@credo-ts/askar 0.7.2-pr-2704-20260925144545 → 0.7.2

package/build/kms/AskarKeyManagementService.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"AskarKeyManagementService.d.mts","names":[],"sources":["../../src/kms/AskarKeyManagementService.ts"],"mappings":";;qBA+Ba,qCAAqC,IAAI;kBAC7B;WACP;iBAED;UAQP;EAID,qBAAqB,eAAe,cAAc,WAAW,IAAI;EA2EjE,YAAY,eAAe,cAAc,SAAS,IAAI,wBAAwB,IAAI;EAI5E,aAAa,cAAc,cAAc,gBAAgB,QAAQ,IAAI;EAOrE,UAAU,YAAY,IAAI,eACrC,cAAc,cACd,SAAS,IAAI,oBAAoB,OAChC,QAAQ,IAAI,mBAAmB;EAsDrB,UAAU,cAAc,cAAc,SAAS,IAAI,sBAAsB;EAczE,UAAU,aAAa,IAAI,kBACtC,cAAc,cACd,SAAS,IAAI,oBAAoB,QAChC,QAAQ,IAAI,mBAAmB;EAqErB,KAAK,cAAc,cAAc,SAAS,IAAI,iBAAiB,QAAQ,IAAI;EAsC3E,OAAO,cAAc,cAAc,SAAS,IAAI,mBAAmB,QAAQ,IAAI;EAqE/E,QAAQ,cAAc,cAAc,SAAS,IAAI,oBAAoB,QAAQ,IAAI;EAyMjF,QAAQ,cAAc,cAAc,SAAS,IAAI,oBAAoB,QAAQ,IAAI;UAyNtF;UAYA;UASA;UAYA;UAeA;UAoBA;UAkBM;UAuBA;UASN"}
+{"version":3,"file":"AskarKeyManagementService.d.mts","names":[],"sources":["../../src/kms/AskarKeyManagementService.ts"],"mappings":";;qBA0Ba,qCAAqC,IAAI;kBAC7B;WACP;iBAED;UAQP;EAID,qBAAqB,eAAe,cAAc,WAAW,IAAI;EA2EjE,YAAY,eAAe,cAAc,SAAS,IAAI,wBAAwB,IAAI;EAI5E,aAAa,cAAc,cAAc,gBAAgB,QAAQ,IAAI;EAOrE,UAAU,YAAY,IAAI,eACrC,cAAc,cACd,SAAS,IAAI,oBAAoB,OAChC,QAAQ,IAAI,mBAAmB;EAsDrB,UAAU,cAAc,cAAc,SAAS,IAAI,sBAAsB;EAczE,UAAU,aAAa,IAAI,kBACtC,cAAc,cACd,SAAS,IAAI,oBAAoB,QAChC,QAAQ,IAAI,mBAAmB;EAqErB,KAAK,cAAc,cAAc,SAAS,IAAI,iBAAiB,QAAQ,IAAI;EAsC3E,OAAO,cAAc,cAAc,SAAS,IAAI,mBAAmB,QAAQ,IAAI;EAqE/E,QAAQ,cAAc,cAAc,SAAS,IAAI,oBAAoB,QAAQ,IAAI;EA+KjF,QAAQ,cAAc,cAAc,SAAS,IAAI,oBAAoB,QAAQ,IAAI;UA2LtF;UAYA;UASA;UAYA;UAeA;UAoBA;UAkBM;UAuBA;UASN"}

package/build/kms/AskarKeyManagementService.mjs

@@ -4,8 +4,8 @@ import { jwkCrvToAskarAlg, jwkEncToAskarAlg } from "../utils/askarKeyTypes.mjs";
 import "../utils/index.mjs";
 import { AskarStoreManager } from "../AskarStoreManager.mjs";
 import { aeadDecrypt } from "./crypto/decrypt.mjs";
+import { askarSupportedKeyAgreementAlgorithms, deriveDecryptionKey, deriveEncryptionKey } from "./crypto/deriveKey.mjs";
 import { aeadEncrypt } from "./crypto/encrypt.mjs";
-import { askarSupportedKeyAgreementAlgorithms, deriveDecryptionKey, deriveEncryptionKey, encryptEcdh1Pu } from "./crypto/deriveKey.mjs";
 import { askarSupportedHpkeAlgorithms, hpkeOpen, hpkeSeal } from "./crypto/hpke.mjs";
 import { randomBytes } from "./crypto/randomBytes.mjs";
 import { JsonEncoder, Kms, TypedArrayEncoder, utils } from "@credo-ts/core";
@@ -243,7 +243,7 @@ var AskarKeyManagementService = class AskarKeyManagementService {
 					Kms.assertJwkAsymmetric(privateJwk, key.keyAgreement.keyId);
 					Kms.assertAllowedKeyDerivationAlgForKey(privateJwk, key.keyAgreement.algorithm);
 					Kms.assertKeyAllowsDerive(privateJwk);
-					if (key.keyAgreement.algorithm !== "ECDH-HSALSA20" && key.keyAgreement.algorithm !== "ECDH-1PU+A256KW") Kms.assertAsymmetricJwkKeyTypeMatches(privateJwk, key.keyAgreement.externalPublicJwk);
+					if (key.keyAgreement.algorithm !== "ECDH-HSALSA20") Kms.assertAsymmetricJwkKeyTypeMatches(privateJwk, key.keyAgreement.externalPublicJwk);
 				}
 				const recipientKey = this.keyFromJwk(agentContext, key.keyAgreement.externalPublicJwk);
 				keysToFree.push(recipientKey);
@@ -269,26 +269,6 @@ var AskarKeyManagementService = class AskarKeyManagementService {
 					};
 				}
 				if (!privateKey) throw new Kms.KeyManagementError("sender key is required for ECDH-ES key derivation.");
-				if (key.keyAgreement.algorithm === "ECDH-1PU+A256KW" && privateKey.algorithm === KeyAlgorithm.Ed25519) {
-					privateKey = privateKey.convertkey({ algorithm: KeyAlgorithm.X25519 });
-					keysToFree.push(privateKey);
-				}
-				if (key.keyAgreement.algorithm === "ECDH-1PU+A256KW") {
-					let ephemeralKey;
-					if ("ephemeralKeyId" in key.keyAgreement && key.keyAgreement.ephemeralKeyId) {
-						ephemeralKey = (await this.getKeyAsserted(agentContext, key.keyAgreement.ephemeralKeyId)).key;
-						keysToFree.push(ephemeralKey);
-					}
-					return encryptEcdh1Pu({
-						askar: this.getAskar(agentContext),
-						keyAgreement: key.keyAgreement,
-						encryption,
-						senderKey: privateKey,
-						recipientKey,
-						data,
-						ephemeralKey
-					});
-				}
 				const { contentEncryptionKey, encryptedContentEncryptionKey } = deriveEncryptionKey({
 					askar: this.getAskar(agentContext),
 					encryption,
@@ -359,11 +339,10 @@ var AskarKeyManagementService = class AskarKeyManagementService {
 				decryptionKey = this.keyFromSecretBytesAndEncryptionAlgorithm(TypedArrayEncoder.fromBase64Url(key.privateJwk.k), decryption.algorithm);
 				keysToFree.push(decryptionKey);
 			} else if (key.keyAgreement) {
-				const externalPublicJwk = key.keyAgreement.algorithm === "ECDH-1PU+A256KW" || !("externalPublicJwk" in key.keyAgreement) ? void 0 : key.keyAgreement.externalPublicJwk;
 				Kms.assertSupportedKeyAgreementAlgorithm(key.keyAgreement, askarSupportedKeyAgreementAlgorithms, this.backend);
-				if (externalPublicJwk) {
-					Kms.assertAllowedKeyDerivationAlgForKey(externalPublicJwk, key.keyAgreement.algorithm);
-					Kms.assertKeyAllowsDerive(externalPublicJwk);
+				if (key.keyAgreement.externalPublicJwk) {
+					Kms.assertAllowedKeyDerivationAlgForKey(key.keyAgreement.externalPublicJwk, key.keyAgreement.algorithm);
+					Kms.assertKeyAllowsDerive(key.keyAgreement.externalPublicJwk);
 				}
 				let privateKey = (await this.getKeyAsserted(agentContext, key.keyAgreement.keyId)).key;
 				keysToFree.push(privateKey);
@@ -371,19 +350,9 @@ var AskarKeyManagementService = class AskarKeyManagementService {
 				Kms.assertJwkAsymmetric(privateJwk, key.keyAgreement.keyId);
 				Kms.assertAllowedKeyDerivationAlgForKey(privateJwk, key.keyAgreement.algorithm);
 				Kms.assertKeyAllowsDerive(privateJwk);
-				const isEd25519Private = privateJwk.kty === "OKP" && privateJwk.crv === "Ed25519";
-				if (externalPublicJwk && key.keyAgreement.algorithm !== "ECDH-HSALSA20" && !(key.keyAgreement.algorithm.startsWith("ECDH-ES") && isEd25519Private)) Kms.assertAsymmetricJwkKeyTypeMatches(privateJwk, externalPublicJwk);
-				let senderKey;
-				let ephemeralKey;
-				if (key.keyAgreement.algorithm === "ECDH-1PU+A256KW") {
-					const agreement = key.keyAgreement;
-					ephemeralKey = this.keyFromJwk(agentContext, agreement.ephemeralPublicJwk);
-					senderKey = this.keyFromJwk(agentContext, agreement.senderPublicJwk);
-					keysToFree.push(ephemeralKey, senderKey);
-				} else {
-					senderKey = externalPublicJwk ? this.keyFromJwk(agentContext, externalPublicJwk) : void 0;
-					if (senderKey) keysToFree.push(senderKey);
-				}
+				if (key.keyAgreement.externalPublicJwk && key.keyAgreement.algorithm !== "ECDH-HSALSA20") Kms.assertAsymmetricJwkKeyTypeMatches(privateJwk, key.keyAgreement.externalPublicJwk);
+				const senderKey = key.keyAgreement.externalPublicJwk ? this.keyFromJwk(agentContext, key.keyAgreement.externalPublicJwk) : void 0;
+				if (senderKey) keysToFree.push(senderKey);
 				if (key.keyAgreement.algorithm === "ECDH-HSALSA20" || decryption.algorithm === "XSALSA20-POLY1305") {
 					if (decryption.algorithm !== "XSALSA20-POLY1305" || key.keyAgreement.algorithm !== "ECDH-HSALSA20") throw new Kms.KeyManagementAlgorithmNotSupportedError(`key agreement algorithm '${key.keyAgreement.algorithm}' with encryption algorithm '${decryption.algorithm}'`, this.backend);
 					if (privateKey.algorithm === KeyAlgorithm.Ed25519) {
@@ -403,17 +372,12 @@ var AskarKeyManagementService = class AskarKeyManagementService {
 					})) };
 				}
 				if (!senderKey) throw new Kms.KeyManagementError("sender key is required for ECDH-ES key derivation.");
-				if ((key.keyAgreement.algorithm === "ECDH-1PU+A256KW" || key.keyAgreement.algorithm === "ECDH-ES+A256KW" || key.keyAgreement.algorithm === "ECDH-ES+A128KW" || key.keyAgreement.algorithm === "ECDH-ES") && privateKey.algorithm === KeyAlgorithm.Ed25519) {
-					privateKey = privateKey.convertkey({ algorithm: KeyAlgorithm.X25519 });
-					keysToFree.push(privateKey);
-				}
 				const { contentEncryptionKey } = deriveDecryptionKey({
 					askar: this.getAskar(agentContext),
 					decryption,
 					keyAgreement: key.keyAgreement,
 					recipientKey: privateKey,
-					senderKey,
-					ephemeralKey
+					senderKey
 				});
 				decryptionKey = contentEncryptionKey;
 				keysToFree.push(contentEncryptionKey);

package/build/kms/AskarKeyManagementService.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"AskarKeyManagementService.mjs","names":[],"sources":["../../src/kms/AskarKeyManagementService.ts"],"sourcesContent":["import { type AgentContext, JsonEncoder, Kms, TypedArrayEncoder, utils } from '@credo-ts/core'\nimport type { JwkProps, KeyEntryObject, Session } from '@openwallet-foundation/askar-shared'\nimport {\n  CryptoBox,\n  Jwk,\n  Key,\n  KeyAlgorithm,\n  KeyEntryList,\n  SignatureAlgorithm,\n} from '@openwallet-foundation/askar-shared'\nimport { AskarModuleConfig } from '../AskarModuleConfig'\nimport { AskarStoreManager } from '../AskarStoreManager'\nimport { AskarErrorCode, isAskarError, jwkCrvToAskarAlg, jwkEncToAskarAlg } from '../utils'\nimport { aeadDecrypt } from './crypto/decrypt'\nimport {\n  askarSupportedKeyAgreementAlgorithms,\n  deriveDecryptionKey,\n  deriveEncryptionKey,\n  encryptEcdh1Pu,\n} from './crypto/deriveKey'\nimport { type AskarSupportedEncryptionOptions, aeadEncrypt } from './crypto/encrypt'\nimport { askarSupportedHpkeAlgorithms, hpkeOpen, hpkeSeal } from './crypto/hpke'\nimport { randomBytes } from './crypto/randomBytes'\n\nconst askarSymmetricKeyAlgorithms: KeyAlgorithm[] = Object.values(jwkEncToAskarAlg)\n\nconst askarSupportedEncryptionAlgorithms = [\n  ...(Object.keys(jwkEncToAskarAlg) as Array<keyof typeof jwkEncToAskarAlg>),\n  'XSALSA20-POLY1305',\n] satisfies Array<Kms.KnownJwaContentEncryptionAlgorithm | Kms.KnownJwaKeyEncryptionAlgorithm>\n\nexport class AskarKeyManagementService implements Kms.KeyManagementService {\n  public static readonly backend = 'askar'\n  public readonly backend = AskarKeyManagementService.backend\n\n  private static algToSigType: Partial<Record<Kms.KnownJwaSignatureAlgorithm, SignatureAlgorithm>> = {\n    EdDSA: SignatureAlgorithm.EdDSA,\n    Ed25519: SignatureAlgorithm.EdDSA,\n    ES256K: SignatureAlgorithm.ES256K,\n    ES256: SignatureAlgorithm.ES256,\n    ES384: SignatureAlgorithm.ES384,\n  }\n\n  private withSession<Return>(agentContext: AgentContext, callback: (session: Session) => Return) {\n    return agentContext.dependencyManager.resolve(AskarStoreManager).withSession(agentContext, callback)\n  }\n\n  public isOperationSupported(_agentContext: AgentContext, operation: Kms.KmsOperation): boolean {\n    if (operation.operation === 'deleteKey') return true\n    if (operation.operation === 'randomBytes') return true\n\n    if (operation.operation === 'importKey') {\n      if (operation.privateJwk.kty === 'EC' || operation.privateJwk.kty === 'OKP') {\n        return jwkCrvToAskarAlg[operation.privateJwk.crv] !== undefined\n      }\n\n      // RSA/oct not supported\n      return false\n    }\n\n    if (operation.operation === 'createKey') {\n      if (operation.type.kty === 'EC' || operation.type.kty === 'OKP') {\n        return jwkCrvToAskarAlg[operation.type.crv] !== undefined\n      }\n\n      if (operation.type.kty === 'oct') {\n        if (operation.type.algorithm === 'C20P') return true\n\n        // TODO: sync with the createKey code\n        if (operation.type.algorithm === 'aes') {\n          return [128, 256].includes(operation.type.length)\n        }\n      }\n\n      return false\n    }\n\n    if (operation.operation === 'sign' || operation.operation === 'verify') {\n      return AskarKeyManagementService.algToSigType[operation.algorithm] !== undefined\n    }\n\n    if (operation.operation === 'encrypt' || operation.operation === 'decrypt') {\n      const encryption = operation.operation === 'encrypt' ? operation.encryption : operation.decryption\n\n      // Askar can only perform key agreement with curves it supports. We also can't create the\n      // ephemeral key for e.g. ECDH-ES if the curve is not supported.\n      if (\n        operation.keyAgreement &&\n        'externalPublicJwk' in operation.keyAgreement &&\n        operation.keyAgreement.externalPublicJwk &&\n        jwkCrvToAskarAlg[operation.keyAgreement.externalPublicJwk.crv] === undefined\n      ) {\n        return false\n      }\n\n      // HPKE is an integrated encryption mode: the suite fixes the AEAD, so the HPKE key agreement\n      // algorithm is all there is to check.\n      if (encryption.algorithm === 'HPKE') {\n        if (!operation.keyAgreement || !Kms.isJwaHpkeAlgorithm(operation.keyAgreement.algorithm)) return false\n\n        return askarSupportedHpkeAlgorithms.includes(\n          operation.keyAgreement.algorithm as (typeof askarSupportedHpkeAlgorithms)[number]\n        )\n      }\n\n      if (\n        !askarSupportedEncryptionAlgorithms.includes(\n          encryption.algorithm as (typeof askarSupportedEncryptionAlgorithms)[number]\n        )\n      ) {\n        return false\n      }\n      if (!operation.keyAgreement) return true\n\n      return askarSupportedKeyAgreementAlgorithms.includes(\n        operation.keyAgreement.algorithm as (typeof askarSupportedKeyAgreementAlgorithms)[number]\n      )\n    }\n\n    return false\n  }\n\n  public randomBytes(_agentContext: AgentContext, options: Kms.KmsRandomBytesOptions): Kms.KmsRandomBytesReturn {\n    return randomBytes(options.length)\n  }\n\n  public async getPublicKey(agentContext: AgentContext, keyId: string): Promise<Kms.KmsJwkPublic | null> {\n    const key = await this.fetchAskarKey(agentContext, keyId)\n    if (!key) return null\n\n    return this.publicJwkFromKey(agentContext, key.key, { kid: keyId })\n  }\n\n  public async importKey<Jwk extends Kms.KmsJwkPrivate>(\n    agentContext: AgentContext,\n    options: Kms.KmsImportKeyOptions<Jwk>\n  ): Promise<Kms.KmsImportKeyReturn<Jwk>> {\n    const { kid } = options.privateJwk\n\n    const privateJwk = {\n      ...options.privateJwk,\n      kid: kid ?? utils.uuid(),\n    }\n\n    let key: Key | undefined\n    try {\n      if (privateJwk.kty === 'oct') {\n        // TODO: we need to look at how to import symmetric keys, as we need the alg\n        // Should we do the same as we do for createKey?\n        throw new Kms.KeyManagementAlgorithmNotSupportedError(\n          `importing keys with kty '${privateJwk.kty}'`,\n          this.backend\n        )\n      }\n      if (privateJwk.kty === 'EC' || privateJwk.kty === 'OKP') {\n        // Throws error if not supported\n        this.assertAskarAlgForJwkCrv(privateJwk.kty, privateJwk.crv)\n\n        key = Key.fromJwk({ jwk: Jwk.fromJson(privateJwk) })\n      }\n\n      const _key = key\n      if (!