run.
 import { execFileSync } from 'node:child_process';
 import { planGcpProvision, executeGcpProvision } from '../dist/kms/provision-gcp.js';
 
@@ -35,7 +45,13 @@ const required = ['project', 'location', 'keyring', 'service-account', 'identiti
 const missing = required.filter((k) => !args[k]);
 if (missing.length) {
   console.error(`ap-provision-gcp: missing required flag(s): ${missing.map((m) => '--' + m).join(', ')}`);
-  console.error('Usage: ap-provision-gcp --project <p> --location <l> --keyring <r> --service-account <email> --identities a,b[,c] [--protection HSM|SOFTWARE] [--dry-run]');
+  console.error('Usage: ap-provision-gcp --project <p> --location <l> --keyring <r> --service-account <email> --identities a,b[,c] [--purpose asymmetric-signing|encrypt-decrypt] [--iam-role <role>] [--protection HSM|SOFTWARE] [--dry-run]');
+  process.exit(2);
+}
+
+const purpose = args.purpose ?? 'asymmetric-signing';
+if (!['asymmetric-signing', 'encrypt-decrypt'].includes(purpose)) {
+  console.error(`ap-provision-gcp: --purpose must be 'asymmetric-signing' or 'encrypt-decrypt' (got '${purpose}')`);
   process.exit(2);
 }
 
@@ -46,6 +62,8 @@ const plan = {
   identities: String(args.identities).split(',').map((s) => s.trim()).filter(Boolean),
   runtimeServiceAccount: args['service-account'],
   protectionLevel: args.protection ?? 'HSM',
+  purpose,
+  ...(args['iam-role'] ? { iamRole: args['iam-role'] } : {}),
 };
 
 if (args['dry-run']) {

package/dist/account.d.ts

@@ -1,5 +1,5 @@
 import { type Hex, type Address } from 'viem';
-import type { KmsAccountBackend } from './types';
+import type { KmsAccountBackend } from './types.js';
 interface KMSSignerShape {
     readonly address: Address;
     readonly keyId: string;

package/dist/account.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"account.d.ts","sourceRoot":"","sources":["../src/account.ts"],"names":[],"mappings":"AAIA,OAAO,EAAyC,KAAK,GAAG,EAAE,KAAK,OAAO,EAAE,MAAM,MAAM,CAAC;AACrF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AAEjD,UAAU,cAAc;IACtB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,WAAW,GAAG,SAAS,GAAG,SAAS,CAAC;IACvD,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG;QAAE,GAAG,EAAE,GAAG,CAAA;KAAE,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IACtD,aAAa,CAAC,IAAI,EAAE;QAClB,MAAM,EAAE,OAAO,CAAC;QAChB,KAAK,EAAE,OAAO,CAAC;QACf,WAAW,EAAE,MAAM,CAAC;QACpB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KAClC,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;CAClB;AAWD,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,iBAAiB,EAC1B,IAAI,CAAC,EAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,WAAW,GAAG,SAAS,GAAG,SAAS,CAAA;CAAE,GAC9F,OAAO,CAAC,cAAc,CAAC,CA0CzB"}
+{"version":3,"file":"account.d.ts","sourceRoot":"","sources":["../src/account.ts"],"names":[],"mappings":"AAIA,OAAO,EAAyC,KAAK,GAAG,EAAE,KAAK,OAAO,EAAE,MAAM,MAAM,CAAC;AACrF,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAEpD,UAAU,cAAc;IACtB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,WAAW,GAAG,SAAS,GAAG,SAAS,CAAC;IACvD,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG;QAAE,GAAG,EAAE,GAAG,CAAA;KAAE,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IACtD,aAAa,CAAC,IAAI,EAAE;QAClB,MAAM,EAAE,OAAO,CAAC;QAChB,KAAK,EAAE,OAAO,CAAC;QACf,WAAW,EAAE,MAAM,CAAC;QACpB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KAClC,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;CAClB;AAWD,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,iBAAiB,EAC1B,IAAI,CAAC,EAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,WAAW,GAAG,SAAS,GAAG,SAAS,CAAA;CAAE,GAC9F,OAAO,CAAC,cAAc,CAAC,CA0CzB"}

package/dist/derive-subject.d.ts

@@ -1,5 +1,5 @@
 import { type Hex } from 'viem';
-import type { BuildOpts, KmsAccountBackend } from './types';
+import type { BuildOpts, KmsAccountBackend } from './types.js';
 /** The Google (OIDC) subject a custodian key is bound to. */
 export interface SubjectId {
     /** OIDC issuer, e.g. `https://accounts.google.com`. */

package/dist/derive-subject.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"derive-subject.d.ts","sourceRoot":"","sources":["../src/derive-subject.ts"],"names":[],"mappings":"AA8BA,OAAO,EAA0B,KAAK,GAAG,EAAE,MAAM,MAAM,CAAC;AACxD,OAAO,KAAK,EAAE,SAAS,EAAE,iBAAiB,EAAc,MAAM,SAAS,CAAC;AAMxE,6DAA6D;AAC7D,MAAM,WAAW,SAAS;IACxB,uDAAuD;IACvD,GAAG,EAAE,MAAM,CAAC;IACZ,gDAAgD;IAChD,GAAG,EAAE,MAAM,CAAC;IACZ,gEAAgE;IAChE,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,iBAAkB,SAAQ,SAAS;IAClD,OAAO,EAAE,SAAS,CAAC;CACpB;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,SAAS,GAAG,MAAM,CAUlE;AAkBD;;;;GAIG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,GAAG,GAAG,CAetF;AAoCD;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,iBAAiB,GAAG,iBAAiB,CAa9E"}
+{"version":3,"file":"derive-subject.d.ts","sourceRoot":"","sources":["../src/derive-subject.ts"],"names":[],"mappings":"AA8BA,OAAO,EAA0B,KAAK,GAAG,EAAE,MAAM,MAAM,CAAC;AACxD,OAAO,KAAK,EAAE,SAAS,EAAE,iBAAiB,EAAc,MAAM,YAAY,CAAC;AAM3E,6DAA6D;AAC7D,MAAM,WAAW,SAAS;IACxB,uDAAuD;IACvD,GAAG,EAAE,MAAM,CAAC;IACZ,gDAAgD;IAChD,GAAG,EAAE,MAAM,CAAC;IACZ,gEAAgE;IAChE,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,iBAAkB,SAAQ,SAAS;IAClD,OAAO,EAAE,SAAS,CAAC;CACpB;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,SAAS,GAAG,MAAM,CAUlE;AAkBD;;;;GAIG;AACH,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,GAAG,GAAG,CAetF;AAoCD;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,iBAAiB,GAAG,iBAAiB,CAa9E"}

package/dist/derive-subject.js

@@ -28,7 +28,7 @@ import { hkdf } from '@noble/hashes/hkdf.js';
 import { sha256 } from '@noble/hashes/sha2.js';
 import { secp256k1 } from '@noble/curves/secp256k1.js';
 import { hexToBytes, bytesToHex } from 'viem';
-import { LocalSecp256k1Signer } from './providers/local';
+import { LocalSecp256k1Signer } from './providers/local.js';
 const DERIVE_INFO_PREFIX = 'kms-custodian:v1';
 const SECP256K1_N = secp256k1.Point.Fn.ORDER;
 /**

package/dist/derive-subject.js.map

@@ -1 +1 @@
-{"version":3,"file":"derive-subject.js","sourceRoot":"","sources":["../src/derive-subject.ts"],"names":[],"mappings":"AAAA,qEAAqE;AACrE,EAAE;AACF,+EAA+E;AAC/E,8EAA8E;AAC9E,6EAA6E;AAC7E,8EAA8E;AAC9E,4EAA4E;AAC5E,2EAA2E;AAC3E,iDAAiD;AACjD,EAAE;AACF,yEAAyE;AACzE,2EAA2E;AAC3E,4EAA4E;AAC5E,4DAA4D;AAC5D,EAAE;AACF,4CAA4C;AAC5C,oEAAoE;AACpE,2FAA2F;AAC3F,4FAA4F;AAC5F,8EAA8E;AAC9E,wDAAwD;AACxD,EAAE;AACF,6EAA6E;AAC7E,4EAA4E;AAC5E,uEAAuE;AACvE,sEAAsE;AAEtE,OAAO,EAAE,IAAI,EAAE,MAAM,uBAAuB,CAAC;AAC7C,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAC/C,OAAO,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,UAAU,EAAY,MAAM,MAAM,CAAC;AAExD,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAEzD,MAAM,kBAAkB,GAAG,kBAAkB,CAAC;AAC9C,MAAM,WAAW,GAAG,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC;AAgB7C;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAkB;IACxD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;IAChC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;IAChC,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAC1E,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAC1E,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,CAAC,CAAC;IACvC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;IAC1F,CAAC;IACD,OAAO,GAAG,kBAAkB,IAAI,kBAAkB,CAAC,GAAG,CAAC,IAAI,kBAAkB,CAAC,GAAG,CAAC,IAAI,QAAQ,EAAE,CAAC;AACnG,CAAC;AAED,SAAS,eAAe,CAAC,KAAiB;IACxC,IAAI,CAAC,GAAG,EAAE,CAAC;IACX,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IACjD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,eAAe,CAAC,CAAS;IAChC,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IAC/B,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,KAAK,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7B,GAAG,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC;QAC3B,CAAC,KAAK,EAAE,CAAC;IACX,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CAAC,MAAkB,EAAE,OAAkB;IAC/E,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,uDAAuD,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1F,CAAC;IACD,MAAM,SAAS,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;IACnD,MAAM,GAAG,GAAG,IAAI,CACd,MAAM,EACN,MAAM,EACN,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,kBAAkB,CAAC,EAC5C,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,EACnC,EAAE,CACH,CAAC;IACF,uEAAuE;IACvE,MAAM,IAAI,GAAG,CAAC,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;IAC9D,OAAO,UAAU,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;AAC3C,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAuB;IACnD,wEAAwE;IACxE,2EAA2E;IAC3E,4EAA4E;IAC5E,4EAA4E;IAC5E,8CAA8C;IAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,mBAAmB,IAAI,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;IACnF,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CACb,0FAA0F;YACxF,mDAAmD,CACtD,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,GAAqB,CAAC,CAAC,CAAE,KAAK,GAAG,EAAoB,CAAC;IAC9F,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IAClC,IAAI,KAAK,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,kEAAkE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IACpG,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,SAAS,CAAC,IAAuB;IACxC,IAAI,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC,OAAO,CAAC;IACtC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,eAAyC,CAAC;QACnE,IAAI,GAAG;YAAE,OAAO,GAAG,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,yCAAyC;IAC3C,CAAC;IACD,8EAA8E;IAC9E,yDAAyD;IACzD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAuB;IACzD,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,OAAO,KAAK,WAAW,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;QAC1C,MAAM,aAAa,GAAG,0BAA0B,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QACvE,OAAO,IAAI,oBAAoB,CAAC,EAAE,aAAa,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;IAChF,CAAC;IACD,MAAM,IAAI,KAAK,CACb,mFAAmF,OAAO,KAAK;QAC7F,8FAA8F;QAC9F,mFAAmF;QACnF,sDAAsD,CACzD,CAAC;AACJ,CAAC"}
+{"version":3,"file":"derive-subject.js","sourceRoot":"","sources":["../src/derive-subject.ts"],"names":[],"mappings":"AAAA,qEAAqE;AACrE,EAAE;AACF,+EAA+E;AAC/E,8EAA8E;AAC9E,6EAA6E;AAC7E,8EAA8E;AAC9E,4EAA4E;AAC5E,2EAA2E;AAC3E,iDAAiD;AACjD,EAAE;AACF,yEAAyE;AACzE,2EAA2E;AAC3E,4EAA4E;AAC5E,4DAA4D;AAC5D,EAAE;AACF,4CAA4C;AAC5C,oEAAoE;AACpE,2FAA2F;AAC3F,4FAA4F;AAC5F,8EAA8E;AAC9E,wDAAwD;AACxD,EAAE;AACF,6EAA6E;AAC7E,4EAA4E;AAC5E,uEAAuE;AACvE,sEAAsE;AAEtE,OAAO,EAAE,IAAI,EAAE,MAAM,uBAAuB,CAAC;AAC7C,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAC/C,OAAO,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,UAAU,EAAY,MAAM,MAAM,CAAC;AAExD,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAE5D,MAAM,kBAAkB,GAAG,kBAAkB,CAAC;AAC9C,MAAM,WAAW,GAAG,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC;AAgB7C;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAkB;IACxD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;IAChC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;IAChC,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAC1E,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAC1E,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,CAAC,CAAC;IACvC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;IAC1F,CAAC;IACD,OAAO,GAAG,kBAAkB,IAAI,kBAAkB,CAAC,GAAG,CAAC,IAAI,kBAAkB,CAAC,GAAG,CAAC,IAAI,QAAQ,EAAE,CAAC;AACnG,CAAC;AAED,SAAS,eAAe,CAAC,KAAiB;IACxC,IAAI,CAAC,GAAG,EAAE,CAAC;IACX,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IACjD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,eAAe,CAAC,CAAS;IAChC,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IAC/B,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,KAAK,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7B,GAAG,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC;QAC3B,CAAC,KAAK,EAAE,CAAC;IACX,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CAAC,MAAkB,EAAE,OAAkB;IAC/E,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,uDAAuD,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IAC1F,CAAC;IACD,MAAM,SAAS,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;IACnD,MAAM,GAAG,GAAG,IAAI,CACd,MAAM,EACN,MAAM,EACN,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,kBAAkB,CAAC,EAC5C,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,EACnC,EAAE,CACH,CAAC;IACF,uEAAuE;IACvE,MAAM,IAAI,GAAG,CAAC,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;IAC9D,OAAO,UAAU,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;AAC3C,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAuB;IACnD,wEAAwE;IACxE,2EAA2E;IAC3E,4EAA4E;IAC5E,4EAA4E;IAC5E,8CAA8C;IAC9C,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,mBAAmB,IAAI,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;IACnF,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CACb,0FAA0F;YACxF,mDAAmD,CACtD,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,GAAqB,CAAC,CAAC,CAAE,KAAK,GAAG,EAAoB,CAAC;IAC9F,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IAClC,IAAI,KAAK,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,kEAAkE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IACpG,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,SAAS,CAAC,IAAuB;IACxC,IAAI,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC,OAAO,CAAC;IACtC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,eAAyC,CAAC;QACnE,IAAI,GAAG;YAAE,OAAO,GAAG,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,yCAAyC;IAC3C,CAAC;IACD,8EAA8E;IAC9E,yDAAyD;IACzD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAuB;IACzD,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,OAAO,KAAK,WAAW,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;QAC1C,MAAM,aAAa,GAAG,0BAA0B,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QACvE,OAAO,IAAI,oBAAoB,CAAC,EAAE,aAAa,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;IAChF,CAAC;IACD,MAAM,IAAI,KAAK,CACb,mFAAmF,OAAO,KAAK;QAC7F,8FAA8F;QAC9F,mFAAmF;QACnF,sDAAsD,CACzD,CAAC;AACJ,CAAC"}

package/dist/factories.d.ts

@@ -1,5 +1,31 @@
-import type { A2AKeyProvider, BuildOpts, KmsAccountBackend } from './types';
+import type { AuditSink } from '@agenticprimitives/audit';
+import type { A2AKeyProvider, BuildOpts, KmsAccountBackend } from './types.js';
 export declare function buildKeyProvider(opts: BuildOpts): A2AKeyProvider;
+/**
+ * Per-person vault KEK selection (spec 278 P3 / VKB-D1, VKB-D2). Returns the
+ * envelope provider a vault host should use to wrap/unwrap a SPECIFIC person's
+ * vault objects.
+ *
+ * Fail-closed by design: a person-owned vault MUST resolve to a per-person KEK
+ * (`kmsKeyRef`, from that person's `VaultKeyBinding` — provisioned via spec 276
+ * `provision-gcp`). There is NO global key for person data. The local-aes path
+ * is permitted ONLY for anonymous/seeded test fixtures and ONLY when the caller
+ * explicitly opts in (`allowFixtureKey: true`) — never for a real person vault.
+ * With neither a `kmsKeyRef` nor an explicit fixture allowance, this THROWS.
+ */
+export interface SelectVaultKeyProviderOpts {
+    /** The person's KEK resource name (from their VaultKeyBinding). Selects a per-person GCP KEK. */
+    kmsKeyRef?: string;
+    /** Service-account JSON for the GCP KEK (required with `kmsKeyRef`). */
+    serviceAccountJson?: string;
+    /** Audit sink → envelope wrap/unwrap emit `key-custody.envelope.*`. */
+    auditSink?: AuditSink;
+    /** Set ONLY for anonymous/seeded fixtures; uses local-aes. Never for a real person vault. */
+    allowFixtureKey?: boolean;
+    /** Fixture master key (local-aes) — used only when `allowFixtureKey` is true. */
+    fixtureKeyHex?: string;
+}
+export declare function selectVaultKeyProvider(opts: SelectVaultKeyProviderOpts): A2AKeyProvider;
 export declare function buildSignerBackend(opts: BuildOpts): KmsAccountBackend;
 /**
  * @deprecated Renamed in H7-B.1 to make the lie loud. Use

package/dist/factories.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"factories.d.ts","sourceRoot":"","sources":["../src/factories.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,iBAAiB,EAAc,MAAM,SAAS,CAAC;AAyDxF,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,SAAS,GAAG,cAAc,CAYhE;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,SAAS,GAAG,iBAAiB,CAgBrE;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,GAAG,iBAAiB,CAU7F;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,mCAAmC,CACjD,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,SAAS,GACd,iBAAiB,CAyBnB;AAED,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,cAAc,CAMlF"}
+{"version":3,"file":"factories.d.ts","sourceRoot":"","sources":["../src/factories.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,KAAK,EAAE,cAAc,EAAE,SAAS,EAAE,iBAAiB,EAAc,MAAM,YAAY,CAAC;AAyD3F,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,SAAS,GAAG,cAAc,CAehE;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,0BAA0B;IACzC,iGAAiG;IACjG,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wEAAwE;IACxE,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,uEAAuE;IACvE,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,6FAA6F;IAC7F,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,iFAAiF;IACjF,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,0BAA0B,GAAG,cAAc,CAqBvF;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,SAAS,GAAG,iBAAiB,CAgBrE;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,GAAG,iBAAiB,CAU7F;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,mCAAmC,CACjD,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,SAAS,GACd,iBAAiB,CAyBnB;AAED,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,cAAc,CAMlF"}

