@agenticprimitives/key-custody 1.0.0-alpha.11 → 1.0.0-alpha.13

package/bin/ap-provision-gcp.mjs

@@ -1,16 +1,26 @@
 #!/usr/bin/env node
-// ap-provision-gcp — provision GCP Cloud KMS secp256k1 signing keys for a set of
-// signing identities, grant the runtime service account roles/cloudkms.signer
-// per key, and print the identity → key-version map + derived EVM addresses
-// (spec 276 KCS-D3). Thin Node wrapper over @agenticprimitives/key-custody/provision-gcp.
+// ap-provision-gcp — provision GCP Cloud KMS keys for a set of identities, grant the
+// runtime service account a per-key IAM role, and print the identity → key map (+
+// derived EVM addresses for signing keys) (spec 276 KCS-D3). Thin Node wrapper over
+// @agenticprimitives/key-custody/provision-gcp.
 //
+//   # secp256k1 signing keys (default):
 //   ap-provision-gcp \
 //     --project my-proj --location us-east1 --keyring my-ring \
 //     --service-account runtime@my-proj.iam.gserviceaccount.com \
 //     --identities signer-a,signer-b [--protection HSM] [--dry-run]
 //
-// --dry-run prints the gcloud steps without executing. Requires `gcloud` on PATH
-// (authenticated) for a real run.
+//   # symmetric per-person vault KEKs (spec 278) — identities are person SA addresses:
+//   ap-provision-gcp --purpose encrypt-decrypt \
+//     --project my-proj --location us-east1 --keyring vault-keks \
+//     --service-account demo-mcp-runtime@my-proj.iam.gserviceaccount.com \
+//     --identities 0xPersonSA1,0xPersonSA2
+//
+// --purpose encrypt-decrypt mints GOOGLE_SYMMETRIC_ENCRYPTION KEKs + grants the runtime SA
+// roles/cloudkms.cryptoKeyEncrypterDecrypter per key; the printed keyMap entry (the version-less
+// cryptoKey resource) is the `kmsKeyRef` the spec-278 VaultKeyBinding carries. --iam-role
+// overrides the granted role. --dry-run prints the gcloud steps without executing. Requires
+// `gcloud` on PATH (authenticated) for a real run.
 import { execFileSync } from 'node:child_process';
 import { planGcpProvision, executeGcpProvision } from '../dist/kms/provision-gcp.js';
 
@@ -35,7 +45,13 @@ const required = ['project', 'location', 'keyring', 'service-account', 'identiti
 const missing = required.filter((k) => !args[k]);
 if (missing.length) {
   console.error(`ap-provision-gcp: missing required flag(s): ${missing.map((m) => '--' + m).join(', ')}`);
-  console.error('Usage: ap-provision-gcp --project <p> --location <l> --keyring <r> --service-account <email> --identities a,b[,c] [--protection HSM|SOFTWARE] [--dry-run]');
+  console.error('Usage: ap-provision-gcp --project <p> --location <l> --keyring <r> --service-account <email> --identities a,b[,c] [--purpose asymmetric-signing|encrypt-decrypt] [--iam-role <role>] [--protection HSM|SOFTWARE] [--dry-run]');
+  process.exit(2);
+}
+
+const purpose = args.purpose ?? 'asymmetric-signing';
+if (!['asymmetric-signing', 'encrypt-decrypt'].includes(purpose)) {
+  console.error(`ap-provision-gcp: --purpose must be 'asymmetric-signing' or 'encrypt-decrypt' (got '${purpose}')`);
   process.exit(2);
 }
 
@@ -46,6 +62,8 @@ const plan = {
   identities: String(args.identities).split(',').map((s) => s.trim()).filter(Boolean),
   runtimeServiceAccount: args['service-account'],
   protectionLevel: args.protection ?? 'HSM',
+  purpose,
+  ...(args['iam-role'] ? { iamRole: args['iam-role'] } : {}),
 };
 
 if (args['dry-run']) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agenticprimitives/key-custody",
-  "version": "1.0.0-alpha.11",
+  "version": "1.0.0-alpha.13",
   "description": "Pluggable envelope encryption + signers + HMAC providers (local-AES / AWS KMS / GCP KMS). Pure crypto primitives; no session lifecycle (that's in delegation).",
   "license": "MIT",
   "repository": {
@@ -76,9 +76,9 @@
   },
   "peerDependencies": {
     "viem": "^2.52.2",
-    "@agenticprimitives/audit": "1.0.0-alpha.11",
-    "@agenticprimitives/connect-auth": "1.0.0-alpha.11",
-    "@agenticprimitives/types": "1.0.0-alpha.11"
+    "@agenticprimitives/audit": "1.0.0-alpha.13",
+    "@agenticprimitives/connect-auth": "1.0.0-alpha.13",
+    "@agenticprimitives/types": "1.0.0-alpha.13"
   },
   "peerDependenciesMeta": {
     "@agenticprimitives/audit": {