_key) {\n        throw new Kms.KeyManagementAlgorithmNotSupportedError(`kty '${privateJwk.kty}'`, this.backend)\n      }\n\n      await this.withSession(agentContext, (session) => session.insertKey({ name: privateJwk.kid, key: _key }))\n      const publicJwk = Kms.publicJwkFromPrivateJwk(privateJwk)\n\n      return {\n        keyId: privateJwk.kid,\n        publicJwk: {\n          ...publicJwk,\n          kid: privateJwk.kid,\n        },\n      } as Kms.KmsImportKeyReturn<Jwk>\n    } catch (error) {\n      if (error instanceof Kms.KeyManagementError) throw error\n\n      // Handle case where key already exists\n      if (isAskarError(error, AskarErrorCode.Duplicate)) {\n        throw new Kms.KeyManagementKeyExistsError(privateJwk.kid, this.backend)\n      }\n\n      throw new Kms.KeyManagementError('Error importing key', { cause: error })\n    } finally {\n      key?.handle.free()\n    }\n  }\n\n  public async deleteKey(agentContext: AgentContext, options: Kms.KmsDeleteKeyOptions): Promise<boolean> {\n    try {\n      await this.withSession(agentContext, (session) => session.removeKey({ name: options.keyId }))\n      return true\n    } catch (error) {\n      // Handle case where key does not exist\n      if (isAskarError(error, AskarErrorCode.NotFound)) {\n        return false\n      }\n\n      throw new Kms.KeyManagementError(`Error deleting key with id '${options.keyId}'`, { cause: error })\n    }\n  }\n\n  public async createKey<Type extends Kms.KmsCreateKeyType>(\n    agentContext: AgentContext,\n    options: Kms.KmsCreateKeyOptions<Type>\n  ): Promise<Kms.KmsCreateKeyReturn<Type>> {\n    const { type, keyId } = options\n\n    // FIXME: we should maybe keep the default keyId as publicKeyBase58 for a while for now, so it doesn't break\n    // Or we need a way to query a key based on the public key?\n    const kid = keyId ?? utils.uuid()\n    let askarKey: Key | undefined\n    try {\n      if (type.kty === 'EC' || type.kty === 'OKP') {\n        const keyAlg = this.assertAskarAlgForJwkCrv(type.kty, type.crv)\n        askarKey = Key.generate(keyAlg)\n      } else if (type.kty === 'oct') {\n        // NOTE: askar is more specific in the intended use of the key at time of generation.\n        // We either need to allow for this on a higher level (should be possible using `alg`)\n        // but as the keys are the same it's ok to just always pick one and if used for another\n        // purpose we can see them as the same.\n        if (type.algorithm === 'aes') {\n          const lengthToKeyAlg: Record<number, KeyAlgorithm | undefined> = {\n            128: KeyAlgorithm.AesA128Gcm,\n            256: KeyAlgorithm.AesA256Gcm,\n            512: KeyAlgorithm.AesA256CbcHs512,\n          }\n\n          const keyAlg = lengthToKeyAlg[type.length]\n          if (!keyAlg) {\n            throw new Kms.KeyManagementAlgorithmNotSupportedError(\n              `length '${type.length}' for kty '${type.kty}' with algorithm '${type.algorithm}'. Supported length values are ${Object.keys(lengthToKeyAlg).join(', ')}`,\n              this.backend\n            )\n          }\n\n          askarKey = Key.generate(keyAlg)\n        } else if (type.algorithm === 'C20P') {\n          // Both X and non-X variant can be used with the same key\n          askarKey = Key.generate(KeyAlgorithm.Chacha20C20P)\n        } else {\n          throw new Kms.KeyManagementAlgorithmNotSupportedError(\n            `algorithm '${type.algorithm}' for kty '${type.kty}'`,\n            this.backend\n          )\n        }\n      }\n\n      const _key = askarKey\n      if (!_key) {\n        throw new Kms.KeyManagementAlgorithmNotSupportedError(`kty '${type.kty}'`, this.backend)\n      }\n\n      const publicJwk = this.publicJwkFromKey(agentContext, _key, { kid }) as Kms.KmsCreateKeyReturn<Type>['publicJwk']\n      await this.withSession(agentContext, (session) => session.insertKey({ name: kid, key: _key }))\n\n      return {\n        publicJwk,\n        keyId: kid,\n      } as Kms.KmsCreateKeyReturn<Type>\n    } catch (error) {\n      if (error instanceof Kms.KeyManagementError) throw error\n\n      // Handle case where key already exists\n      if (isAskarError(error, AskarErrorCode.Duplicate)) {\n        throw new Kms.KeyManagementKeyExistsError(kid, this.backend)\n      }\n\n      throw new Kms.KeyManagementError('Error creating key', { cause: error })\n    } finally {\n      askarKey?.handle.free()\n    }\n  }\n\n  public async sign(agentContext: AgentContext, options: Kms.KmsSignOptions): Promise<Kms.KmsSignReturn> {\n    const { keyId, algorithm, data } = options\n\n    // 1. Retrieve the key\n    const key = await this.getKeyAsserted(agentContext, keyId)\n    try {\n      const sigType = this.assertedSigTypeForAlg(algorithm)\n      // Askar has a bug with loading symmetric keys, but we shouldn't get here as I don't think askar\n      // support signing with symmetric keys, and we don't support it (it will be caught by assertedSigTypeForAlg)\n      if (!key.key) {\n        throw new Kms.KeyManagementAlgorithmNotSupportedError(`algorithm ${algorithm}`, this.backend)\n      }\n\n      // TODO: we should extend this with metadata properties (e.g. use, key_ops)\n      const publicJwk = this.publicJwkFromKey(agentContext, key.key, { kid: keyId })\n      const privateJwk = this.privateJwkFromKey(agentContext, key.key, { kid: keyId })\n\n      // 2. Validate alg and use for key\n      Kms.assertAllowedSigningAlgForKey(privateJwk, algorithm)\n      Kms.assertKeyAllowsSign(publicJwk)\n\n      // 3. Perform the signing operation\n      const signature = key.key.signMessage({\n        message: new Uint8Array(data),\n        sigType,\n      })\n\n      return {\n        signature: new Uint8Array(signature),\n      }\n    } catch (error) {\n      if (error instanceof Kms.KeyManagementError) throw error\n      throw new Kms.KeyManagementError('Error signing with key', { cause: error })\n    } finally {\n      key.key?.handle.free()\n    }\n  }\n\n  public async verify(agentContext: AgentContext, options: Kms.KmsVerifyOptions): Promise<Kms.KmsVerifyReturn> {\n    const { algorithm, data, signature, key: keyInput } = options\n\n    // Get askar sig type (and handles unsupported alg)\n    const sigType = this.assertedSigTypeForAlg(algorithm)\n\n    // Retrieve the key\n    let askarKey: Key | undefined\n\n    try {\n      if (keyInput.keyId) {\n        askarKey = (await this.getKeyAsserted(agentContext, keyInput.keyId)).key\n      } else if (keyInput.publicJwk?.kty === 'EC' || keyInput.publicJwk?.kty === 'OKP') {\n        // Throws error if not supported\n        this.assertAskarAlgForJwkCrv(keyInput.publicJwk.kty, keyInput.publicJwk.crv)\n\n        askarKey = Key.fromJwk({ jwk: Jwk.fromJson(keyInput.publicJwk as JwkProps) })\n      } else {\n        throw new Kms.KeyManagementAlgorithmNotSupportedError(`kty ${keyInput.publicJwk?.kty}`, this.backend)\n      }\n\n      // Askar has a bug with loading symmetric keys, but we shouldn't get here as I don't think askar\n      // support signing with symmetric keys, and we don't support it (it will be caught by assertedSigTypeForAlg)\n      if (!askarKey) {\n        throw new Kms.KeyManagementAlgorithmNotSupportedError(`algorithm ${algorithm}`, this.backend)\n      }\n\n      const keyId = keyInput.keyId ?? keyInput.publicJwk?.kid\n      const publicJwk = this.publicJwkFromKey(agentContext, askarKey, { kid: keyId })\n\n      // For symmetric verificdation we need the private key\n      if (publicJwk.kty === 'oct') {\n        const privateJwk = this.privateJwkFromKey(agentContext, askarKey, { kid: keyId })\n\n        // 2. Validate alg and use for key\n        Kms.assertAllowedSigningAlgForKey(privateJwk, algorithm)\n        Kms.assertKeyAllowsVerify(publicJwk)\n      } else {\n        // 2. Validate alg and use for key\n        Kms.assertAllowedSigningAlgForKey(publicJwk, algorithm)\n        Kms.assertKeyAllowsVerify(publicJwk)\n      }\n\n      // 4. Perform the verify operation\n      const verified = askarKey.verifySignature({\n        message: new Uint8Array(data),\n        signature: new Uint8Array(signature),\n        sigType,\n      })\n      if (verified) {\n        return {\n          verified: true,\n          publicJwk: keyInput.keyId\n            ? this.publicJwkFromKey(agentContext, askarKey, { kid: keyId })\n            : (keyInput.publicJwk as Kms.KmsJwkPublic),\n        }\n      }\n\n      return {\n        verified: false,\n      }\n    } catch (error) {\n      if (error instanceof Kms.KeyManagementError) throw error\n      throw new Kms.KeyManagementError('Error verifying with key', { cause: error })\n    } finally {\n      if (askarKey) askarKey.handle.free()\n    }\n  }\n\n  public async encrypt(agentContext: AgentContext, options: Kms.KmsEncryptOptions): Promise<Kms.KmsEncryptReturn> {\n    const { data, encryption, key } = options\n\n    if (encryption.algorithm === 'HPKE') {\n      if (!key.keyAgreement || !Kms.isKmsKeyAgreementEncryptHpke(key.keyAgreement)) {\n        throw new Kms.KeyManagementError(\n          `Encryption algorithm 'HPKE' can only be used with an integrated-encryption HPKE key agreement algorithm`\n        )\n      }\n\n      const { keyAgreement } = key\n      Kms.assertAllowedKeyDerivationAlgForKey(keyAgreement.externalPublicJwk, keyAgreement.algorithm)\n      Kms.assertKeyAllowsDerive(keyAgreement.externalPublicJwk)\n\n      try {\n        return await hpkeSeal({\n          algorithm: keyAgreement.algorithm,\n          recipientPublicJwk: keyAgreement.externalPublicJwk,\n          data,\n          info: keyAgreement.info,\n          aad: encryption.aad,\n        })\n      } catch (error) {\n        if (error instanceof Kms.KeyManagementError) throw error\n        throw new Kms.KeyManagementError('Error encrypting with key', { cause: error })\n      }\n    }\n\n    Kms.assertSupportedEncryptionAlgorithm(encryption, askarSupportedEncryptionAlgorithms, this.backend)\n\n    const keysToFree: Key[] = []\n    try {\n      let encryptionKey: Key | undefined\n      let encryptedKey: Kms.KmsEncryptedKey | undefined\n\n      // TODO: we should check if the key allows this operation\n      if (key.keyId) {\n        encryptionKey = (await this.getKeyAsserted(agentContext, key.keyId)).key\n\n        keysToFree.push(encryptionKey)\n      } else if (key.privateJwk) {\n        if (encryption.algorithm === 'XSALSA20-POLY1305') {\n          throw new Kms.KeyManagementAlgorithmNotSupportedError(\n            `encryption algorithm '${encryption.algorithm}' is only supported in combination with key agreement algorithm '${Kms.KnownJwaKeyAgreementAlgorithms.ECDH_HSALSA20}'`,\n            this.backend\n          )\n        }\n        encryptionKey = this.keyFromSecretBytesAndEncryptionAlgorithm(\n          TypedArrayEncoder.fromBase64Url(key.privateJwk.k),\n          encryption.algorithm\n        )\n        keysToFree.push(encryptionKey)\n      } else if (key.keyAgreement) {\n        Kms.assertAllowedKeyDerivationAlgForKey(key.keyAgreement.externalPublicJwk, key.keyAgreement.algorithm)\n        Kms.assertKeyAllowsDerive(key.keyAgreement.externalPublicJwk)\n        Kms.assertSupportedKeyAgreementAlgorithm(key.keyAgreement, askarSupportedKeyAgreementAlgorithms, this.backend)\n\n        let privateKey = key.keyAgreement.keyId\n          ? (await this.getKeyAsserted(agentContext, key.keyAgreement.keyId)).key\n          : undefined\n        if (privateKey) keysToFree.push(privateKey)\n\n        const privateJwk = privateKey ? this.privateJwkFromKey(agentContext, privateKey) : undefined\n        if (privateJwk) {\n          Kms.assertJwkAsymmetric(privateJwk, key.keyAgreement.keyId)\n          Kms.assertAllowedKeyDerivationAlgForKey(privateJwk, key.keyAgreement.algorithm)\n          Kms.assertKeyAllowsDerive(privateJwk)\n\n          // Special case: DIDComm v1/v2 often use X25519 for the recipient but Ed25519 for our key (we convert to X25519)\n          if (key.keyAgreement.algorithm !== 'ECDH-HSALSA20' && key.keyAgreement.algorithm !== 'ECDH-1PU+A256KW') {\n            Kms.assertAsymmetricJwkKeyTypeMatches(privateJwk, key.keyAgreement.externalPublicJwk)\n          }\n        }\n\n        const recipientKey = this.keyFromJwk(agentContext, key.keyAgreement.externalPublicJwk)\n        keysToFree.push(recipientKey)\n\n        // Special case to support DIDComm v1\n        if (key.keyAgreement.algorithm === 'ECDH-HSALSA20' || encryption.algorithm === 'XSALSA20-POLY1305') {\n          if (encryption.algorithm !== 'XSALSA20-POLY1305' || key.keyAgreement.algorithm !== 'ECDH-HSALSA20') {\n            throw new Kms.KeyManagementAlgorithmNotSupportedError(\n              `key agreement algorithm '${key.keyAgreement.algorithm}' with encryption algorithm '${encryption.algorithm}'`,\n              this.backend\n            )\n          }\n\n          // anonymous encryption\n          if (!privateKey) {\n            return {\n              encrypted: new Uint8Array(\n                CryptoBox.seal({\n                  recipientKey,\n                  message: new Uint8Array(data),\n                })\n              ),\n            }\n          }\n\n          // Special case. For DIDComm v1 we basically use the Ed25519 key also\n          // for X25519 operations.\n          if (privateKey.algorithm === KeyAlgorithm.Ed25519) {\n            privateKey = privateKey.convertkey({ algorithm: KeyAlgorithm.X25519 })\n            keysToFree.push(privateKey)\n          }\n\n          const nonce = new Uint8Array(CryptoBox.randomNonce())\n          const encrypted = new Uint8Array(\n            CryptoBox.cryptoBox({\n              recipientKey,\n              senderKey: privateKey,\n              message: new Uint8Array(data),\n              nonce,\n            })\n          )\n\n          return {\n            encrypted,\n            iv: nonce,\n          }\n        }\n\n        // This should not happen, but for TS\n        if (!privateKey) {\n          throw new Kms.KeyManagementError('sender key is required for ECDH-ES key derivation.')\n        }\n\n        // ECDH-1PU+A256KW (e.g. DIDComm v2) requires X25519; convert Ed25519 like DIDComm v1\n        if (key.keyAgreement.algorithm === 'ECDH-1PU+A256KW' && privateKey.algorithm === KeyAlgorithm.Ed25519) {\n          privateKey = privateKey.convertkey({ algorithm: KeyAlgorithm.X25519 })\n          keysToFree.push(privateKey)\n        }\n\n        // ECDH-1PU+A256KW binds the JWE Authentication Tag into the KDF per draft-madden, so\n        // content encryption has to happen before key derivation. encryptEcdh1Pu does the full\n        // atomic flow (CEK gen, content encrypt, KEK derive with tag, CEK wrap) and short-circuits\n        // the rest of this method.