@btravstack/keys 0.45.0 → 0.46.0

package/README.md

@@ -27,6 +27,8 @@ A port that seals a tenant's payloads under a key of that tenant's own, and
 the composition that provides the keys:
 
 ```ts
+import type { webcrypto } from "node:crypto";
+
 import {
   EnvelopeKeys,
   deriveKey,
@@ -40,7 +42,7 @@ import { kmsKeys } from "@btravstack/keys/kms";
 class PayloadKeys extends Port("ReadmePayloadKeys")<{
   readonly key: (
     generation: KeyGeneration,
-  ) => AsyncResult<CryptoKey, KeyErased | KeysUnavailable | InvalidKeyPurpose>;
+  ) => AsyncResult<webcrypto.CryptoKey, KeyErased | KeysUnavailable | InvalidKeyPurpose>;
 }> {}
 
 export const payloadKeys = Provider(PayloadKeys)({

package/dist/index.cjs

@@ -1,5 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_keys = require("./keys-DtMnWJHq.cjs");
+let node_crypto = require("node:crypto");
 let unthrown = require("unthrown");
 //#region src/derive.ts
 /** A purpose whose `info` would be ambiguous: a segment outside the alphabet, or a version that is not a positive integer. */
@@ -24,7 +25,7 @@ const SEGMENT = /^[A-Za-z0-9._-]+$/;
 * random 96-bit AES-GCM nonces never draw from one key. The salt is empty
 * because the root is already uniformly random (RFC 5869, section 3.1).
 */
-const deriveKey = (root, purpose, derived) => SEGMENT.test(purpose.namespace) && SEGMENT.test(purpose.purpose) && Number.isSafeInteger(purpose.version) && purpose.version > 0 ? (0, unthrown.fromSafePromise)(crypto.subtle.deriveKey({
+const deriveKey = (root, purpose, derived) => SEGMENT.test(purpose.namespace) && SEGMENT.test(purpose.purpose) && Number.isSafeInteger(purpose.version) && purpose.version > 0 ? (0, unthrown.fromSafePromise)(node_crypto.webcrypto.subtle.deriveKey({
 	name: "HKDF",
 	hash: "SHA-256",
 	salt: /* @__PURE__ */ new Uint8Array(0),

package/dist/index.d.cts

@@ -1,4 +1,4 @@
-import { a as KeysUnavailable, i as KeyGeneration, n as EnvelopeKeysService, r as KeyErased, t as EnvelopeKeys } from "./keys-DpvmIcWy.cjs";
+import { a as KeysUnavailable, i as KeyGeneration, n as EnvelopeKeysService, r as KeyErased, t as EnvelopeKeys } from "./keys-B_EdZt6c.cjs";
 import { webcrypto } from "node:crypto";
 import { AsyncResult } from "unthrown";
 //#region src/derive.d.ts
@@ -44,6 +44,6 @@ export declare class InvalidKeyPurpose extends InvalidKeyPurpose_base<{
  * random 96-bit AES-GCM nonces never draw from one key. The salt is empty
  * because the root is already uniformly random (RFC 5869, section 3.1).
  */
-export declare const deriveKey: (root: CryptoKey, purpose: KeyPurpose, derived: DerivedKey) => AsyncResult<CryptoKey, InvalidKeyPurpose>;
+export declare const deriveKey: (root: webcrypto.CryptoKey, purpose: KeyPurpose, derived: DerivedKey) => AsyncResult<webcrypto.CryptoKey, InvalidKeyPurpose>;
 //#endregion
 export { type DerivedKey, EnvelopeKeys, type EnvelopeKeysService, KeyErased, type KeyGeneration, type KeyPurpose, KeysUnavailable };

package/dist/index.d.mts

@@ -1,6 +1,6 @@
-import { a as KeysUnavailable, i as KeyGeneration, n as EnvelopeKeysService, r as KeyErased, t as EnvelopeKeys } from "./keys-DpvmIcWy.mjs";
-import { AsyncResult } from "unthrown";
+import { a as KeysUnavailable, i as KeyGeneration, n as EnvelopeKeysService, r as KeyErased, t as EnvelopeKeys } from "./keys-B_EdZt6c.mjs";
 import { webcrypto } from "node:crypto";
+import { AsyncResult } from "unthrown";
 //#region src/derive.d.ts
 /**
  * What a derived key is for, spelled into HKDF's `info` as
@@ -44,6 +44,6 @@ export declare class InvalidKeyPurpose extends InvalidKeyPurpose_base<{
  * random 96-bit AES-GCM nonces never draw from one key. The salt is empty
  * because the root is already uniformly random (RFC 5869, section 3.1).