package/dist/factories.js

@@ -1,6 +1,6 @@
-import { LocalAesProvider, LocalSecp256k1Signer } from './providers/local';
-import { AwsKmsProvider, AwsKmsSigner } from './providers/aws';
-import { GcpKmsProvider, GcpKmsSigner } from './providers/gcp';
+import { LocalAesProvider, LocalSecp256k1Signer } from './providers/local.js';
+import { AwsKmsProvider, AwsKmsSigner } from './providers/aws.js';
+import { GcpKmsProvider, GcpKmsSigner } from './providers/gcp.js';
 /**
  * Resolve effective environment for production-default gates (audit H1).
  *   1. Explicit `opts.environment` wins.
@@ -65,9 +65,32 @@ export function buildKeyProvider(opts) {
             return new GcpKmsProvider({
                 cryptoKeyName: opts.config?.cryptoKeyName,
                 serviceAccountJson: opts.config?.serviceAccountJson,
+                // spec 278 P0/P3: thread the audit sink so envelope wrap/unwrap emit
+                // `key-custody.envelope.{wrap,unwrap}` on the production path.
+                auditSink: opts.auditSink,
             });
     }
 }
+export function selectVaultKeyProvider(opts) {
+    if (opts.kmsKeyRef) {
+        if (!opts.serviceAccountJson) {
+            throw new Error('[key-custody] selectVaultKeyProvider: serviceAccountJson is required with a kmsKeyRef (per-person KEK).');
+        }
+        return new GcpKmsProvider({
+            cryptoKeyName: opts.kmsKeyRef,
+            serviceAccountJson: opts.serviceAccountJson,
+            auditSink: opts.auditSink,
+        });
+    }
+    if (opts.allowFixtureKey) {
+        // Anonymous / seeded fixtures only (spec 278 VKB-D1 exception). LocalAesProvider
+        // keeps its own production guard; this path is testnet/fixture-grade by contract.
+        return new LocalAesProvider({ sessionSecretHex: opts.fixtureKeyHex });
+    }
+    throw new Error('[key-custody] selectVaultKeyProvider: a person-owned vault requires a per-person `kmsKeyRef` ' +
+        '(from the VaultKeyBinding). No global key is permitted for person data (spec 278 VKB-D1). ' +
+        'For anonymous/seeded fixtures only, pass `allowFixtureKey: true`.');
+}
 export function buildSignerBackend(opts) {
     switch (backendOrEnv(opts)) {
         case 'local-aes':

package/dist/factories.js.map

@@ -1 +1 @@
-{"version":3,"file":"factories.js","sourceRoot":"","sources":["../src/factories.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAC3E,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAE/D;;;;;;;GAOG;AACH,SAAS,gBAAgB,CAAC,IAAe;IACvC,IAAI,IAAI,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC,WAAW,CAAC;IAC9C,IAAI,IAAI,CAAC,eAAe,KAAK,IAAI;QAAE,OAAO,aAAa,CAAC;IACxD,IAAI,CAAC;QACH,IAAI,OAAO,OAAO,KAAK,WAAW,IAAI,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,CAAC;YAC5D,OAAO,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,aAAa,CAAC;QAC9E,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,+CAA+C;IACjD,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,YAAY,CAAC,IAAe;IACnC,IAAI,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC,OAAO,CAAC;IACtC,MAAM,UAAU,GAAG,CAAC,GAAG,EAAE;QACvB,IAAI,CAAC;YACH,OAAO,OAAO,CAAC,GAAG,EAAE,eAAyC,CAAC;QAChE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC,CAAC,EAAE,CAAC;IACL,IAAI,UAAU;QAAE,OAAO,UAAU,CAAC;IAClC,IAAI,gBAAgB,CAAC,IAAI,CAAC,KAAK,YAAY,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CACb,yEAAyE;YACvE,2DAA2D;YAC3D,6EAA6E;YAC7E,4DAA4D;YAC5D,wEAAwE,CAC3E,CAAC;IACJ,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAe;IAC9C,QAAQ,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,KAAK,WAAW;YACd,OAAO,IAAI,gBAAgB,CAAC,EAAE,gBAAgB,EAAE,IAAI,CAAC,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC;QACnF,KAAK,SAAS;YACZ,OAAO,IAAI,cAAc,EAAE,CAAC;QAC9B,KAAK,SAAS;YACZ,OAAO,IAAI,cAAc,CAAC;gBACxB,aAAa,EAAE,IAAI,CAAC,MAAM,EAAE,aAAa;gBACzC,kBAAkB,EAAE,IAAI,CAAC,MAAM,EAAE,kBAAkB;aACpD,CAAC,CAAC;IACP,CAAC;AACH,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,IAAe;IAChD,QAAQ,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,KAAK,WAAW;YACd,OAAO,IAAI,oBAAoB,CAAC;gBAC9B,aAAa,EAAE,IAAI,CAAC,MAAM,EAAE,aAAa;gBACzC,SAAS,EAAE,IAAI,CAAC,SAAS;aAC1B,CAAC,CAAC;QACL,KAAK,SAAS;YACZ,OAAO,IAAI,YAAY,EAAE,CAAC;QAC5B,KAAK,SAAS;YACZ,OAAO,IAAI,YAAY,CAAC;gBACtB,oBAAoB,EAAE,IAAI,CAAC,MAAM,EAAE,oBAAoB;gBACvD,kBAAkB,EAAE,IAAI,CAAC,MAAM,EAAE,kBAAkB;gBACnD,SAAS,EAAE,IAAI,CAAC,SAAS;aAC1B,CAAC,CAAC;IACP,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,OAAe,EAAE,KAAgB;IACxE,MAAM,IAAI,KAAK,CACb,8FAA8F;QAC5F,0FAA0F;QAC1F,0EAA0E;QAC1E,sFAAsF;QACtF,8DAA8D;QAC9D,6DAA6D;QAC7D,uEAAuE,CAC1E,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,mCAAmC,CACjD,MAAc,EACd,IAAe;IAEf,KAAK,MAAM,CAAC;IACZ,MAAM,GAAG,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACnC,IAAI,GAAG,KAAK,YAAY,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,8EAA8E;YAC5E,sFAAsF;YACtF,mFAAmF;YACnF,sCAAsC,CACzC,CAAC;IACJ,CAAC;IACD,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,CAAC;QACH,SAAS,GAAG,OAAO,CAAC,GAAG,EAAE,0BAA0B,KAAK,MAAM,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,6BAA6B;IAC/B,CAAC;IACD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,qEAAqE;YACnE,8EAA8E;YAC9E,qFAAqF,CACxF,CAAC;IACJ,CAAC;IACD,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC;AAClC,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,QAAgB,EAAE,IAAe;IAChE,uDAAuD;IACvD,4EAA4E;IAC5E,gCAAgC;IAChC,KAAK,QAAQ,CAAC;IACd,OAAO,gBAAgB,CAAC,IAAI,CAAC,CAAC;AAChC,CAAC"}
+{"version":3,"file":"factories.js","sourceRoot":"","sources":["../src/factories.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC9E,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClE,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElE;;;;;;;GAOG;AACH,SAAS,gBAAgB,CAAC,IAAe;IACvC,IAAI,IAAI,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC,WAAW,CAAC;IAC9C,IAAI,IAAI,CAAC,eAAe,KAAK,IAAI;QAAE,OAAO,aAAa,CAAC;IACxD,IAAI,CAAC;QACH,IAAI,OAAO,OAAO,KAAK,WAAW,IAAI,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,CAAC;YAC5D,OAAO,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,aAAa,CAAC;QAC9E,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,+CAA+C;IACjD,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,YAAY,CAAC,IAAe;IACnC,IAAI,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC,OAAO,CAAC;IACtC,MAAM,UAAU,GAAG,CAAC,GAAG,EAAE;QACvB,IAAI,CAAC;YACH,OAAO,OAAO,CAAC,GAAG,EAAE,eAAyC,CAAC;QAChE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IACH,CAAC,CAAC,EAAE,CAAC;IACL,IAAI,UAAU;QAAE,OAAO,UAAU,CAAC;IAClC,IAAI,gBAAgB,CAAC,IAAI,CAAC,KAAK,YAAY,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CACb,yEAAyE;YACvE,2DAA2D;YAC3D,6EAA6E;YAC7E,4DAA4D;YAC5D,wEAAwE,CAC3E,CAAC;IACJ,CAAC;IACD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAe;IAC9C,QAAQ,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,KAAK,WAAW;YACd,OAAO,IAAI,gBAAgB,CAAC,EAAE,gBAAgB,EAAE,IAAI,CAAC,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC;QACnF,KAAK,SAAS;YACZ,OAAO,IAAI,cAAc,EAAE,CAAC;QAC9B,KAAK,SAAS;YACZ,OAAO,IAAI,cAAc,CAAC;gBACxB,aAAa,EAAE,IAAI,CAAC,MAAM,EAAE,aAAa;gBACzC,kBAAkB,EAAE,IAAI,CAAC,MAAM,EAAE,kBAAkB;gBACnD,qEAAqE;gBACrE,+DAA+D;gBAC/D,SAAS,EAAE,IAAI,CAAC,SAAS;aAC1B,CAAC,CAAC;IACP,CAAC;AACH,CAAC;AA2BD,MAAM,UAAU,sBAAsB,CAAC,IAAgC;IACrE,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACnB,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,yGAAyG,CAAC,CAAC;QAC7H,CAAC;QACD,OAAO,IAAI,cAAc,CAAC;YACxB,aAAa,EAAE,IAAI,CAAC,SAAS;YAC7B,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;YAC3C,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC,CAAC;IACL,CAAC;IACD,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;QACzB,iFAAiF;QACjF,kFAAkF;QAClF,OAAO,IAAI,gBAAgB,CAAC,EAAE,gBAAgB,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,IAAI,KAAK,CACb,+FAA+F;QAC7F,4FAA4F;QAC5F,mEAAmE,CACtE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,IAAe;IAChD,QAAQ,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,KAAK,WAAW;YACd,OAAO,IAAI,oBAAoB,CAAC;gBAC9B,aAAa,EAAE,IAAI,CAAC,MAAM,EAAE,aAAa;gBACzC,SAAS,EAAE,IAAI,CAAC,SAAS;aAC1B,CAAC,CAAC;QACL,KAAK,SAAS;YACZ,OAAO,IAAI,YAAY,EAAE,CAAC;QAC5B,KAAK,SAAS;YACZ,OAAO,IAAI,YAAY,CAAC;gBACtB,oBAAoB,EAAE,IAAI,CAAC,MAAM,EAAE,oBAAoB;gBACvD,kBAAkB,EAAE,IAAI,CAAC,MAAM,EAAE,kBAAkB;gBACnD,SAAS,EAAE,IAAI,CAAC,SAAS;aAC1B,CAAC,CAAC;IACP,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,OAAe,EAAE,KAAgB;IACxE,MAAM,IAAI,KAAK,CACb,8FAA8F;QAC5F,0FAA0F;QAC1F,0EAA0E;QAC1E,sFAAsF;QACtF,8DAA8D;QAC9D,6DAA6D;QAC7D,uEAAuE,CAC1E,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,mCAAmC,CACjD,MAAc,EACd,IAAe;IAEf,KAAK,MAAM,CAAC;IACZ,MAAM,GAAG,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACnC,IAAI,GAAG,KAAK,YAAY,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,8EAA8E;YAC5E,sFAAsF;YACtF,mFAAmF;YACnF,sCAAsC,CACzC,CAAC;IACJ,CAAC;IACD,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,CAAC;QACH,SAAS,GAAG,OAAO,CAAC,GAAG,EAAE,0BAA0B,KAAK,MAAM,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,6BAA6B;IAC/B,CAAC;IACD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,qEAAqE;YACnE,8EAA8E;YAC9E,qFAAqF,CACxF,CAAC;IACJ,CAAC;IACD,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC;AAClC,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,QAAgB,EAAE,IAAe;IAChE,uDAAuD;IACvD,4EAA4E;IAC5E,gCAAgC;IAChC,KAAK,QAAQ,CAAC;IACd,OAAO,gBAAgB,CAAC,IAAI,CAAC,CAAC;AAChC,CAAC"}

package/dist/index.d.ts

@@ -1,15 +1,15 @@
 import type { Address, Hex } from '@agenticprimitives/types';
 export type { Address, Hex };
-export type { A2AKeyProvider, KmsAccountBackend, BuildOpts, KmsBackend, Secret } from './types';
-export { loadSecret, loadSecretFromEnv, unwrapSecret, isSecret } from './types';
-export { buildKeyProvider, buildSignerBackend, buildToolExecutorBackendNoIsolation, buildMacProvider, } from './factories';
-export { deriveSubjectSigner, subjectCanonicalMessage, type SubjectId, type DeriveSubjectOpts, } from './derive-subject';
-export { getRelayOnlySigner } from './relay-only';
-export { createKmsAccount } from './account';
-export { createKmsViemAccount } from './kms-viem-account';
-export { createRelayerAccount, type CreateRelayerAccountOpts, } from './relayer-account';
-export { createSpendCappedAccount, SpendCapExceededError, type CreateSpendCappedAccountOpts, } from './spend-capped-account';
-export { canonicalContextBytes } from './aad';
-export { LocalAesProvider, LocalSecp256k1Signer } from './providers/local';
-export { GcpKmsProvider, GcpKmsSigner } from './providers/gcp';
+export type { A2AKeyProvider, KmsAccountBackend, BuildOpts, KmsBackend, Secret } from './types.js';
+export { loadSecret, loadSecretFromEnv, unwrapSecret, isSecret } from './types.js';
+export { buildKeyProvider, buildSignerBackend, buildToolExecutorBackendNoIsolation, buildMacProvider, selectVaultKeyProvider, type SelectVaultKeyProviderOpts, } from './factories.js';
+export { deriveSubjectSigner, subjectCanonicalMessage, type SubjectId, type DeriveSubjectOpts, } from './derive-subject.js';
+export { getRelayOnlySigner } from './relay-only.js';
+export { createKmsAccount } from './account.js';
+export { createKmsViemAccount } from './kms-viem-account.js';
+export { createRelayerAccount, type CreateRelayerAccountOpts, } from './relayer-account.js';
+export { createSpendCappedAccount, SpendCapExceededError, type CreateSpendCappedAccountOpts, } from './spend-capped-account.js';
+export { canonicalContextBytes } from './aad.js';
+export { LocalAesProvider, LocalSecp256k1Signer } from './providers/local.js';
+export { GcpKmsProvider, GcpKmsSigner } from './providers/gcp.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,0BAA0B,CAAC;AAE7D,YAAY,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;AAC7B,YAAY,EAAE,cAAc,EAAE,iBAAiB,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAChG,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEhF,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAWlB,mCAAmC,EACnC,gBAAgB,GACjB,MAAM,aAAa,CAAC;AAKrB,OAAO,EACL,mBAAmB,EACnB,uBAAuB,EACvB,KAAK,SAAS,EACd,KAAK,iBAAiB,GACvB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EACL,oBAAoB,EACpB,KAAK,wBAAwB,GAC9B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,wBAAwB,EACxB,qBAAqB,EACrB,KAAK,4BAA4B,GAClC,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,qBAAqB,EAAE,MAAM,OAAO,CAAC;AAE9C,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAU3E,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,0BAA0B,CAAC;AAE7D,YAAY,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;AAC7B,YAAY,EAAE,cAAc,EAAE,iBAAiB,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AACnG,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAEnF,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAWlB,mCAAmC,EACnC,gBAAgB,EAEhB,sBAAsB,EACtB,KAAK,0BAA0B,GAChC,MAAM,gBAAgB,CAAC;AAKxB,OAAO,EACL,mBAAmB,EACnB,uBAAuB,EACvB,KAAK,SAAS,EACd,KAAK,iBAAiB,GACvB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EACL,oBAAoB,EACpB,KAAK,wBAAwB,GAC9B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,wBAAwB,EACxB,qBAAqB,EACrB,KAAK,4BAA4B,GAClC,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AAEjD,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAU9E,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC"}

package/dist/index.js

@@ -1,7 +1,7 @@
 // @agenticprimitives/key-custody — public API
 //
 // See ../../specs/203-key-custody.md for the full contract.
-export { loadSecret, loadSecretFromEnv, unwrapSecret, isSecret } from './types';
+export { loadSecret, loadSecretFromEnv, unwrapSecret, isSecret } from './types.js';
 export { buildKeyProvider, buildSignerBackend, 
 // R11.3 / PKG-KEY-CUSTODY-001 follow-up — `buildToolExecutorBackend`
 // is NOT re-exported here. Its v0 implementation is the always-throwing
@@ -13,19 +13,21 @@ export { buildKeyProvider, buildSignerBackend,
 // either implements HKDF per-tool isolation or graduates
 // `buildToolExecutorBackendNoIsolation` to the canonical name. Until
 // then, the public surface is the explicit-name one only.
-buildToolExecutorBackendNoIsolation, buildMacProvider, } from './factories';
+buildToolExecutorBackendNoIsolation, buildMacProvider, 
+// spec 278 P3 — per-person vault KEK selection (fail-closed; no global key for person data).
+selectVaultKeyProvider, } from './factories.js';
 // `deriveSubjectPrivateKeyHex` is intentionally NOT re-exported here — it returns
 // a per-subject raw private key (security-sensitive). It stays exported from
 // `./derive-subject` for in-package unit tests but is not part of the public API.
 // See `capability.manifest.json:publicExports` (audit row ARCH-006 / PKG-KEY-CUSTODY-002 closure).
-export { deriveSubjectSigner, subjectCanonicalMessage, } from './derive-subject';
-export { getRelayOnlySigner } from './relay-only';
-export { createKmsAccount } from './account';
-export { createKmsViemAccount } from './kms-viem-account';
-export { createRelayerAccount, } from './relayer-account';
-export { createSpendCappedAccount, SpendCapExceededError, } from './spend-capped-account';
-export { canonicalContextBytes } from './aad';
-export { LocalAesProvider, LocalSecp256k1Signer } from './providers/local';
+export { deriveSubjectSigner, subjectCanonicalMessage, } from './derive-subject.js';
+export { getRelayOnlySigner } from './relay-only.js';
+export { createKmsAccount } from './account.js';
+export { createKmsViemAccount } from './kms-viem-account.js';
+export { createRelayerAccount, } from './relayer-account.js';
+export { createSpendCappedAccount, SpendCapExceededError, } from './spend-capped-account.js';
+export { canonicalContextBytes } from './aad.js';
+export { LocalAesProvider, LocalSecp256k1Signer } from './providers/local.js';
 // R11.3 — `AwsKmsProvider` / `AwsKmsSigner` are NOT re-exported here.
 // Their current implementations throw a `not yet implemented in v0;
 // use LocalAesProvider for the demo` message at construction time. A
@@ -35,5 +37,5 @@ export { LocalAesProvider, LocalSecp256k1Signer } from './providers/local';
 // factory throws a clear error when selected. v1 is GCP-only +
 // local-aes (dev). When AWS lands, re-add the export alongside the
 // LocalAes + Gcp providers.
-export { GcpKmsProvider, GcpKmsSigner } from './providers/gcp';
+export { GcpKmsProvider, GcpKmsSigner } from './providers/gcp.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,8CAA8C;AAC9C,EAAE;AACF,4DAA4D;AAM5D,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEhF,OAAO,EACL,gBAAgB,EAChB,kBAAkB;AAClB,qEAAqE;AACrE,wEAAwE;AACxE,iDAAiD;AACjD,6DAA6D;AAC7D,wEAAwE;AACxE,qEAAqE;AACrE,oEAAoE;AACpE,yDAAyD;AACzD,qEAAqE;AACrE,0DAA0D;AAC1D,mCAAmC,EACnC,gBAAgB,GACjB,MAAM,aAAa,CAAC;AACrB,kFAAkF;AAClF,6EAA6E;AAC7E,kFAAkF;AAClF,mGAAmG;AACnG,OAAO,EACL,mBAAmB,EACnB,uBAAuB,GAGxB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EACL,oBAAoB,GAErB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,wBAAwB,EACxB,qBAAqB,GAEtB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,qBAAqB,EAAE,MAAM,OAAO,CAAC;AAE9C,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAC3E,sEAAsE;AACtE,oEAAoE;AACpE,qEAAqE;AACrE,uEAAuE;AACvE,yEAAyE;AACzE,qEAAqE;AACrE,+DAA+D;AAC/D,mEAAmE;AACnE,4BAA4B;AAC5B,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,8CAA8C;AAC9C,EAAE;AACF,4DAA4D;AAM5D,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAEnF,OAAO,EACL,gBAAgB,EAChB,kBAAkB;AAClB,qEAAqE;AACrE,wEAAwE;AACxE,iDAAiD;AACjD,6DAA6D;AAC7D,wEAAwE;AACxE,qEAAqE;AACrE,oEAAoE;AACpE,yDAAyD;AACzD,qEAAqE;AACrE,0DAA0D;AAC1D,mCAAmC,EACnC,gBAAgB;AAChB,6FAA6F;AAC7F,sBAAsB,GAEvB,MAAM,gBAAgB,CAAC;AACxB,kFAAkF;AAClF,6EAA6E;AAC7E,kFAAkF;AAClF,mGAAmG;AACnG,OAAO,EACL,mBAAmB,EACnB,uBAAuB,GAGxB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EACL,oBAAoB,GAErB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,wBAAwB,EACxB,qBAAqB,GAEtB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AAEjD,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC9E,sEAAsE;AACtE,oEAAoE;AACpE,qEAAqE;AACrE,uEAAuE;AACvE,yEAAyE;AACzE,qEAAqE;AACrE,+DAA+D;AAC/D,mEAAmE;AACnE,4BAA4B;AAC5B,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC"}