\n        if (key.keyAgreement.algorithm === 'ECDH-1PU+A256KW') {\n          let ephemeralKey: Key | undefined\n          if ('ephemeralKeyId' in key.keyAgreement && key.keyAgreement.ephemeralKeyId) {\n            ephemeralKey = (await this.getKeyAsserted(agentContext, key.keyAgreement.ephemeralKeyId)).key\n            keysToFree.push(ephemeralKey)\n          }\n          return encryptEcdh1Pu({\n            askar: this.getAskar(agentContext),\n            keyAgreement: key.keyAgreement,\n            encryption: encryption as AskarSupportedEncryptionOptions,\n            senderKey: privateKey,\n            recipientKey,\n            data,\n            ephemeralKey,\n          })\n        }\n\n        const { contentEncryptionKey, encryptedContentEncryptionKey } = deriveEncryptionKey({\n          askar: this.getAskar(agentContext),\n          encryption,\n          keyAgreement: key.keyAgreement,\n          recipientKey,\n          senderKey: privateKey,\n        })\n\n        encryptionKey = contentEncryptionKey\n        keysToFree.push(contentEncryptionKey)\n        encryptedKey = encryptedContentEncryptionKey\n      } else {\n        throw new Kms.KeyManagementError('Unexpected key parameter for encrypt')\n      }\n\n      if (encryption.algorithm === 'XSALSA20-POLY1305') {\n        throw new Kms.KeyManagementAlgorithmNotSupportedError(\n          `encryption algorithm '${encryption.algorithm}' can only be used with key agreement algorithm ECDH-HSALSA20`,\n          this.backend\n        )\n      }\n\n      const privateJwk = this.privateJwkFromKey(agentContext, encryptionKey)\n      Kms.assertKeyAllowsDerive(privateJwk)\n      Kms.assertAllowedEncryptionAlgForKey(privateJwk, encryption.algorithm)\n      Kms.assertKeyAllowsEncrypt(privateJwk)\n\n      const encrypted = aeadEncrypt({\n        key: encryptionKey,\n        data,\n        encryption,\n      })\n\n      return {\n        ...encrypted,\n        encryptedKey,\n      }\n    } catch (error) {\n      if (error instanceof Kms.KeyManagementError) throw error\n      throw new Kms.KeyManagementError('Error encrypting with key', { cause: error })\n    } finally {\n      // Clear all keys\n      for (const key of keysToFree) {\n        key.handle.free()\n      }\n    }\n  }\n\n  public async decrypt(agentContext: AgentContext, options: Kms.KmsDecryptOptions): Promise<Kms.KmsDecryptReturn> {\n    const { encrypted, decryption, key } = options\n\n    if (decryption.algorithm === 'HPKE') {\n      if (!key.keyAgreement || !Kms.isKmsKeyAgreementDecryptHpke(key.keyAgreement)) {\n        throw new Kms.KeyManagementError(\n          `Decryption algorithm 'HPKE' can only be used with an integrated-encryption HPKE key agreement algorithm`\n        )\n      }\n\n      const { keyAgreement } = key\n      const recipientKey = (await this.getKeyAsserted(agentContext, keyAgreement.keyId)).key\n\n      try {\n        const recipientPublicJwk = this.publicJwkFromKey(agentContext, recipientKey)\n        Kms.assertJwkAsymmetric(recipientPublicJwk, keyAgreement.keyId)\n        Kms.assertAllowedKeyDerivationAlgForKey(recipientPublicJwk, keyAgreement.algorithm)\n        Kms.assertKeyAllowsDerive(recipientPublicJwk)\n\n        return {\n          data: await hpkeOpen({\n            algorithm: keyAgreement.algorithm,\n            recipientKey,\n            recipientPublicJwk,\n            encapsulatedKey: keyAgreement.encapsulatedKey,\n            encrypted,\n            info: keyAgreement.info,\n            aad: decryption.aad,\n          }),\n        }\n      } catch (error) {\n        if (error instanceof Kms.KeyManagementError) throw error\n        throw new Kms.KeyManagementError('Error decrypting with key', { cause: error })\n      } finally {\n        recipientKey.handle.free()\n      }\n    }\n\n    Kms.assertSupportedEncryptionAlgorithm(decryption, askarSupportedEncryptionAlgorithms, this.backend)\n\n    const keysToFree: Key[] = []\n\n    try {\n      let decryptionKey: Key | undefined\n\n      if (key.keyId) {\n        decryptionKey = (await this.getKeyAsserted(agentContext, key.keyId)).key\n        keysToFree.push(decryptionKey)\n      } else if (key.privateJwk) {\n        if (decryption.algorithm === 'XSALSA20-POLY1305') {\n          throw new Kms.KeyManagementAlgorithmNotSupportedError(\n            `decryption algorithm '${decryption.algorithm}' is only supported in combination with key agreement algorithm '${Kms.KnownJwaKeyAgreementAlgorithms.ECDH_HSALSA20}'`,\n            this.backend\n          )\n        }\n        decryptionKey = this.keyFromSecretBytesAndEncryptionAlgorithm(\n          TypedArrayEncoder.fromBase64Url(key.privateJwk.k),\n          decryption.algorithm\n        )\n        keysToFree.push(decryptionKey)\n      } else if (key.keyAgreement) {\n        // ECDH-1PU+A256KW has ephemeralPublicJwk/senderPublicJwk instead of externalPublicJwk.\n        const externalPublicJwk =\n          key.keyAgreement.algorithm === 'ECDH-1PU+A256KW' || !('externalPublicJwk' in key.keyAgreement)\n            ? undefined\n            : key.keyAgreement.externalPublicJwk\n        Kms.assertSupportedKeyAgreementAlgorithm(key.keyAgreement, askarSupportedKeyAgreementAlgorithms, this.backend)\n        if (externalPublicJwk) {\n          Kms.assertAllowedKeyDerivationAlgForKey(externalPublicJwk, key.keyAgreement.algorithm)\n          Kms.assertKeyAllowsDerive(externalPublicJwk)\n        }\n\n        let privateKey = (await this.getKeyAsserted(agentContext, key.keyAgreement.keyId)).key\n        keysToFree.push(privateKey)\n\n        const privateJwk = this.privateJwkFromKey(agentContext, privateKey)\n\n        Kms.assertJwkAsymmetric(privateJwk, key.keyAgreement.keyId)\n        Kms.assertAllowedKeyDerivationAlgForKey(privateJwk, key.keyAgreement.algorithm)\n        Kms.assertKeyAllowsDerive(privateJwk)\n\n        // Special case: Ed25519 may be converted to X25519 for ECDH-HSALSA20 (DIDComm v1) and ECDH-ES (DIDComm v2 anoncrypt)\n        const isEd25519Private = privateJwk.kty === 'OKP' && privateJwk.crv === 'Ed25519'\n        if (\n          externalPublicJwk &&\n          key.keyAgreement.algorithm !== 'ECDH-HSALSA20' &&\n          !(key.keyAgreement.algorithm.startsWith('ECDH-ES') && isEd25519Private)\n        ) {\n          Kms.assertAsymmetricJwkKeyTypeMatches(privateJwk, externalPublicJwk)\n        }\n\n        let senderKey: Key | undefined\n        let ephemeralKey: Key | undefined\n        if (key.keyAgreement.algorithm === 'ECDH-1PU+A256KW') {\n          const agreement = key.keyAgreement\n          ephemeralKey = this.keyFromJwk(agentContext, agreement.ephemeralPublicJwk)\n          senderKey = this.keyFromJwk(agentContext, agreement.senderPublicJwk)\n          keysToFree.push(ephemeralKey, senderKey)\n        } else {\n          senderKey = externalPublicJwk ? this.keyFromJwk(agentContext, externalPublicJwk) : undefined\n          if (senderKey) keysToFree.push(senderKey)\n        }\n\n        // Special case to support DIDComm v1\n        if (key.keyAgreement.algorithm === 'ECDH-HSALSA20' || decryption.algorithm === 'XSALSA20-POLY1305') {\n          if (decryption.algorithm !== 'XSALSA20-POLY1305' || key.keyAgreement.algorithm !== 'ECDH-HSALSA20') {\n            throw new Kms.KeyManagementAlgorithmNotSupportedError(\n              `key agreement algorithm '${key.keyAgreement.algorithm}' with encryption algorithm '${decryption.algorithm}'`,\n              this.backend\n            )\n          }\n\n          // Special case. For DIDComm v1 we basically use the Ed25519 key also\n          // for X25519 operations.\n          if (privateKey.algorithm === KeyAlgorithm.Ed25519) {\n            privateKey = privateKey.convertkey({ algorithm: KeyAlgorithm.X25519 })\n            keysToFree.push(privateKey)\n          }\n\n          if (!senderKey) {\n            // anonymous encryption\n            return {\n              data: new Uint8Array(\n                CryptoBox.sealOpen({\n                  recipientKey: privateKey,\n                  ciphertext: new Uint8Array(encrypted),\n                })\n              ),\n            }\n          }\n\n          if (!decryption.iv) {\n            throw new Kms.KeyManagementError(\n              `Missing required 'iv' for key agreement algorithm ${key.keyAgreement.algorithm} and encryption algorithm ${decryption.algorithm} with sender key defined.`\n            )\n          }\n\n          const decrypted = new Uint8Array(\n            CryptoBox.open({\n              recipientKey: privateKey,\n              senderKey: senderKey,\n              message: new Uint8Array(encrypted),\n              nonce: new Uint8Array(decryption.iv),\n            })\n          )\n\n          return {\n            data: decrypted,\n          }\n        }\n\n        // This should not happen, but for TS\n        if (!senderKey) {\n          throw new Kms.KeyManagementError('sender key is required for ECDH-ES key derivation.')\n        }\n\n        // ECDH-1PU+A256KW and ECDH-ES require X25519; convert Ed25519 like DIDComm v1\n        // Note: ECDH-ES+A192KW is not in askarSupportedKeyAgreementAlgorithms so it's already\n        // rejected by assertSupportedKeyAgreementAlgorithm above.\n        if (\n          (key.keyAgreement.algorithm === 'ECDH-1PU+A256KW' ||\n            key.keyAgreement.algorithm === 'ECDH-ES+A256KW' ||\n            key.keyAgreement.algorithm === 'ECDH-ES+A128KW' ||\n            key.keyAgreement.algorithm === 'ECDH-ES') &&\n          privateKey.algorithm === KeyAlgorithm.Ed25519\n        ) {\n          privateKey = privateKey.convertkey({ algorithm: KeyAlgorithm.X25519 })\n          keysToFree.push(privateKey)\n        }\n\n        const { contentEncryptionKey } = deriveDecryptionKey({\n          askar: this.getAskar(agentContext),\n          decryption,\n          keyAgreement: key.keyAgreement,\n          recipientKey: privateKey,\n          senderKey,\n          ephemeralKey,\n        })\n\n        decryptionKey = contentEncryptionKey\n        keysToFree.push(contentEncryptionKey)\n      } else {\n        throw new Kms.KeyManagementError('Unexpected key parameter for decrypt')\n      }\n\n      if (decryption.algorithm === 'XSALSA20-POLY1305') {\n        throw new Kms.KeyManagementAlgorithmNotSupportedError(\n          `encryption algorithm '${decryption.algorithm}' can only be used with key agreement algorithm ECDH-HSALSA20`,\n          this.backend\n        )\n      }\n\n      const privateJwk = this.privateJwkFromKey(agentContext, decryptionKey)\n      Kms.assertKeyAllowsDerive(privateJwk)\n      Kms.assertAllowedEncryptionAlgForKey(privateJwk, decryption.algorithm)\n      Kms.assertKeyAllowsEncrypt(privateJwk)\n\n      const decrypted = aeadDecrypt({\n        key: decryptionKey,\n        encrypted,\n        decryption,\n      })\n\n      return {\n        data: decrypted,\n      }\n    } catch (error) {\n      if (error instanceof Kms.KeyManagementError) throw error\n      throw new Kms.KeyManagementError('Error decrypting with key', { cause: error })\n    } finally {\n      // Clear all keys\n      for (const key of keysToFree) {\n        key.handle.free()\n      }\n    }\n  }\n\n  private assertedSigTypeForAlg(algorithm: Kms.KnownJwaSignatureAlgorithm): SignatureAlgorithm {\n    const sigType = AskarKeyManagementService.algToSigType[algorithm]\n    if (!sigType) {\n      throw new Kms.KeyManagementAlgorithmNotSupportedError(\n        `signing and verification with algorithm '${algorithm}'`,\n        this.backend\n      )\n    }\n\n    return sigType\n  }\n\n  private assertAskarAlgForJwkCrv(kty: string, crv: Kms.KmsJwkPublicEc['crv'] | Kms.KmsJwkPublicOkp['crv']) {\n    const keyAlg = jwkCrvToAskarAlg[crv]\n    if (!keyAlg) {\n      throw new Kms.KeyManagementAlgorithmNotSupportedError(`crv '${crv}' for kty '${kty}'`, this.backend)\n    }\n\n    return keyAlg\n  }\n\n  private keyFromJwk(agentContext: AgentContext, jwk: Kms.KmsJwkPrivate | Kms.KmsJwkPublic) {\n    const key = new Key(\n      this.getAskar(agentContext).keyFromJwk({\n        // TODO: the JWK class in JS Askar wrapper is too limiting\n        // so we use this method directly. should update it\n        jwk: new Uint8Array(JsonEncoder.toUint8Array(jwk)) as unknown as Jwk,\n      })\n    )\n\n    return key\n  }\n\n  private keyFromSecretBytesAndEncryptionAlgorithm(\n    secretBytes: Uint8Array,\n    algorithm: AskarSupportedEncryptionOptions['algorithm']\n  ) {\n    const askarEncryptionAlgorithm = jwkEncToAskarAlg[algorithm]\n    if (!askarEncryptionAlgorithm) {\n      throw new Kms.KeyManagementAlgorithmNotSupportedError(`JWA encryption algorithm '${algorithm}'`, 'askar')\n    }\n\n    return Key.fromSecretBytes({\n      algorithm: askarEncryptionAlgorithm,\n      secretKey: new Uint8Array(secretBytes),\n    })\n  }\n\n  private publicJwkFromKey(agentContext: AgentContext, key: Key, partialJwkPublic?: Partial<Kms.KmsJwkPublic>) {\n    // Askar has no public jwk representation for symmetric keys, and there's nothing\n    // public about them besides the key type\n    if (askarSymmetricKeyAlgorithms.includes(key.algorithm)) {\n      return Kms.publicJwkFromPrivateJwk({ ...partialJwkPublic, kty: 'oct' } as Kms.KmsJwkPublic)\n    }\n\n    // TODO: the JWK class in JS Askar wrapper is too limiting\n    // so we use this method directly. should update it\n    // We extract alg, as Askar doesn't always use the same algs\n    const { alg, ...jwkPublic } = JSON.parse(\n      this.getAskar(agentContext).keyGetJwkPublic({\n        localKeyHandle: key.handle,\n        algorithm: key.algorithm,\n      })\n    )\n\n    return Kms.publicJwkFromPrivateJwk({ ...partialJwkPublic, ...jwkPublic } as Kms.KmsJwkPublic)\n  }\n\n  private privateJwkFromKey(agentContext: AgentContext, key: Key, partialJwkPrivate?: Partial<Kms.KmsJwkPrivate>) {\n    // TODO: once we support additional params we should add these here\n\n    // TODO: the JWK class in JS Askar wrapper is too limiting\n    // so we use this method directly. should update it\n    // We extract alg, as Askar doesn't always use the same algs\n    const { alg, ...jwkSecret } = JsonEncoder.fromUint8Array(\n      this.getAskar(agentContext).keyGetJwkSecret({\n        localKeyHandle: key.handle,\n      })\n    )\n\n    return {\n      ...partialJwkPrivate,\n      ...jwkSecret,\n    } as Kms.KmsJwkPrivate\n  }\n\n  private async fetchAskarKey(agentContext: AgentContext, keyId: string): Promise<KeyEntryObject | null> {\n    return await this.withSession(agentContext, async (session) => {\n      if (!session.handle) throw Error('Cannot fetch a key with a closed session')\n\n      // Fetch the key from the session\n      const handle = await this.getAskar(agentContext).sessionFetchKey({\n        forUpdate: false,\n        name: keyId,\n        sessionHandle: session.handle,\n      })\n      if (!handle) return null\n\n      // Get the key entry\n      const keyEntryList = new KeyEntryList({ handle })\n      const keyEntry = keyEntryList.getEntryByIndex(0)\n\n      const keyEntryObject = keyEntry.toJson()\n      keyEntryList.handle.free()\n\n      return keyEntryObject\n    })\n  }\n\n  private async getKeyAsserted(agentContext: AgentContext, keyId: string) {\n    const storageKey = await this.fetchAskarKey(agentContext, keyId)\n    if (!storageKey) {\n      throw new Kms.KeyManagementKeyNotFoundError(keyId, [this.backend])\n    }\n\n    return storageKey\n  }\n\n  private getAskar(agentContext: AgentContext) {\n    return agentContext.resolve(AskarModuleConfig).askar\n  }\n}\n"],"mappings":";;;;;;;;;;;;;AAwBA,MAAM,8BAA8C,OAAO,OAAO,gBAAgB;AAElF,MAAM,qCAAqC,CACzC,GAAI,OAAO,KAAK,gBAAgB,GAChC,mBACF;AAEA,IAAa,4BAAb,MAAa,0BAA8D;;EAEzE,KAAgB,UAAU,0BAA0B;;CAUpD,YAA4B,cAA4B,UAAwC;EAC9F,OAAO,aAAa,kBAAkB,QAAQ,iBAAiB,CAAC,CAAC,YAAY,cAAc,QAAQ;CACrG;CAEA,qBAA4B,eAA6B,WAAsC;EAC7F,IAAI,UAAU,cAAc,aAAa,OAAO;EAChD,IAAI,UAAU,cAAc,eAAe,OAAO;EAElD,IAAI,UAAU,cAAc,aAAa;GACvC,IAAI,UAAU,WAAW,QAAQ,QAAQ,UAAU,WAAW,QAAQ,OACpE,OAAO,iBAAiB,UAAU,WAAW,SAAS,KAAA;GAIxD,OAAO;EACT;EAEA,IAAI,UAAU,cAAc,aAAa;GACvC,IAAI,UAAU,KAAK,QAAQ,QAAQ,UAAU,KAAK,QAAQ,OACxD,OAAO,iBAAiB,UAAU,KAAK,SAAS,KAAA;GAGlD,IAAI,UAAU,KAAK,QAAQ,OAAO;IAChC,IAAI,UAAU,KAAK,cAAc,QAAQ,OAAO;IAGhD,IAAI,UAAU,KAAK,cAAc,OAC/B,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,SAAS,UAAU,KAAK,MAAM;GAEpD;GAEA,OAAO;EACT;EAEA,IAAI,UAAU,cAAc,UAAU,UAAU,cAAc,UAC5D,OAAO,0BAA0B,aAAa,UAAU,eAAe,KAAA;EAGzE,IAAI,UAAU,cAAc,aAAa,UAAU,cAAc,WAAW;GAC1E,MAAM,aAAa,UAAU,cAAc,YAAY,UAAU,aAAa,UAAU;GAIxF,IACE,UAAU,gBACV,uBAAuB,UAAU,gBACjC,UAAU,aAAa,qBACvB,iBAAiB,UAAU,aAAa,kBAAkB,SAAS,KAAA,GAEnE,OAAO;GAKT,IAAI,WAAW,cAAc,QAAQ;IACnC,IAAI,CAAC,UAAU,gBAAgB,CAAC,IAAI,mBAAmB,UAAU,aAAa,SAAS,GAAG,OAAO;IAEjG,OAAO,6BAA6B,SAClC,UAAU,aAAa,SACzB;GACF;GAEA,IACE,CAAC,mCAAmC,SAClC,WAAW,SACb,GAEA,OAAO;GAET,IAAI,CAAC,UAAU,cAAc,OAAO;GAEpC,OAAO,qCAAqC,SAC1C,UAAU,aAAa,SACzB;EACF;EAEA,OAAO;CACT;CAEA,YAAmB,eAA6B,SAA8D;EAC5G,OAAO,YAAY,QAAQ,MAAM;CACnC;CAEA,MAAa,aAAa,cAA4B,OAAiD;EACrG,MAAM,MAAM,MAAM,KAAK,cAAc,cAAc,KAAK;EACxD,IAAI,CAAC,KAAK,OAAO;EAEjB,OAAO,KAAK,iBAAiB,cAAc,IAAI,KAAK,EAAE,KAAK,MAAM,CAAC;CACpE;CAEA,MAAa,UACX,cACA,SACsC;EACtC,MAAM,EAAE,QAAQ,QAAQ;EAExB,MAAM,aAAa;GACjB,GAAG,QAAQ;GACX,KAAK,OAAO,MAAM,KAAK;EACzB;EAEA,IAAI;EACJ,IAAI;GACF,IAAI,WAAW,QAAQ,OAGrB,MAAM,IAAI,IAAI,wCACZ,4BAA4B,WAAW,IAAI,IAC3C,KAAK,OACP;GAEF,IAAI,WAAW,QAAQ,QAAQ,WAAW,QAAQ,OAAO;IAEvD,KAAK,wBAAwB,WAAW,KAAK,WAAW,GAAG;IAE3D,MAAM,IAAI,QAAQ,EAAE,KAAK,IAAI,SAAS,UAAU,EAAE,CAAC;GACrD;GAEA,MAAM,OAAO;GACb,IAAI,CAAC,MACH,MAAM,IAAI,IAAI,wCAAwC,QAAQ,WAAW,IAAI,IAAI,KAAK,OAAO;GAG/F,MAAM,KAAK,YAAY,eAAe,YAAY,QAAQ,UAAU;IAAE,MAAM,WAAW;IAAK,KAAK;GAAK,CAAC,CAAC;GACxG,MAAM,YAAY,IAAI,wBAAwB,UAAU;GAExD,OAAO;IACL,OAAO,WAAW;IAClB,WAAW;KACT,GAAG;KACH,KAAK,WAAW;IAClB;GACF;EACF,SAAS,OAAO;GACd,IAAI,iBAAiB,IAAI,oBAAoB,MAAM;GAGnD,IAAI,aAAa,OAAA,CAA+B,GAC9C,MAAM,IAAI,IAAI,4BAA4B,WAAW,KAAK,KAAK,OAAO;GAGxE,MAAM,IAAI,IAAI,mBAAmB,uBAAuB,EAAE,OAAO,MAAM,CAAC;EAC1E,UAAU;GACR,KAAK,OAAO,KAAK;EACnB;CACF;CAEA,MAAa,UAAU,cAA4B,SAAoD;EACrG,IAAI;GACF,MAAM,KAAK,YAAY,eAAe,YAAY,QAAQ,UAAU,EAAE,MAAM,QAAQ,MAAM,CAAC,CAAC;GAC5F,OAAO;EACT,SAAS,OAAO;GAEd,IAAI,aAAa,OAAA,CAA8B,GAC7C,OAAO;GAGT,MAAM,IAAI,IAAI,mBAAmB,+BAA+B,QAAQ,MAAM,IAAI,EAAE,OAAO,MAAM,CAAC;EACpG;CACF;CAEA,MAAa,UACX,cACA,SACuC;EACvC,MAAM,EAAE,MAAM,UAAU;EAIxB,MAAM,MAAM,SAAS,MAAM,KAAK;EAChC,IAAI;EACJ,IAAI;GACF,IAAI,KAAK,QAAQ,QAAQ,KAAK,QAAQ,OAAO;IAC3C,MAAM,SAAS,KAAK,wBAAwB,KAAK,KAAK,KAAK,GAAG;IAC9D,WAAW,IAAI,SAAS,MAAM;GAChC,OAAO,IAAI,KAAK,QAAQ,OAAO;IAK7B,IAAI,KAAK,cAAc,OAAO;KAC5B,MAAM,iBAA2D;MAC/D,KAAK,aAAa;MAClB,KAAK,aAAa;MAClB,KAAK,aAAa;KACpB;KAEA,MAAM,SAAS,eAAe,KAAK;KACnC,IAAI,CAAC,QACH,MAAM,IAAI,IAAI,wCACZ,WAAW,KAAK,OAAO,aAAa,KAAK,IAAI,oBAAoB,KAAK,UAAU,iCAAiC,OAAO,KAAK,cAAc,CAAC,CAAC,KAAK,IAAI,KACtJ,KAAK,OACP;KAGF,WAAW,IAAI,SAAS,MAAM;IAChC,OAAO,IAAI,KAAK,cAAc,QAE5B,WAAW,IAAI,SAAS,aAAa,YAAY;SAEjD,MAAM,IAAI,IAAI,wCACZ,cAAc,KAAK,UAAU,aAAa,KAAK,IAAI,IACnD,KAAK,OACP;GAEJ;GAEA,MAAM,OAAO;GACb,IAAI,CAAC,MACH,MAAM,IAAI,IAAI,wCAAwC,QAAQ,KAAK,IAAI,IAAI,KAAK,OAAO;GAGzF,MAAM,YAAY,KAAK,iBAAiB,cAAc,MAAM,EAAE,IAAI,CAAC;GACnE,MAAM,KAAK,YAAY,eAAe,YAAY,QAAQ,UAAU;IAAE,MAAM;IAAK,KAAK;GAAK,CAAC,CAAC;GAE7F,OAAO;IACL;IACA,OAAO;GACT;EACF,SAAS,OAAO;GACd,IAAI,iBAAiB,IAAI,oBAAoB,MAAM;GAGnD,IAAI,aAAa,OAAA,CAA+B,GAC9C,MAAM,IAAI,IAAI,4BAA4B,KAAK,KAAK,OAAO;GAG7D,MAAM,IAAI,IAAI,mBAAmB,sBAAsB,EAAE,OAAO,MAAM,CAAC;EACzE,UAAU;GACR,UAAU,OAAO,KAAK;EACxB;CACF;CAEA,MAAa,KAAK,cAA4B,SAAyD;EACrG,MAAM,EAAE,OAAO,WAAW,SAAS;EAGnC,MAAM,MAAM,MAAM,KAAK,eAAe,cAAc,KAAK;EACzD,IAAI;GACF,MAAM,UAAU,KAAK,sBAAsB,SAAS;GAGpD,IAAI,CAAC,IAAI,KACP,MAAM,IAAI,IAAI,wCAAwC,aAAa,aAAa,KAAK,OAAO;GAI9F,MAAM,YAAY,KAAK,iBAAiB,cAAc,IAAI,KAAK,EAAE,KAAK,MAAM,CAAC;GAC7E,MAAM,aAAa,KAAK,kBAAkB,cAAc,IAAI,KAAK,EAAE,KAAK,MAAM,CAAC;GAG/E,IAAI,8BAA8B,YAAY,SAAS;GACvD,IAAI,oBAAoB,SAAS;GAGjC,MAAM,YAAY,IAAI,IAAI,YAAY;IACpC,SAAS,IAAI,WAAW,IAAI;IAC5B;GACF,CAAC;GAED,OAAO,EACL,WAAW,IAAI,WAAW,SAAS,EACrC;EACF,SAAS,OAAO;GACd,IAAI,iBAAiB,IAAI,oBAAoB,MAAM;GACnD,MAAM,IAAI,IAAI,mBAAmB,0BAA0B,EAAE,OAAO,MAAM,CAAC;EAC7E,UAAU;GACR,IAAI,KAAK,OAAO,KAAK;EACvB;CACF;CAEA,MAAa,OAAO,cAA4B,SAA6D;EAC3G,MAAM,EAAE,WAAW,MAAM,WAAW,KAAK,aAAa;EAGtD,MAAM,UAAU,KAAK,sBAAsB,SAAS;EAGpD,IAAI;EAEJ,IAAI;GACF,IAAI,SAAS,OACX,YAAY,MAAM,KAAK,eAAe,cAAc,SAAS,KAAK,EAAA,CAAG;QAChE,IAAI,SAAS,WAAW,QAAQ,QAAQ,SAAS,WAAW,QAAQ,OAAO;IAEhF,KAAK,wBAAwB,SAAS,UAAU,KAAK,SAAS,UAAU,GAAG;IAE3E,WAAW,IAAI,QAAQ,EAAE,KAAK,IAAI,SAAS,SAAS,SAAqB,EAAE,CAAC;GAC9E,OACE,MAAM,IAAI,IAAI,wCAAwC,OAAO,SAAS,WAAW,OAAO,KAAK,OAAO;GAKtG,IAAI,CAAC,UACH,MAAM,IAAI,IAAI,wCAAwC,aAAa,aAAa,KAAK,OAAO;GAG9F,MAAM,QAAQ,SAAS,SAAS,SAAS,WAAW;GACpD,MAAM,YAAY,KAAK,iBAAiB,cAAc,UAAU,EAAE,KAAK,MAAM,CAAC;GAG9E,IAAI,UAAU,QAAQ,OAAO;IAC3B,MAAM,aAAa,KAAK,kBAAkB,cAAc,UAAU,EAAE,KAAK,MAAM,CAAC;IAGhF,IAAI,8BAA8B,YAAY,SAAS;IACvD,IAAI,sBAAsB,SAAS;GACrC,OAAO;IAEL,IAAI,8BAA8B,WAAW,SAAS;IACtD,IAAI,sBAAsB,SAAS;GACrC;GAQA,IALiB,SAAS,gBAAgB;IACxC,SAAS,IAAI,WAAW,IAAI;IAC5B,WAAW,IAAI,WAAW,SAAS;IACnC;GACF,CACW,GACT,OAAO;IACL,UAAU;IACV,WAAW,SAAS,QAChB,KAAK,iBAAiB,cAAc,UAAU,EAAE,KAAK,MAAM,CAAC,IAC3D,SAAS;GAChB;GAGF,OAAO,EACL,UAAU,MACZ;EACF,SAAS,OAAO;GACd,IAAI,iBAAiB,IAAI,oBAAoB,MAAM;GACnD,MAAM,IAAI,IAAI,mBAAmB,4BAA4B,EAAE,OAAO,MAAM,CAAC;EAC/E,UAAU;GACR,IAAI,UAAU,SAAS,OAAO,KAAK;EACrC;CACF;CAEA,MAAa,QAAQ,cAA4B,SAA+D;EAC9G,MAAM,EAAE,MAAM,YAAY,QAAQ;EAElC,IAAI,WAAW,cAAc,QAAQ;GACnC,IAAI,CAAC,IAAI,gBAAgB,CAAC,IAAI,6BAA6B,IAAI,YAAY,GACzE,MAAM,IAAI,IAAI,mBACZ,yGACF;GAGF,MAAM,EAAE,iBAAiB;GACzB,IAAI,oCAAoC,aAAa,mBAAmB,aAAa,SAAS;GAC9F,IAAI,sBAAsB,aAAa,iBAAiB;GAExD,IAAI;IACF,OAAO,MAAM,SAAS;KACpB,WAAW,aAAa;KACxB,oBAAoB,aAAa;KACjC;KACA,MAAM,aAAa;KACnB,KAAK,WAAW;IAClB,CAAC;GACH,SAAS,OAAO;IACd,IAAI,iBAAiB,IAAI,oBAAoB,MAAM;IACnD,MAAM,IAAI,IAAI,mBAAmB,6BAA6B,EAAE,OAAO,MAAM,CAAC;GAChF;EACF;EAEA,IAAI,mCAAmC,YAAY,oCAAoC,KAAK,OAAO;EAEnG,MAAM,aAAoB,CAAC;EAC3B,IAAI;GACF,IAAI;GACJ,IAAI;GAGJ,IAAI,IAAI,OAAO;IACb,iBAAiB,MAAM,KAAK,eAAe,cAAc,IAAI,KAAK,EAAA,CAAG;IAErE,WAAW,KAAK,aAAa;GAC/B,OAAO,IAAI,IAAI,YAAY;IACzB,IAAI,WAAW,cAAc,qBAC3B,MAAM,IAAI,IAAI,wCACZ,yBAAyB,WAAW,UAAU,mEAAmE,IAAI,+BAA+B,cAAc,IAClK,KAAK,OACP;IAEF,gBAAgB,KAAK,yCACnB,kBAAkB,cAAc,IAAI,WAAW,CAAC,GAChD,WAAW,SACb;IACA,WAAW,KAAK,aAAa;GAC/B,OAAO,IAAI,IAAI,cAAc;IAC3B,IAAI,oCAAoC,IAAI,aAAa,mBAAmB,IAAI,aAAa,SAAS;IACtG,IAAI,sBAAsB,IAAI,aAAa,iBAAiB;IAC5D,IAAI,qCAAqC,IAAI,cAAc,sCAAsC,KAAK,OAAO;IAE7G,IAAI,aAAa,IAAI,aAAa,SAC7B,MAAM,KAAK,eAAe,cAAc,IAAI,aAAa,KAAK,EAAA,CAAG,MAClE,KAAA;IACJ,IAAI,YAAY,WAAW,KAAK,UAAU;IAE1C,MAAM,aAAa,aAAa,KAAK,kBAAkB,cAAc,UAAU,IAAI,KAAA;IACnF,IAAI,YAAY;KACd,IAAI,oBAAoB,YAAY,IAAI,aAAa,KAAK;KAC1D,IAAI,oCAAoC,YAAY,IAAI,aAAa,SAAS;KAC9E,IAAI,sBAAsB,UAAU;KAGpC,IAAI,IAAI,aAAa,cAAc,mBAAmB,IAAI,aAAa,cAAc,mBACnF,IAAI,kCAAkC,YAAY,IAAI,aAAa,iBAAiB;IAExF;IAEA,MAAM,eAAe,KAAK,WAAW,cAAc,IAAI,aAAa,iBAAiB;IACrF,WAAW,KAAK,YAAY;IAG5B,IAAI,IAAI,aAAa,cAAc,mBAAmB,WAAW,cAAc,qBAAqB;KAClG,IAAI,WAAW,cAAc,uBAAuB,IAAI,aAAa,cAAc,iBACjF,MAAM,IAAI,IAAI,wCACZ,4BAA4B,IAAI,aAAa,UAAU,+BAA+B,WAAW,UAAU,IAC3G,KAAK,OACP;KAIF,IAAI,CAAC,YACH,OAAO,EACL,WAAW,IAAI,WACb,UAAU,KAAK;MACb;MACA,SAAS,IAAI,WAAW,IAAI;KAC9B,CAAC,CACH,EACF;KAKF,IAAI,WAAW,cAAc,aAAa,SAAS;MACjD,aAAa,WAAW,WAAW,EAAE,WAAW,aAAa,OAAO,CAAC;MACrE,WAAW,KAAK,UAAU;KAC5B;KAEA,MAAM,QAAQ,IAAI,WAAW,UAAU,YAAY,CAAC;KAUpD,OAAO;MACL,WAAA,IAVoB,WACpB,UAAU,UAAU;OAClB;OACA,WAAW;OACX,SAAS,IAAI,WAAW,IAAI;OAC5B;MACF,CAAC,CAIO;MACR,IAAI;KACN;IACF;IAGA,IAAI,CAAC,YACH,MAAM,IAAI,IAAI,mBAAmB,oDAAoD;IAIvF,IAAI,IAAI,aAAa,cAAc,qBAAqB,WAAW,cAAc,aAAa,SAAS;KACrG,aAAa,WAAW,WAAW,EAAE,WAAW,aAAa,OAAO,CAAC;KACrE,WAAW,KAAK,UAAU;IAC5B;IAMA,IAAI,IAAI,aAAa,cAAc,mBAAmB;KACpD,IAAI;KACJ,IAAI,oBAAoB,IAAI,gBAAgB,IAAI,aAAa,gBAAgB;MAC3E,gBAAgB,MAAM,KAAK,eAAe,cAAc,IAAI,aAAa,cAAc,EAAA,CAAG;MAC1F,WAAW,KAAK,YAAY;KAC9B;KACA,OAAO,eAAe;MACpB,OAAO,KAAK,SAAS,YAAY;MACjC,cAAc,IAAI;MACN;MACZ,WAAW;MACX;MACA;MACA;KACF,CAAC;IACH;IAEA,MAAM,EAAE,sBAAsB,kCAAkC,oBAAoB;KAClF,OAAO,KAAK,SAAS,YAAY;KACjC;KACA,cAAc,IAAI;KAClB;KACA,WAAW;IACb,CAAC;IAED,gBAAgB;IAChB,WAAW,KAAK,oBAAoB;IACpC,eAAe;GACjB,OACE,MAAM,IAAI,IAAI,mBAAmB,sCAAsC;GAGzE,IAAI,WAAW,cAAc,qBAC3B,MAAM,IAAI,IAAI,wCACZ,yBAAyB,WAAW,UAAU,gEAC9C,KAAK,OACP;GAGF,MAAM,aAAa,KAAK,kBAAkB,cAAc,aAAa;GACrE,IAAI,sBAAsB,UAAU;GACpC,IAAI,iCAAiC,YAAY,WAAW,SAAS;GACrE,IAAI,uBAAuB,UAAU;GAQrC,OAAO;IACL,GAPgB,YAAY;KAC5B,KAAK;KACL;KACA;IACF,CAGa;IACX;GACF;EACF,SAAS,OAAO;GACd,IAAI,iBAAiB,IAAI,oBAAoB,MAAM;GACnD,MAAM,IAAI,IAAI,mBAAmB,6BAA6B,EAAE,OAAO,MAAM,CAAC;EAChF,UAAU;GAER,KAAK,MAAM,OAAO,YAChB,IAAI,OAAO,KAAK;EAEpB;CACF;CAEA,MAAa,QAAQ,cAA4B,SAA+D;EAC9G,MAAM,EAAE,WAAW,YAAY,QAAQ;EAEvC,IAAI,WAAW,cAAc,QAAQ;GACnC,IAAI,CAAC,IAAI,gBAAgB,CAAC,IAAI,6BAA6B,IAAI,YAAY,GACzE,MAAM,IAAI,IAAI,mBACZ,yGACF;GAGF,MAAM,EAAE,iBAAiB;GACzB,MAAM,gBAAgB,MAAM,KAAK,eAAe,cAAc,aAAa,KAAK,EAAA,CAAG;GAEnF,IAAI;IACF,MAAM,qBAAqB,KAAK,iBAAiB,cAAc,YAAY;IAC3E,IAAI,oBAAoB,oBAAoB,aAAa,KAAK;IAC9D,IAAI,oCAAoC,oBAAoB,aAAa,SAAS;IAClF,IAAI,sBAAsB,kBAAkB;IAE5C,OAAO,EACL,MAAM,MAAM,SAAS;KACnB,WAAW,aAAa;KACxB;KACA;KACA,iBAAiB,aAAa;KAC9B;KACA,MAAM,aAAa;KACnB,KAAK,WAAW;IAClB,CAAC,EACH;GACF,SAAS,OAAO;IACd,IAAI,iBAAiB,IAAI,oBAAoB,MAAM;IACnD,MAAM,IAAI,IAAI,mBAAmB,6BAA6B,EAAE,OAAO,MAAM,CAAC;GAChF,UAAU;IACR,aAAa,OAAO,KAAK;GAC3B;EACF;EAEA,IAAI,mCAAmC,YAAY,oCAAoC,KAAK,OAAO;EAEnG,MAAM,aAAoB,CAAC;EAE3B,IAAI;GACF,IAAI;GAEJ,IAAI,IAAI,OAAO;IACb,iBAAiB,MAAM,KAAK,eAAe,cAAc,IAAI,KAAK,EAAA,CAAG;IACrE,WAAW,KAAK,aAAa;GAC/B,OAAO,IAAI,IAAI,YAAY;IACzB,IAAI,WAAW,cAAc,qBAC3B,MAAM,IAAI,IAAI,wCACZ,yBAAyB,WAAW,UAAU,mEAAmE,IAAI,+BAA+B,cAAc,IAClK,KAAK,OACP;IAEF,gBAAgB,KAAK,yCACnB,kBAAkB,cAAc,IAAI,WAAW,CAAC,GAChD,WAAW,SACb;IACA,WAAW,KAAK,aAAa;GAC/B,OAAO,IAAI,IAAI,cAAc;IAE3B,MAAM,oBACJ,IAAI,aAAa,cAAc,qBAAqB,EAAE,uBAAuB,IAAI,gBAC7E,KAAA,IACA,IAAI,aAAa;IACvB,IAAI,qCAAqC,IAAI,cAAc,sCAAsC,KAAK,OAAO;IAC7G,IAAI,mBAAmB;KACrB,IAAI,oCAAoC,mBAAmB,IAAI,aAAa,SAAS;KACrF,IAAI,sBAAsB,iBAAiB;IAC7C;IAEA,IAAI,cAAc,MAAM,KAAK,eAAe,cAAc,IAAI,aAAa,KAAK,EAAA,CAAG;IACnF,WAAW,KAAK,UAAU;IAE1B,MAAM,aAAa,KAAK,kBAAkB,cAAc,UAAU;IAElE,IAAI,oBAAoB,YAAY,IAAI,aAAa,KAAK;IAC1D,IAAI,oCAAoC,YAAY,IAAI,aAAa,SAAS;IAC9E,IAAI,sBAAsB,UAAU;IAGpC,MAAM,mBAAmB,WAAW,QAAQ,SAAS,WAAW,QAAQ;IACxE,IACE,qBACA,IAAI,aAAa,cAAc,mBAC/B,EAAE,IAAI,aAAa,UAAU,WAAW,SAAS,KAAK,mBAEtD,IAAI,kCAAkC,YAAY,iBAAiB;IAGrE,IAAI;IACJ,IAAI;IACJ,IAAI,IAAI,aAAa,cAAc,mBAAmB;KACpD,MAAM,YAAY,IAAI;KACtB,eAAe,KAAK,WAAW,cAAc,UAAU,kBAAkB;KACzE,YAAY,KAAK,WAAW,cAAc,UAAU,eAAe;KACnE,WAAW,KAAK,cAAc,SAAS;IACzC,OAAO;KACL,YAAY,oBAAoB,KAAK,WAAW,cAAc,iBAAiB,IAAI,KAAA;KACnF,IAAI,WAAW,WAAW,KAAK,SAAS;IAC1C;IAGA,IAAI,IAAI,aAAa,cAAc,mBAAmB,WAAW,cAAc,qBAAqB;KAClG,IAAI,WAAW,cAAc,uBAAuB,IAAI,aAAa,cAAc,iBACjF,MAAM,IAAI,IAAI,wCACZ,4BAA4B,IAAI,aAAa,UAAU,+BAA+B,WAAW,UAAU,IAC3G,KAAK,OACP;KAKF,IAAI,WAAW,cAAc,aAAa,SAAS;MACjD,aAAa,WAAW,WAAW,EAAE,WAAW,aAAa,OAAO,CAAC;MACrE,WAAW,KAAK,UAAU;KAC5B;KAEA,IAAI,CAAC,WAEH,OAAO,EACL,MAAM,IAAI,WACR,UAAU,SAAS;MACjB,cAAc;MACd,YAAY,IAAI,WAAW,SAAS;KACtC,CAAC,CACH,EACF;KAGF,IAAI,CAAC,WAAW,IACd,MAAM,IAAI,IAAI,mBACZ,qDAAqD,IAAI,aAAa,UAAU,4BAA4B,WAAW,UAAU,0BACnI;KAYF,OAAO,EACL,MAAM,IAVc,WACpB,UAAU,KAAK;MACb,cAAc;MACH;MACX,SAAS,IAAI,WAAW,SAAS;MACjC,OAAO,IAAI,WAAW,WAAW,EAAE;KACrC,CAAC,CAIa,EAChB;IACF;IAGA,IAAI,CAAC,WACH,MAAM,IAAI,IAAI,mBAAmB,oDAAoD;IAMvF,KACG,IAAI,aAAa,cAAc,qBAC9B,IAAI,aAAa,cAAc,oBAC/B,IAAI,aAAa,cAAc,oBAC/B,IAAI,aAAa,cAAc,cACjC,WAAW,cAAc,aAAa,SACtC;KACA,aAAa,WAAW,WAAW,EAAE,WAAW,aAAa,OAAO,CAAC;KACrE,WAAW,KAAK,UAAU;IAC5B;IAEA,MAAM,EAAE,yBAAyB,oBAAoB;KACnD,OAAO,KAAK,SAAS,YAAY;KACjC;KACA,cAAc,IAAI;KAClB,cAAc;KACd;KACA;IACF,CAAC;IAED,gBAAgB;IAChB,WAAW,KAAK,oBAAoB;GACtC,OACE,MAAM,IAAI,IAAI,mBAAmB,sCAAsC;GAGzE,IAAI,WAAW,cAAc,qBAC3B,MAAM,IAAI,IAAI,wCACZ,yBAAyB,WAAW,UAAU,gEAC9C,KAAK,OACP;GAGF,MAAM,aAAa,KAAK,kBAAkB,cAAc,aAAa;GACrE,IAAI,sBAAsB,UAAU;GACpC,IAAI,iCAAiC,YAAY,WAAW,SAAS;GACrE,IAAI,uBAAuB,UAAU;GAQrC,OAAO,EACL,MAPgB,YAAY;IAC5B,KAAK;IACL;IACA;GACF,CAGgB,EAChB;EACF,SAAS,OAAO;GACd,IAAI,iBAAiB,IAAI,oBAAoB,MAAM;GACnD,MAAM,IAAI,IAAI,mBAAmB,6BAA6B,EAAE,OAAO,MAAM,CAAC;EAChF,UAAU;GAER,KAAK,MAAM,OAAO,YAChB,IAAI,OAAO,KAAK;EAEpB;CACF;CAEA,sBAA8B,WAA+D;EAC3F,MAAM,UAAU,0BAA0B,aAAa;EACvD,IAAI,CAAC,SACH,MAAM,IAAI,IAAI,wCACZ,4CAA4C,UAAU,IACtD,KAAK,OACP;EAGF,OAAO;CACT;CAEA,wBAAgC,KAAa,KAA6D;EACxG,MAAM,SAAS,iBAAiB;EAChC,IAAI,CAAC,QACH,MAAM,IAAI,IAAI,wCAAwC,QAAQ,IAAI,aAAa,IAAI,IAAI,KAAK,OAAO;EAGrG,OAAO;CACT;CAEA,WAAmB,cAA4B,KAA2C;EASxF,OAAO,IARS,IACd,KAAK,SAAS,YAAY,CAAC,CAAC,WAAW,EAGrC,KAAK,IAAI,WAAW,YAAY,aAAa,GAAG,CAAC,EACnD,CAAC,CAGM;CACX;CAEA,yCACE,aACA,WACA;EACA,MAAM,2BAA2B,iBAAiB;EAClD,IAAI,CAAC,0BACH,MAAM,IAAI,IAAI,wCAAwC,6BAA6B,UAAU,IAAI,OAAO;EAG1G,OAAO,IAAI,gBAAgB;GACzB,WAAW;GACX,WAAW,IAAI,WAAW,WAAW;EACvC,CAAC;CACH;CAEA,iBAAyB,cAA4B,KAAU,kBAA8C;EAG3G,IAAI,4BAA4B,SAAS,IAAI,SAAS,GACpD,OAAO,IAAI,wBAAwB;GAAE,GAAG;GAAkB,KAAK;EAAM,CAAqB;EAM5F,MAAM,EAAE,KAAK,GAAG,cAAc,KAAK,MACjC,KAAK,SAAS,YAAY,CAAC,CAAC,gBAAgB;GAC1C,gBAAgB,IAAI;GACpB,WAAW,IAAI;EACjB,CAAC,CACH;EAEA,OAAO,IAAI,wBAAwB;GAAE,GAAG;GAAkB,GAAG;EAAU,CAAqB;CAC9F;CAEA,kBAA0B,cAA4B,KAAU,mBAAgD;EAM9G,MAAM,EAAE,KAAK,GAAG,cAAc,YAAY,eACxC,KAAK,SAAS,YAAY,CAAC,CAAC,gBAAgB,EAC1C,gBAAgB,IAAI,OACtB,CAAC,CACH;EAEA,OAAO;GACL,GAAG;GACH,GAAG;EACL;CACF;CAEA,MAAc,cAAc,cAA4B,OAA+C;EACrG,OAAO,MAAM,KAAK,YAAY,cAAc,OAAO,YAAY;GAC7D,IAAI,CAAC,QAAQ,QAAQ,MAAM,MAAM,0CAA0C;GAG3E,MAAM,SAAS,MAAM,KAAK,SAAS,YAAY,CAAC,CAAC,gBAAgB;IAC/D,WAAW;IACX,MAAM;IACN,eAAe,QAAQ;GACzB,CAAC;GACD,IAAI,CAAC,QAAQ,OAAO;GAGpB,MAAM,eAAe,IAAI,aAAa,EAAE,OAAO,CAAC;GAGhD,MAAM,iBAFW,aAAa,gBAAgB,CAEhB,CAAC,CAAC,OAAO;GACvC,aAAa,OAAO,KAAK;GAEzB,OAAO;EACT,CAAC;CACH;CAEA,MAAc,eAAe,cAA4B,OAAe;EACtE,MAAM,aAAa,MAAM,KAAK,cAAc,cAAc,KAAK;EAC/D,IAAI,CAAC,YACH,MAAM,IAAI,IAAI,8BAA8B,OAAO,CAAC,KAAK,OAAO,CAAC;EAGnE,OAAO;CACT;CAEA,SAAiB,cAA4B;EAC3C,OAAO,aAAa,QAAQ,iBAAiB,CAAC,CAAC;CACjD;AACF;AA13BE,0BAAuB,UAAU;AAGjC,0BAAe,eAAoF;CACjG,OAAO,mBAAmB;CAC1B,SAAS,mBAAmB;CAC5B,QAAQ,mBAAmB;CAC3B,OAAO,mBAAmB;CAC1B,OAAO,mBAAmB;AAC5B"}