  */
-export declare const deriveKey: (root: CryptoKey, purpose: KeyPurpose, derived: DerivedKey) => AsyncResult<CryptoKey, InvalidKeyPurpose>;
+export declare const deriveKey: (root: webcrypto.CryptoKey, purpose: KeyPurpose, derived: DerivedKey) => AsyncResult<webcrypto.CryptoKey, InvalidKeyPurpose>;
 //#endregion
 export { type DerivedKey, EnvelopeKeys, type EnvelopeKeysService, KeyErased, type KeyGeneration, type KeyPurpose, KeysUnavailable };

package/dist/index.mjs

@@ -1,4 +1,5 @@
 import { n as KeyErased, r as KeysUnavailable, t as EnvelopeKeys } from "./keys-CGbVjuu3.mjs";
+import { webcrypto } from "node:crypto";
 import { ErrAsync, TaggedError, fromSafePromise } from "unthrown";
 //#region src/derive.ts
 /** A purpose whose `info` would be ambiguous: a segment outside the alphabet, or a version that is not a positive integer. */
@@ -23,7 +24,7 @@ const SEGMENT = /^[A-Za-z0-9._-]+$/;
 * random 96-bit AES-GCM nonces never draw from one key. The salt is empty
 * because the root is already uniformly random (RFC 5869, section 3.1).
 */
-const deriveKey = (root, purpose, derived) => SEGMENT.test(purpose.namespace) && SEGMENT.test(purpose.purpose) && Number.isSafeInteger(purpose.version) && purpose.version > 0 ? fromSafePromise(crypto.subtle.deriveKey({
+const deriveKey = (root, purpose, derived) => SEGMENT.test(purpose.namespace) && SEGMENT.test(purpose.purpose) && Number.isSafeInteger(purpose.version) && purpose.version > 0 ? fromSafePromise(webcrypto.subtle.deriveKey({
 	name: "HKDF",
 	hash: "SHA-256",
 	salt: /* @__PURE__ */ new Uint8Array(0),

package/dist/{keys-DpvmIcWy.d.cts → keys-B_EdZt6c.d.cts}

@@ -1,3 +1,4 @@
+import { webcrypto } from "node:crypto";
 import { AsyncResult } from "unthrown";
 //#region src/keys.d.ts
 /**
@@ -50,7 +51,7 @@ type EnvelopeKeysService = {
    * key, to derive a key per purpose from with `deriveKey`. Kept for the
    * cache's TTL; callers asking while it is being unwrapped share one request.
    */
-  readonly rootKey: (generation: KeyGeneration) => AsyncResult<CryptoKey, KeyErased | KeysUnavailable>;
+  readonly rootKey: (generation: KeyGeneration) => AsyncResult<webcrypto.CryptoKey, KeyErased | KeysUnavailable>;
   /**
    * A new generation under the owner's key, for the application to keep.
    * Rotation is provisioning another key id; the old generations stay

package/dist/{keys-DpvmIcWy.d.mts → keys-B_EdZt6c.d.mts}

@@ -1,3 +1,4 @@
+import { webcrypto } from "node:crypto";
 import { AsyncResult } from "unthrown";
 //#region src/keys.d.ts
 /**
@@ -50,7 +51,7 @@ type EnvelopeKeysService = {
    * key, to derive a key per purpose from with `deriveKey`. Kept for the
    * cache's TTL; callers asking while it is being unwrapped share one request.
    */
-  readonly rootKey: (generation: KeyGeneration) => AsyncResult<CryptoKey, KeyErased | KeysUnavailable>;
+  readonly rootKey: (generation: KeyGeneration) => AsyncResult<webcrypto.CryptoKey, KeyErased | KeysUnavailable>;
   /**
    * A new generation under the owner's key, for the application to keep.