package/dist/kms/provision-gcp.d.ts

@@ -1,56 +1,89 @@
 import { type Hex } from './secp256k1-core.js';
+/** Key purpose. `asymmetric-signing` = secp256k1 EVM signer (default). `encrypt-decrypt` =
+ *  symmetric KEK for envelope wrapping (spec 277/278 per-person vault key). */
+export type KeyPurpose = 'asymmetric-signing' | 'encrypt-decrypt';
 export interface ProvisionPlan {
     project: string;
     location: string;
     keyRing: string;
-    /** Opaque signing-identity labels → one HSM secp256k1 key each. NO vertical names here. */
+    /** Signing/KEK identity labels — arbitrary (dotted agent names ok); sanitized to key ids (B2). */
     identities: string[];
-    /** Service-account email to grant `roles/cloudkms.signer`, scoped per key. */
+    /** Service-account email to grant the per-key IAM role. */
     runtimeServiceAccount: string;
-    /** secp256k1 in GCP requires HSM; SOFTWARE is rejected by GCP for this curve. Default HSM. */
+    /** secp256k1 requires HSM; SOFTWARE is rejected by GCP for that curve. Default HSM. */
     protectionLevel?: 'HSM' | 'SOFTWARE';
+    /** Default `asymmetric-signing`. `encrypt-decrypt` mints a symmetric KEK (spec 278 vault key). */
+    purpose?: KeyPurpose;
+    /** Per-key IAM role (B3). Default: `roles/cloudkms.signerVerifier` for signing,
+     *  `roles/cloudkms.cryptoKeyEncrypterDecrypter` for encrypt-decrypt. */
+    iamRole?: string;
 }
 export type StepKind = 'create-keyring' | 'create-key' | 'grant-iam';
-export interface GcloudStep {
+/** REST-executor parameters carried alongside the gcloud `argv` so both executors work. */
+export interface ProvisionStepRest {
+    project: string;
+    location: string;
+    keyRing: string;
+    keyId?: string;
+    purpose?: KeyPurpose;
+    protectionLevel?: 'HSM' | 'SOFTWARE';
+    role?: string;
+    member?: string;
+}
+export interface ProvisionStep {
     id: string;
     kind: StepKind;
     description: string;
     /** argv for `gcloud` (no shell string — avoids injection). */
     argv: string[];
-    /** Present for create-key / grant-iam steps. */
+    /** The ORIGINAL identity label (create-key / grant-iam). */
     identity?: string;
+    /** The sanitized GCP key id used in the resource name. */
+    keyId?: string;
     /** The key resource this step targets (create-key / grant-iam). */
     cryptoKeyName?: string;
+    /** Structured params the REST executor uses (the gcloud executor uses `argv`). */
+    rest: ProvisionStepRest;
 }
+/** @deprecated name — kept for back-compat; use `ProvisionStep`. */
+export type GcloudStep = ProvisionStep;
 export interface StepExecutor {
-    /** Run a planned step. Return `{ alreadyExists: true }` to mark an idempotent skip
-     *  (the resource already existed); throw for any real failure. */
-    run(step: GcloudStep): Promise<{
+    /** Run a planned step. Return `{ alreadyExists: true }` for an idempotent skip; throw on real failure. */
+    run(step: ProvisionStep): Promise<{
         stdout: string;
         alreadyExists?: boolean;
     }>;
-    /** Fetch a key version's SPKI PEM (for address verification) — via gcloud or REST. */
+    /** Fetch a key version's SPKI PEM (asymmetric keys only — for address verification). */
     getPublicKeyPem(cryptoKeyVersionName: string): Promise<string>;
 }
 export interface ProvisionResult {
-    /** identity → full `…/cryptoKeyVersions/1` resource name. */
+    /** identity (ORIGINAL label) → key resource: `…/cryptoKeyVersions/1` for signing keys,
+     *  the version-less `…/cryptoKeys/<id>` for encrypt-decrypt KEKs (what the provider wants). */
     keyMap: Record<string, string>;
-    /** identity → derived EVM address (verify against expectations BEFORE wiring env). */
+    /** identity → derived EVM address (signing keys only; verify BEFORE wiring env). */
     addresses: Record<string, Hex>;
     granted: Array<{
         key: string;
         member: string;
-        role: 'roles/cloudkms.signer';
+        role: string;
     }>;
-    /** Step ids that were skipped because the resource already existed (idempotent re-run). */
+    /** Step ids skipped because the resource already existed (idempotent re-run). */
     alreadyExisted: string[];
 }
-/** First key version GCP creates for an asymmetric-signing key. */
-export declare function keyVersionName(plan: ProvisionPlan, identity: string): string;
-/** Emit the ordered gcloud steps for a provisioning plan. Pure — no execution. */
-export declare function planGcpProvision(plan: ProvisionPlan): GcloudStep[];
-/** Execute a provisioning plan through an injected executor. Idempotent: steps whose
- *  resource already exists are skipped and reported. After create+grant, fetches each
- *  key's public key and derives its EVM address so the operator can verify before wiring. */
+/** Sanitize an arbitrary identity label to a GCP cryptoKey id ([a-zA-Z0-9_-], ≤63) (B2). */
+export declare function sanitizeKeyId(identity: string): string;
+/** First key version GCP creates (asymmetric keys — the version is what you sign with). */
+export declare function keyVersionName(plan: ProvisionPlan, keyId: string): string;
+/** Emit the ordered steps for a provisioning plan. Pure — no execution. */
+export declare function planGcpProvision(plan: ProvisionPlan): ProvisionStep[];
+/** Execute a provisioning plan through an injected executor. Idempotent: steps whose resource
+ *  already exists are skipped + reported. For asymmetric keys, fetches each key's public key and
+ *  derives its EVM address (verify before wiring); encrypt-decrypt KEKs have no public key, so the
+ *  keyMap points at the version-less cryptoKey resource and no address is derived. */
 export declare function executeGcpProvision(plan: ProvisionPlan, exec: StepExecutor): Promise<ProvisionResult>;
+/** Build a Cloud KMS REST StepExecutor from a service-account JSON (single-line or base64 — B4).
+ *  Zero gcloud dependency; SA-JWT → KMS REST. Idempotent (409 ALREADY_EXISTS → skip). */
+export declare function createGcpRestStepExecutor(opts: {
+    serviceAccountJson: string | object;
+}): StepExecutor;
 //# sourceMappingURL=provision-gcp.d.ts.map

package/dist/kms/provision-gcp.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"provision-gcp.d.ts","sourceRoot":"","sources":["../../src/kms/provision-gcp.ts"],"names":[],"mappings":"AAaA,OAAO,EAAsB,KAAK,GAAG,EAAE,MAAM,qBAAqB,CAAC;AAEnE,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,2FAA2F;IAC3F,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,8EAA8E;IAC9E,qBAAqB,EAAE,MAAM,CAAC;IAC9B,8FAA8F;IAC9F,eAAe,CAAC,EAAE,KAAK,GAAG,UAAU,CAAC;CACtC;AAED,MAAM,MAAM,QAAQ,GAAG,gBAAgB,GAAG,YAAY,GAAG,WAAW,CAAC;AAErE,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,QAAQ,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,8DAA8D;IAC9D,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,gDAAgD;IAChD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mEAAmE;IACnE,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,YAAY;IAC3B;sEACkE;IAClE,GAAG,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAC5E,sFAAsF;IACtF,eAAe,CAAC,oBAAoB,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAChE;AAED,MAAM,WAAW,eAAe;IAC9B,6DAA6D;IAC7D,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,sFAAsF;IACtF,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC/B,OAAO,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,uBAAuB,CAAA;KAAE,CAAC,CAAC;IAC/E,2FAA2F;IAC3F,cAAc,EAAE,MAAM,EAAE,CAAC;CAC1B;AAMD,mEAAmE;AACnE,wBAAgB,cAAc,CAAC,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE5E;AAED,kFAAkF;AAClF,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,aAAa,GAAG,UAAU,EAAE,CA2DlE;AAED;;6FAE6F;AAC7F,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,eAAe,CAAC,CAuB3G"}
+{"version":3,"file":"provision-gcp.d.ts","sourceRoot":"","sources":["../../src/kms/provision-gcp.ts"],"names":[],"mappings":"AAaA,OAAO,EAAsB,KAAK,GAAG,EAAE,MAAM,qBAAqB,CAAC;AAInE;+EAC+E;AAC/E,MAAM,MAAM,UAAU,GAAG,oBAAoB,GAAG,iBAAiB,CAAC;AAElE,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,kGAAkG;IAClG,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,2DAA2D;IAC3D,qBAAqB,EAAE,MAAM,CAAC;IAC9B,uFAAuF;IACvF,eAAe,CAAC,EAAE,KAAK,GAAG,UAAU,CAAC;IACrC,kGAAkG;IAClG,OAAO,CAAC,EAAE,UAAU,CAAC;IACrB;4EACwE;IACxE,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,MAAM,QAAQ,GAAG,gBAAgB,GAAG,YAAY,GAAG,WAAW,CAAC;AAErE,2FAA2F;AAC3F,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,UAAU,CAAC;IACrB,eAAe,CAAC,EAAE,KAAK,GAAG,UAAU,CAAC;IACrC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,QAAQ,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,8DAA8D;IAC9D,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,4DAA4D;IAC5D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,0DAA0D;IAC1D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mEAAmE;IACnE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,kFAAkF;IAClF,IAAI,EAAE,iBAAiB,CAAC;CACzB;AACD,oEAAoE;AACpE,MAAM,MAAM,UAAU,GAAG,aAAa,CAAC;AAEvC,MAAM,WAAW,YAAY;IAC3B,0GAA0G;IAC1G,GAAG,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAC/E,wFAAwF;IACxF,eAAe,CAAC,oBAAoB,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAChE;AAED,MAAM,WAAW,eAAe;IAC9B;mGAC+F;IAC/F,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,oFAAoF;IACpF,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC/B,OAAO,EAAE,KAAK,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC9D,iFAAiF;IACjF,cAAc,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED,4FAA4F;AAC5F,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAWtD;AAMD,2FAA2F;AAC3F,wBAAgB,cAAc,CAAC,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAEzE;AAQD,2EAA2E;AAC3E,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,aAAa,GAAG,aAAa,EAAE,CAgFrE;AAED;;;sFAGsF;AACtF,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,YAAY,GAAG,OAAO,CAAC,eAAe,CAAC,CA8B3G;AASD;yFACyF;AACzF,wBAAgB,yBAAyB,CAAC,IAAI,EAAE;IAAE,kBAAkB,EAAE,MAAM,GAAG,MAAM,CAAA;CAAE,GAAG,YAAY,CAyDrG"}

package/dist/kms/provision-gcp.js

@@ -1,24 +1,47 @@
-// GCP Cloud KMS provisioning helper (spec 276 KCS-D3). Ports smart-agent's
-// G-PR-6 operator runbook into a reusable, peer-dependency-free primitive.
+// GCP Cloud KMS provisioning helper (spec 276 KCS-D3 + upstream backlog B1/B2/B3).
 //
-// PURE PLANNING + INJECTED EXECUTION: `planGcpProvision` emits the gcloud steps;
-// `executeGcpProvision` runs them through a caller-supplied `StepExecutor` (a
-// gcloud runner, a REST runner, or a test fake). The package never shells out
-// itself — that keeps it Workers-safe and unit-testable. The CLI (`bin/ap-provision-gcp.mjs`)
-// supplies a Node child_process executor.
+// PURE PLANNING + INJECTED EXECUTION: `planGcpProvision` emits the ordered steps;
+// `executeGcpProvision` runs them through a `StepExecutor`. Two executors ship:
+//   - `createGcpRestStepExecutor` — gcloud-FREE: SA-JWT → Cloud KMS REST (B1).
+//     Works on Workers (no gRPC SDK); a "drop the SA key and run" path.
+//   - the CLI (`bin/ap-provision-gcp.mjs`) supplies a Node child_process gcloud runner.
 //
-// No vertical identity names are baked in — `identities` are opaque labels the
-// caller supplies (ADR-0021). Per-key (not per-keyring) IAM enforces master-key
-// separation (key-custody CLAUDE.md invariant).
+// B2: `identities` are arbitrary labels (dotted agent names ok); each is sanitized to a
+// GCP key id internally, and the result maps are keyed by the ORIGINAL label.
+// B3: the granted IAM role is configurable (default derives from the key purpose).
+// Per-key (not per-keyring) IAM enforces master-key separation (CLAUDE.md invariant).
 import { addressFromSpkiPem } from './secp256k1-core.js';
-function keyResourceName(plan, identity) {
-    return `projects/${plan.project}/locations/${plan.location}/keyRings/${plan.keyRing}/cryptoKeys/${identity}`;
+import { fetchAccessToken, callKms } from './gcp-transport.js';
+import { parseServiceAccountJson } from './key-map.js';
+/** Sanitize an arbitrary identity label to a GCP cryptoKey id ([a-zA-Z0-9_-], ≤63) (B2). */
+export function sanitizeKeyId(identity) {
+    // Trim leading/trailing '-' with linear string ops — NOT a regex. The `/^-+|-+$/g`
+    // alternation is ReDoS-prone (polynomial on a long run of '-'); a scan is O(n).
+    const collapsed = identity.replace(/[^a-zA-Z0-9_-]/g, '-');
+    let start = 0;
+    let end = collapsed.length;
+    while (start < end && collapsed[start] === '-')
+        start++;
+    while (end > start && collapsed[end - 1] === '-')
+        end--;
+    const id = collapsed.slice(start, end).slice(0, 63);
+    if (!id)
+        throw new Error(`sanitizeKeyId: identity "${identity}" sanitizes to an empty key id`);
+    return id;
 }
-/** First key version GCP creates for an asymmetric-signing key. */
-export function keyVersionName(plan, identity) {
-    return `${keyResourceName(plan, identity)}/cryptoKeyVersions/1`;
+function keyResourceName(plan, keyId) {
+    return `projects/${plan.project}/locations/${plan.location}/keyRings/${plan.keyRing}/cryptoKeys/${keyId}`;
 }
-/** Emit the ordered gcloud steps for a provisioning plan. Pure — no execution. */
+/** First key version GCP creates (asymmetric keys — the version is what you sign with). */
+export function keyVersionName(plan, keyId) {
+    return `${keyResourceName(plan, keyId)}/cryptoKeyVersions/1`;
+}
+function defaultRole(purpose) {
+    return purpose === 'encrypt-decrypt'
+        ? 'roles/cloudkms.cryptoKeyEncrypterDecrypter'
+        : 'roles/cloudkms.signerVerifier';
+}
+/** Emit the ordered steps for a provisioning plan. Pure — no execution. */
 export function planGcpProvision(plan) {
     if (!plan.project || !plan.location || !plan.keyRing) {
         throw new Error('planGcpProvision: project, location, and keyRing are required');
@@ -31,58 +54,80 @@ export function planGcpProvision(plan) {
     const dupes = plan.identities.filter((id, i) => plan.identities.indexOf(id) !== i);
     if (dupes.length)
         throw new Error(`planGcpProvision: duplicate identities: ${[...new Set(dupes)].join(', ')}`);
+    const purpose = plan.purpose ?? 'asymmetric-signing';
     const protection = (plan.protectionLevel ?? 'HSM').toLowerCase();
+    const role = plan.iamRole ?? defaultRole(purpose);
+    const gcloudPurpose = purpose === 'encrypt-decrypt' ? 'encryption' : 'asymmetric-signing';
+    const gcloudAlgo = purpose === 'encrypt-decrypt' ? 'google-symmetric-encryption' : 'ec-sign-secp256k1-sha256';
+    // B2: map ORIGINAL identity → sanitized keyId; reject collisions (two labels → one key id).
+    const keyIdByIdentity = new Map();
+    const seen = new Map();
+    for (const identity of plan.identities) {
+        const keyId = sanitizeKeyId(identity);
+        const prior = seen.get(keyId);
+        if (prior && prior !== identity) {
+            throw new Error(`planGcpProvision: identities "${prior}" and "${identity}" both sanitize to key id "${keyId}"`);
+        }
+        seen.set(keyId, identity);
+        keyIdByIdentity.set(identity, keyId);
+    }
     const steps = [
         {
             id: 'keyring',
             kind: 'create-keyring',
             description: `Create key ring ${plan.keyRing} in ${plan.location}`,
             argv: ['kms', 'keyrings', 'create', plan.keyRing, '--location', plan.location, '--project', plan.project],
+            rest: { project: plan.project, location: plan.location, keyRing: plan.keyRing },
         },
     ];
     for (const identity of plan.identities) {
-        if (!/^[a-zA-Z0-9_-]+$/.test(identity)) {
-            throw new Error(`planGcpProvision: identity "${identity}" must match [a-zA-Z0-9_-]+ (a GCP key id)`);
-        }
-        const cryptoKeyName = keyResourceName(plan, identity);
+        const keyId = keyIdByIdentity.get(identity);
+        const cryptoKeyName = keyResourceName(plan, keyId);
         steps.push({
             id: `key:${identity}`,
             kind: 'create-key',
             identity,
+            keyId,
             cryptoKeyName,
-            description: `Create HSM secp256k1 signing key ${identity}`,
+            description: `Create ${protection.toUpperCase()} ${purpose} key ${keyId} (for "${identity}")`,
             argv: [
-                'kms', 'keys', 'create', identity,
+                'kms', 'keys', 'create', keyId,
                 '--keyring', plan.keyRing,
                 '--location', plan.location,
                 '--project', plan.project,
-                '--purpose', 'asymmetric-signing',
-                '--default-algorithm', 'ec-sign-secp256k1-sha256',
+                '--purpose', gcloudPurpose,
+                '--default-algorithm', gcloudAlgo,
                 '--protection-level', protection,
             ],
+            rest: { project: plan.project, location: plan.location, keyRing: plan.keyRing, keyId, purpose, protectionLevel: plan.protectionLevel ?? 'HSM' },
         });
         steps.push({
             id: `iam:${identity}`,
             kind: 'grant-iam',
             identity,
+            keyId,
             cryptoKeyName,
-            description: `Grant roles/cloudkms.signer on ${identity} to ${plan.runtimeServiceAccount}`,
+            description: `Grant ${role} on ${keyId} to ${plan.runtimeServiceAccount}`,
             argv: [
-                'kms', 'keys', 'add-iam-policy-binding', identity,
+                'kms', 'keys', 'add-iam-policy-binding', keyId,
                 '--keyring', plan.keyRing,
                 '--location', plan.location,
                 '--project', plan.project,
                 '--member', `serviceAccount:${plan.runtimeServiceAccount}`,
-                '--role', 'roles/cloudkms.signer',
+                '--role', role,
             ],
+            rest: { project: plan.project, location: plan.location, keyRing: plan.keyRing, keyId, role, member: plan.runtimeServiceAccount },
         });
     }
     return steps;
 }
-/** Execute a provisioning plan through an injected executor. Idempotent: steps whose
- *  resource already exists are skipped and reported. After create+grant, fetches each
- *  key's public key and derives its EVM address so the operator can verify before wiring. */
+/** Execute a provisioning plan through an injected executor. Idempotent: steps whose resource
+ *  already exists are skipped + reported. For asymmetric keys, fetches each key's public key and
+ *  derives its EVM address (verify before wiring); encrypt-decrypt KEKs have no public key, so the
+ *  keyMap points at the version-less cryptoKey resource and no address is derived. */
 export async function executeGcpProvision(plan, exec) {
+    const purpose = plan.purpose ?? 'asymmetric-signing';
+    const role = plan.iamRole ?? defaultRole(purpose);
     const steps = planGcpProvision(plan);
     const alreadyExisted = [];
     const granted = [];
@@ -91,17 +136,94 @@ export async function executeGcpProvision(plan, exec) {
         if (r.alreadyExists)
             alreadyExisted.push(step.id);
         if (step.kind === 'grant-iam' && step.cryptoKeyName) {
-            granted.push({ key: step.cryptoKeyName, member: `serviceAccount:${plan.runtimeServiceAccount}`, role: 'roles/cloudkms.signer' });
+            granted.push({ key: step.cryptoKeyName, member: `serviceAccount:${plan.runtimeServiceAccount}`, role });
         }
     }
     const keyMap = {};
     const addresses = {};
     for (const identity of plan.identities) {
-        const versionName = keyVersionName(plan, identity);
-        keyMap[identity] = versionName;
-        const pem = await exec.getPublicKeyPem(versionName);
-        addresses[identity] = addressFromSpkiPem(pem);
+        const keyId = sanitizeKeyId(identity);
+        if (purpose === 'encrypt-decrypt') {
+            // The envelope provider's `kmsKeyRef` is the version-less cryptoKey resource.
+            keyMap[identity] = keyResourceName(plan, keyId);
+        }
+        else {
+            const versionName = keyVersionName(plan, keyId);
+            keyMap[identity] = versionName;
+            addresses[identity] = addressFromSpkiPem(await exec.getPublicKeyPem(versionName));
+        }
     }
     return { keyMap, addresses, granted, alreadyExisted };
 }
+// ─── B1: gcloud-free REST StepExecutor ─────────────────────────────────────
+const GCP_PURPOSE = { 'asymmetric-signing': 'ASYMMETRIC_SIGN', 'encrypt-decrypt': 'ENCRYPT_DECRYPT' };
+const GCP_ALGORITHM = { 'asymmetric-signing': 'EC_SIGN_SECP256K1_SHA256', 'encrypt-decrypt': 'GOOGLE_SYMMETRIC_ENCRYPTION' };
+/** Build a Cloud KMS REST StepExecutor from a service-account JSON (single-line or base64 — B4).
+ *  Zero gcloud dependency; SA-JWT → KMS REST. Idempotent (409 ALREADY_EXISTS → skip). */
+export function createGcpRestStepExecutor(opts) {
+    const sa = parseServiceAccountJson(opts.serviceAccountJson);
+    let cached;
+    async function token() {
+        const now = Math.floor(Date.now() / 1000);
+        if (!cached || cached.expiresAt <= now)
+            cached = await fetchAccessToken(sa);
+        return cached.accessToken;
+    }
+    const isConflict = (e) => e instanceof Error && /HTTP 409|ALREADY_EXISTS/i.test(e.message);
+    return {
+        async run(step) {
+            const t = await token();
+            const r = step.rest;
+            const loc = `projects/${r.project}/locations/${r.location}`;
+            if (step.kind === 'create-keyring') {
+                try {
+                    await callKms(t, `${loc}/keyRings?keyRingId=${encodeURIComponent(r.keyRing)}`, { method: 'POST', body: {} });
+                    return { stdout: 'keyring created' };
+                }
+                catch (e) {
+                    if (isConflict(e))
+                        return { stdout: 'keyring exists', alreadyExists: true };
+                    throw e;
+                }
+            }
+            if (step.kind === 'create-key') {
+                const purpose = r.purpose ?? 'asymmetric-signing';
+                try {
+                    await callKms(t, `${loc}/keyRings/${encodeURIComponent(r.keyRing)}/cryptoKeys?cryptoKeyId=${encodeURIComponent(r.keyId)}`, {
+                        method: 'POST',
+                        body: {
+                            purpose: GCP_PURPOSE[purpose],
+                            versionTemplate: { algorithm: GCP_ALGORITHM[purpose], protectionLevel: (r.protectionLevel ?? 'HSM') },
+                        },
+                    });
+                    return { stdout: 'key created' };
+                }
+                catch (e) {
+                    if (isConflict(e))
+                        return { stdout: 'key exists', alreadyExists: true };
+                    throw e;
+                }
+            }
+            // grant-iam: read-modify-write the key's IAM policy (idempotent; member added once).
+            const keyPath = `${loc}/keyRings/${encodeURIComponent(r.keyRing)}/cryptoKeys/${encodeURIComponent(r.keyId)}`;
+            const policy = await callKms(t, `${keyPath}:getIamPolicy`, { method: 'GET' });
+            const member = `serviceAccount:${r.member}`;
+            const bindings = policy.bindings ?? [];
+            let binding = bindings.find((b) => b.role === r.role);
+            if (!binding) {
+                binding = { role: r.role, members: [] };
+                bindings.push(binding);
+            }
+            if (binding.members.includes(member))
+                return { stdout: 'iam binding already present', alreadyExists: true };
+            binding.members.push(member);
+            await callKms(t, `${keyPath}:setIamPolicy`, { method: 'POST', body: { policy: { ...policy, bindings } } });
+            return { stdout: 'iam granted' };
+        },
+        async getPublicKeyPem(cryptoKeyVersionName) {
+            const res = await callKms(await token(), `${cryptoKeyVersionName}/publicKey`, { method: 'GET' });
+            return res.pem;
+        },
+    };
+}
 //# sourceMappingURL=provision-gcp.js.map