+{"version":3,"file":"AskarKeyManagementService.mjs","names":[],"sources":["../../src/kms/AskarKeyManagementService.ts"],"sourcesContent":["import { type AgentContext, JsonEncoder, Kms, TypedArrayEncoder, utils } from '@credo-ts/core'\nimport type { JwkProps, KeyEntryObject, Session } from '@openwallet-foundation/askar-shared'\nimport {\n  CryptoBox,\n  Jwk,\n  Key,\n  KeyAlgorithm,\n  KeyEntryList,\n  SignatureAlgorithm,\n} from '@openwallet-foundation/askar-shared'\nimport { AskarModuleConfig } from '../AskarModuleConfig'\nimport { AskarStoreManager } from '../AskarStoreManager'\nimport { AskarErrorCode, isAskarError, jwkCrvToAskarAlg, jwkEncToAskarAlg } from '../utils'\nimport { aeadDecrypt } from './crypto/decrypt'\nimport { askarSupportedKeyAgreementAlgorithms, deriveDecryptionKey, deriveEncryptionKey } from './crypto/deriveKey'\nimport { type AskarSupportedEncryptionOptions, aeadEncrypt } from './crypto/encrypt'\nimport { askarSupportedHpkeAlgorithms, hpkeOpen, hpkeSeal } from './crypto/hpke'\nimport { randomBytes } from './crypto/randomBytes'\n\nconst askarSymmetricKeyAlgorithms: KeyAlgorithm[] = Object.values(jwkEncToAskarAlg)\n\nconst askarSupportedEncryptionAlgorithms = [\n  ...(Object.keys(jwkEncToAskarAlg) as Array<keyof typeof jwkEncToAskarAlg>),\n  'XSALSA20-POLY1305',\n] satisfies Array<Kms.KnownJwaContentEncryptionAlgorithm | Kms.KnownJwaKeyEncryptionAlgorithm>\n\nexport class AskarKeyManagementService implements Kms.KeyManagementService {\n  public static readonly backend = 'askar'\n  public readonly backend = AskarKeyManagementService.backend\n\n  private static algToSigType: Partial<Record<Kms.KnownJwaSignatureAlgorithm, SignatureAlgorithm>> = {\n    EdDSA: SignatureAlgorithm.EdDSA,\n    Ed25519: SignatureAlgorithm.EdDSA,\n    ES256K: SignatureAlgorithm.ES256K,\n    ES256: SignatureAlgorithm.ES256,\n    ES384: SignatureAlgorithm.ES384,\n  }\n\n  private withSession<Return>(agentContext: AgentContext, callback: (session: Session) => Return) {\n    return agentContext.dependencyManager.resolve(AskarStoreManager).withSession(agentContext, callback)\n  }\n\n  public isOperationSupported(_agentContext: AgentContext, operation: Kms.KmsOperation): boolean {\n    if (operation.operation === 'deleteKey') return true\n    if (operation.operation === 'randomBytes') return true\n\n    if (operation.operation === 'importKey') {\n      if (operation.privateJwk.kty === 'EC' || operation.privateJwk.kty === 'OKP') {\n        return jwkCrvToAskarAlg[operation.privateJwk.crv] !== undefined\n      }\n\n      // RSA/oct not supported\n      return false\n    }\n\n    if (operation.operation === 'createKey') {\n      if (operation.type.kty === 'EC' || operation.type.kty === 'OKP') {\n        return jwkCrvToAskarAlg[operation.type.crv] !== undefined\n      }\n\n      if (operation.type.kty === 'oct') {\n        if (operation.type.algorithm === 'C20P') return true\n\n        // TODO: sync with the createKey code\n        if (operation.type.algorithm === 'aes') {\n          return [128, 256].includes(operation.type.length)\n        }\n      }\n\n      return false\n    }\n\n    if (operation.operation === 'sign' || operation.operation === 'verify') {\n      return AskarKeyManagementService.algToSigType[operation.algorithm] !== undefined\n    }\n\n    if (operation.operation === 'encrypt' || operation.operation === 'decrypt') {\n      const encryption = operation.operation === 'encrypt' ? operation.encryption : operation.decryption\n\n      // Askar can only perform key agreement with curves it supports. We also can't create the\n      // ephemeral key for e.g. ECDH-ES if the curve is not supported.\n      if (\n        operation.keyAgreement &&\n        'externalPublicJwk' in operation.keyAgreement &&\n        operation.keyAgreement.externalPublicJwk &&\n        jwkCrvToAskarAlg[operation.keyAgreement.externalPublicJwk.crv] === undefined\n      ) {\n        return false\n      }\n\n      // HPKE is an integrated encryption mode: the suite fixes the AEAD, so the HPKE key agreement\n      // algorithm is all there is to check.\n      if (encryption.algorithm === 'HPKE') {\n        if (!operation.keyAgreement || !Kms.isJwaHpkeAlgorithm(operation.keyAgreement.algorithm)) return false\n\n        return askarSupportedHpkeAlgorithms.includes(\n          operation.keyAgreement.algorithm as (typeof askarSupportedHpkeAlgorithms)[number]\n        )\n      }\n\n      if (\n        !askarSupportedEncryptionAlgorithms.includes(\n          encryption.algorithm as (typeof askarSupportedEncryptionAlgorithms)[number]\n        )\n      ) {\n        return false\n      }\n      if (!operation.keyAgreement) return true\n\n      return askarSupportedKeyAgreementAlgorithms.includes(\n        operation.keyAgreement.algorithm as (typeof askarSupportedKeyAgreementAlgorithms)[number]\n      )\n    }\n\n    return false\n  }\n\n  public randomBytes(_agentContext: AgentContext, options: Kms.KmsRandomBytesOptions): Kms.KmsRandomBytesReturn {\n    return randomBytes(options.length)\n  }\n\n  public async getPublicKey(agentContext: AgentContext, keyId: string): Promise<Kms.KmsJwkPublic | null> {\n    const key = await this.fetchAskarKey(agentContext, keyId)\n    if (!key) return null\n\n    return this.publicJwkFromKey(agentContext, key.key, { kid: keyId })\n  }\n\n  public async importKey<Jwk extends Kms.KmsJwkPrivate>(\n    agentContext: AgentContext,\n    options: Kms.KmsImportKeyOptions<Jwk>\n  ): Promise<Kms.KmsImportKeyReturn<Jwk>> {\n    const { kid } = options.privateJwk\n\n    const privateJwk = {\n      ...options.privateJwk,\n      kid: kid ?? utils.uuid(),\n    }\n\n    let key: Key | undefined\n    try {\n      if (privateJwk.kty === 'oct') {\n        // TODO: we need to look at how to import symmetric keys, as we need the alg\n        // Should we do the same as we do for createKey?\n        throw new Kms.KeyManagementAlgorithmNotSupportedError(\n          `importing keys with kty '${privateJwk.kty}'`,\n          this.backend\n        )\n      }\n      if (privateJwk.kty === 'EC' || privateJwk.kty === 'OKP') {\n        // Throws error if not supported\n        this.assertAskarAlgForJwkCrv(privateJwk.kty, privateJwk.crv)\n\n        key = Key.fromJwk({ jwk: Jwk.fromJson(privateJwk) })\n      }\n\n      const _key = key\n      if (!_key) {\n        throw new Kms.KeyManagementAlgorithmNotSupportedError(`kty '${privateJwk.kty}'`, this.backend)\n      }\n\n      await this.withSession(agentContext, (session) => session.insertKey({ name: privateJwk.kid, key: _key }))\n      const publicJwk = Kms.publicJwkFromPrivateJwk(privateJwk)\n\n      return {\n        keyId: privateJwk.kid,\n        publicJwk: {\n          ...publicJwk,\n          kid: privateJwk.kid,\n        },\n      } as Kms.KmsImportKeyReturn<Jwk>\n    } catch (error) {\n      if (error instanceof Kms.KeyManagementError) throw error\n\n      // Handle case where key already exists\n      if (isAskarError(error, AskarErrorCode.Duplicate)) {\n        throw new Kms.KeyManagementKeyExistsError(privateJwk.kid, this.backend)\n      }\n\n      throw new Kms.KeyManagementError('Error importing key', { cause: error })\n    } finally {\n      key?.handle.free()\n    }\n  }\n\n  public async deleteKey(agentContext: AgentContext, options: Kms.KmsDeleteKeyOptions): Promise<boolean> {\n    try {\n      await this.withSession(agentContext, (session) => session.removeKey({ name: options.keyId }))\n      return true\n    } catch (error) {\n      // Handle case where key does not exist\n      if (isAskarError(error, AskarErrorCode.NotFound)) {\n        return false\n      }\n\n      throw new Kms.KeyManagementError(`Error deleting key with id '${options.keyId}'`, { cause: error })\n    }\n  }\n\n  public async createKey<Type extends Kms.KmsCreateKeyType>(\n    agentContext: AgentContext,\n    options: Kms.KmsCreateKeyOptions<Type>\n  ): Promise<Kms.KmsCreateKeyReturn<Type>> {\n    const { type, keyId } = options\n\n    // FIXME: we should maybe keep the default keyId as publicKeyBase58 for a while for now, so it doesn't break\n    // Or we need a way to query a key based on the public key?\n    const kid = keyId ?? utils.uuid()\n    let askarKey: Key | undefined\n    try {\n      if (type.kty === 'EC' || type.kty === 'OKP') {\n        const keyAlg = this.assertAskarAlgForJwkCrv(type.kty, type.crv)\n        askarKey = Key.generate(keyAlg)\n      } else if (type.kty === 'oct') {\n        // NOTE: askar is more specific in the intended use of the key at time of generation.\n        // We either need to allow for this on a higher level (should be possible using `alg`)\n        // but as the keys are the same it's ok to just always pick one and if used for another\n        // purpose we can see them as the same.\n        if (type.algorithm === 'aes') {\n          const lengthToKeyAlg: Record<number, KeyAlgorithm | undefined> = {\n            128: KeyAlgorithm.AesA128Gcm,\n            256: KeyAlgorithm.AesA256Gcm,\n            512: KeyAlgorithm.AesA256CbcHs512,\n          }\n\n          const keyAlg = lengthToKeyAlg[type.length]\n          if (!keyAlg) {\n            throw new Kms.KeyManagementAlgorithmNotSupportedError(\n              `length '${type.length}' for kty '${type.kty}' with algorithm '${type.algorithm}'. Supported length values are ${Object.keys(lengthToKeyAlg).join(', ')}`,\n              this.backend\n            )\n          }\n\n          askarKey = Key.generate(keyAlg)\n        } else if (type.algorithm === 'C20P') {\n          // Both X and non-X variant can be used with the same key\n          askarKey = Key.generate(KeyAlgorithm.Chacha20C20P)\n        } else {\n          throw new Kms.KeyManagementAlgorithmNotSupportedError(\n            `algorithm '${type.algorithm}' for kty '${type.kty}'`,\n            this.backend\n          )\n        }\n      }\n\n      const _key = askarKey\n      if (!_key) {\n        throw new Kms.KeyManagementAlgorithmNotSupportedError(`kty '${type.kty}'`, this.backend)\n      }\n\n      const publicJwk = this.publicJwkFromKey(agentContext, _key, { kid }) as Kms.KmsCreateKeyReturn<Type>['publicJwk']\n      await this.withSession(agentContext, (session) => session.insertKey({ name: kid, key: _key }))\n\n      return {\n        publicJwk,\n        keyId: kid,\n      } as Kms.KmsCreateKeyReturn<Type>\n    } catch (error) {\n      if (error instanceof Kms.KeyManagementError) throw error\n\n      // Handle case where key already exists\n      if (isAskarError(error, AskarErrorCode.Duplicate)) {\n        throw new Kms.KeyManagementKeyExistsError(kid, this.backend)\n      }\n\n      throw new Kms.KeyManagementError('Error creating key', { cause: error })\n    } finally {\n      askarKey?.handle.free()\n    }\n  }\n\n  public async sign(agentContext: AgentContext, options: Kms.KmsSignOptions): Promise<Kms.KmsSignReturn> {\n    const { keyId, algorithm, data } = options\n\n    // 1. Retrieve the key\n    const key = await this.getKeyAsserted(agentContext, keyId)\n    try {\n      const sigType = this.assertedSigTypeForAlg(algorithm)\n      // Askar has a bug with loading symmetric keys, but we shouldn't get here as I don't think askar\n      // support signing with symmetric keys, and we don't support it (it will be caught by assertedSigTypeForAlg)\n      if (!key.key) {\n        throw new Kms.KeyManagementAlgorithmNotSupportedError(`algorithm ${algorithm}`, this.backend)\n      }\n\n      // TODO: we should extend this with metadata properties (e.g. use, key_ops)\n      const publicJwk = this.publicJwkFromKey(agentContext, key.key, { kid: keyId })\n      const privateJwk = this.privateJwkFromKey(agentContext, key.key, { kid: keyId })\n\n      // 2. Validate alg and use for key\n      Kms.assertAllowedSigningAlgForKey(privateJwk, algorithm)\n      Kms.assertKeyAllowsSign(publicJwk)\n\n      // 3. Perform the signing operation\n      const signature = key.key.signMessage({\n        message: new Uint8Array(data),\n        sigType,\n      })\n\n      return {\n        signature: new Uint8Array(signature),\n      }\n    } catch (error) {\n      if (error instanceof Kms.KeyManagementError) throw error\n      throw new Kms.KeyManagementError('Error signing with key', { cause: error })\n    } finally {\n      key.key?.handle.free()\n    }\n  }\n\n  public async verify(agentContext: AgentContext, options: Kms.KmsVerifyOptions): Promise<Kms.KmsVerifyReturn> {\n    const { algorithm, data, signature, key: keyInput } = options\n\n    // Get askar sig type (and handles unsupported alg)\n    const sigType = this.assertedSigTypeForAlg(algorithm)\n\n    // Retrieve the key\n    let askarKey: Key | undefined\n\n    try {\n      if (keyInput.keyId) {\n        askarKey = (await this.getKeyAsserted(agentContext, keyInput.keyId)).key\n      } else if (keyInput.publicJwk?.kty === 'EC' || keyInput.publicJwk?.kty === 'OKP') {\n        // Throws error if not supported\n        this.assertAskarAlgForJwkCrv(keyInput.publicJwk.kty, keyInput.publicJwk.crv)\n\n        askarKey = Key.fromJwk({ jwk: Jwk.fromJson(keyInput.publicJwk as JwkProps) })\n      } else {\n        throw new Kms.KeyManagementAlgorithmNotSupportedError(`kty ${keyInput.publicJwk?.kty}`, this.backend)\n      }\n\n      // Askar has a bug with loading symmetric keys, but we shouldn't get here as I don't think askar\n      // support signing with symmetric keys, and we don't support it (it will be caught by assertedSigTypeForAlg)\n      if (!askarKey) {\n        throw new Kms.KeyManagementAlgorithmNotSupportedError(`algorithm ${algorithm}`, this.backend)\n      }\n\n      const keyId = keyInput.keyId ?? keyInput.publicJwk?.kid\n      const publicJwk = this.publicJwkFromKey(agentContext, askarKey, { kid: keyId })\n\n      // For symmetric verificdation we need the private key\n      if (publicJwk.kty === 'oct') {\n        const privateJwk = this.privateJwkFromKey(agentContext, askarKey, { kid: keyId })\n\n        // 2. Validate alg and use for key\n        Kms.assertAllowedSigningAlgForKey(privateJwk, algorithm)\n        Kms.assertKeyAllowsVerify(publicJwk)\n      } else {\n        // 2. Validate alg and use for key\n        Kms.assertAllowedSigningAlgForKey(publicJwk, algorithm)\n        Kms.assertKeyAllowsVerify(publicJwk)\n      }\n\n      // 4. Perform the verify operation\n      const verified = askarKey.verifySignature({\n        message: new Uint8Array(data),\n        signature: new Uint8Array(signature),\n        sigType,\n      })\n      if (verified) {\n        return {\n          verified: true,\n          publicJwk: keyInput.keyId\n            ? this.publicJwkFromKey(agentContext, askarKey, { kid: keyId })\n            : (keyInput.publicJwk as Kms.KmsJwkPublic),\n        }\n      }\n\n      return {\n        verified: false,\n      }\n    } catch (error) {\n      if (error instanceof Kms.KeyManagementError) throw error\n      throw new Kms.KeyManagementError('Error verifying with key', { cause: error })\n    } finally {\n      if (askarKey) askarKey.handle.free()\n    }\n  }\n\n  public async encrypt(agentContext: AgentContext, options: Kms.KmsEncryptOptions): Promise<Kms.KmsEncryptReturn> {\n    const { data, encryption, key } = options\n\n    if (encryption.algorithm === 'HPKE') {\n      if (!key.keyAgreement || !Kms.isKmsKeyAgreementEncryptHpke(key.keyAgreement)) {\n        throw new Kms.KeyManagementError(\n          `Encryption algorithm 'HPKE' can only be used with an integrated-encryption HPKE key agreement algorithm`\n        )\n      }\n\n      const { keyAgreement } = key\n      Kms.assertAllowedKeyDerivationAlgForKey(keyAgreement.externalPublicJwk, keyAgreement.algorithm)\n      Kms.assertKeyAllowsDerive(keyAgreement.externalPublicJwk)\n\n      try {\n        return await hpkeSeal({\n          algorithm: keyAgreement.algorithm,\n          recipientPublicJwk: keyAgreement.externalPublicJwk,\n          data,\n          info: keyAgreement.info,\n          aad: encryption.aad,\n        })\n      } catch (error) {\n        if (error instanceof Kms.KeyManagementError) throw error\n        throw new Kms.KeyManagementError('Error encrypting with key', { cause: error })\n      }\n    }\n\n    Kms.assertSupportedEncryptionAlgorithm(encryption, askarSupportedEncryptionAlgorithms, this.backend)\n\n    const keysToFree: Key[] = []\n    try {\n      let encryptionKey: Key | undefined\n      let encryptedKey: Kms.KmsEncryptedKey | undefined\n\n      // TODO: we should check if the key allows this operation\n      if (key.keyId) {\n        encryptionKey = (await this.getKeyAsserted(agentContext, key.keyId)).key\n\n        keysToFree.push(encryptionKey)\n      } else if (key.privateJwk) {\n        if (encryption.algorithm === 'XSALSA20-POLY1305') {\n          throw new Kms.KeyManagementAlgorithmNotSupportedError(\n            `encryption algorithm '${encryption.algorithm}' is only supported in combination with key agreement algorithm '${Kms.KnownJwaKeyAgreementAlgorithms.ECDH_HSALSA20}'`,\n            this.backend\n          )\n        }\n        encryptionKey = this.keyFromSecretBytesAndEncryptionAlgorithm(\n          TypedArrayEncoder.fromBase64Url(key.privateJwk.k),\n          encryption.algorithm\n        )\n        keysToFree.push(encryptionKey)\n      } else if (key.keyAgreement) {\n        Kms.assertAllowedKeyDerivationAlgForKey(key.keyAgreement.externalPublicJwk, key.keyAgreement.algorithm)\n        Kms.assertKeyAllowsDerive(key.keyAgreement.externalPublicJwk)\n        Kms.assertSupportedKeyAgreementAlgorithm(key.keyAgreement, askarSupportedKeyAgreementAlgorithms, this.backend)\n\n        let privateKey = key.keyAgreement.keyId\n          ? (await this.getKeyAsserted(agentContext, key.keyAgreement.keyId)).key\n          : undefined\n        if (privateKey) keysToFree.push(privateKey)\n\n        const privateJwk = privateKey ? this.privateJwkFromKey(agentContext, privateKey) : undefined\n        if (privateJwk) {\n          Kms.assertJwkAsymmetric(privateJwk, key.keyAgreement.keyId)\n          Kms.assertAllowedKeyDerivationAlgForKey(privateJwk, key.keyAgreement.algorithm)\n          Kms.assertKeyAllowsDerive(privateJwk)\n\n          // Special case, for DIDComm v1 we often use an X25519 for the external key\n          // but we use an Ed25519 for our key\n          if (key.keyAgreement.algorithm !