    * Rotation is provisioning another key id; the old generations stay

package/dist/kms.cjs

@@ -1,5 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_keys = require("./keys-DtMnWJHq.cjs");
+let node_crypto = require("node:crypto");
 let unthrown = require("unthrown");
 let _btravstack_di = require("@btravstack/di");
 let _aws_sdk_client_kms = require("@aws-sdk/client-kms");
@@ -134,7 +135,7 @@ const kmsEnvelopeKeys = (client, config, observers, clock) => {
 			}
 		}))).flatMap(({ Plaintext }) => {
 			const plaintext = Plaintext;
-			return (0, unthrown.fromSafePromise)(crypto.subtle.importKey("raw", plaintext, "HKDF", false, ["deriveKey", "deriveBits"]).finally(() => plaintext.fill(0)));
+			return (0, unthrown.fromSafePromise)(node_crypto.webcrypto.subtle.importKey("raw", plaintext, "HKDF", false, ["deriveKey", "deriveBits"]).finally(() => plaintext.fill(0)));
 		})).tap((root) => {
 			inFlight.delete(entry);
 			const now = clock.now();

package/dist/kms.d.cts

@@ -1,4 +1,4 @@
-import { t as EnvelopeKeys } from "./keys-DpvmIcWy.cjs";
+import { t as EnvelopeKeys } from "./keys-B_EdZt6c.cjs";
 import { ConfigInvalid, EnvReading } from "@btravstack/config";
 import { Clock } from "@btravstack/core";
 import { Module, Scope } from "@btravstack/di";

package/dist/kms.d.mts

@@ -1,4 +1,4 @@
-import { t as EnvelopeKeys } from "./keys-DpvmIcWy.mjs";
+import { t as EnvelopeKeys } from "./keys-B_EdZt6c.mjs";
 import { Module, Scope } from "@btravstack/di";
 import { ConfigInvalid, EnvReading } from "@btravstack/config";
 import { Clock } from "@btravstack/core";

package/dist/kms.mjs

@@ -1,4 +1,5 @@
 import { n as KeyErased, r as KeysUnavailable, t as EnvelopeKeys } from "./keys-CGbVjuu3.mjs";
+import { webcrypto } from "node:crypto";
 import { Err, Ok, OkAsync, P, fromPromise, fromSafePromise } from "unthrown";
 import { Module, Port, Provider } from "@btravstack/di";
 import { DecryptCommand, DescribeKeyCommand, GenerateDataKeyWithoutPlaintextCommand, KMSClient, ScheduleKeyDeletionCommand } from "@aws-sdk/client-kms";
@@ -133,7 +134,7 @@ const kmsEnvelopeKeys = (client, config, observers, clock) => {
 			}
 		}))).flatMap(({ Plaintext }) => {
 			const plaintext = Plaintext;
-			return fromSafePromise(crypto.subtle.importKey("raw", plaintext, "HKDF", false, ["deriveKey", "deriveBits"]).finally(() => plaintext.fill(0)));
+			return fromSafePromise(webcrypto.subtle.importKey("raw", plaintext, "HKDF", false, ["deriveKey", "deriveBits"]).finally(() => plaintext.fill(0)));
 		})).tap((root) => {
 			inFlight.delete(entry);
 			const now = clock.now();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@btravstack/keys",
-  "version": "0.45.0",
+  "version": "0.46.0",
   "description": "An EnvelopeKeys port for @btravstack/core: per-owner root keys wrapped by an AWS KMS key of that owner, unwrapped in memory and cached for a TTL, erased with one key deletion, and an HKDF helper giving each purpose its own key",
   "keywords": [
     "crypto-shredding",
@@ -55,11 +55,11 @@
   },
   "devDependencies": {
     "@aws-sdk/client-kms": "3.1152.0",
-    "@btravstack/config": "0.45.0",
-    "@btravstack/core": "0.45.0",
-    "@btravstack/di": "0.45.0",
+    "@btravstack/config": "0.46.0",
+    "@btravstack/core": "0.46.0",
+    "@btravstack/di": "0.46.0",
     "@btravstack/internal-test-infra": "0.0.0",
-    "@btravstack/testing": "0.45.0",
+    "@btravstack/testing": "0.46.0",
     "@btravstack/tsconfig": "0.4.0",
     "@types/node": "26.6.5",
     "@unthrown/vitest": "5.12.1",
@@ -71,9 +71,9 @@
   },
   "peerDependencies": {
     "@aws-sdk/client-kms": "^3.1000.0",
-    "@btravstack/config": "^0.45.0",
-    "@btravstack/core": "^0.45.0",
-    "@btravstack/di": "^0.45.0",
+    "@btravstack/config": "^0.46.0",
+    "@btravstack/core": "^0.46.0",
+    "@btravstack/di": "^0.46.0",
     "unthrown": "^5.0.0"
   },
   "peerDependenciesMeta": {