package/dist/kms/provision-gcp.js.map

@@ -1 +1 @@
-{"version":3,"file":"provision-gcp.js","sourceRoot":"","sources":["../../src/kms/provision-gcp.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,2EAA2E;AAC3E,EAAE;AACF,iFAAiF;AACjF,8EAA8E;AAC9E,8EAA8E;AAC9E,8FAA8F;AAC9F,0CAA0C;AAC1C,EAAE;AACF,+EAA+E;AAC/E,gFAAgF;AAChF,gDAAgD;AAEhD,OAAO,EAAE,kBAAkB,EAAY,MAAM,qBAAqB,CAAC;AA8CnE,SAAS,eAAe,CAAC,IAAmB,EAAE,QAAgB;IAC5D,OAAO,YAAY,IAAI,CAAC,OAAO,cAAc,IAAI,CAAC,QAAQ,aAAa,IAAI,CAAC,OAAO,eAAe,QAAQ,EAAE,CAAC;AAC/G,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,cAAc,CAAC,IAAmB,EAAE,QAAgB;IAClE,OAAO,GAAG,eAAe,CAAC,IAAI,EAAE,QAAQ,CAAC,sBAAsB,CAAC;AAClE,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,gBAAgB,CAAC,IAAmB;IAClD,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;IACnF,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,yEAAyE,CAAC,CAAC;IAC7F,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzG,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;IACnF,IAAI,KAAK,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC/G,MAAM,UAAU,GAAG,CAAC,IAAI,CAAC,eAAe,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;IAEjE,MAAM,KAAK,GAAiB;QAC1B;YACE,EAAE,EAAE,SAAS;YACb,IAAI,EAAE,gBAAgB;YACtB,WAAW,EAAE,mBAAmB,IAAI,CAAC,OAAO,OAAO,IAAI,CAAC,QAAQ,EAAE;YAClE,IAAI,EAAE,CAAC,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,CAAC,OAAO,EAAE,YAAY,EAAE,IAAI,CAAC,QAAQ,EAAE,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC;SAC1G;KACF,CAAC;IAEF,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACvC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YACvC,MAAM,IAAI,KAAK,CAAC,+BAA+B,QAAQ,4CAA4C,CAAC,CAAC;QACvG,CAAC;QACD,MAAM,aAAa,GAAG,eAAe,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACtD,KAAK,CAAC,IAAI,CAAC;YACT,EAAE,EAAE,OAAO,QAAQ,EAAE;YACrB,IAAI,EAAE,YAAY;YAClB,QAAQ;YACR,aAAa;YACb,WAAW,EAAE,oCAAoC,QAAQ,EAAE;YAC3D,IAAI,EAAE;gBACJ,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ;gBACjC,WAAW,EAAE,IAAI,CAAC,OAAO;gBACzB,YAAY,EAAE,IAAI,CAAC,QAAQ;gBAC3B,WAAW,EAAE,IAAI,CAAC,OAAO;gBACzB,WAAW,EAAE,oBAAoB;gBACjC,qBAAqB,EAAE,0BAA0B;gBACjD,oBAAoB,EAAE,UAAU;aACjC;SACF,CAAC,CAAC;QACH,KAAK,CAAC,IAAI,CAAC;YACT,EAAE,EAAE,OAAO,QAAQ,EAAE;YACrB,IAAI,EAAE,WAAW;YACjB,QAAQ;YACR,aAAa;YACb,WAAW,EAAE,kCAAkC,QAAQ,OAAO,IAAI,CAAC,qBAAqB,EAAE;YAC1F,IAAI,EAAE;gBACJ,KAAK,EAAE,MAAM,EAAE,wBAAwB,EAAE,QAAQ;gBACjD,WAAW,EAAE,IAAI,CAAC,OAAO;gBACzB,YAAY,EAAE,IAAI,CAAC,QAAQ;gBAC3B,WAAW,EAAE,IAAI,CAAC,OAAO;gBACzB,UAAU,EAAE,kBAAkB,IAAI,CAAC,qBAAqB,EAAE;gBAC1D,QAAQ,EAAE,uBAAuB;aAClC;SACF,CAAC,CAAC;IACL,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;6FAE6F;AAC7F,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,IAAmB,EAAE,IAAkB;IAC/E,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,cAAc,GAAa,EAAE,CAAC;IACpC,MAAM,OAAO,GAA+B,EAAE,CAAC;IAE/C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,CAAC,CAAC,aAAa;YAAE,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAClD,IAAI,IAAI,CAAC,IAAI,KAAK,WAAW,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACpD,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,aAAa,EAAE,MAAM,EAAE,kBAAkB,IAAI,CAAC,qBAAqB,EAAE,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC,CAAC;QACnI,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,MAAM,SAAS,GAAwB,EAAE,CAAC;IAC1C,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACvC,MAAM,WAAW,GAAG,cAAc,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACnD,MAAM,CAAC,QAAQ,CAAC,GAAG,WAAW,CAAC;QAC/B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC;QACpD,SAAS,CAAC,QAAQ,CAAC,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;IAChD,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC;AACxD,CAAC"}
+{"version":3,"file":"provision-gcp.js","sourceRoot":"","sources":["../../src/kms/provision-gcp.ts"],"names":[],"mappings":"AAAA,mFAAmF;AACnF,EAAE;AACF,kFAAkF;AAClF,gFAAgF;AAChF,+EAA+E;AAC/E,wEAAwE;AACxE,wFAAwF;AACxF,EAAE;AACF,wFAAwF;AACxF,8EAA8E;AAC9E,mFAAmF;AACnF,sFAAsF;AAEtF,OAAO,EAAE,kBAAkB,EAAY,MAAM,qBAAqB,CAAC;AACnE,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAoB,MAAM,oBAAoB,CAAC;AACjF,OAAO,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAC;AAyEvD,4FAA4F;AAC5F,MAAM,UAAU,aAAa,CAAC,QAAgB;IAC5C,mFAAmF;IACnF,gFAAgF;IAChF,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC;IAC3D,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,GAAG,GAAG,SAAS,CAAC,MAAM,CAAC;IAC3B,OAAO,KAAK,GAAG,GAAG,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,GAAG;QAAE,KAAK,EAAE,CAAC;IACxD,OAAO,GAAG,GAAG,KAAK,IAAI,SAAS,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,GAAG;QAAE,GAAG,EAAE,CAAC;IACxD,MAAM,EAAE,GAAG,SAAS,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACpD,IAAI,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,QAAQ,gCAAgC,CAAC,CAAC;IAC/F,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,eAAe,CAAC,IAAmB,EAAE,KAAa;IACzD,OAAO,YAAY,IAAI,CAAC,OAAO,cAAc,IAAI,CAAC,QAAQ,aAAa,IAAI,CAAC,OAAO,eAAe,KAAK,EAAE,CAAC;AAC5G,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,cAAc,CAAC,IAAmB,EAAE,KAAa;IAC/D,OAAO,GAAG,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,sBAAsB,CAAC;AAC/D,CAAC;AAED,SAAS,WAAW,CAAC,OAAmB;IACtC,OAAO,OAAO,KAAK,iBAAiB;QAClC,CAAC,CAAC,4CAA4C;QAC9C,CAAC,CAAC,+BAA+B,CAAC;AACtC,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,gBAAgB,CAAC,IAAmB;IAClD,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;IACnF,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,yEAAyE,CAAC,CAAC;IAC7F,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzG,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;IACnF,IAAI,KAAK,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAE/G,MAAM,OAAO,GAAe,IAAI,CAAC,OAAO,IAAI,oBAAoB,CAAC;IACjE,MAAM,UAAU,GAAG,CAAC,IAAI,CAAC,eAAe,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;IACjE,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,IAAI,WAAW,CAAC,OAAO,CAAC,CAAC;IAClD,MAAM,aAAa,GAAG,OAAO,KAAK,iBAAiB,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,oBAAoB,CAAC;IAC1F,MAAM,UAAU,GAAG,OAAO,KAAK,iBAAiB,CAAC,CAAC,CAAC,6BAA6B,CAAC,CAAC,CAAC,0BAA0B,CAAC;IAE9G,4FAA4F;IAC5F,MAAM,eAAe,GAAG,IAAI,GAAG,EAAkB,CAAC;IAClD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IACvC,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;QACtC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC9B,IAAI,KAAK,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,iCAAiC,KAAK,UAAU,QAAQ,8BAA8B,KAAK,GAAG,CAAC,CAAC;QAClH,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QAC1B,eAAe,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACvC,CAAC;IAED,MAAM,KAAK,GAAoB;QAC7B;YACE,EAAE,EAAE,SAAS;YACb,IAAI,EAAE,gBAAgB;YACtB,WAAW,EAAE,mBAAmB,IAAI,CAAC,OAAO,OAAO,IAAI,CAAC,QAAQ,EAAE;YAClE,IAAI,EAAE,CAAC,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,CAAC,OAAO,EAAE,YAAY,EAAE,IAAI,CAAC,QAAQ,EAAE,WAAW,EAAE,IAAI,CAAC,OAAO,CAAC;YACzG,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE;SAChF;KACF,CAAC;IAEF,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAE,CAAC;QAC7C,MAAM,aAAa,GAAG,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACnD,KAAK,CAAC,IAAI,CAAC;YACT,EAAE,EAAE,OAAO,QAAQ,EAAE;YACrB,IAAI,EAAE,YAAY;YAClB,QAAQ;YACR,KAAK;YACL,aAAa;YACb,WAAW,EAAE,UAAU,UAAU,CAAC,WAAW,EAAE,IAAI,OAAO,QAAQ,KAAK,UAAU,QAAQ,IAAI;YAC7F,IAAI,EAAE;gBACJ,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK;gBAC9B,WAAW,EAAE,IAAI,CAAC,OAAO;gBACzB,YAAY,EAAE,IAAI,CAAC,QAAQ;gBAC3B,WAAW,EAAE,IAAI,CAAC,OAAO;gBACzB,WAAW,EAAE,aAAa;gBAC1B,qBAAqB,EAAE,UAAU;gBACjC,oBAAoB,EAAE,UAAU;aACjC;YACD,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,eAAe,EAAE,IAAI,CAAC,eAAe,IAAI,KAAK,EAAE;SAChJ,CAAC,CAAC;QACH,KAAK,CAAC,IAAI,CAAC;YACT,EAAE,EAAE,OAAO,QAAQ,EAAE;YACrB,IAAI,EAAE,WAAW;YACjB,QAAQ;YACR,KAAK;YACL,aAAa;YACb,WAAW,EAAE,SAAS,IAAI,OAAO,KAAK,OAAO,IAAI,CAAC,qBAAqB,EAAE;YACzE,IAAI,EAAE;gBACJ,KAAK,EAAE,MAAM,EAAE,wBAAwB,EAAE,KAAK;gBAC9C,WAAW,EAAE,IAAI,CAAC,OAAO;gBACzB,YAAY,EAAE,IAAI,CAAC,QAAQ;gBAC3B,WAAW,EAAE,IAAI,CAAC,OAAO;gBACzB,UAAU,EAAE,kBAAkB,IAAI,CAAC,qBAAqB,EAAE;gBAC1D,QAAQ,EAAE,IAAI;aACf;YACD,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,qBAAqB,EAAE;SACjI,CAAC,CAAC;IACL,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;sFAGsF;AACtF,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,IAAmB,EAAE,IAAkB;IAC/E,MAAM,OAAO,GAAe,IAAI,CAAC,OAAO,IAAI,oBAAoB,CAAC;IACjE,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,IAAI,WAAW,CAAC,OAAO,CAAC,CAAC;IAClD,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,cAAc,GAAa,EAAE,CAAC;IACpC,MAAM,OAAO,GAA+B,EAAE,CAAC;IAE/C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,CAAC,CAAC,aAAa;YAAE,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAClD,IAAI,IAAI,CAAC,IAAI,KAAK,WAAW,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACpD,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,aAAa,EAAE,MAAM,EAAE,kBAAkB,IAAI,CAAC,qBAAqB,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1G,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,MAAM,SAAS,GAAwB,EAAE,CAAC;IAC1C,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;QACtC,IAAI,OAAO,KAAK,iBAAiB,EAAE,CAAC;YAClC,8EAA8E;YAC9E,MAAM,CAAC,QAAQ,CAAC,GAAG,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAClD,CAAC;aAAM,CAAC;YACN,MAAM,WAAW,GAAG,cAAc,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YAChD,MAAM,CAAC,QAAQ,CAAC,GAAG,WAAW,CAAC;YAC/B,SAAS,CAAC,QAAQ,CAAC,GAAG,kBAAkB,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC,CAAC;QACpF,CAAC;IACH,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC;AACxD,CAAC;AAED,8EAA8E;AAE9E,MAAM,WAAW,GAAG,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,iBAAiB,EAAW,CAAC;AAC/G,MAAM,aAAa,GAAG,EAAE,oBAAoB,EAAE,0BAA0B,EAAE,iBAAiB,EAAE,6BAA6B,EAAW,CAAC;AAItI;yFACyF;AACzF,MAAM,UAAU,yBAAyB,CAAC,IAA6C;IACrF,MAAM,EAAE,GAAG,uBAAuB,CAAC,IAAI,CAAC,kBAA4B,CAAC,CAAC;IACtE,IAAI,MAA+B,CAAC;IACpC,KAAK,UAAU,KAAK;QAClB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,SAAS,IAAI,GAAG;YAAE,MAAM,GAAG,MAAM,gBAAgB,CAAC,EAAE,CAAC,CAAC;QAC5E,OAAO,MAAM,CAAC,WAAW,CAAC;IAC5B,CAAC;IACD,MAAM,UAAU,GAAG,CAAC,CAAU,EAAW,EAAE,CAAC,CAAC,YAAY,KAAK,IAAI,0BAA0B,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAE7G,OAAO;QACL,KAAK,CAAC,GAAG,CAAC,IAAmB;YAC3B,MAAM,CAAC,GAAG,MAAM,KAAK,EAAE,CAAC;YACxB,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC;YACpB,MAAM,GAAG,GAAG,YAAY,CAAC,CAAC,OAAO,cAAc,CAAC,CAAC,QAAQ,EAAE,CAAC;YAC5D,IAAI,IAAI,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;gBACnC,IAAI,CAAC;oBACH,MAAM,OAAO,CAAC,CAAC,EAAE,GAAG,GAAG,uBAAuB,kBAAkB,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;oBAC7G,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;gBACvC,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,IAAI,UAAU,CAAC,CAAC,CAAC;wBAAE,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;oBAC5E,MAAM,CAAC,CAAC;gBACV,CAAC;YACH,CAAC;YACD,IAAI,IAAI,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBAC/B,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,IAAI,oBAAoB,CAAC;gBAClD,IAAI,CAAC;oBACH,MAAM,OAAO,CAAC,CAAC,EAAE,GAAG,GAAG,aAAa,kBAAkB,CAAC,CAAC,CAAC,OAAO,CAAC,2BAA2B,kBAAkB,CAAC,CAAC,CAAC,KAAM,CAAC,EAAE,EAAE;wBAC1H,MAAM,EAAE,MAAM;wBACd,IAAI,EAAE;4BACJ,OAAO,EAAE,WAAW,CAAC,OAAO,CAAC;4BAC7B,eAAe,EAAE,EAAE,SAAS,EAAE,aAAa,CAAC,OAAO,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,eAAe,IAAI,KAAK,CAAC,EAAE;yBACtG;qBACF,CAAC,CAAC;oBACH,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;gBACnC,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,IAAI,UAAU,CAAC,CAAC,CAAC;wBAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;oBACxE,MAAM,CAAC,CAAC;gBACV,CAAC;YACH,CAAC;YACD,qFAAqF;YACrF,MAAM,OAAO,GAAG,GAAG,GAAG,aAAa,kBAAkB,CAAC,CAAC,CAAC,OAAO,CAAC,eAAe,kBAAkB,CAAC,CAAC,CAAC,KAAM,CAAC,EAAE,CAAC;YAC9G,MAAM,MAAM,GAAG,MAAM,OAAO,CAAe,CAAC,EAAE,GAAG,OAAO,eAAe,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YAC5F,MAAM,MAAM,GAAG,kBAAkB,CAAC,CAAC,MAAM,EAAE,CAAC;YAC5C,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC;YACvC,IAAI,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC;YACtD,IAAI,CAAC,OAAO,EAAE,CAAC;gBAAC,OAAO,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,IAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;gBAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAAC,CAAC;YACnF,IAAI,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAAE,OAAO,EAAE,MAAM,EAAE,6BAA6B,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;YAC5G,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC7B,MAAM,OAAO,CAAC,CAAC,EAAE,GAAG,OAAO,eAAe,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;YAC3G,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;QACnC,CAAC;QACD,KAAK,CAAC,eAAe,CAAC,oBAA4B;YAChD,MAAM,GAAG,GAAG,MAAM,OAAO,CAAkB,MAAM,KAAK,EAAE,EAAE,GAAG,oBAAoB,YAAY,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YAClH,OAAO,GAAG,CAAC,GAAG,CAAC;QACjB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/kms-viem-account.d.ts