== 'ECDH-HSALSA20') {\n            Kms.assertAsymmetricJwkKeyTypeMatches(privateJwk, key.keyAgreement.externalPublicJwk)\n          }\n        }\n\n        const recipientKey = this.keyFromJwk(agentContext, key.keyAgreement.externalPublicJwk)\n        keysToFree.push(recipientKey)\n\n        // Special case to support DIDComm v1\n        if (key.keyAgreement.algorithm === 'ECDH-HSALSA20' || encryption.algorithm === 'XSALSA20-POLY1305') {\n          if (encryption.algorithm !== 'XSALSA20-POLY1305' || key.keyAgreement.algorithm !== 'ECDH-HSALSA20') {\n            throw new Kms.KeyManagementAlgorithmNotSupportedError(\n              `key agreement algorithm '${key.keyAgreement.algorithm}' with encryption algorithm '${encryption.algorithm}'`,\n              this.backend\n            )\n          }\n\n          // anonymous encryption\n          if (!privateKey) {\n            return {\n              encrypted: new Uint8Array(\n                CryptoBox.seal({\n                  recipientKey,\n                  message: new Uint8Array(data),\n                })\n              ),\n            }\n          }\n\n          // Special case. For DIDComm v1 we basically use the Ed25519 key also\n          // for X25519 operations.\n          if (privateKey.algorithm === KeyAlgorithm.Ed25519) {\n            privateKey = privateKey.convertkey({ algorithm: KeyAlgorithm.X25519 })\n            keysToFree.push(privateKey)\n          }\n\n          const nonce = new Uint8Array(CryptoBox.randomNonce())\n          const encrypted = new Uint8Array(\n            CryptoBox.cryptoBox({\n              recipientKey,\n              senderKey: privateKey,\n              message: new Uint8Array(data),\n              nonce,\n            })\n          )\n\n          return {\n            encrypted,\n            iv: nonce,\n          }\n        }\n\n        // This should not happen, but for TS\n        if (!privateKey) {\n          throw new Kms.KeyManagementError('sender key is required for ECDH-ES key derivation.')\n        }\n\n        const { contentEncryptionKey, encryptedContentEncryptionKey } = deriveEncryptionKey({\n          askar: this.getAskar(agentContext),\n          encryption,\n          keyAgreement: key.keyAgreement,\n          recipientKey,\n          senderKey: privateKey,\n        })\n\n        encryptionKey = contentEncryptionKey\n        keysToFree.push(contentEncryptionKey)\n        encryptedKey = encryptedContentEncryptionKey\n      } else {\n        throw new Kms.KeyManagementError('Unexpected key parameter for encrypt')\n      }\n\n      if (encryption.algorithm === 'XSALSA20-POLY1305') {\n        throw new Kms.KeyManagementAlgorithmNotSupportedError(\n          `encryption algorithm '${encryption.algorithm}' can only be used with key agreement algorithm ECDH-HSALSA20`,\n          this.backend\n        )\n      }\n\n      const privateJwk = this.privateJwkFromKey(agentContext, encryptionKey)\n      Kms.assertKeyAllowsDerive(privateJwk)\n      Kms.assertAllowedEncryptionAlgForKey(privateJwk, encryption.algorithm)\n      Kms.assertKeyAllowsEncrypt(privateJwk)\n\n      const encrypted = aeadEncrypt({\n        key: encryptionKey,\n        data,\n        encryption,\n      })\n\n      return {\n        ...encrypted,\n        encryptedKey,\n      }\n    } catch (error) {\n      if (error instanceof Kms.KeyManagementError) throw error\n      throw new Kms.KeyManagementError('Error encrypting with key', { cause: error })\n    } finally {\n      // Clear all keys\n      for (const key of keysToFree) {\n        key.handle.free()\n      }\n    }\n  }\n\n  public async decrypt(agentContext: AgentContext, options: Kms.KmsDecryptOptions): Promise<Kms.KmsDecryptReturn> {\n    const { encrypted, decryption, key } = options\n\n    if (decryption.algorithm === 'HPKE') {\n      if (!key.keyAgreement || !Kms.isKmsKeyAgreementDecryptHpke(key.keyAgreement)) {\n        throw new Kms.KeyManagementError(\n          `Decryption algorithm 'HPKE' can only be used with an integrated-encryption HPKE key agreement algorithm`\n        )\n      }\n\n      const { keyAgreement } = key\n      const recipientKey = (await this.getKeyAsserted(agentContext, keyAgreement.keyId)).key\n\n      try {\n        const recipientPublicJwk = this.publicJwkFromKey(agentContext, recipientKey)\n        Kms.assertJwkAsymmetric(recipientPublicJwk, keyAgreement.keyId)\n        Kms.assertAllowedKeyDerivationAlgForKey(recipientPublicJwk, keyAgreement.algorithm)\n        Kms.assertKeyAllowsDerive(recipientPublicJwk)\n\n        return {\n          data: await hpkeOpen({\n            algorithm: keyAgreement.algorithm,\n            recipientKey,\n            recipientPublicJwk,\n            encapsulatedKey: keyAgreement.encapsulatedKey,\n            encrypted,\n            info: keyAgreement.info,\n            aad: decryption.aad,\n          }),\n        }\n      } catch (error) {\n        if (error instanceof Kms.KeyManagementError) throw error\n        throw new Kms.KeyManagementError('Error decrypting with key', { cause: error })\n      } finally {\n        recipientKey.handle.free()\n      }\n    }\n\n    Kms.assertSupportedEncryptionAlgorithm(decryption, askarSupportedEncryptionAlgorithms, this.backend)\n\n    const keysToFree: Key[] = []\n\n    try {\n      let decryptionKey: Key | undefined\n\n      if (key.keyId) {\n        decryptionKey = (await this.getKeyAsserted(agentContext, key.keyId)).key\n        keysToFree.push(decryptionKey)\n      } else if (key.privateJwk) {\n        if (decryption.algorithm === 'XSALSA20-POLY1305') {\n          throw new Kms.KeyManagementAlgorithmNotSupportedError(\n            `decryption algorithm '${decryption.algorithm}' is only supported in combination with key agreement algorithm '${Kms.KnownJwaKeyAgreementAlgorithms.ECDH_HSALSA20}'`,\n            this.backend\n          )\n        }\n        decryptionKey = this.keyFromSecretBytesAndEncryptionAlgorithm(\n          TypedArrayEncoder.fromBase64Url(key.privateJwk.k),\n          decryption.algorithm\n        )\n        keysToFree.push(decryptionKey)\n      } else if (key.keyAgreement) {\n        // Narrows away the integrated-encryption HPKE algorithms, which are handled above\n        Kms.assertSupportedKeyAgreementAlgorithm(key.keyAgreement, askarSupportedKeyAgreementAlgorithms, this.backend)\n\n        if (key.keyAgreement.externalPublicJwk) {\n          Kms.assertAllowedKeyDerivationAlgForKey(key.keyAgreement.externalPublicJwk, key.keyAgreement.algorithm)\n          Kms.assertKeyAllowsDerive(key.keyAgreement.externalPublicJwk)\n        }\n\n        let privateKey = (await this.getKeyAsserted(agentContext, key.keyAgreement.keyId)).key\n        keysToFree.push(privateKey)\n\n        const privateJwk = this.privateJwkFromKey(agentContext, privateKey)\n\n        Kms.assertJwkAsymmetric(privateJwk, key.keyAgreement.keyId)\n        Kms.assertAllowedKeyDerivationAlgForKey(privateJwk, key.keyAgreement.algorithm)\n        Kms.assertKeyAllowsDerive(privateJwk)\n\n        // Special case for ECDH-HSALSA as we can have mismatch between keys because of DIDComm v1\n        if (key.keyAgreement.externalPublicJwk && key.keyAgreement.algorithm !== 'ECDH-HSALSA20') {\n          Kms.assertAsymmetricJwkKeyTypeMatches(privateJwk, key.keyAgreement.externalPublicJwk)\n        }\n\n        const senderKey = key.keyAgreement.externalPublicJwk\n          ? this.keyFromJwk(agentContext, key.keyAgreement.externalPublicJwk)\n          : undefined\n        if (senderKey) keysToFree.push(senderKey)\n\n        // Special case to support DIDComm v1\n        if (key.keyAgreement.algorithm === 'ECDH-HSALSA20' || decryption.algorithm === 'XSALSA20-POLY1305') {\n          if (decryption.algorithm !== 'XSALSA20-POLY1305' || key.keyAgreement.algorithm !== 'ECDH-HSALSA20') {\n            throw new Kms.KeyManagementAlgorithmNotSupportedError(\n              `key agreement algorithm '${key.keyAgreement.algorithm}' with encryption algorithm '${decryption.algorithm}'`,\n              this.backend\n            )\n          }\n\n          // Special case. For DIDComm v1 we basically use the Ed25519 key also\n          // for X25519 operations.\n          if (privateKey.algorithm === KeyAlgorithm.Ed25519) {\n            privateKey = privateKey.convertkey({ algorithm: KeyAlgorithm.X25519 })\n            keysToFree.push(privateKey)\n          }\n\n          if (!senderKey) {\n            // anonymous encryption\n            return {\n              data: new Uint8Array(\n                CryptoBox.sealOpen({\n                  recipientKey: privateKey,\n                  ciphertext: new Uint8Array(encrypted),\n                })\n              ),\n            }\n          }\n\n          if (!decryption.iv) {\n            throw new Kms.KeyManagementError(\n              `Missing required 'iv' for key agreement algorithm ${key.keyAgreement.algorithm} and encryption algorithm ${decryption.algorithm} with sender key defined.`\n            )\n          }\n\n          const decrypted = new Uint8Array(\n            CryptoBox.open({\n              recipientKey: privateKey,\n              senderKey: senderKey,\n              message: new Uint8Array(encrypted),\n              nonce: new Uint8Array(decryption.iv),\n            })\n          )\n\n          return {\n            data: decrypted,\n          }\n        }\n\n        // This should not happen, but for TS\n        if (!senderKey) {\n          throw new Kms.KeyManagementError('sender key is required for ECDH-ES key derivation.')\n        }\n\n        const { contentEncryptionKey } = deriveDecryptionKey({\n          askar: this.getAskar(agentContext),\n          decryption,\n          keyAgreement: key.keyAgreement,\n          recipientKey: privateKey,\n          senderKey,\n        })\n\n        decryptionKey = contentEncryptionKey\n        keysToFree.push(contentEncryptionKey)\n      } else {\n        throw new Kms.KeyManagementError('Unexpected key parameter for decrypt')\n      }\n\n      if (decryption.algorithm === 'XSALSA20-POLY1305') {\n        throw new Kms.KeyManagementAlgorithmNotSupportedError(\n          `encryption algorithm '${decryption.algorithm}' can only be used with key agreement algorithm ECDH-HSALSA20`,\n          this.backend\n        )\n      }\n\n      const privateJwk = this.privateJwkFromKey(agentContext, decryptionKey)\n      Kms.assertKeyAllowsDerive(privateJwk)\n      Kms.assertAllowedEncryptionAlgForKey(privateJwk, decryption.algorithm)\n      Kms.assertKeyAllowsEncrypt(privateJwk)\n\n      const decrypted = aeadDecrypt({\n        key: decryptionKey,\n        encrypted,\n        decryption,\n      })\n\n      return {\n        data: decrypted,\n      }\n    } catch (error) {\n      if (error instanceof Kms.KeyManagementError) throw error\n      throw new Kms.KeyManagementError('Error decrypting with key', { cause: error })\n    } finally {\n      // Clear all keys\n      for (const key of keysToFree) {\n        key.handle.free()\n      }\n    }\n  }\n\n  private assertedSigTypeForAlg(algorithm: Kms.KnownJwaSignatureAlgorithm): SignatureAlgorithm {\n    const sigType = AskarKeyManagementService.algToSigType[algorithm]\n    if (!sigType) {\n      throw new Kms.KeyManagementAlgorithmNotSupportedError(\n        `signing and verification with algorithm '${algorithm}'`,\n        this.backend\n      )\n    }\n\n    return sigType\n  }\n\n  private assertAskarAlgForJwkCrv(kty: string, crv: Kms.KmsJwkPublicEc['crv'] | Kms.KmsJwkPublicOkp['crv']) {\n    const keyAlg = jwkCrvToAskarAlg[crv]\n    if (!keyAlg) {\n      throw new Kms.KeyManagementAlgorithmNotSupportedError(`crv '${crv}' for kty '${kty}'`, this.backend)\n    }\n\n    return keyAlg\n  }\n\n  private keyFromJwk(agentContext: AgentContext, jwk: Kms.KmsJwkPrivate | Kms.KmsJwkPublic) {\n    const key = new Key(\n      this.getAskar(agentContext).keyFromJwk({\n        // TODO: the JWK class in JS Askar wrapper is too limiting\n        // so we use this method directly. should update it\n        jwk: new Uint8Array(JsonEncoder.toUint8Array(jwk)) as unknown as Jwk,\n      })\n    )\n\n    return key\n  }\n\n  private keyFromSecretBytesAndEncryptionAlgorithm(\n    secretBytes: Uint8Array,\n    algorithm: AskarSupportedEncryptionOptions['algorithm']\n  ) {\n    const askarEncryptionAlgorithm = jwkEncToAskarAlg[algorithm]\n    if (!askarEncryptionAlgorithm) {\n      throw new Kms.KeyManagementAlgorithmNotSupportedError(`JWA encryption algorithm '${algorithm}'`, 'askar')\n    }\n\n    return Key.fromSecretBytes({\n      algorithm: askarEncryptionAlgorithm,\n      secretKey: new Uint8Array(secretBytes),\n    })\n  }\n\n  private publicJwkFromKey(agentContext: AgentContext, key: Key, partialJwkPublic?: Partial<Kms.KmsJwkPublic>) {\n    // Askar has no public jwk representation for symmetric keys, and there's nothing\n    // public about them besides the key type\n    if (askarSymmetricKeyAlgorithms.includes(key.algorithm)) {\n      return Kms.publicJwkFromPrivateJwk({ ...partialJwkPublic, kty: 'oct' } as Kms.KmsJwkPublic)\n    }\n\n    // TODO: the JWK class in JS Askar wrapper is too limiting\n    // so we use this method directly. should update it\n    // We extract alg, as Askar doesn't always use the same algs\n    const { alg, ...jwkPublic } = JSON.parse(\n      this.getAskar(agentContext).keyGetJwkPublic({\n        localKeyHandle: key.handle,\n        algorithm: key.algorithm,\n      })\n    )\n\n    return Kms.publicJwkFromPrivateJwk({ ...partialJwkPublic, ...jwkPublic } as Kms.KmsJwkPublic)\n  }\n\n  private privateJwkFromKey(agentContext: AgentContext, key: Key, partialJwkPrivate?: Partial<Kms.KmsJwkPrivate>) {\n    // TODO: once we support additional params we should add these here\n\n    // TODO: the JWK class in JS Askar wrapper is too limiting\n    // so we use this method directly. should update it\n    // We extract alg, as Askar doesn't always use the same algs\n    const { alg, ...jwkSecret } = JsonEncoder.fromUint8Array(\n      this.getAskar(agentContext).keyGetJwkSecret({\n        localKeyHandle: key.handle,\n      })\n    )\n\n    return {\n      ...partialJwkPrivate,\n      ...jwkSecret,\n    } as Kms.KmsJwkPrivate\n  }\n\n  private async fetchAskarKey(agentContext: AgentContext, keyId: string): Promise<KeyEntryObject | null> {\n    return await this.withSession(agentContext, async (session) => {\n      if (!session.handle) throw Error('Cannot fetch a key with a closed session')\n\n      // Fetch the key from the session\n      const handle = await this.getAskar(agentContext).sessionFetchKey({\n        forUpdate: false,\n        name: keyId,\n        sessionHandle: session.handle,\n      })\n      if (!handle) return null\n\n      // Get the key entry\n      const keyEntryList = new KeyEntryList({ handle })\n      const keyEntry = keyEntryList.getEntryByIndex(0)\n\n      const keyEntryObject = keyEntry.toJson()\n      keyEntryList.handle.free()\n\n      return keyEntryObject\n    })\n  }\n\n  private async getKeyAsserted(agentContext: AgentContext, keyId: string) {\n    const storageKey = await this.fetchAskarKey(agentContext, keyId)\n    if (!storageKey) {\n      throw new Kms.KeyManagementKeyNotFoundError(keyId, [this.backend])\n    }\n\n    return storageKey\n  }\n\n  private getAskar(agentContext: AgentContext) {\n    return agentContext.resolve(AskarModuleConfig).askar\n  }\n}\n"],"mappings":";;;;;;;;;;;;;AAmBA,MAAM,8BAA8C,OAAO,OAAO,gBAAgB;AAElF,MAAM,qCAAqC,CACzC,GAAI,OAAO,KAAK,gBAAgB,GAChC,mBACF;AAEA,IAAa,4BAAb,MAAa,0BAA8D;;EAEzE,KAAgB,UAAU,0BAA0B;;CAUpD,YAA4B,cAA4B,UAAwC;EAC9F,OAAO,aAAa,kBAAkB,QAAQ,iBAAiB,CAAC,CAAC,YAAY,cAAc,QAAQ;CACrG;CAEA,qBAA4B,eAA6B,WAAsC;EAC7F,IAAI,UAAU,cAAc,aAAa,OAAO;EAChD,IAAI,UAAU,cAAc,eAAe,OAAO;EAElD,IAAI,UAAU,cAAc,aAAa;GACvC,IAAI,UAAU,WAAW,QAAQ,QAAQ,UAAU,WAAW,QAAQ,OACpE,OAAO,iBAAiB,UAAU,WAAW,SAAS,KAAA;GAIxD,OAAO;EACT;EAEA,IAAI,UAAU,cAAc,aAAa;GACvC,IAAI,UAAU,KAAK,QAAQ,QAAQ,UAAU,KAAK,QAAQ,OACxD,OAAO,iBAAiB,UAAU,KAAK,SAAS,KAAA;GAGlD,IAAI,UAAU,KAAK,QAAQ,OAAO;IAChC,IAAI,UAAU,KAAK,cAAc,QAAQ,OAAO;IAGhD,IAAI,UAAU,KAAK,cAAc,OAC/B,OAAO,CAAC,KAAK,GAAG,CAAC,CAAC,SAAS,UAAU,KAAK,MAAM;GAEpD;GAEA,OAAO;EACT;EAEA,IAAI,UAAU,cAAc,UAAU,UAAU,cAAc,UAC5D,OAAO,0BAA0B,aAAa,UAAU,eAAe,KAAA;EAGzE,IAAI,UAAU,cAAc,aAAa,UAAU,cAAc,WAAW;GAC1E,MAAM,aAAa,UAAU,cAAc,YAAY,UAAU,aAAa,UAAU;GAIxF,IACE,UAAU,gBACV,uBAAuB,UAAU,gBACjC,UAAU,aAAa,qBACvB,iBAAiB,UAAU,aAAa,kBAAkB,SAAS,KAAA,GAEnE,OAAO;GAKT,IAAI,WAAW,cAAc,QAAQ;IACnC,IAAI,CAAC,UAAU,gBAAgB,CAAC,IAAI,mBAAmB,UAAU,aAAa,SAAS,GAAG,OAAO;IAEjG,OAAO,6BAA6B,SAClC,UAAU,aAAa,SACzB;GACF;GAEA,IACE,CAAC,mCAAmC,SAClC,WAAW,SACb,GAEA,OAAO;GAET,IAAI,CAAC,UAAU,cAAc,OAAO;GAEpC,OAAO,qCAAqC,SAC1C,UAAU,aAAa,SACzB;EACF;EAEA,OAAO;CACT;CAEA,YAAmB,eAA6B,SAA8D;EAC5G,OAAO,YAAY,QAAQ,MAAM;CACnC;CAEA,MAAa,aAAa,cAA4B,OAAiD;EACrG,MAAM,MAAM,MAAM,KAAK,cAAc,cAAc,KAAK;EACxD,IAAI,CAAC,KAAK,OAAO;EAEjB,OAAO,KAAK,iBAAiB,cAAc,IAAI,KAAK,EAAE,KAAK,MAAM,CAAC;CACpE;CAEA,MAAa,UACX,cACA,SACsC;EACtC,MAAM,EAAE,QAAQ,QAAQ;EAExB,MAAM,aAAa;GACjB,GAAG,QAAQ;GACX,KAAK,OAAO,MAAM,KAAK;EACzB;EAEA,IAAI;EACJ,IAAI;GACF,IAAI,WAAW,QAAQ,OAGrB,MAAM,IAAI,IAAI,wCACZ,4BAA4B,WAAW,IAAI,IAC3C,KAAK,OACP;GAEF,IAAI,WAAW,QAAQ,QAAQ,WAAW,QAAQ,OAAO;IAEvD,KAAK,wBAAwB,WAAW,KAAK,WAAW,GAAG;IAE3D,MAAM,IAAI,QAAQ,EAAE,KAAK,IAAI,SAAS,UAAU,EAAE,CAAC;GACrD;GAEA,MAAM,OAAO;GACb,IAAI,CAAC,MACH,MAAM,IAAI,IAAI,wCAAwC,QAAQ,WAAW,IAAI,IAAI,KAAK,OAAO;GAG/F,MAAM,KAAK,YAAY,eAAe,YAAY,QAAQ,UAAU;IAAE,MAAM,WAAW;IAAK,KAAK;GAAK,CAAC,CAAC;GACxG,MAAM,YAAY,IAAI,wBAAwB,UAAU;GAExD,OAAO;IACL,OAAO,WAAW;IAClB,WAAW;KACT,GAAG;KACH,KAAK,WAAW;IAClB;GACF;EACF,SAAS,OAAO;GACd,IAAI,iBAAiB,IAAI,oBAAoB,MAAM;GAGnD,IAAI,aAAa,OAAA,CAA+B,GAC9C,MAAM,IAAI,IAAI,4BAA4B,WAAW,KAAK,KAAK,OAAO;GAGxE,MAAM,IAAI,IAAI,mBAAmB,uBAAuB,EAAE,OAAO,MAAM,CAAC;EAC1E,UAAU;GACR,KAAK,OAAO,KAAK;EACnB;CACF;CAEA,MAAa,UAAU,cAA4B,SAAoD;EACrG,IAAI;GACF,MAAM,KAAK,YAAY,eAAe,YAAY,QAAQ,UAAU,EAAE,MAAM,QAAQ,MAAM,CAAC,CAAC;GAC5F,OAAO;EACT,SAAS,OAAO;GAEd,IAAI,aAAa,OAAA,CAA8B,GAC7C,OAAO;GAGT,MAAM,IAAI,IAAI,mBAAmB,+BAA+B,QAAQ,MAAM,IAAI,EAAE,OAAO,MAAM,CAAC;EACpG;CACF;CAEA,MAAa,UACX,cACA,SACuC;EACvC,MAAM,EAAE,MAAM,UAAU;EAIxB,MAAM,MAAM,SAAS,MAAM,KAAK;EAChC,IAAI;EACJ,IAAI;GACF,IAAI,KAAK,QAAQ,QAAQ,KAAK,QAAQ,OAAO;IAC3C,MAAM,SAAS,KAAK,wBAAwB,KAAK,KAAK,KAAK,GAAG;IAC9D,WAAW,IAAI,SAAS,MAAM;GAChC,OAAO,IAAI,KAAK,QAAQ,OAAO;IAK7B,IAAI,KAAK,cAAc,OAAO;KAC5B,MAAM,iBAA2D;MAC/D,KAAK,aAAa;MAClB,KAAK,aAAa;MAClB,KAAK,aAAa;KACpB;KAEA,MAAM,SAAS,eAAe,KAAK;KACnC,IAAI,CAAC,QACH,MAAM,IAAI,IAAI,wCACZ,WAAW,KAAK,OAAO,aAAa,KAAK,IAAI,oBAAoB,KAAK,UAAU,iCAAiC,OAAO,KAAK,cAAc,CAAC,CAAC,KAAK,IAAI,KACtJ,KAAK,OACP;KAGF,WAAW,IAAI,SAAS,MAAM;IAChC,OAAO,IAAI,KAAK,cAAc,QAE5B,WAAW,IAAI,SAAS,aAAa,YAAY;SAEjD,MAAM,IAAI,IAAI,wCACZ,cAAc,KAAK,UAAU,aAAa,KAAK,IAAI,IACnD,KAAK,OACP;GAEJ;GAEA,MAAM,OAAO;GACb,IAAI,CAAC,MACH,MAAM,IAAI,IAAI,wCAAwC,QAAQ,KAAK,IAAI,IAAI,KAAK,OAAO;GAGzF,MAAM,YAAY,KAAK,iBAAiB,cAAc,MAAM,EAAE,IAAI,CAAC;GACnE,MAAM,KAAK,YAAY,eAAe,YAAY,QAAQ,UAAU;IAAE,MAAM;IAAK,KAAK;GAAK,CAAC,CAAC;GAE7F,OAAO;IACL;IACA,OAAO;GACT;EACF,SAAS,OAAO;GACd,IAAI,iBAAiB,IAAI,oBAAoB,MAAM;GAGnD,IAAI,aAAa,OAAA,CAA+B,GAC9C,MAAM,IAAI,IAAI,4BAA4B,KAAK,KAAK,OAAO;GAG7D,MAAM,IAAI,IAAI,mBAAmB,sBAAsB,EAAE,OAAO,MAAM,CAAC;EACzE,UAAU;GACR,UAAU,OAAO,KAAK;EACxB;CACF;CAEA,MAAa,KAAK,cAA4B,SAAyD;EACrG,MAAM,EAAE,OAAO,WAAW,SAAS;EAGnC,MAAM,MAAM,MAAM,KAAK,eAAe,cAAc,KAAK;EACzD,IAAI;GACF,MAAM,UAAU,KAAK,sBAAsB,SAAS;GAGpD,IAAI,CAAC,IAAI,KACP,MAAM,IAAI,IAAI,wCAAwC,aAAa,aAAa,KAAK,OAAO;GAI9F,MAAM,YAAY,KAAK,iBAAiB,cAAc,IAAI,KAAK,EAAE,KAAK,MAAM,CAAC;GAC7E,MAAM,aAAa,KAAK,kBAAkB,cAAc,IAAI,KAAK,EAAE,KAAK,MAAM,CAAC;GAG/E,IAAI,8BAA8B,YAAY,SAAS;GACvD,IAAI,oBAAoB,SAAS;GAGjC,MAAM,YAAY,IAAI,IAAI,YAAY;IACpC,SAAS,IAAI,WAAW,IAAI;IAC5B;GACF,CAAC;GAED,OAAO,EACL,WAAW,IAAI,WAAW,SAAS,EACrC;EACF,SAAS,OAAO;GACd,IAAI,iBAAiB,IAAI,oBAAoB,MAAM;GACnD,MAAM,IAAI,IAAI,mBAAmB,0BAA0B,EAAE,OAAO,MAAM,CAAC;EAC7E,UAAU;GACR,IAAI,KAAK,OAAO,KAAK;EACvB;CACF;CAEA,MAAa,OAAO,cAA4B,SAA6D;EAC3G,MAAM,EAAE,WAAW,MAAM,WAAW,KAAK,aAAa;EAGtD,MAAM,UAAU,KAAK,sBAAsB,SAAS;EAGpD,IAAI;EAEJ,IAAI;GACF,IAAI,SAAS,OACX,YAAY,MAAM,KAAK,eAAe,cAAc,SAAS,KAAK,EAAA,CAAG;QAChE,IAAI,SAAS,WAAW,QAAQ,QAAQ,SAAS,WAAW,QAAQ,OAAO;IAEhF,KAAK,wBAAwB,SAAS,UAAU,KAAK,SAAS,UAAU,GAAG;IAE3E,WAAW,IAAI,QAAQ,EAAE,KAAK,IAAI,SAAS,SAAS,SAAqB,EAAE,CAAC;GAC9E,OACE,MAAM,IAAI,IAAI,wCAAwC,OAAO,SAAS,WAAW,OAAO,KAAK,OAAO;GAKtG,IAAI,CAAC,UACH,MAAM,IAAI,IAAI,wCAAwC,aAAa,aAAa,KAAK,OAAO;GAG9F,MAAM,QAAQ,SAAS,SAAS,SAAS,WAAW;GACpD,MAAM,YAAY,KAAK,iBAAiB,cAAc,UAAU,EAAE,KAAK,MAAM,CAAC;GAG9E,IAAI,UAAU,QAAQ,OAAO;IAC3B,MAAM,aAAa,KAAK,kBAAkB,cAAc,UAAU,EAAE,KAAK,MAAM,CAAC;IAGhF,IAAI,8BAA8B,YAAY,SAAS;IACvD,IAAI,sBAAsB,SAAS;GACrC,OAAO;IAEL,IAAI,8BAA8B,WAAW,SAAS;IACtD,IAAI,sBAAsB,SAAS;GACrC;GAQA,IALiB,SAAS,gBAAgB;IACxC,SAAS,IAAI,WAAW,IAAI;IAC5B,WAAW,IAAI,WAAW,SAAS;IACnC;GACF,CACW,GACT,OAAO;IACL,UAAU;IACV,WAAW,SAAS,QAChB,KAAK,iBAAiB,cAAc,UAAU,EAAE,KAAK,MAAM,CAAC,IAC3D,SAAS;GAChB;GAGF,OAAO,EACL,UAAU,MACZ;EACF,SAAS,OAAO;GACd,IAAI,iBAAiB,IAAI,oBAAoB,MAAM;GACnD,MAAM,IAAI,IAAI,mBAAmB,4BAA4B,EAAE,OAAO,MAAM,CAAC;EAC/E,UAAU;GACR,IAAI,UAAU,SAAS,OAAO,KAAK;EACrC;CACF;CAEA,MAAa,QAAQ,cAA4B,SAA+D;EAC9G,MAAM,EAAE,MAAM,YAAY,QAAQ;EAElC,IAAI,WAAW,cAAc,QAAQ;GACnC,IAAI,CAAC,IAAI,gBAAgB,CAAC,IAAI,6BAA6B,IAAI,YAAY,GACzE,MAAM,IAAI,IAAI,mBACZ,yGACF;GAGF,MAAM,EAAE,iBAAiB;GACzB,IAAI,oCAAoC,aAAa,mBAAmB,aAAa,SAAS;GAC9F,IAAI,sBAAsB,aAAa,iBAAiB;GAExD,IAAI;IACF,OAAO,MAAM,SAAS;KACpB,WAAW,aAAa;KACxB,oBAAoB,aAAa;KACjC;KACA,MAAM,aAAa;KACnB,KAAK,WAAW;IAClB,CAAC;GACH,SAAS,OAAO;IACd,IAAI,iBAAiB,IAAI,oBAAoB,MAAM;IACnD,MAAM,IAAI,IAAI,mBAAmB,6BAA6B,EAAE,OAAO,MAAM,CAAC;GAChF;EACF;EAEA,IAAI,mCAAmC,YAAY,oCAAoC,KAAK,OAAO;EAEnG,MAAM,aAAoB,CAAC;EAC3B,IAAI;GACF,IAAI;GACJ,IAAI;GAGJ,IAAI,IAAI,OAAO;IACb,iBAAiB,MAAM,KAAK,eAAe,cAAc,IAAI,KAAK,EAAA,CAAG;IAErE,WAAW,KAAK,aAAa;GAC/B,OAAO,IAAI,IAAI,YAAY;IACzB,IAAI,WAAW,cAAc,qBAC3B,MAAM,IAAI,IAAI,wCACZ,yBAAyB,WAAW,UAAU,mEAAmE,IAAI,+BAA+B,cAAc,IAClK,KAAK,OACP;IAEF,gBAAgB,KAAK,yCACnB,kBAAkB,cAAc,IAAI,WAAW,CAAC,GAChD,WAAW,SACb;IACA,WAAW,KAAK,aAAa;GAC/B,OAAO,IAAI,IAAI,cAAc;IAC3B,IAAI,oCAAoC,IAAI,aAAa,mBAAmB,IAAI,aAAa,SAAS;IACtG,IAAI,sBAAsB,IAAI,aAAa,iBAAiB;IAC5D,IAAI,qCAAqC,IAAI,cAAc,sCAAsC,KAAK,OAAO;IAE7G,IAAI,aAAa,IAAI,aAAa,SAC7B,MAAM,KAAK,eAAe,cAAc,IAAI,aAAa,KAAK,EAAA,CAAG,MAClE,KAAA;IACJ,IAAI,YAAY,WAAW,KAAK,UAAU;IAE1C,MAAM,aAAa,aAAa,KAAK,kBAAkB,cAAc,UAAU,IAAI,KAAA;IACnF,IAAI,YAAY;KACd,IAAI,oBAAoB,YAAY,IAAI,aAAa,KAAK;KAC1D,IAAI,oCAAoC,YAAY,IAAI,aAAa,SAAS;KAC9E,IAAI,sBAAsB,UAAU;KAIpC,IAAI,IAAI,aAAa,cAAc,iBACjC,IAAI,kCAAkC,YAAY,IAAI,aAAa,iBAAiB;IAExF;IAEA,MAAM,eAAe,KAAK,WAAW,cAAc,IAAI,aAAa,iBAAiB;IACrF,WAAW,KAAK,YAAY;IAG5B,IAAI,IAAI,aAAa,cAAc,mBAAmB,WAAW,cAAc,qBAAqB;KAClG,IAAI,WAAW,cAAc,uBAAuB,IAAI,aAAa,cAAc,iBACjF,MAAM,IAAI,IAAI,wCACZ,4BAA4B,IAAI,aAAa,UAAU,+BAA+B,WAAW,UAAU,IAC3G,KAAK,OACP;KAIF,IAAI,CAAC,YACH,OAAO,EACL,WAAW,IAAI,WACb,UAAU,KAAK;MACb;MACA,SAAS,IAAI,WAAW,IAAI;KAC9B,CAAC,CACH,EACF;KAKF,IAAI,WAAW,cAAc,aAAa,SAAS;MACjD,aAAa,WAAW,WAAW,EAAE,WAAW,aAAa,OAAO,CAAC;MACrE,WAAW,KAAK,UAAU;KAC5B;KAEA,MAAM,QAAQ,IAAI,WAAW,UAAU,YAAY,CAAC;KAUpD,OAAO;MACL,WAAA,IAVoB,WACpB,UAAU,UAAU;OAClB;OACA,WAAW;OACX,SAAS,IAAI,WAAW,IAAI;OAC5B;MACF,CAAC,CAIO;MACR,IAAI;KACN;IACF;IAGA,IAAI,CAAC,YACH,MAAM,IAAI,IAAI,mBAAmB,oDAAoD;IAGvF,MAAM,EAAE,sBAAsB,kCAAkC,oBAAoB;KAClF,OAAO,KAAK,SAAS,YAAY;KACjC;KACA,cAAc,IAAI;KAClB;KACA,WAAW;IACb,CAAC;IAED,gBAAgB;IAChB,WAAW,KAAK,oBAAoB;IACpC,eAAe;GACjB,OACE,MAAM,IAAI,IAAI,mBAAmB,sCAAsC;GAGzE,IAAI,WAAW,cAAc,qBAC3B,MAAM,IAAI,IAAI,wCACZ,yBAAyB,WAAW,UAAU,gEAC9C,KAAK,OACP;GAGF,MAAM,aAAa,KAAK,kBAAkB,cAAc,aAAa;GACrE,IAAI,sBAAsB,UAAU;GACpC,IAAI,iCAAiC,YAAY,WAAW,SAAS;GACrE,IAAI,uBAAuB,UAAU;GAQrC,OAAO;IACL,GAPgB,YAAY;KAC5B,KAAK;KACL;KACA;IACF,CAGa;IACX;GACF;EACF,SAAS,OAAO;GACd,IAAI,iBAAiB,IAAI,oBAAoB,MAAM;GACnD,MAAM,IAAI,IAAI,mBAAmB,6BAA6B,EAAE,OAAO,MAAM,CAAC;EAChF,UAAU;GAER,KAAK,MAAM,OAAO,YAChB,IAAI,OAAO,KAAK;EAEpB;CACF;CAEA,MAAa,QAAQ,cAA4B,SAA+D;EAC9G,MAAM,EAAE,WAAW,YAAY,QAAQ;EAEvC,IAAI,WAAW,cAAc,QAAQ;GACnC,IAAI,CAAC,IAAI,gBAAgB,CAAC,IAAI,6BAA6B,IAAI,YAAY,GACzE,MAAM,IAAI,IAAI,mBACZ,yGACF;GAGF,MAAM,EAAE,iBAAiB;GACzB,MAAM,gBAAgB,MAAM,KAAK,eAAe,cAAc,aAAa,KAAK,EAAA,CAAG;GAEnF,IAAI;IACF,MAAM,qBAAqB,KAAK,iBAAiB,cAAc,YAAY;IAC3E,IAAI,oBAAoB,oBAAoB,aAAa,KAAK;IAC9D,IAAI,oCAAoC,oBAAoB,aAAa,SAAS;IAClF,IAAI,sBAAsB,kBAAkB;IAE5C,OAAO,EACL,MAAM,MAAM,SAAS;KACnB,WAAW,aAAa;KACxB;KACA;KACA,iBAAiB,aAAa;KAC9B;KACA,MAAM,aAAa;KACnB,KAAK,WAAW;IAClB,CAAC,EACH;GACF,SAAS,OAAO;IACd,IAAI,iBAAiB,IAAI,oBAAoB,MAAM;IACnD,MAAM,IAAI,IAAI,mBAAmB,6BAA6B,EAAE,OAAO,MAAM,CAAC;GAChF,UAAU;IACR,aAAa,OAAO,KAAK;GAC3B;EACF;EAEA,IAAI,mCAAmC,YAAY,oCAAoC,KAAK,OAAO;EAEnG,MAAM,aAAoB,CAAC;EAE3B,IAAI;GACF,IAAI;GAEJ,IAAI,IAAI,OAAO;IACb,iBAAiB,MAAM,KAAK,eAAe,cAAc,IAAI,KAAK,EAAA,CAAG;IACrE,WAAW,KAAK,aAAa;GAC/B,OAAO,IAAI,IAAI,YAAY;IACzB,IAAI,WAAW,cAAc,qBAC3B,MAAM,IAAI,IAAI,wCACZ,yBAAyB,WAAW,UAAU,mEAAmE,IAAI,+BAA+B,cAAc,IAClK,KAAK,OACP;IAEF,gBAAgB,KAAK,yCACnB,kBAAkB,cAAc,IAAI,WAAW,CAAC,GAChD,WAAW,SACb;IACA,WAAW,KAAK,aAAa;GAC/B,OAAO,IAAI,IAAI,cAAc;IAE3B,IAAI,qCAAqC,IAAI,cAAc,sCAAsC,KAAK,OAAO;IAE7G,IAAI,IAAI,aAAa,mBAAmB;KACtC,IAAI,oCAAoC,IAAI,aAAa,mBAAmB,IAAI,aAAa,SAAS;KACtG,IAAI,sBAAsB,IAAI,aAAa,iBAAiB;IAC9D;IAEA,IAAI,cAAc,MAAM,KAAK,eAAe,cAAc,IAAI,aAAa,KAAK,EAAA,CAAG;IACnF,WAAW,KAAK,UAAU;IAE1B,MAAM,aAAa,KAAK,kBAAkB,cAAc,UAAU;IAElE,IAAI,oBAAoB,YAAY,IAAI,aAAa,KAAK;IAC1D,IAAI,oCAAoC,YAAY,IAAI,aAAa,SAAS;IAC9E,IAAI,sBAAsB,UAAU;IAGpC,IAAI,IAAI,aAAa,qBAAqB,IAAI,aAAa,cAAc,iBACvE,IAAI,kCAAkC,YAAY,IAAI,aAAa,iBAAiB;IAGtF,MAAM,YAAY,IAAI,aAAa,oBAC/B,KAAK,WAAW,cAAc,IAAI,aAAa,iBAAiB,IAChE,KAAA;IACJ,IAAI,WAAW,WAAW,KAAK,SAAS;IAGxC,IAAI,IAAI,aAAa,cAAc,mBAAmB,WAAW,cAAc,qBAAqB;KAClG,IAAI,WAAW,cAAc,uBAAuB,IAAI,aAAa,cAAc,iBACjF,MAAM,IAAI,IAAI,wCACZ,4BAA4B,IAAI,aAAa,UAAU,+BAA+B,WAAW,UAAU,IAC3G,KAAK,OACP;KAKF,IAAI,WAAW,cAAc,aAAa,SAAS;MACjD,aAAa,WAAW,WAAW,EAAE,WAAW,aAAa,OAAO,CAAC;MACrE,WAAW,KAAK,UAAU;KAC5B;KAEA,IAAI,CAAC,WAEH,OAAO,EACL,MAAM,IAAI,WACR,UAAU,SAAS;MACjB,cAAc;MACd,YAAY,IAAI,WAAW,SAAS;KACtC,CAAC,CACH,EACF;KAGF,IAAI,CAAC,WAAW,IACd,MAAM,IAAI,IAAI,mBACZ,qDAAqD,IAAI,aAAa,UAAU,4BAA4B,WAAW,UAAU,0BACnI;KAYF,OAAO,EACL,MAAM,IAVc,WACpB,UAAU,KAAK;MACb,cAAc;MACH;MACX,SAAS,IAAI,WAAW,SAAS;MACjC,OAAO,IAAI,WAAW,WAAW,EAAE;KACrC,CAAC,CAIa,EAChB;IACF;IAGA,IAAI,CAAC,WACH,MAAM,IAAI,IAAI,mBAAmB,oDAAoD;IAGvF,MAAM,EAAE,yBAAyB,oBAAoB;KACnD,OAAO,KAAK,SAAS,YAAY;KACjC;KACA,cAAc,IAAI;KAClB,cAAc;KACd;IACF,CAAC;IAED,gBAAgB;IAChB,WAAW,KAAK,oBAAoB;GACtC,OACE,MAAM,IAAI,IAAI,mBAAmB,sCAAsC;GAGzE,IAAI,WAAW,cAAc,qBAC3B,MAAM,IAAI,IAAI,wCACZ,yBAAyB,WAAW,UAAU,gEAC9C,KAAK,OACP;GAGF,MAAM,aAAa,KAAK,kBAAkB,cAAc,aAAa;GACrE,IAAI,sBAAsB,UAAU;GACpC,IAAI,iCAAiC,YAAY,WAAW,SAAS;GACrE,IAAI,uBAAuB,UAAU;GAQrC,OAAO,EACL,MAPgB,YAAY;IAC5B,KAAK;IACL;IACA;GACF,CAGgB,EAChB;EACF,SAAS,OAAO;GACd,IAAI,iBAAiB,IAAI,oBAAoB,MAAM;GACnD,MAAM,IAAI,IAAI,mBAAmB,6BAA6B,EAAE,OAAO,MAAM,CAAC;EAChF,UAAU;GAER,KAAK,MAAM,OAAO,YAChB,IAAI,OAAO,KAAK;EAEpB;CACF;CAEA,sBAA8B,WAA+D;EAC3F,MAAM,UAAU,0BAA0B,aAAa;EACvD,IAAI,CAAC,SACH,MAAM,IAAI,IAAI,wCACZ,4CAA4C,UAAU,IACtD,KAAK,OACP;EAGF,OAAO;CACT;CAEA,wBAAgC,KAAa,KAA6D;EACxG,MAAM,SAAS,iBAAiB;EAChC,IAAI,CAAC,QACH,MAAM,IAAI,IAAI,wCAAwC,QAAQ,IAAI,aAAa,IAAI,IAAI,KAAK,OAAO;EAGrG,OAAO;CACT;CAEA,WAAmB,cAA4B,KAA2C;EASxF,OAAO,IARS,IACd,KAAK,SAAS,YAAY,CAAC,CAAC,WAAW,EAGrC,KAAK,IAAI,WAAW,YAAY,aAAa,GAAG,CAAC,EACnD,CAAC,CAGM;CACX;CAEA,yCACE,aACA,WACA;EACA,MAAM,2BAA2B,iBAAiB;EAClD,IAAI,CAAC,0BACH,MAAM,IAAI,IAAI,wCAAwC,6BAA6B,UAAU,IAAI,OAAO;EAG1G,OAAO,IAAI,gBAAgB;GACzB,WAAW;GACX,WAAW,IAAI,WAAW,WAAW;EACvC,CAAC;CACH;CAEA,iBAAyB,cAA4B,KAAU,kBAA8C;EAG3G,IAAI,4BAA4B,SAAS,IAAI,SAAS,GACpD,OAAO,IAAI,wBAAwB;GAAE,GAAG;GAAkB,KAAK;EAAM,CAAqB;EAM5F,MAAM,EAAE,KAAK,GAAG,cAAc,KAAK,MACjC,KAAK,SAAS,YAAY,CAAC,CAAC,gBAAgB;GAC1C,gBAAgB,IAAI;GACpB,WAAW,IAAI;EACjB,CAAC,CACH;EAEA,OAAO,IAAI,wBAAwB;GAAE,GAAG;GAAkB,GAAG;EAAU,CAAqB;CAC9F;CAEA,kBAA0B,cAA4B,KAAU,mBAAgD;EAM9G,MAAM,EAAE,KAAK,GAAG,cAAc,YAAY,eACxC,KAAK,SAAS,YAAY,CAAC,CAAC,gBAAgB,EAC1C,gBAAgB,IAAI,OACtB,CAAC,CACH;EAEA,OAAO;GACL,GAAG;GACH,GAAG;EACL;CACF;CAEA,MAAc,cAAc,cAA4B,OAA+C;EACrG,OAAO,MAAM,KAAK,YAAY,cAAc,OAAO,YAAY;GAC7D,IAAI,CAAC,QAAQ,QAAQ,MAAM,MAAM,0CAA0C;GAG3E,MAAM,SAAS,MAAM,KAAK,SAAS,YAAY,CAAC,CAAC,gBAAgB;IAC/D,WAAW;IACX,MAAM;IACN,eAAe,QAAQ;GACzB,CAAC;GACD,IAAI,CAAC,QAAQ,OAAO;GAGpB,MAAM,eAAe,IAAI,aAAa,EAAE,OAAO,CAAC;GAGhD,MAAM,iBAFW,aAAa,gBAAgB,CAEhB,CAAC,CAAC,OAAO;GACvC,aAAa,OAAO,KAAK;GAEzB,OAAO;EACT,CAAC;CACH;CAEA,MAAc,eAAe,cAA4B,OAAe;EACtE,MAAM,aAAa,MAAM,KAAK,cAAc,cAAc,KAAK;EAC/D,IAAI,CAAC,YACH,MAAM,IAAI,IAAI,8BAA8B,OAAO,CAAC,KAAK,OAAO,CAAC;EAGnE,OAAO;CACT;CAEA,SAAiB,cAA4B;EAC3C,OAAO,aAAa,QAAQ,iBAAiB,CAAC,CAAC;CACjD;AACF;AAl0BE,0BAAuB,UAAU;AAGjC,0BAAe,eAAoF;CACjG,OAAO,mBAAmB;CAC1B,SAAS,mBAAmB;CAC5B,QAAQ,mBAAmB;CAC3B,OAAO,mBAAmB;CAC1B,OAAO,mBAAmB;AAC5B"}

package/build/kms/crypto/deriveKey.mjs

@@ -1,83 +1,19 @@
 import { jwkEncToAskarAlg } from "../../utils/askarKeyTypes.mjs";
 import "../../utils/index.mjs";
-import { aeadEncrypt } from "./encrypt.mjs";
 import { Kms, TypedArrayEncoder } from "@credo-ts/core";
-import { Key, KeyAlgorithm } from "@openwallet-foundation/askar-shared";
+import { Key } from "@openwallet-foundation/askar-shared";
 //#region src/kms/crypto/deriveKey.ts
 const askarSupportedKeyAgreementAlgorithms = [
 	"ECDH-ES",
 	"ECDH-ES+A128KW",
 	"ECDH-ES+A256KW",
-	"ECDH-1PU+A256KW",
 	"ECDH-HSALSA20"
 ];
-/**
-* Full ECDH-1PU+A256KW encrypt flow per draft-madden-jose-ecdh-1pu-04 §2.3:
-* encrypt content with a fresh CEK first, then derive the KEK with the resulting JWE
-* Authentication Tag bound into SuppPubInfo, then wrap the CEK with that KEK. The KEK
-* cannot be derived before content encryption because it depends on the tag.