@@ -1,4 +1,4 @@
 import { type LocalAccount } from 'viem';
-import type { KmsAccountBackend } from './types';
+import type { KmsAccountBackend } from './types.js';
 export declare function createKmsViemAccount(backend: KmsAccountBackend): Promise<LocalAccount>;
 //# sourceMappingURL=kms-viem-account.d.ts.map

package/dist/kms-viem-account.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"kms-viem-account.d.ts","sourceRoot":"","sources":["../src/kms-viem-account.ts"],"names":[],"mappings":"AAqBA,OAAO,EASL,KAAK,YAAY,EAElB,MAAM,MAAM,CAAC;AACd,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AA0BjD,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,YAAY,CAAC,CAwC5F"}
+{"version":3,"file":"kms-viem-account.d.ts","sourceRoot":"","sources":["../src/kms-viem-account.ts"],"names":[],"mappings":"AAqBA,OAAO,EASL,KAAK,YAAY,EAElB,MAAM,MAAM,CAAC;AACd,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AA0BpD,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,YAAY,CAAC,CAwC5F"}

package/dist/providers/aws.d.ts

@@ -1,4 +1,4 @@
-import type { A2AKeyProvider, KmsAccountBackend } from '../types';
+import type { A2AKeyProvider, KmsAccountBackend } from '../types.js';
 import type { Address } from '@agenticprimitives/types';
 export declare const AWS_KMS_NOT_IMPLEMENTED: string;
 export declare class AwsKmsProvider implements A2AKeyProvider {

package/dist/providers/aws.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"aws.d.ts","sourceRoot":"","sources":["../../src/providers/aws.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAClE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AAExD,eAAO,MAAM,uBAAuB,QAEyE,CAAC;AAE9G,qBAAa,cAAe,YAAW,cAAc;IACnD,QAAQ,CAAC,UAAU,6BAA6B;;IAG1C,sBAAsB,IAAI,OAAO,CAAC,KAAK,CAAC;IACxC,qBAAqB,IAAI,OAAO,CAAC,KAAK,CAAC;CAC9C;AAED,qBAAa,YAAa,YAAW,iBAAiB;IACpD,QAAQ,CAAC,QAAQ,EAAG,SAAS,CAAU;;IAGjC,aAAa,IAAI,OAAO,CAAC,KAAK,CAAC;IAC/B,gBAAgB,IAAI,OAAO,CAAC,OAAO,CAAC;CAC3C"}
+{"version":3,"file":"aws.d.ts","sourceRoot":"","sources":["../../src/providers/aws.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACrE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AAExD,eAAO,MAAM,uBAAuB,QAEyE,CAAC;AAE9G,qBAAa,cAAe,YAAW,cAAc;IACnD,QAAQ,CAAC,UAAU,6BAA6B;;IAG1C,sBAAsB,IAAI,OAAO,CAAC,KAAK,CAAC;IACxC,qBAAqB,IAAI,OAAO,CAAC,KAAK,CAAC;CAC9C;AAED,qBAAa,YAAa,YAAW,iBAAiB;IACpD,QAAQ,CAAC,QAAQ,EAAG,SAAS,CAAU;;IAGjC,aAAa,IAAI,OAAO,CAAC,KAAK,CAAC;IAC/B,gBAAgB,IAAI,OAAO,CAAC,OAAO,CAAC;CAC3C"}

package/dist/providers/gcp.d.ts

@@ -1,6 +1,6 @@
 import type { Address } from 'viem';
 import { type AuditSink } from '@agenticprimitives/audit';
-import type { A2AKeyProvider, KmsAccountBackend } from '../types';
+import type { A2AKeyProvider, KmsAccountBackend } from '../types.js';
 export { base64UrlEncode, pemToDer, parseDerEcdsa, normalizeLowS, bigIntTo32Bytes, parseSpkiUncompressedSecp256k1PubKey, publicKeyToAddress, findRecoveryByte, } from '../kms/secp256k1-core.js';
 export { signJwt, fetchAccessToken } from '../kms/gcp-transport.js';
 export interface GcpKmsSignerOpts {
@@ -47,14 +47,30 @@ export interface GcpKmsProviderOpts {
     cryptoKeyName: string;
     /** Raw JSON string of the service-account key file. */
     serviceAccountJson: string;
+    /**
+     * Optional audit sink (spec 278 P0). When set, each envelope op emits a
+     * `key-custody.envelope.{wrap,unwrap}` row carrying refs/hashes ONLY
+     * (`keyId`, `keyVersion`, `aadHash`) — never the data key or plaintext.
+     * Fail-soft: an audit failure never breaks the crypto op.
+     */
+    auditSink?: AuditSink;
 }
 export declare class GcpKmsProvider implements A2AKeyProvider {
     /** Only used when the GCP encrypt response doesn't carry a `name` (test fixtures). */
     readonly keyVersion = "gcp-kms:unknown";
     private readonly keyName;
     private readonly serviceAccount;
+    private readonly auditSink?;
     private cachedToken?;
-    constructor(opts?: Partial<GcpKmsProviderOpts>);
+    constructor(opts?: Partial<GcpKmsProviderOpts> & {
+        auditSink?: AuditSink;
+    });
+    /**
+     * Emit an envelope-op audit row (spec 278 P0). Refs/hashes ONLY — the AAD is
+     * hashed (never logged raw, since it can carry owner/resource identifiers),
+     * and the data key / plaintext never appear. Fail-soft.
+     */
+    private emitEnvelopeAudit;
     private getAccessToken;
     generateSessionDataKey(input: {
         aadContext: Record<string, string>;

package/dist/providers/gcp.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gcp.d.ts","sourceRoot":"","sources":["../../src/providers/gcp.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AACpC,OAAO,EAAc,KAAK,SAAS,EAAE,MAAM,0BAA0B,CAAC;AACtE,OAAO,KAAK,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AA0BlE,OAAO,EACL,eAAe,EACf,QAAQ,EACR,aAAa,EACb,aAAa,EACb,eAAe,EACf,oCAAoC,EACpC,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAEpE,MAAM,WAAW,gBAAgB;IAC/B;;;;OAIG;IACH,oBAAoB,EAAE,MAAM,CAAC;IAC7B,uDAAuD;IACvD,kBAAkB,EAAE,MAAM,CAAC;CAC5B;AAMD,qBAAa,YAAa,YAAW,iBAAiB;IACpD,QAAQ,CAAC,QAAQ,EAAG,SAAS,CAAU;IACvC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAkB;IAC5C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAY;IACvC,OAAO,CAAC,cAAc,CAAC,CAAa;IACpC,OAAO,CAAC,aAAa,CAAC,CAAU;gBAEpB,IAAI,CAAC,EAAE,OAAO,CAAC,gBAAgB,CAAC,GAAG;QAAE,SAAS,CAAC,EAAE,SAAS,CAAA;KAAE;YAyB1D,iBAAiB;IAQzB,gBAAgB,IAAI,OAAO,CAAC,OAAO,CAAC;IAOpC,aAAa,CAAC,KAAK,EAAE;QACzB,MAAM,EAAE,UAAU,CAAC;QACnB,YAAY,CAAC,EAAE;YAAE,MAAM,CAAC,EAAE,MAAM,CAAC;YAAC,SAAS,CAAC,EAAE,MAAM,CAAC;YAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;KAC3E,GAAG,OAAO,CAAC;QAAE,SAAS,EAAE,UAAU,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,OAAO,CAAA;KAAE,CAAC;CA4C9E;AAeD,MAAM,WAAW,kBAAkB;IACjC;;;;OAIG;IACH,aAAa,EAAE,MAAM,CAAC;IACtB,uDAAuD;IACvD,kBAAkB,EAAE,MAAM,CAAC;CAC5B;AAuBD,qBAAa,cAAe,YAAW,cAAc;IACnD,sFAAsF;IACtF,QAAQ,CAAC,UAAU,qBAAqB;IACxC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAiB;IAChD,OAAO,CAAC,WAAW,CAAC,CAAc;gBAEtB,IAAI,CAAC,EAAE,OAAO,CAAC,kBAAkB,CAAC;YAwBhC,cAAc;IAStB,sBAAsB,CAAC,KAAK,EAAE;QAClC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KACpC,GAAG,OAAO,CAAC;QACV,gBAAgB,EAAE,UAAU,CAAC;QAC7B,gBAAgB,EAAE,UAAU,CAAC;QAC7B,KAAK,EAAE,MAAM,CAAC;QACd,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC;IAmBI,qBAAqB,CAAC,KAAK,EAAE;QACjC,gBAAgB,EAAE,UAAU,CAAC;QAC7B,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACnC,KAAK,EAAE,MAAM,CAAC;QACd,UAAU,EAAE,MAAM,CAAC;KACpB,GAAG,OAAO,CAAC,UAAU,CAAC;CAqBxB"}
+{"version":3,"file":"gcp.d.ts","sourceRoot":"","sources":["../../src/providers/gcp.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AACpC,OAAO,EAAc,KAAK,SAAS,EAAE,MAAM,0BAA0B,CAAC;AACtE,OAAO,KAAK,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AA2BrE,OAAO,EACL,eAAe,EACf,QAAQ,EACR,aAAa,EACb,aAAa,EACb,eAAe,EACf,oCAAoC,EACpC,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAEpE,MAAM,WAAW,gBAAgB;IAC/B;;;;OAIG;IACH,oBAAoB,EAAE,MAAM,CAAC;IAC7B,uDAAuD;IACvD,kBAAkB,EAAE,MAAM,CAAC;CAC5B;AAMD,qBAAa,YAAa,YAAW,iBAAiB;IACpD,QAAQ,CAAC,QAAQ,EAAG,SAAS,CAAU;IACvC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAkB;IAC5C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAY;IACvC,OAAO,CAAC,cAAc,CAAC,CAAa;IACpC,OAAO,CAAC,aAAa,CAAC,CAAU;gBAEpB,IAAI,CAAC,EAAE,OAAO,CAAC,gBAAgB,CAAC,GAAG;QAAE,SAAS,CAAC,EAAE,SAAS,CAAA;KAAE;YA4B1D,iBAAiB;IAQzB,gBAAgB,IAAI,OAAO,CAAC,OAAO,CAAC;IAOpC,aAAa,CAAC,KAAK,EAAE;QACzB,MAAM,EAAE,UAAU,CAAC;QACnB,YAAY,CAAC,EAAE;YAAE,MAAM,CAAC,EAAE,MAAM,CAAC;YAAC,SAAS,CAAC,EAAE,MAAM,CAAC;YAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;KAC3E,GAAG,OAAO,CAAC;QAAE,SAAS,EAAE,UAAU,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,OAAO,CAAA;KAAE,CAAC;CA4C9E;AAeD,MAAM,WAAW,kBAAkB;IACjC;;;;OAIG;IACH,aAAa,EAAE,MAAM,CAAC;IACtB,uDAAuD;IACvD,kBAAkB,EAAE,MAAM,CAAC;IAC3B;;;;;OAKG;IACH,SAAS,CAAC,EAAE,SAAS,CAAC;CACvB;AAuBD,qBAAa,cAAe,YAAW,cAAc;IACnD,sFAAsF;IACtF,QAAQ,CAAC,UAAU,qBAAqB;IACxC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAiB;IAChD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAY;IACvC,OAAO,CAAC,WAAW,CAAC,CAAc;gBAEtB,IAAI,CAAC,EAAE,OAAO,CAAC,kBAAkB,CAAC,GAAG;QAAE,SAAS,CAAC,EAAE,SAAS,CAAA;KAAE;IA4B1E;;;;OAIG;YACW,iBAAiB;YAyBjB,cAAc;IAStB,sBAAsB,CAAC,KAAK,EAAE;QAClC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;KACpC,GAAG,OAAO,CAAC;QACV,gBAAgB,EAAE,UAAU,CAAC;QAC7B,gBAAgB,EAAE,UAAU,CAAC;QAC7B,KAAK,EAAE,MAAM,CAAC;QACd,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC;IAoBI,qBAAqB,CAAC,KAAK,EAAE;QACjC,gBAAgB,EAAE,UAAU,CAAC;QAC7B,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACnC,KAAK,EAAE,MAAM,CAAC;QACd,UAAU,EAAE,MAAM,CAAC;KACpB,GAAG,OAAO,CAAC,UAAU,CAAC;CAuBxB"}

package/dist/providers/gcp.js

@@ -8,14 +8,20 @@
 // the optional audit sink (`key-custody.sign`). One implementation, two
 // surfaces — no second KMS path.
 //
-// GcpKmsProvider (envelope encryption via GCP KMS Encrypt/Decrypt) remains a
-// stub — that's a separate v0.2 follow-up. The signer covers the production
-// path for the agent's master-key requirement.
+// GcpKmsProvider (envelope encryption via GCP KMS Encrypt/Decrypt) is
+// IMPLEMENTED: it wraps/unwraps a per-row 32-byte data key with Cloud KMS
+// :encrypt/:decrypt under the AAD-bound EncryptionContext, and (spec 278 P0)
+// emits a `key-custody.envelope.{wrap,unwrap}` audit row per op (refs/hashes
+// only). It uses a DIFFERENT symmetric KMS key from the signer (master-key
+// separation). Residual per-person-KEK selection + person-SA AAD binding is
+// spec 278 (per-person vault key binding), not a crypto gap.
 import { keccak_256 } from '@noble/hashes/sha3.js';
+import { sha256 } from '@noble/hashes/sha2.js';
 import { buildEvent } from '@agenticprimitives/audit';
-import { canonicalContextBytes } from '../aad';
+import { canonicalContextBytes } from '../aad.js';
 import { bytesToHex, base64Decode, base64Encode, pemToDer, bigIntTo32Bytes, parseDerEcdsa, normalizeLowS, parseSpkiUncompressedSecp256k1PubKey, publicKeyToAddress, findRecoveryByte, } from '../kms/secp256k1-core.js';
 import { fetchAccessToken, callKms, createGcpKmsTransport, } from '../kms/gcp-transport.js';
+import { parseServiceAccountJson } from '../kms/key-map.js';
 // Re-export the consumer-safe helpers under their established names so existing
 // importers (unit tests + any downstream) keep resolving them from this module.
 // New code should prefer the `@agenticprimitives/key-custody/kms-core` subpath.
@@ -41,12 +47,15 @@ export class GcpKmsSigner {
         if (!jsonStr) {
             throw new Error('GcpKmsSigner: GCP_SERVICE_ACCOUNT_JSON (service-account JSON string) is required.');
         }
+        // Backlog B4: accept the SAME formats parseServiceAccountJson does (single-line JSON OR
+        // base64-encoded JSON) so one secret value satisfies both the kms-core validator and this
+        // backend — base64 dodges the literal-newline paste hazard (B5).
         let parsed;
         try {
-            parsed = JSON.parse(jsonStr);
+            parsed = parseServiceAccountJson(jsonStr);
         }
-        catch {
-            throw new Error('GcpKmsSigner: GCP_SERVICE_ACCOUNT_JSON is not valid JSON.');
+        catch (e) {
+            throw new Error(`GcpKmsSigner: GCP_SERVICE_ACCOUNT_JSON invalid — ${e instanceof Error ? e.message : String(e)}`);
         }
         if (!parsed.client_email || !parsed.private_key) {
             throw new Error('GcpKmsSigner: service-account JSON missing client_email or private_key.');
@@ -127,6 +136,7 @@ export class GcpKmsProvider {
     keyVersion = 'gcp-kms:unknown';
     keyName;
     serviceAccount;
+    auditSink;
     cachedToken;
     constructor(opts) {
         const keyName = opts?.cryptoKeyName ?? process.env.GCP_KMS_ENCRYPT_KEY_NAME;
@@ -137,18 +147,47 @@ export class GcpKmsProvider {
         if (!jsonStr) {
             throw new Error('GcpKmsProvider: GCP_SERVICE_ACCOUNT_JSON (service-account JSON string) is required.');
         }
+        // Backlog B4: accept single-line JSON OR base64-encoded JSON (parseServiceAccountJson), so the
+        // SAME GCP_SERVICE_ACCOUNT_JSON secret satisfies the signer, this envelope provider, and the
+        // kms-core validator — base64 dodges the literal-newline paste hazard (B5).
         let parsed;
         try {
-            parsed = JSON.parse(jsonStr);
+            parsed = parseServiceAccountJson(jsonStr);
         }
-        catch {
-            throw new Error('GcpKmsProvider: GCP_SERVICE_ACCOUNT_JSON is not valid JSON.');
+        catch (e) {
+            throw new Error(`GcpKmsProvider: GCP_SERVICE_ACCOUNT_JSON invalid — ${e instanceof Error ? e.message : String(e)}`);
         }
         if (!parsed.client_email || !parsed.private_key) {
             throw new Error('GcpKmsProvider: service-account JSON missing client_email or private_key.');
         }
         this.keyName = keyName;
         this.serviceAccount = parsed;
+        this.auditSink = opts?.auditSink;
+    }
+    /**
+     * Emit an envelope-op audit row (spec 278 P0). Refs/hashes ONLY — the AAD is
+     * hashed (never logged raw, since it can carry owner/resource identifiers),
+     * and the data key / plaintext never appear. Fail-soft.
+     */
+    async emitEnvelopeAudit(action, aadBytes, keyVersion) {
+        if (!this.auditSink)
+            return;
+        try {
+            await this.auditSink.write(buildEvent({
+                action,
+                outcome: 'success',
+                actor: { type: 'system', id: 'gcp-kms-provider' },
+                subject: { type: 'vault-data-key', id: keyVersion },
+                context: {
+                    keyId: this.keyName,
+                    keyVersion,
+                    aadHash: bytesToHex(sha256(aadBytes)),
+                },
+            }));
+        }
+        catch {
+            /* fail-soft — an audit failure must not break the crypto op */
+        }
     }
     async getAccessToken() {
         const now = Math.floor(Date.now() / 1000);
@@ -172,6 +211,7 @@ export class GcpKmsProvider {
         });
         const encryptedDataKey = base64Decode(res.ciphertext);
         const keyVersion = parseCryptoKeyVersion(res.name) ?? this.keyVersion;
+        await this.emitEnvelopeAudit('key-custody.envelope.wrap', aadBytes, keyVersion);
         return { plaintextDataKey, encryptedDataKey, keyId: this.keyName, keyVersion };
     }
     async decryptSessionDataKey(input) {
@@ -191,7 +231,9 @@ export class GcpKmsProvider {
                 additionalAuthenticatedData: base64Encode(aadBytes),
             },
         });
-        return base64Decode(res.plaintext);
+        const plaintextDataKey = base64Decode(res.plaintext);
+        await this.emitEnvelopeAudit('key-custody.envelope.unwrap', aadBytes, input.keyVersion);
+        return plaintextDataKey;
     }
 }
 //# sourceMappingURL=gcp.js.map

package/dist/providers/gcp.js.map

@@ -1 +1 @@
-{"version":3,"file":"gcp.js","sourceRoot":"","sources":["../../src/providers/gcp.ts"],"names":[],"mappings":"AAAA,qEAAqE;AACrE,EAAE;AACF,2EAA2E;AAC3E,yEAAyE;AACzE,8EAA8E;AAC9E,wEAAwE;AACxE,6EAA6E;AAC7E,wEAAwE;AACxE,iCAAiC;AACjC,EAAE;AACF,6EAA6E;AAC7E,4EAA4E;AAC5E,+CAA+C;AAE/C,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAEnD,OAAO,EAAE,UAAU,EAAkB,MAAM,0BAA0B,CAAC;AAEtE,OAAO,EAAE,qBAAqB,EAAE,MAAM,QAAQ,CAAC;AAC/C,OAAO,EACL,UAAU,EACV,YAAY,EACZ,YAAY,EACZ,QAAQ,EACR,eAAe,EACf,aAAa,EACb,aAAa,EACb,oCAAoC,EACpC,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAIL,gBAAgB,EAChB,OAAO,EACP,qBAAqB,GACtB,MAAM,yBAAyB,CAAC;AAEjC,gFAAgF;AAChF,gFAAgF;AAChF,gFAAgF;AAChF,OAAO,EACL,eAAe,EACf,QAAQ,EACR,aAAa,EACb,aAAa,EACb,eAAe,EACf,oCAAoC,EACpC,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAapE,wEAAwE;AACxE,mEAAmE;AACnE,wEAAwE;AAExE,MAAM,OAAO,YAAY;IACd,QAAQ,GAAG,SAAkB,CAAC;IACtB,OAAO,CAAS;IAChB,SAAS,CAAkB;IAC3B,SAAS,CAAa;IAC/B,cAAc,CAAc;IAC5B,aAAa,CAAW;IAEhC,YAAY,IAA4D;QACtE,MAAM,OAAO,GAAG,IAAI,EAAE,oBAAoB,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;QAC3E,MAAM,OAAO,GAAG,IAAI,EAAE,kBAAkB,IAAI,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC;QACjF,IAAI,CAAC,SAAS,GAAG,IAAI,EAAE,SAAS,CAAC;QACjC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CACb,4HAA4H,CAC7H,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,mFAAmF,CAAC,CAAC;QACvG,CAAC;QACD,IAAI,MAAsB,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAmB,CAAC;QACjD,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;QAC/E,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,YAAY,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CAAC,yEAAyE,CAAC,CAAC;QAC7F,CAAC;QACD,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,SAAS,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;IACjD,CAAC;IAEO,KAAK,CAAC,iBAAiB;QAC7B,IAAI,IAAI,CAAC,cAAc;YAAE,OAAO,IAAI,CAAC,cAAc,CAAC;QACpD,8EAA8E;QAC9E,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC/D,IAAI,CAAC,cAAc,GAAG,oCAAoC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1E,OAAO,IAAI,CAAC,cAAc,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,gBAAgB;QACpB,IAAI,IAAI,CAAC,aAAa;YAAE,OAAO,IAAI,CAAC,aAAa,CAAC;QAClD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC3C,IAAI,CAAC,aAAa,GAAG,kBAAkB,CAAC,GAAG,CAAY,CAAC;QACxD,OAAO,IAAI,CAAC,aAAa,CAAC;IAC5B,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,KAGnB;QACC,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,4DAA4D,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;QACtG,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC9C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAC5E,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QAClC,MAAM,CAAC,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAClC,MAAM,CAAC,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAE9D,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;QACjC,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACxC,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAClC,KAAK,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;QAEd,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACpD,iGAAiG;QACjG,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,MAAM,GAAG,GAAG,KAAK,CAAC,YAAY,IAAI,EAAE,CAAC;YACrC,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CACxB,UAAU,CAAC;oBACT,MAAM,EAAE,kBAAkB;oBAC1B,OAAO,EAAE,SAAS;oBAClB,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,gBAAgB,EAAE;oBAC/C,OAAO,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,EAAE,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE;oBAC9D,OAAO,EAAE;wBACP,KAAK,EAAE,IAAI,CAAC,OAAO;wBACnB,aAAa;wBACb,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,IAAI;wBAC1B,QAAQ,EAAE,GAAG,CAAC,QAAQ,IAAI,IAAI;wBAC9B,WAAW,EAAE,GAAG,CAAC,SAAS;4BACxB,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;4BAC9E,CAAC,CAAC,IAAI;qBACT;iBACF,CAAC,CACH,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,eAAe;YACjB,CAAC;QACH,CAAC;QAED,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,aAAa,EAAE,CAAC;IAClE,CAAC;CACF;AAmCD;;;;;GAKG;AACH,SAAS,qBAAqB,CAAC,YAAgC;IAC7D,IAAI,CAAC,YAAY;QAAE,OAAO,IAAI,CAAC;IAC/B,MAAM,CAAC,GAAG,6BAA6B,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC3D,OAAO,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACvC,CAAC;AAED,MAAM,OAAO,cAAc;IACzB,sFAAsF;IAC7E,UAAU,GAAG,iBAAiB,CAAC;IACvB,OAAO,CAAS;IAChB,cAAc,CAAiB;IACxC,WAAW,CAAe;IAElC,YAAY,IAAkC;QAC5C,MAAM,OAAO,GAAG,IAAI,EAAE,aAAa,IAAI,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC;QAC5E,MAAM,OAAO,GAAG,IAAI,EAAE,kBAAkB,IAAI,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC;QACjF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CACb,gHAAgH,CACjH,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,qFAAqF,CAAC,CAAC;QACzG,CAAC;QACD,IAAI,MAAsB,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAmB,CAAC;QACjD,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;QACjF,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,YAAY,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CAAC,2EAA2E,CAAC,CAAC;QAC/F,CAAC;QACD,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC;IAC/B,CAAC;IAEO,KAAK,CAAC,cAAc;QAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,WAAW,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC;YACzD,OAAO,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC;QACtC,CAAC;QACD,IAAI,CAAC,WAAW,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC/D,OAAO,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC;IACtC,CAAC;IAED,KAAK,CAAC,sBAAsB,CAAC,KAE5B;QAMC,MAAM,gBAAgB,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;QAC5C,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,gBAAgB,CAAC,CAAC;QACpD,MAAM,QAAQ,GAAG,qBAAqB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAEzD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAC1C,MAAM,GAAG,GAAG,MAAM,OAAO,CAAkB,KAAK,EAAE,GAAG,IAAI,CAAC,OAAO,UAAU,EAAE;YAC3E,MAAM,EAAE,MAAM;YACd,IAAI,EAAE;gBACJ,SAAS,EAAE,YAAY,CAAC,gBAAgB,CAAC;gBACzC,2BAA2B,EAAE,YAAY,CAAC,QAAQ,CAAC;aACpD;SACF,CAAC,CAAC;QACH,MAAM,gBAAgB,GAAG,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACtD,MAAM,UAAU,GAAG,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC;QAEtE,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,CAAC;IACjF,CAAC;IAED,KAAK,CAAC,qBAAqB,CAAC,KAK3B;QACC,4EAA4E;QAC5E,yEAAyE;QACzE,+DAA+D;QAC/D,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;YACvD,MAAM,IAAI,KAAK,CACb,qCAAqC,KAAK,CAAC,UAAU,+BAA+B;gBAClF,qDAAqD,CACxD,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG,qBAAqB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACzD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAC1C,MAAM,GAAG,GAAG,MAAM,OAAO,CAAkB,KAAK,EAAE,GAAG,IAAI,CAAC,OAAO,UAAU,EAAE;YAC3E,MAAM,EAAE,MAAM;YACd,IAAI,EAAE;gBACJ,UAAU,EAAE,YAAY,CAAC,KAAK,CAAC,gBAAgB,CAAC;gBAChD,2BAA2B,EAAE,YAAY,CAAC,QAAQ,CAAC;aACpD;SACF,CAAC,CAAC;QACH,OAAO,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACrC,CAAC;CACF"}
+{"version":3,"file":"gcp.js","sourceRoot":"","sources":["../../src/providers/gcp.ts"],"names":[],"mappings":"AAAA,qEAAqE;AACrE,EAAE;AACF,2EAA2E;AAC3E,yEAAyE;AACzE,8EAA8E;AAC9E,wEAAwE;AACxE,6EAA6E;AAC7E,wEAAwE;AACxE,iCAAiC;AACjC,EAAE;AACF,sEAAsE;AACtE,0EAA0E;AAC1E,6EAA6E;AAC7E,6EAA6E;AAC7E,2EAA2E;AAC3E,4EAA4E;AAC5E,6DAA6D;AAE7D,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAE/C,OAAO,EAAE,UAAU,EAAkB,MAAM,0BAA0B,CAAC;AAEtE,OAAO,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC;AAClD,OAAO,EACL,UAAU,EACV,YAAY,EACZ,YAAY,EACZ,QAAQ,EACR,eAAe,EACf,aAAa,EACb,aAAa,EACb,oCAAoC,EACpC,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAIL,gBAAgB,EAChB,OAAO,EACP,qBAAqB,GACtB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAE5D,gFAAgF;AAChF,gFAAgF;AAChF,gFAAgF;AAChF,OAAO,EACL,eAAe,EACf,QAAQ,EACR,aAAa,EACb,aAAa,EACb,eAAe,EACf,oCAAoC,EACpC,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAapE,wEAAwE;AACxE,mEAAmE;AACnE,wEAAwE;AAExE,MAAM,OAAO,YAAY;IACd,QAAQ,GAAG,SAAkB,CAAC;IACtB,OAAO,CAAS;IAChB,SAAS,CAAkB;IAC3B,SAAS,CAAa;IAC/B,cAAc,CAAc;IAC5B,aAAa,CAAW;IAEhC,YAAY,IAA4D;QACtE,MAAM,OAAO,GAAG,IAAI,EAAE,oBAAoB,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;QAC3E,MAAM,OAAO,GAAG,IAAI,EAAE,kBAAkB,IAAI,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC;QACjF,IAAI,CAAC,SAAS,GAAG,IAAI,EAAE,SAAS,CAAC;QACjC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CACb,4HAA4H,CAC7H,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,mFAAmF,CAAC,CAAC;QACvG,CAAC;QACD,wFAAwF;QACxF,0FAA0F;QAC1F,iEAAiE;QACjE,IAAI,MAAsB,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;QAC5C,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACpH,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,YAAY,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CAAC,yEAAyE,CAAC,CAAC;QAC7F,CAAC;QACD,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,SAAS,GAAG,qBAAqB,CAAC,MAAM,CAAC,CAAC;IACjD,CAAC;IAEO,KAAK,CAAC,iBAAiB;QAC7B,IAAI,IAAI,CAAC,cAAc;YAAE,OAAO,IAAI,CAAC,cAAc,CAAC;QACpD,8EAA8E;QAC9E,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC/D,IAAI,CAAC,cAAc,GAAG,oCAAoC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1E,OAAO,IAAI,CAAC,cAAc,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,gBAAgB;QACpB,IAAI,IAAI,CAAC,aAAa;YAAE,OAAO,IAAI,CAAC,aAAa,CAAC;QAClD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC3C,IAAI,CAAC,aAAa,GAAG,kBAAkB,CAAC,GAAG,CAAY,CAAC;QACxD,OAAO,IAAI,CAAC,aAAa,CAAC;IAC5B,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,KAGnB;QACC,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,4DAA4D,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;QACtG,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC9C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAC5E,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QAClC,MAAM,CAAC,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAClC,MAAM,CAAC,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAE9D,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;QACjC,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACxC,KAAK,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAClC,KAAK,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;QAEd,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACpD,iGAAiG;QACjG,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,MAAM,GAAG,GAAG,KAAK,CAAC,YAAY,IAAI,EAAE,CAAC;YACrC,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CACxB,UAAU,CAAC;oBACT,MAAM,EAAE,kBAAkB;oBAC1B,OAAO,EAAE,SAAS;oBAClB,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,gBAAgB,EAAE;oBAC/C,OAAO,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,EAAE,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE;oBAC9D,OAAO,EAAE;wBACP,KAAK,EAAE,IAAI,CAAC,OAAO;wBACnB,aAAa;wBACb,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,IAAI;wBAC1B,QAAQ,EAAE,GAAG,CAAC,QAAQ,IAAI,IAAI;wBAC9B,WAAW,EAAE,GAAG,CAAC,SAAS;4BACxB,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;4BAC9E,CAAC,CAAC,IAAI;qBACT;iBACF,CAAC,CACH,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,eAAe;YACjB,CAAC;QACH,CAAC;QAED,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,aAAa,EAAE,CAAC;IAClE,CAAC;CACF;AA0CD;;;;;GAKG;AACH,SAAS,qBAAqB,CAAC,YAAgC;IAC7D,IAAI,CAAC,YAAY;QAAE,OAAO,IAAI,CAAC;IAC/B,MAAM,CAAC,GAAG,6BAA6B,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC3D,OAAO,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACvC,CAAC;AAED,MAAM,OAAO,cAAc;IACzB,sFAAsF;IAC7E,UAAU,GAAG,iBAAiB,CAAC;IACvB,OAAO,CAAS;IAChB,cAAc,CAAiB;IAC/B,SAAS,CAAa;IAC/B,WAAW,CAAe;IAElC,YAAY,IAA8D;QACxE,MAAM,OAAO,GAAG,IAAI,EAAE,aAAa,IAAI,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC;QAC5E,MAAM,OAAO,GAAG,IAAI,EAAE,kBAAkB,IAAI,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC;QACjF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CACb,gHAAgH,CACjH,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,qFAAqF,CAAC,CAAC;QACzG,CAAC;QACD,+FAA+F;QAC/F,6FAA6F;QAC7F,4EAA4E;QAC5E,IAAI,MAAsB,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;QAC5C,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACtH,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,YAAY,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CAAC,2EAA2E,CAAC,CAAC;QAC/F,CAAC;QACD,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC;QAC7B,IAAI,CAAC,SAAS,GAAG,IAAI,EAAE,SAAS,CAAC;IACnC,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,iBAAiB,CAC7B,MAAmE,EACnE,QAAoB,EACpB,UAAkB;QAElB,IAAI,CAAC,IAAI,CAAC,SAAS;YAAE,OAAO;QAC5B,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CACxB,UAAU,CAAC;gBACT,MAAM;gBACN,OAAO,EAAE,SAAS;gBAClB,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,kBAAkB,EAAE;gBACjD,OAAO,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,EAAE,EAAE,UAAU,EAAE;gBACnD,OAAO,EAAE;oBACP,KAAK,EAAE,IAAI,CAAC,OAAO;oBACnB,UAAU;oBACV,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;iBACtC;aACF,CAAC,CACH,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,+DAA+D;QACjE,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,cAAc;QAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,WAAW,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC;YACzD,OAAO,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC;QACtC,CAAC;QACD,IAAI,CAAC,WAAW,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC/D,OAAO,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC;IACtC,CAAC;IAED,KAAK,CAAC,sBAAsB,CAAC,KAE5B;QAMC,MAAM,gBAAgB,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;QAC5C,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,gBAAgB,CAAC,CAAC;QACpD,MAAM,QAAQ,GAAG,qBAAqB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAEzD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAC1C,MAAM,GAAG,GAAG,MAAM,OAAO,CAAkB,KAAK,EAAE,GAAG,IAAI,CAAC,OAAO,UAAU,EAAE;YAC3E,MAAM,EAAE,MAAM;YACd,IAAI,EAAE;gBACJ,SAAS,EAAE,YAAY,CAAC,gBAAgB,CAAC;gBACzC,2BAA2B,EAAE,YAAY,CAAC,QAAQ,CAAC;aACpD;SACF,CAAC,CAAC;QACH,MAAM,gBAAgB,GAAG,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QACtD,MAAM,UAAU,GAAG,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC;QAEtE,MAAM,IAAI,CAAC,iBAAiB,CAAC,2BAA2B,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;QAChF,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,CAAC;IACjF,CAAC;IAED,KAAK,CAAC,qBAAqB,CAAC,KAK3B;QACC,4EAA4E;QAC5E,yEAAyE;QACzE,+DAA+D;QAC/D,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;YACvD,MAAM,IAAI,KAAK,CACb,qCAAqC,KAAK,CAAC,UAAU,+BAA+B;gBAClF,qDAAqD,CACxD,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG,qBAAqB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACzD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAC1C,MAAM,GAAG,GAAG,MAAM,OAAO,CAAkB,KAAK,EAAE,GAAG,IAAI,CAAC,OAAO,UAAU,EAAE;YAC3E,MAAM,EAAE,MAAM;YACd,IAAI,EAAE;gBACJ,UAAU,EAAE,YAAY,CAAC,KAAK,CAAC,gBAAgB,CAAC;gBAChD,2BAA2B,EAAE,YAAY,CAAC,QAAQ,CAAC;aACpD;SACF,CAAC,CAAC;QACH,MAAM,gBAAgB,GAAG,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACrD,MAAM,IAAI,CAAC,iBAAiB,CAAC,6BAA6B,EAAE,QAAQ,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QACxF,OAAO,gBAAgB,CAAC;IAC1B,CAAC;CACF"}

package/dist/providers/local.d.ts

@@ -1,5 +1,5 @@
 import { hexToBytes, bytesToHex, toHex, type Address, type Hex } from 'viem';
-import type { A2AKeyProvider, KmsAccountBackend } from '../types';
+import type { A2AKeyProvider, KmsAccountBackend } from '../types.js';
 import { type AuditSink } from '@agenticprimitives/audit';
 export declare class LocalAesProvider implements A2AKeyProvider {
     readonly keyVersion = "local-v1";

package/dist/providers/local.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"local.d.ts","sourceRoot":"","sources":["../../src/providers/local.ts"],"names":[],"mappings":"AAoBA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,OAAO,EAAE,KAAK,GAAG,EAAE,MAAM,MAAM,CAAC;AAC7E,OAAO,KAAK,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAElE,OAAO,EAAc,KAAK,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAiHtE,qBAAa,gBAAiB,YAAW,cAAc;IACrD,QAAQ,CAAC,UAAU,cAAc;IACjC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAa;gBAExB,IAAI,CAAC,EAAE;QAAE,gBAAgB,CAAC,EAAE,MAAM,CAAA;KAAE;IAe1C,sBAAsB,CAAC,KAAK,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE;;;;;;IAiBpE,qBAAqB,CAAC,KAAK,EAAE;QACjC,gBAAgB,EAAE,UAAU,CAAC;QAC7B,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACnC,KAAK,EAAE,MAAM,CAAC;QACd,UAAU,EAAE,MAAM,CAAC;KACpB;IAmBK,WAAW,CAAC,KAAK,EAAE;QAAE,gBAAgB,EAAE,UAAU,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE;;;;CAW7F;AAED,qBAAa,oBAAqB,YAAW,iBAAiB;IAC5D,QAAQ,CAAC,QAAQ,EAAG,WAAW,CAAU;IACzC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAa;IAClC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAU;IAC/B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAY;gBAE3B,IAAI,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,SAAS,CAAA;KAAE;IAQ9D,aAAa,CAAC,KAAK,EAAE;QACzB,MAAM,EAAE,UAAU,CAAC;QACnB,YAAY,CAAC,EAAE;YAAE,MAAM,CAAC,EAAE,MAAM,CAAC;YAAC,SAAS,CAAC,EAAE,MAAM,CAAC;YAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;KAC3E;;;;;IA2DK,gBAAgB,IAAI,OAAO,CAAC,OAAO,CAAC;IAI1C,yEAAyE;IACzE,UAAU,IAAI,OAAO;CAGtB;AAaD,YAAY,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC"}
+{"version":3,"file":"local.d.ts","sourceRoot":"","sources":["../../src/providers/local.ts"],"names":[],"mappings":"AAoBA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,OAAO,EAAE,KAAK,GAAG,EAAE,MAAM,MAAM,CAAC;AAC7E,OAAO,KAAK,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAErE,OAAO,EAAc,KAAK,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAiHtE,qBAAa,gBAAiB,YAAW,cAAc;IACrD,QAAQ,CAAC,UAAU,cAAc;IACjC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAa;gBAExB,IAAI,CAAC,EAAE;QAAE,gBAAgB,CAAC,EAAE,MAAM,CAAA;KAAE;IAe1C,sBAAsB,CAAC,KAAK,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE;;;;;;IAiBpE,qBAAqB,CAAC,KAAK,EAAE;QACjC,gBAAgB,EAAE,UAAU,CAAC;QAC7B,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACnC,KAAK,EAAE,MAAM,CAAC;QACd,UAAU,EAAE,MAAM,CAAC;KACpB;IAmBK,WAAW,CAAC,KAAK,EAAE;QAAE,gBAAgB,EAAE,UAAU,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE;;;;CAW7F;AAED,qBAAa,oBAAqB,YAAW,iBAAiB;IAC5D,QAAQ,CAAC,QAAQ,EAAG,WAAW,CAAU;IACzC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAa;IAClC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAU;IAC/B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAY;gBAE3B,IAAI,CAAC,EAAE;QAAE,aAAa,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,SAAS,CAAA;KAAE;IAQ9D,aAAa,CAAC,KAAK,EAAE;QACzB,MAAM,EAAE,UAAU,CAAC;QACnB,YAAY,CAAC,EAAE;YAAE,MAAM,CAAC,EAAE,MAAM,CAAC;YAAC,SAAS,CAAC,EAAE,MAAM,CAAC;YAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;KAC3E;;;;;IA2DK,gBAAgB,IAAI,OAAO,CAAC,OAAO,CAAC;IAI1C,yEAAyE;IACzE,UAAU,IAAI,OAAO;CAGtB;AAaD,YAAY,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC"}

package/dist/providers/local.js

@@ -18,7 +18,7 @@ import { hkdf } from '@noble/hashes/hkdf.js';
 import { secp256k1 } from '@noble/curves/secp256k1.js';
 import { keccak_256 } from '@noble/hashes/sha3.js';
 import { hexToBytes, bytesToHex, toHex } from 'viem';
-import { canonicalContextBytes } from '../aad';
+import { canonicalContextBytes } from '../aad.js';
 import { buildEvent } from '@agenticprimitives/audit';
 const HKDF_INFO = 'agenticprimitives/local-aes:v1';
 const SALT_BYTES = 16;

package/dist/providers/local.js.map

@@ -1 +1 @@
-{"version":3,"file":"local.js","sourceRoot":"","sources":["../../src/providers/local.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAC/D,EAAE;AACF,8EAA8E;AAC9E,EAAE;AACF,oBAAoB;AACpB,gFAAgF;AAChF,uEAAuE;AACvE,8EAA8E;AAC9E,6EAA6E;AAC7E,2CAA2C;AAC3C,EAAE;AACF,wBAAwB;AACxB,uEAAuE;AACvE,2EAA2E;AAE3E,OAAO,EAAE,IAAI,EAAE,MAAM,uBAAuB,CAAC;AAC7C,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAC/C,OAAO,EAAE,IAAI,EAAE,MAAM,uBAAuB,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,KAAK,EAA0B,MAAM,MAAM,CAAC;AAE7E,OAAO,EAAE,qBAAqB,EAAE,MAAM,QAAQ,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAkB,MAAM,0BAA0B,CAAC;AAEtE,MAAM,SAAS,GAAG,gCAAgC,CAAC;AACnD,MAAM,UAAU,GAAG,EAAE,CAAC;AAEtB;;;;;;;;;;;;;;;GAeG;AACH,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;AAEvC;;;;;;;GAOG;AACH,SAAS,uBAAuB;IAC9B,IAAI,CAAC;QACH,IAAI,OAAO,OAAO,KAAK,WAAW,IAAI,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,CAAC;YAC5D,OAAO,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC;QAC/C,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,+CAA+C;IACjD,CAAC;IACD,uDAAuD;IACvD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,sCAAsC,CAAC,KAAa,EAAE,WAAmB;IAChF,IAAI,CAAC,uBAAuB,EAAE;QAAE,OAAO;IACvC,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,IAAI,CAAC;QACH,KAAK,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,KAAK,MAAM,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,2DAA2D;IAC7D,CAAC;IACD,IAAI,KAAK,EAAE,CAAC;QACV,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;YACnC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YAC9B,sCAAsC;YACtC,OAAO,CAAC,IAAI,CACV,iBAAiB,KAAK,+BAA+B,WAAW,SAAS;gBACvE,8FAA8F,CACjG,CAAC;QACJ,CAAC;QACD,OAAO;IACT,CAAC;IACD,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,6EAA6E;QACnF,8DAA8D;QAC9D,GAAG,WAAW,6EAA6E,CAC9F,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,WAAoB;IAC5C,MAAM,GAAG,GAAG,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;IAC1D,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CACb,oGAAoG,CACrG,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,GAAqB,CAAC,CAAC,CAAE,KAAK,GAAG,EAAoB,CAAC,CAAC;IACxG,IAAI,KAAK,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,oEAAoE,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;IACvG,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,cAAc,CAAC,WAAoB;IAC1C,MAAM,GAAG,GAAG,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;IAC9D,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CACb,6EAA6E,CAC9E,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,GAAqB,CAAC,CAAC,CAAE,KAAK,GAAG,EAAoB,CAAC;IAC9F,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IAClC,IAAI,KAAK,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,gDAAgD,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;IACnF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,WAAW,CAAC,CAAS;IAC5B,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;IAC9B,6EAA6E;IAC7E,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;IACvC,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAkB;IAC5C,gDAAgD;IAChD,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAC5D,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAC7B,gEAAgE;IAChE,OAAO,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAY,CAAC;AAC/C,CAAC;AAED,MAAM,OAAO,gBAAgB;IAClB,UAAU,GAAG,UAAU,CAAC;IAChB,MAAM,CAAa;IAEpC,YAAY,IAAoC;QAC9C,qDAAqD;QACrD,wDAAwD;QACxD,4DAA4D;QAC5D,+DAA+D;QAC/D,iEAAiE;QACjE,6DAA6D;QAC7D,mEAAmE;QACnE,6DAA6D;QAC7D,+DAA+D;QAC/D,kEAAkE;QAClE,WAAW;QACX,IAAI,CAAC,MAAM,GAAG,gBAAgB,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;IACzD,CAAC;IAED,KAAK,CAAC,sBAAsB,CAAC,KAA6C;QACxE,sCAAsC,CACpC,yCAAyC,EACzC,8BAA8B,CAC/B,CAAC;QACF,MAAM,IAAI,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC;QACrC,MAAM,IAAI,GAAG,qBAAqB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACrD,4FAA4F;QAC5F,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,UAAU,CAAC,CAAC,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,GAAG,GAAG,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACxH,OAAO;YACL,gBAAgB,EAAE,EAAE;YACpB,gBAAgB,EAAE,IAAI;YACtB,KAAK,EAAE,cAAc;YACrB,UAAU,EAAE,IAAI,CAAC,UAAU;SAC5B,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,qBAAqB,CAAC,KAK3B;QACC,sCAAsC,CACpC,wCAAwC,EACxC,8BAA8B,CAC/B,CAAC;QACF,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;YACzC,MAAM,IAAI,KAAK,CAAC,+CAA+C,KAAK,CAAC,UAAU,gBAAgB,IAAI,CAAC,UAAU,KAAK,CAAC,CAAC;QACvH,CAAC;QACD,MAAM,IAAI,GAAG,qBAAqB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACrD,MAAM,EAAE,GAAG,IAAI,CACb,MAAM,EACN,IAAI,CAAC,MAAM,EACX,KAAK,CAAC,gBAAgB,EACtB,IAAI,UAAU,CAAC,CAAC,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,GAAG,GAAG,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,EACvE,EAAE,CACH,CAAC;QACF,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAA0E;QAC1F,gEAAgE;QAChE,6DAA6D;QAC7D,iEAAiE;QACjE,gEAAgE;QAChE,sDAAsD;QACtD,MAAM,GAAG,GAAG,OAAO,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QACrD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QACxE,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,gBAAgB,CAAC,CAAC;QACzD,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,aAAa,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,QAAQ,EAAE,EAAE,CAAC;IACxE,CAAC;CACF;AAED,MAAM,OAAO,oBAAoB;IACtB,QAAQ,GAAG,WAAoB,CAAC;IACxB,IAAI,CAAa;IACjB,IAAI,CAAU;IACd,SAAS,CAAa;IAEvC,YAAY,IAAwD;QAClE,sCAAsC,CAAC,sBAAsB,EAAE,4BAA4B,CAAC,CAAC;QAC7F,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;QAChD,MAAM,GAAG,GAAG,SAAS,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,0BAA0B;QAChF,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,CAAC,SAAS,GAAG,IAAI,EAAE,SAAS,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,KAGnB;QACC,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,+CAA+C,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;QACzF,CAAC;QACD,oEAAoE;QACpE,kEAAkE;QAClE,8DAA8D;QAC9D,oEAAoE;QACpE,6DAA6D;QAC7D,iEAAiE;QACjE,gEAAgE;QAChE,wDAAwD;QACxD,sEAAsE;QACtE,sDAAsD;QACtD,MAAM,GAAG,GAAG,SAAS,CAAC,SAAS,CAAC,SAAS,CACvC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,EAC5F,WAAW,CACZ,CAAC;QACF,+DAA+D;QAC/D,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;QAC/B,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACnC,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACpC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC;QACnC,6DAA6D;QAC7D,0DAA0D;QAC1D,6DAA6D;QAC7D,0CAA0C;QAC1C,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,MAAM,GAAG,GAAG,KAAK,CAAC,YAAY,IAAI,EAAE,CAAC;YACrC,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CACxB,UAAU,CAAC;oBACT,MAAM,EAAE,kBAAkB;oBAC1B,OAAO,EAAE,SAAS;oBAClB,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,wBAAwB,EAAE;oBACvD,OAAO,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,EAAE,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE;oBAC9D,OAAO,EAAE;wBACP,KAAK,EAAE,wBAAwB;wBAC/B,aAAa,EAAE,IAAI,CAAC,IAAI;wBACxB,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,IAAI;wBAC1B,QAAQ,EAAE,GAAG,CAAC,QAAQ,IAAI,IAAI;wBAC9B,kCAAkC;wBAClC,WAAW,EAAE,GAAG,CAAC,SAAS;4BACxB,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;4BACzE,CAAC,CAAC,IAAI;qBACT;iBACF,CAAC,CACH,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,eAAe;YACjB,CAAC;QACH,CAAC;QACD,OAAO;YACL,SAAS,EAAE,GAAG;YACd,KAAK,EAAE,wBAAwB;YAC/B,aAAa,EAAE,IAAI,CAAC,IAAI;SACzB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,gBAAgB;QACpB,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED,yEAAyE;IACzE,UAAU;QACR,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;CACF;AAED,SAAS,eAAe,CAAC,CAAS;IAChC,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IAC/B,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7B,GAAG,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC;QAC/B,KAAK,KAAK,EAAE,CAAC;IACf,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAID,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC"}
+{"version":3,"file":"local.js","sourceRoot":"","sources":["../../src/providers/local.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAC/D,EAAE;AACF,8EAA8E;AAC9E,EAAE;AACF,oBAAoB;AACpB,gFAAgF;AAChF,uEAAuE;AACvE,8EAA8E;AAC9E,6EAA6E;AAC7E,2CAA2C;AAC3C,EAAE;AACF,wBAAwB;AACxB,uEAAuE;AACvE,2EAA2E;AAE3E,OAAO,EAAE,IAAI,EAAE,MAAM,uBAAuB,CAAC;AAC7C,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAC/C,OAAO,EAAE,IAAI,EAAE,MAAM,uBAAuB,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,KAAK,EAA0B,MAAM,MAAM,CAAC;AAE7E,OAAO,EAAE,qBAAqB,EAAE,MAAM,WAAW,CAAC;AAClD,OAAO,EAAE,UAAU,EAAkB,MAAM,0BAA0B,CAAC;AAEtE,MAAM,SAAS,GAAG,gCAAgC,CAAC;AACnD,MAAM,UAAU,GAAG,EAAE,CAAC;AAEtB;;;;;;;;;;;;;;;GAeG;AACH,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAC;AAEvC;;;;;;;GAOG;AACH,SAAS,uBAAuB;IAC9B,IAAI,CAAC;QACH,IAAI,OAAO,OAAO,KAAK,WAAW,IAAI,OAAO,CAAC,GAAG,EAAE,QAAQ,EAAE,CAAC;YAC5D,OAAO,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC;QAC/C,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,+CAA+C;IACjD,CAAC;IACD,uDAAuD;IACvD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,sCAAsC,CAAC,KAAa,EAAE,WAAmB;IAChF,IAAI,CAAC,uBAAuB,EAAE;QAAE,OAAO;IACvC,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,IAAI,CAAC;QACH,KAAK,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC,WAAW,CAAC,KAAK,MAAM,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,2DAA2D;IAC7D,CAAC;IACD,IAAI,KAAK,EAAE,CAAC;QACV,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;YACnC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YAC9B,sCAAsC;YACtC,OAAO,CAAC,IAAI,CACV,iBAAiB,KAAK,+BAA+B,WAAW,SAAS;gBACvE,8FAA8F,CACjG,CAAC;QACJ,CAAC;QACD,OAAO;IACT,CAAC;IACD,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,6EAA6E;QACnF,8DAA8D;QAC9D,GAAG,WAAW,6EAA6E,CAC9F,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,WAAoB;IAC5C,MAAM,GAAG,GAAG,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;IAC1D,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CACb,oGAAoG,CACrG,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,GAAqB,CAAC,CAAC,CAAE,KAAK,GAAG,EAAoB,CAAC,CAAC;IACxG,IAAI,KAAK,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,oEAAoE,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;IACvG,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,cAAc,CAAC,WAAoB;IAC1C,MAAM,GAAG,GAAG,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC;IAC9D,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CACb,6EAA6E,CAC9E,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,GAAqB,CAAC,CAAC,CAAE,KAAK,GAAG,EAAoB,CAAC;IAC9F,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IAClC,IAAI,KAAK,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,gDAAgD,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;IACnF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,WAAW,CAAC,CAAS;IAC5B,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC;IAC9B,6EAA6E;IAC7E,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;IACvC,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAkB;IAC5C,gDAAgD;IAChD,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAC5D,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAC7B,gEAAgE;IAChE,OAAO,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAY,CAAC;AAC/C,CAAC;AAED,MAAM,OAAO,gBAAgB;IAClB,UAAU,GAAG,UAAU,CAAC;IAChB,MAAM,CAAa;IAEpC,YAAY,IAAoC;QAC9C,qDAAqD;QACrD,wDAAwD;QACxD,4DAA4D;QAC5D,+DAA+D;QAC/D,iEAAiE;QACjE,6DAA6D;QAC7D,mEAAmE;QACnE,6DAA6D;QAC7D,+DAA+D;QAC/D,kEAAkE;QAClE,WAAW;QACX,IAAI,CAAC,MAAM,GAAG,gBAAgB,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;IACzD,CAAC;IAED,KAAK,CAAC,sBAAsB,CAAC,KAA6C;QACxE,sCAAsC,CACpC,yCAAyC,EACzC,8BAA8B,CAC/B,CAAC;QACF,MAAM,IAAI,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC;QACrC,MAAM,IAAI,GAAG,qBAAqB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACrD,4FAA4F;QAC5F,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,UAAU,CAAC,CAAC,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,GAAG,GAAG,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACxH,OAAO;YACL,gBAAgB,EAAE,EAAE;YACpB,gBAAgB,EAAE,IAAI;YACtB,KAAK,EAAE,cAAc;YACrB,UAAU,EAAE,IAAI,CAAC,UAAU;SAC5B,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,qBAAqB,CAAC,KAK3B;QACC,sCAAsC,CACpC,wCAAwC,EACxC,8BAA8B,CAC/B,CAAC;QACF,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;YACzC,MAAM,IAAI,KAAK,CAAC,+CAA+C,KAAK,CAAC,UAAU,gBAAgB,IAAI,CAAC,UAAU,KAAK,CAAC,CAAC;QACvH,CAAC;QACD,MAAM,IAAI,GAAG,qBAAqB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACrD,MAAM,EAAE,GAAG,IAAI,CACb,MAAM,EACN,IAAI,CAAC,MAAM,EACX,KAAK,CAAC,gBAAgB,EACtB,IAAI,UAAU,CAAC,CAAC,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,GAAG,GAAG,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,EACvE,EAAE,CACH,CAAC;QACF,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAA0E;QAC1F,gEAAgE;QAChE,6DAA6D;QAC7D,iEAAiE;QACjE,gEAAgE;QAChE,sDAAsD;QACtD,MAAM,GAAG,GAAG,OAAO,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QACrD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QACxE,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,gBAAgB,CAAC,CAAC;QACzD,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,aAAa,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,QAAQ,EAAE,EAAE,CAAC;IACxE,CAAC;CACF;AAED,MAAM,OAAO,oBAAoB;IACtB,QAAQ,GAAG,WAAoB,CAAC;IACxB,IAAI,CAAa;IACjB,IAAI,CAAU;IACd,SAAS,CAAa;IAEvC,YAAY,IAAwD;QAClE,sCAAsC,CAAC,sBAAsB,EAAE,4BAA4B,CAAC,CAAC;QAC7F,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;QAChD,MAAM,GAAG,GAAG,SAAS,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,0BAA0B;QAChF,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,CAAC,SAAS,GAAG,IAAI,EAAE,SAAS,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,KAGnB;QACC,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,+CAA+C,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;QACzF,CAAC;QACD,oEAAoE;QACpE,kEAAkE;QAClE,8DAA8D;QAC9D,oEAAoE;QACpE,6DAA6D;QAC7D,iEAAiE;QACjE,gEAAgE;QAChE,wDAAwD;QACxD,sEAAsE;QACtE,sDAAsD;QACtD,MAAM,GAAG,GAAG,SAAS,CAAC,SAAS,CAAC,SAAS,CACvC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,EAC5F,WAAW,CACZ,CAAC;QACF,+DAA+D;QAC/D,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;QAC/B,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACnC,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACpC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC;QACnC,6DAA6D;QAC7D,0DAA0D;QAC1D,6DAA6D;QAC7D,0CAA0C;QAC1C,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,MAAM,GAAG,GAAG,KAAK,CAAC,YAAY,IAAI,EAAE,CAAC;YACrC,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CACxB,UAAU,CAAC;oBACT,MAAM,EAAE,kBAAkB;oBAC1B,OAAO,EAAE,SAAS;oBAClB,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,wBAAwB,EAAE;oBACvD,OAAO,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,EAAE,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE;oBAC9D,OAAO,EAAE;wBACP,KAAK,EAAE,wBAAwB;wBAC/B,aAAa,EAAE,IAAI,CAAC,IAAI;wBACxB,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,IAAI;wBAC1B,QAAQ,EAAE,GAAG,CAAC,QAAQ,IAAI,IAAI;wBAC9B,kCAAkC;wBAClC,WAAW,EAAE,GAAG,CAAC,SAAS;4BACxB,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;4BACzE,CAAC,CAAC,IAAI;qBACT;iBACF,CAAC,CACH,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,eAAe;YACjB,CAAC;QACH,CAAC;QACD,OAAO;YACL,SAAS,EAAE,GAAG;YACd,KAAK,EAAE,wBAAwB;YAC/B,aAAa,EAAE,IAAI,CAAC,IAAI;SACzB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,gBAAgB;QACpB,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED,yEAAyE;IACzE,UAAU;QACR,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;CACF;AAED,SAAS,eAAe,CAAC,CAAS;IAChC,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IAC/B,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7B,GAAG,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC,CAAC;QAC/B,KAAK,KAAK,EAAE,CAAC;IACf,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAID,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC"}

package/dist/relay-only.d.ts

@@ -1,3 +1,3 @@
-import type { BuildOpts, KmsAccountBackend } from './types';
+import type { BuildOpts, KmsAccountBackend } from './types.js';
 export declare function getRelayOnlySigner(opts: BuildOpts): KmsAccountBackend;
 //# sourceMappingURL=relay-only.d.ts.map

package/dist/relay-only.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"relay-only.d.ts","sourceRoot":"","sources":["../src/relay-only.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AAI5D,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,SAAS,GAAG,iBAAiB,CAerE"}
+{"version":3,"file":"relay-only.d.ts","sourceRoot":"","sources":["../src/relay-only.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAI/D,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,SAAS,GAAG,iBAAiB,CAerE"}

package/dist/relay-only.js

@@ -1,7 +1,7 @@
 // getRelayOnlySigner — wraps a KmsAccountBackend so any sign call throws.
 // Used in Phase B to guarantee the master signer can only broadcast, never
 // sign on the user's authority.
-import { buildSignerBackend } from './factories';
+import { buildSignerBackend } from './factories.js';
 export function getRelayOnlySigner(opts) {
     const inner = buildSignerBackend(opts);
     return {

package/dist/relay-only.js.map

@@ -1 +1 @@
-{"version":3,"file":"relay-only.js","sourceRoot":"","sources":["../src/relay-only.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,2EAA2E;AAC3E,gCAAgC;AAGhC,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAGjD,MAAM,UAAU,kBAAkB,CAAC,IAAe;IAChD,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACvC,OAAO;QACL,sEAAsE;QACtE,2CAA2C;QAC3C,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,KAAK,CAAC,gBAAgB;YACpB,OAAO,KAAK,CAAC,gBAAgB,EAAE,CAAC;QAClC,CAAC;QACD,KAAK,CAAC,aAAa;YACjB,MAAM,IAAI,KAAK,CACb,2HAA2H,CAC5H,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"relay-only.js","sourceRoot":"","sources":["../src/relay-only.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,2EAA2E;AAC3E,gCAAgC;AAGhC,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAGpD,MAAM,UAAU,kBAAkB,CAAC,IAAe;IAChD,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACvC,OAAO;QACL,sEAAsE;QACtE,2CAA2C;QAC3C,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,KAAK,CAAC,gBAAgB;YACpB,OAAO,KAAK,CAAC,gBAAgB,EAAE,CAAC;QAClC,CAAC;QACD,KAAK,CAAC,aAAa;YACjB,MAAM,IAAI,KAAK,CACb,2HAA2H,CAC5H,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/relayer-account.d.ts

@@ -1,6 +1,6 @@
 import { type LocalAccount } from 'viem';
 import { type AuditSink } from '@agenticprimitives/audit';
-import type { KmsAccountBackend } from './types';
+import type { KmsAccountBackend } from './types.js';
 /**
  * Caller-supplied options for `createRelayerAccount`.
  *

package/dist/relayer-account.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"relayer-account.d.ts","sourceRoot":"","sources":["../src/relayer-account.ts"],"names":[],"mappings":"AA2CA,OAAO,EAML,KAAK,YAAY,EAElB,MAAM,MAAM,CAAC;AACd,OAAO,EAAc,KAAK,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAEtE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AAEjD;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,SAAS,CAAC;CACvB;AA6CD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,iBAAiB,EAC1B,IAAI,EAAE,wBAAwB,GAC7B,OAAO,CAAC,YAAY,CAAC,CAgDvB"}
+{"version":3,"file":"relayer-account.d.ts","sourceRoot":"","sources":["../src/relayer-account.ts"],"names":[],"mappings":"AA2CA,OAAO,EAML,KAAK,YAAY,EAElB,MAAM,MAAM,CAAC;AACd,OAAO,EAAc,KAAK,SAAS,EAAE,MAAM,0BAA0B,CAAC;AAEtE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAEpD;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,SAAS,CAAC;CACvB;AA6CD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,iBAAiB,EAC1B,IAAI,EAAE,wBAAwB,GAC7B,OAAO,CAAC,YAAY,CAAC,CAgDvB"}

package/dist/relayer-account.js

@@ -42,7 +42,7 @@
 // `composeFailHardSinks` from @agenticprimitives/audit.
 import { hashMessage, hashTypedData, keccak256, serializeTransaction, } from 'viem';
 import { buildEvent } from '@agenticprimitives/audit';
-import { createKmsViemAccount } from './kms-viem-account';
+import { createKmsViemAccount } from './kms-viem-account.js';
 function digestFingerprint(digest) {
     // 18 chars = 9 bytes of the keccak hash. Enough to disambiguate in
     // logs; far too short to be a preimage. Same redaction shape used by

package/dist/relayer-account.js.map

@@ -1 +1 @@
-{"version":3,"file":"relayer-account.js","sourceRoot":"","sources":["../src/relayer-account.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,oDAAoD;AACpD,EAAE;AACF,8DAA8D;AAC9D,EAAE;AACF,sDAAsD;AACtD,EAAE;AACF,mEAAmE;AACnE,yEAAyE;AACzE,wEAAwE;AACxE,sEAAsE;AACtE,oEAAoE;AACpE,wEAAwE;AACxE,mBAAmB;AACnB,EAAE;AACF,qEAAqE;AACrE,qEAAqE;AACrE,mEAAmE;AACnE,EAAE;AACF,0DAA0D;AAC1D,qEAAqE;AACrE,sEAAsE;AACtE,4EAA4E;AAC5E,uDAAuD;AACvD,EAAE;AACF,wCAAwC;AACxC,uCAAuC;AACvC,6CAA6C;AAC7C,0DAA0D;AAC1D,aAAa;AACb,+CAA+C;AAC/C,sCAAsC;AACtC,+DAA+D;AAC/D,2DAA2D;AAC3D,yDAAyD;AACzD,qEAAqE;AACrE,6DAA6D;AAC7D,EAAE;AACF,sEAAsE;AACtE,mEAAmE;AACnE,yDAAyD;AACzD,wDAAwD;AAExD,OAAO,EACL,WAAW,EACX,aAAa,EACb,SAAS,EACT,oBAAoB,GAIrB,MAAM,MAAM,CAAC;AACd,OAAO,EAAE,UAAU,EAAkB,MAAM,0BAA0B,CAAC;AACtE,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAoB1D,SAAS,iBAAiB,CAAC,MAAW;IACpC,mEAAmE;IACnE,qEAAqE;IACrE,iEAAiE;IACjE,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACxC,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,SAAgC,EAChC,IAAY,EACZ,aAAkB,EAClB,MAAgD,EAChD,MAAW,EACX,SAA+C;IAE/C,IAAI,CAAC,SAAS;QAAE,OAAO;IACvB,IAAI,CAAC;QACH,MAAM,SAAS,CAAC,KAAK,CACnB,UAAU,CAAC;YACT,MAAM,EAAE,wBAAwB;YAChC,OAAO,EAAE,SAAS;YAClB,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE;YACnC,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,iBAAiB,CAAC,MAAM,CAAC,EAAE;YACxD,OAAO,EAAE;gBACP,IAAI;gBACJ,aAAa;gBACb,MAAM;gBACN,EAAE,EAAE,SAAS,EAAE,EAAE,IAAI,IAAI;gBACzB,gEAAgE;gBAChE,+DAA+D;gBAC/D,KAAK,EACH,SAAS,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI;gBACpE,iBAAiB,EAAE,iBAAiB,CAAC,MAAM,CAAC;aAC7C;SACF,CAAC,CACH,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,+DAA+D;QAC/D,mDAAmD;QACnD,sDAAsD;IACxD,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAA0B,EAC1B,IAA8B;IAE9B,MAAM,KAAK,GAAG,MAAM,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAClD,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC;IAEjC,OAAO;QACL,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,IAAI,EAAE,OAAO;QACb,MAAM,EAAE,aAAa;QACrB,SAAS,EAAE,KAAK,CAAC,SAAS;QAE1B,KAAK,CAAC,WAAW,CAAC,EAAE,OAAO,EAAgC;YACzD,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;YACpC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;YACpD,MAAM,aAAa,CAAC,SAAS,EAAE,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;YACvE,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,8DAA8D;QAC9D,KAAK,CAAC,eAAe,CAAC,WAAgB,EAAE,OAAa;YACnD,8DAA8D;YAC9D,kEAAkE;YAClE,+DAA+D;YAC/D,wDAAwD;YACxD,MAAM,UAAU,GAAG,OAAO,EAAE,UAAU,IAAI,oBAAoB,CAAC;YAC/D,MAAM,QAAQ,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC;YACzC,MAAM,MAAM,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;YACnC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,eAAe,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;YACjE,MAAM,aAAa,CAAC,SAAS,EAAE,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE;gBACzE,EAAE,EAAG,WAAW,CAAC,EAA6B,IAAI,IAAI;gBACtD,sEAAsE;gBACtE,KAAK,EACH,OAAO,WAAW,CAAC,KAAK,KAAK,QAAQ;oBACnC,CAAC,CAAC,WAAW,CAAC,KAAK;oBACnB,CAAC,CAAC,WAAW,CAAC,KAAK,KAAK,SAAS;wBAC/B,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,KAAwB,CAAC;wBAC9C,CAAC,CAAC,EAAE;aACX,CAAC,CAAC;YACH,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,8DAA8D;QAC9D,KAAK,CAAC,aAAa,CAAC,IAAS;YAC3B,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;YACnC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;YAC/C,MAAM,aAAa,CAAC,SAAS,EAAE,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC;YAC1E,OAAO,MAAM,CAAC;QAChB,CAAC;KACqB,CAAC;AAC3B,CAAC"}
+{"version":3,"file":"relayer-account.js","sourceRoot":"","sources":["../src/relayer-account.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,oDAAoD;AACpD,EAAE;AACF,8DAA8D;AAC9D,EAAE;AACF,sDAAsD;AACtD,EAAE;AACF,mEAAmE;AACnE,yEAAyE;AACzE,wEAAwE;AACxE,sEAAsE;AACtE,oEAAoE;AACpE,wEAAwE;AACxE,mBAAmB;AACnB,EAAE;AACF,qEAAqE;AACrE,qEAAqE;AACrE,mEAAmE;AACnE,EAAE;AACF,0DAA0D;AAC1D,qEAAqE;AACrE,sEAAsE;AACtE,4EAA4E;AAC5E,uDAAuD;AACvD,EAAE;AACF,wCAAwC;AACxC,uCAAuC;AACvC,6CAA6C;AAC7C,0DAA0D;AAC1D,aAAa;AACb,+CAA+C;AAC/C,sCAAsC;AACtC,+DAA+D;AAC/D,2DAA2D;AAC3D,yDAAyD;AACzD,qEAAqE;AACrE,6DAA6D;AAC7D,EAAE;AACF,sEAAsE;AACtE,mEAAmE;AACnE,yDAAyD;AACzD,wDAAwD;AAExD,OAAO,EACL,WAAW,EACX,aAAa,EACb,SAAS,EACT,oBAAoB,GAIrB,MAAM,MAAM,CAAC;AACd,OAAO,EAAE,UAAU,EAAkB,MAAM,0BAA0B,CAAC;AACtE,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAoB7D,SAAS,iBAAiB,CAAC,MAAW;IACpC,mEAAmE;IACnE,qEAAqE;IACrE,iEAAiE;IACjE,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACxC,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,SAAgC,EAChC,IAAY,EACZ,aAAkB,EAClB,MAAgD,EAChD,MAAW,EACX,SAA+C;IAE/C,IAAI,CAAC,SAAS;QAAE,OAAO;IACvB,IAAI,CAAC;QACH,MAAM,SAAS,CAAC,KAAK,CACnB,UAAU,CAAC;YACT,MAAM,EAAE,wBAAwB;YAChC,OAAO,EAAE,SAAS;YAClB,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE;YACnC,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,iBAAiB,CAAC,MAAM,CAAC,EAAE;YACxD,OAAO,EAAE;gBACP,IAAI;gBACJ,aAAa;gBACb,MAAM;gBACN,EAAE,EAAE,SAAS,EAAE,EAAE,IAAI,IAAI;gBACzB,gEAAgE;gBAChE,+DAA+D;gBAC/D,KAAK,EACH,SAAS,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI;gBACpE,iBAAiB,EAAE,iBAAiB,CAAC,MAAM,CAAC;aAC7C;SACF,CAAC,CACH,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,+DAA+D;QAC/D,mDAAmD;QACnD,sDAAsD;IACxD,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAA0B,EAC1B,IAA8B;IAE9B,MAAM,KAAK,GAAG,MAAM,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAClD,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC;IAEjC,OAAO;QACL,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,IAAI,EAAE,OAAO;QACb,MAAM,EAAE,aAAa;QACrB,SAAS,EAAE,KAAK,CAAC,SAAS;QAE1B,KAAK,CAAC,WAAW,CAAC,EAAE,OAAO,EAAgC;YACzD,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;YACpC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;YACpD,MAAM,aAAa,CAAC,SAAS,EAAE,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;YACvE,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,8DAA8D;QAC9D,KAAK,CAAC,eAAe,CAAC,WAAgB,EAAE,OAAa;YACnD,8DAA8D;YAC9D,kEAAkE;YAClE,+DAA+D;YAC/D,wDAAwD;YACxD,MAAM,UAAU,GAAG,OAAO,EAAE,UAAU,IAAI,oBAAoB,CAAC;YAC/D,MAAM,QAAQ,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC;YACzC,MAAM,MAAM,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;YACnC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,eAAe,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;YACjE,MAAM,aAAa,CAAC,SAAS,EAAE,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE;gBACzE,EAAE,EAAG,WAAW,CAAC,EAA6B,IAAI,IAAI;gBACtD,sEAAsE;gBACtE,KAAK,EACH,OAAO,WAAW,CAAC,KAAK,KAAK,QAAQ;oBACnC,CAAC,CAAC,WAAW,CAAC,KAAK;oBACnB,CAAC,CAAC,WAAW,CAAC,KAAK,KAAK,SAAS;wBAC/B,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,KAAwB,CAAC;wBAC9C,CAAC,CAAC,EAAE;aACX,CAAC,CAAC;YACH,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,8DAA8D;QAC9D,KAAK,CAAC,aAAa,CAAC,IAAS;YAC3B,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;YACnC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;YAC/C,MAAM,aAAa,CAAC,SAAS,EAAE,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC;YAC1E,OAAO,MAAM,CAAC;QAChB,CAAC;KACqB,CAAC;AAC3B,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agenticprimitives/key-custody",
-  "version": "1.0.0-alpha.10",
+  "version": "1.0.0-alpha.12",
   "description": "Pluggable envelope encryption + signers + HMAC providers (local-AES / AWS KMS / GCP KMS). Pure crypto primitives; no session lifecycle (that's in delegation).",
   "license": "MIT",
   "repository": {
@@ -76,9 +76,9 @@
   },
   "peerDependencies": {
     "viem": "^2.52.2",
-    "@agenticprimitives/audit": "1.0.0-alpha.10",
-    "@agenticprimitives/types": "1.0.0-alpha.10",
-    "@agenticprimitives/connect-auth": "1.0.0-alpha.10"
+    "@agenticprimitives/audit": "1.0.0-alpha.12",
+    "@agenticprimitives/connect-auth": "1.0.0-alpha.12",
+    "@agenticprimitives/types": "1.0.0-alpha.12"
   },
   "peerDependenciesMeta": {
     "@agenticprimitives/audit": {