-*/
-function encryptEcdh1Pu(options) {
-	const { askar, keyAgreement, encryption, senderKey, recipientKey, data, ephemeralKey: providedEphemeralKey } = options;
-	const supportedAlgorithms = [
-		KeyAlgorithm.X25519,
-		KeyAlgorithm.EcSecp256r1,
-		KeyAlgorithm.EcSecp384r1
-	];
-	if (!supportedAlgorithms.includes(senderKey.algorithm) || !supportedAlgorithms.includes(recipientKey.algorithm)) throw new Kms.KeyManagementAlgorithmNotSupportedError("ECDH-1PU+A256KW requires X25519, P-256, or P-384 sender and recipient keys", "askar");
-	if (senderKey.algorithm !== recipientKey.algorithm) throw new Kms.KeyManagementAlgorithmNotSupportedError("ECDH-1PU+A256KW sender and recipient keys must be on the same curve", "askar");
-	if (providedEphemeralKey && providedEphemeralKey.algorithm !== recipientKey.algorithm) throw new Kms.KeyManagementAlgorithmNotSupportedError("ECDH-1PU+A256KW ephemeral key must match the recipient curve", "askar");
-	const askarEncryptionAlgorithm = jwkEncToAskarAlg[encryption.algorithm];
-	if (!askarEncryptionAlgorithm) throw new Kms.KeyManagementAlgorithmNotSupportedError(`encryption with algorithm '${encryption.algorithm}'`, "askar");
-	const ephemeralKey = providedEphemeralKey ?? Key.generate(recipientKey.algorithm);
-	const ownsEphemeralKey = !providedEphemeralKey;
-	const apu = keyAgreement.apu ? new Uint8Array(keyAgreement.apu) : new Uint8Array([]);
-	const apv = keyAgreement.apv ? new Uint8Array(keyAgreement.apv) : new Uint8Array([]);
-	const algId = TypedArrayEncoder.fromUtf8String("ECDH-1PU+A256KW");
-	const contentEncryptionKey = Key.generate(askarEncryptionAlgorithm);
-	let derivedKey;
-	try {
-		const aeadResult = aeadEncrypt({
-			key: contentEncryptionKey,
-			data,
-			encryption
-		});
-		derivedKey = new Key(askar.keyDeriveEcdh1pu({
-			algorithm: KeyAlgorithm.AesA256Kw,
-			ephemeralKey,
-			senderKey,
-			recipientKey,
-			algId,
-			apu,
-			apv,
-			ccTag: aeadResult.tag,
-			receive: false
-		}));
-		const wrappedKey = derivedKey.wrapKey({ other: contentEncryptionKey });
-		const ephemeralPublicKey = ephemeralKey.jwkPublic;
-		return {
-			encrypted: aeadResult.encrypted,
-			iv: aeadResult.iv,
-			tag: aeadResult.tag,
-			encryptedKey: {
-				encrypted: new Uint8Array(wrappedKey.ciphertext),
-				iv: wrappedKey.nonce ? new Uint8Array(wrappedKey.nonce) : void 0,
-				tag: wrappedKey.tag ? new Uint8Array(wrappedKey.tag) : void 0,
-				ephemeralPublicKey
-			}
-		};
-	} finally {
-		if (ownsEphemeralKey) ephemeralKey.handle.free();
-		derivedKey?.handle.free();
-		contentEncryptionKey.handle.free();
-	}
-}
 function deriveEncryptionKey(options) {
 	const { askar, keyAgreement, encryption, senderKey, recipientKey } = options;
 	const askarEncryptionAlgorithm = jwkEncToAskarAlg[encryption.algorithm];
 	if (!askarEncryptionAlgorithm) throw new Kms.KeyManagementAlgorithmNotSupportedError(`encryption with algorithm '${encryption.algorithm}'`, "askar");
 	if (keyAgreement.algorithm === "ECDH-HSALSA20") throw new Kms.KeyManagementAlgorithmNotSupportedError(`derive key for algorithm '${keyAgreement.algorithm}' with encryption algorithm '${encryption.algorithm}'`, "askar");
-	if (keyAgreement.algorithm === "ECDH-1PU+A256KW") throw new Kms.KeyManagementError("Use encryptEcdh1Pu for ECDH-1PU+A256KW; deriveEncryptionKey only handles ECDH-ES");
 	const askarKeyWrappingAlgorithm = keyAgreement.algorithm !== "ECDH-ES" ? jwkEncToAskarAlg[keyAgreement.algorithm.replace("ECDH-ES+", "")] : void 0;
 	const derivedKey = new Key(askar.keyDeriveEcdhEs({
 		algId: TypedArrayEncoder.fromUtf8String(keyAgreement.algorithm === "ECDH-ES" ? encryption.algorithm : keyAgreement.algorithm),
@@ -113,21 +49,10 @@ function deriveEncryptionKey(options) {
 	}
 }
 function deriveDecryptionKey(options) {
-	const { askar, keyAgreement, decryption, senderKey, recipientKey, ephemeralKey } = options;
+	const { askar, keyAgreement, decryption, senderKey, recipientKey } = options;
 	const askarEncryptionAlgorithm = jwkEncToAskarAlg[decryption.algorithm];
 	if (!askarEncryptionAlgorithm) throw new Kms.KeyManagementAlgorithmNotSupportedError(`decryption with algorithm '${decryption.algorithm}'`, "askar");
 	if (keyAgreement.algorithm === "ECDH-HSALSA20") throw new Kms.KeyManagementAlgorithmNotSupportedError(`derive key for algorithm '${keyAgreement.algorithm}' with encryption algorithm '${decryption.algorithm}'`, "askar");
-	if (keyAgreement.algorithm === "ECDH-1PU+A256KW") {
-		if (!ephemeralKey) throw new Kms.KeyManagementError("ECDH-1PU+A256KW decrypt requires ephemeralKey (ephemeral public key from JWE)");
-		return deriveDecryptionKeyEcdh1Pu({
-			askar,
-			keyAgreement,
-			decryption,
-			ephemeralKey,
-			senderKey,
-			recipientKey
-		});
-	}
 	const askarKeyWrappingAlgorithm = keyAgreement.algorithm !== "ECDH-ES" ? jwkEncToAskarAlg[keyAgreement.algorithm.replace("ECDH-ES+", "")] : void 0;
 	const derivedKey = new Key(askar.keyDeriveEcdhEs({
 		algId: TypedArrayEncoder.fromUtf8String(keyAgreement.algorithm === "ECDH-ES" ? decryption.algorithm : keyAgreement.algorithm),
@@ -155,44 +80,7 @@ function deriveDecryptionKey(options) {
 		if (contentEncryptionKey) derivedKey.handle.free();
 	}
 }
-function deriveDecryptionKeyEcdh1Pu(options) {
-	const { askar, keyAgreement, decryption, ephemeralKey, senderKey, recipientKey } = options;
-	if (![
-		KeyAlgorithm.X25519,
-		KeyAlgorithm.EcSecp256r1,
-		KeyAlgorithm.EcSecp384r1
-	].includes(recipientKey.algorithm)) throw new Kms.KeyManagementAlgorithmNotSupportedError("ECDH-1PU+A256KW requires X25519, P-256, or P-384 recipient key", "askar");
-	if (ephemeralKey.algorithm !== recipientKey.algorithm || senderKey.algorithm !== recipientKey.algorithm) throw new Kms.KeyManagementAlgorithmNotSupportedError("ECDH-1PU+A256KW sender, ephemeral, and recipient keys must be on the same curve", "askar");
-	const askarEncryptionAlgorithm = jwkEncToAskarAlg[decryption.algorithm];
-	if (!askarEncryptionAlgorithm) throw new Kms.KeyManagementAlgorithmNotSupportedError(`decryption with algorithm '${decryption.algorithm}'`, "askar");
-	const apu = keyAgreement.apu ? new Uint8Array(keyAgreement.apu) : new Uint8Array([]);
-	const apv = keyAgreement.apv ? new Uint8Array(keyAgreement.apv) : new Uint8Array([]);
-	const algId = TypedArrayEncoder.fromUtf8String("ECDH-1PU+A256KW");
-	const decryptionTag = "tag" in decryption ? decryption.tag : void 0;
-	const ccTag = decryptionTag ? new Uint8Array(decryptionTag) : void 0;
-	const derivedKey = new Key(askar.keyDeriveEcdh1pu({
-		algorithm: KeyAlgorithm.AesA256Kw,
-		ephemeralKey,
-		senderKey,
-		recipientKey,
-		algId,
-		apu,
-		apv,
-		ccTag,
-		receive: true
-	}));
-	try {
-		return { contentEncryptionKey: derivedKey.unwrapKey({
-			ciphertext: new Uint8Array(keyAgreement.encryptedKey.encrypted),
-			algorithm: askarEncryptionAlgorithm,
-			nonce: keyAgreement.encryptedKey.iv ? new Uint8Array(keyAgreement.encryptedKey.iv) : void 0,
-			tag: keyAgreement.encryptedKey.tag ? new Uint8Array(keyAgreement.encryptedKey.tag) : void 0
-		}) };
-	} finally {
-		derivedKey.handle.free();
-	}
-}
 //#endregion
-export { askarSupportedKeyAgreementAlgorithms, deriveDecryptionKey, deriveEncryptionKey, encryptEcdh1Pu };
+export { askarSupportedKeyAgreementAlgorithms, deriveDecryptionKey, deriveEncryptionKey };
 
 //# sourceMappingURL=deriveKey.mjs.map

package/build/kms/crypto/deriveKey.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"deriveKey.mjs","names":[],"sources":["../../../src/kms/crypto/deriveKey.ts"],"sourcesContent":["import { Kms, TypedArrayEncoder } from '@credo-ts/core'\nimport type { Askar } from '@openwallet-foundation/askar-shared'\nimport { Key, KeyAlgorithm } from '@openwallet-foundation/askar-shared'\nimport { jwkEncToAskarAlg } from '../../utils'\nimport { type AskarSupportedEncryptionOptions, aeadEncrypt } from './encrypt'\n\nexport const askarSupportedKeyAgreementAlgorithms = [\n  'ECDH-ES',\n  'ECDH-ES+A128KW',\n  'ECDH-ES+A256KW',\n  'ECDH-1PU+A256KW',\n  'ECDH-HSALSA20',\n] satisfies Kms.KnownJwaKeyAgreementAlgorithm[]\n\ntype AskarSupportedKeyAgreementEncryptOptions = Kms.KmsKeyAgreementEncryptOptions & {\n  algorithm: (typeof askarSupportedKeyAgreementAlgorithms)[number]\n}\n\ntype AskarSupportedKeyAgreementDecryptOptions = Kms.KmsKeyAgreementDecryptOptions & {\n  algorithm: (typeof askarSupportedKeyAgreementAlgorithms)[number]\n}\n\n/**\n * Full ECDH-1PU+A256KW encrypt flow per draft-madden-jose-ecdh-1pu-04 §2.3:\n * encrypt content with a fresh CEK first, then derive the KEK with the resulting JWE\n * Authentication Tag bound into SuppPubInfo, then wrap the CEK with that KEK. The KEK\n * cannot be derived before content encryption because it depends on the tag.\n */\nexport function encryptEcdh1Pu(options: {\n  askar: Askar\n  keyAgreement: AskarSupportedKeyAgreementEncryptOptions & { algorithm: 'ECDH-1PU+A256KW' }\n  encryption: AskarSupportedEncryptionOptions\n  senderKey: Key\n  recipientKey: Key\n  data: Uint8Array\n  ephemeralKey?: Key\n}) {\n  const { askar, keyAgreement, encryption, senderKey, recipientKey, data, ephemeralKey: providedEphemeralKey } = options\n\n  const supportedAlgorithms: KeyAlgorithm[] = [KeyAlgorithm.X25519, KeyAlgorithm.EcSecp256r1, KeyAlgorithm.EcSecp384r1]\n  if (!supportedAlgorithms.includes(senderKey.algorithm) || !supportedAlgorithms.includes(recipientKey.algorithm)) {\n    throw new Kms.KeyManagementAlgorithmNotSupportedError(\n      'ECDH-1PU+A256KW requires X25519, P-256, or P-384 sender and recipient keys',\n      'askar'\n    )\n  }\n  if (senderKey.algorithm !== recipientKey.algorithm) {\n    throw new Kms.KeyManagementAlgorithmNotSupportedError(\n      'ECDH-1PU+A256KW sender and recipient keys must be on the same curve',\n      'askar'\n    )\n  }\n  if (providedEphemeralKey && providedEphemeralKey.algorithm !== recipientKey.algorithm) {\n    throw new Kms.KeyManagementAlgorithmNotSupportedError(\n      'ECDH-1PU+A256KW ephemeral key must match the recipient curve',\n      'askar'\n    )\n  }\n  const askarEncryptionAlgorithm = jwkEncToAskarAlg[encryption.algorithm as keyof typeof jwkEncToAskarAlg]\n  if (!askarEncryptionAlgorithm) {\n    throw new Kms.KeyManagementAlgorithmNotSupportedError(\n      `encryption with algorithm '${encryption.algorithm}'`,\n      'askar'\n    )\n  }\n\n  const ephemeralKey = providedEphemeralKey ?? Key.generate(recipientKey.algorithm)\n  const ownsEphemeralKey = !providedEphemeralKey\n  const apu = keyAgreement.apu ? new Uint8Array(keyAgreement.apu) : new Uint8Array([])\n  const apv = keyAgreement.apv ? new Uint8Array(keyAgreement.apv) : new Uint8Array([])\n  const algId = TypedArrayEncoder.fromUtf8String('ECDH-1PU+A256KW')\n\n  const contentEncryptionKey = Key.generate(askarEncryptionAlgorithm)\n  let derivedKey: Key | undefined\n  try {\n    const aeadResult = aeadEncrypt({ key: contentEncryptionKey, data, encryption })\n\n    derivedKey = new Key(\n      askar.keyDeriveEcdh1pu({\n        algorithm: KeyAlgorithm.AesA256Kw,\n        ephemeralKey,\n        senderKey,\n        recipientKey,\n        algId,\n        apu,\n        apv,\n        ccTag: aeadResult.tag,\n        receive: false,\n      })\n    )\n    const wrappedKey = derivedKey.wrapKey({ other: contentEncryptionKey })\n    const ephemeralPublicKey = ephemeralKey.jwkPublic as Kms.KmsJwkPublicEcdh\n\n    return {\n      encrypted: aeadResult.encrypted,\n      iv: aeadResult.iv,\n      tag: aeadResult.tag,\n      encryptedKey: {\n        encrypted: new Uint8Array(wrappedKey.ciphertext),\n        iv: wrappedKey.nonce ? new Uint8Array(wrappedKey.nonce) : undefined,\n        tag: wrappedKey.tag ? new Uint8Array(wrappedKey.tag) : undefined,\n        ephemeralPublicKey,\n      } satisfies Kms.KmsEncryptedKey,\n    }\n  } finally {\n    if (ownsEphemeralKey) ephemeralKey.handle.free()\n    derivedKey?.handle.free()\n    contentEncryptionKey.handle.free()\n  }\n}\n\nexport function deriveEncryptionKey(options: {\n  askar: Askar\n  keyAgreement: AskarSupportedKeyAgreementEncryptOptions\n  senderKey: Key\n  recipientKey: Key\n  encryption: Kms.KmsEncryptDataContentEncryption\n}) {\n  const { askar, keyAgreement, encryption, senderKey, recipientKey } = options\n\n  const askarEncryptionAlgorithm = jwkEncToAskarAlg[encryption.algorithm as keyof typeof jwkEncToAskarAlg]\n  if (!askarEncryptionAlgorithm) {\n    throw new Kms.KeyManagementAlgorithmNotSupportedError(\n      `encryption with algorithm '${encryption.algorithm}'`,\n      'askar'\n    )\n  }\n\n  // This should be handled on a higher level as we only support combined key agreemnt + encryption\n  if (keyAgreement.algorithm === 'ECDH-HSALSA20') {\n    throw new Kms.KeyManagementAlgorithmNotSupportedError(\n      `derive key for algorithm '${keyAgreement.algorithm}' with encryption algorithm '${encryption.algorithm}'`,\n      'askar'\n    )\n  }\n\n  // ECDH-1PU+A256KW requires the JWE Authentication Tag in the KDF, so it goes through encryptEcdh1Pu\n  // which performs content encryption + key wrapping atomically. Callers that reach this dispatcher\n  // with 1PU are programming errors.\n  if (keyAgreement.algorithm === 'ECDH-1PU+A256KW') {\n    throw new Kms.KeyManagementError('Use encryptEcdh1Pu for ECDH-1PU+A256KW; deriveEncryptionKey only handles ECDH-ES')\n  }\n\n  const askarKeyWrappingAlgorithm =\n    keyAgreement.algorithm !== 'ECDH-ES'\n      ? jwkEncToAskarAlg[keyAgreement.algorithm.replace('ECDH-ES+', '') as keyof typeof jwkEncToAskarAlg]\n      : undefined\n\n  const derivedKey = new Key(\n    askar.keyDeriveEcdhEs({\n      algId: TypedArrayEncoder.fromUtf8String(\n        keyAgreement.algorithm === 'ECDH-ES' ? encryption.algorithm : keyAgreement.algorithm\n      ),\n      receive: false,\n      apv: keyAgreement.apv ? new Uint8Array(keyAgreement.apv) : new Uint8Array([]),\n      apu: keyAgreement.apu ? new Uint8Array(keyAgreement.apu) : new Uint8Array([]),\n      algorithm: askarKeyWrappingAlgorithm ?? askarEncryptionAlgorithm,\n      ephemeralKey: senderKey,\n      recipientKey: recipientKey,\n    })\n  )\n  let contentEncryptionKey: Key | undefined\n  let encryptedContentEncryptionKey: Kms.KmsEncryptedKey | undefined\n  try {\n    // Key wrapping\n    if (keyAgreement.algorithm !== 'ECDH-ES') {\n      contentEncryptionKey = Key.generate(askarEncryptionAlgorithm)\n\n      const wrappedKey = derivedKey.wrapKey({\n        other: contentEncryptionKey,\n      })\n      encryptedContentEncryptionKey = {\n        encrypted: new Uint8Array(wrappedKey.ciphertext),\n        iv: new Uint8Array(wrappedKey.nonce),\n        tag: new Uint8Array(wrappedKey.tag),\n      }\n    }\n\n    return {\n      contentEncryptionKey: contentEncryptionKey ?? derivedKey,\n      encryptedContentEncryptionKey,\n    }\n  } catch (error) {\n    if (contentEncryptionKey) {\n      contentEncryptionKey.handle.free()\n    }\n    // We only free the derived key if there is no content encryption key\n    // as in this case the derived key is already freed in the finally clause\n    else {\n      derivedKey.handle.free()\n    }\n\n    throw error\n  } finally {\n    // If there is a content encryption key, it means we can free the\n    // derived key\n    if (contentEncryptionKey) {\n      derivedKey.handle.free()\n    }\n  }\n}\n\nexport function deriveDecryptionKey(options: {\n  askar: Askar\n  keyAgreement: AskarSupportedKeyAgreementDecryptOptions\n  senderKey: Key\n  recipientKey: Key\n  decryption: Kms.KmsDecryptDataDecryption\n  /** For ECDH-1PU+A256KW: ephemeral public key from the JWE header */\n  ephemeralKey?: Key\n}) {\n  const { askar, keyAgreement, decryption, senderKey, recipientKey, ephemeralKey } = options\n\n  const askarEncryptionAlgorithm = jwkEncToAskarAlg[decryption.algorithm as keyof typeof jwkEncToAskarAlg]\n  if (!askarEncryptionAlgorithm) {\n    throw new Kms.KeyManagementAlgorithmNotSupportedError(\n      `decryption with algorithm '${decryption.algorithm}'`,\n      'askar'\n    )\n  }\n\n  if (keyAgreement.algorithm === 'ECDH-HSALSA20') {\n    // This should be handled on a higher level as we only support combined key agreemnt + encryption\n    throw new Kms.KeyManagementAlgorithmNotSupportedError(\n      `derive key for algorithm '${keyAgreement.algorithm}' with encryption algorithm '${decryption.algorithm}'`,\n      'askar'\n    )\n  }\n\n  // ECDH-1PU+A256KW: ephemeralKey and senderKey (sender public) are required\n  if (keyAgreement.algorithm === 'ECDH-1PU+A256KW') {\n    if (!ephemeralKey) {\n      throw new Kms.KeyManagementError('ECDH-1PU+A256KW decrypt requires ephemeralKey (ephemeral public key from JWE)')\n    }\n    return deriveDecryptionKeyEcdh1Pu({\n      askar,\n      keyAgreement: keyAgreement as AskarSupportedKeyAgreementDecryptOptions & { algorithm: 'ECDH-1PU+A256KW' },\n      decryption,\n      ephemeralKey,\n      senderKey,\n      recipientKey,\n    })\n  }\n\n  const askarKeyWrappingAlgorithm =\n    keyAgreement.algorithm !== 'ECDH-ES'\n      ? jwkEncToAskarAlg[keyAgreement.algorithm.replace('ECDH-ES+', '') as keyof typeof jwkEncToAskarAlg]\n      : undefined\n\n  const derivedKey = new Key(\n    askar.keyDeriveEcdhEs({\n      algId: TypedArrayEncoder.fromUtf8String(\n        keyAgreement.algorithm === 'ECDH-ES' ? decryption.algorithm : keyAgreement.algorithm\n      ),\n      receive: true,\n      apv: keyAgreement.apv ? new Uint8Array(keyAgreement.apv) : new Uint8Array(),\n      apu: keyAgreement.apu ? new Uint8Array(keyAgreement.apu) : new Uint8Array(),\n      algorithm: askarKeyWrappingAlgorithm ?? askarEncryptionAlgorithm,\n      ephemeralKey: senderKey,\n      recipientKey: recipientKey,\n    })\n  )\n\n  let contentEncryptionKey: Key | undefined\n  try {\n    // Key unwrapping\n    if (keyAgreement.algorithm !== 'ECDH-ES') {\n      contentEncryptionKey = derivedKey.unwrapKey({\n        ciphertext: new Uint8Array(keyAgreement.encryptedKey.encrypted),\n        algorithm: askarEncryptionAlgorithm,\n        nonce: keyAgreement.encryptedKey.iv ? new Uint8Array(keyAgreement.encryptedKey.iv) : undefined,\n        tag: keyAgreement.encryptedKey.tag ? new Uint8Array(keyAgreement.encryptedKey.tag) : undefined,\n      })\n    }\n\n    return {\n      contentEncryptionKey: contentEncryptionKey ?? derivedKey,\n    }\n  } catch (error) {\n    if (contentEncryptionKey) {\n      contentEncryptionKey.handle.free()\n    } else {\n      derivedKey.handle.free()\n    }\n    throw error\n  } finally {\n    if (contentEncryptionKey) {\n      derivedKey.handle.free()\n    }\n  }\n}\n\nfunction deriveDecryptionKeyEcdh1Pu(options: {\n  askar: Askar\n  keyAgreement: AskarSupportedKeyAgreementDecryptOptions & { algorithm: 'ECDH-1PU+A256KW' }\n  decryption: Kms.KmsDecryptDataDecryption\n  ephemeralKey: Key\n  senderKey: Key\n  recipientKey: Key\n}) {\n  const { askar, keyAgreement, decryption, ephemeralKey, senderKey, recipientKey } = options\n\n  const supportedAlgorithms: KeyAlgorithm[] = [KeyAlgorithm.X25519, KeyAlgorithm.EcSecp256r1, KeyAlgorithm.EcSecp384r1]\n  if (!supportedAlgorithms.includes(recipientKey.algorithm)) {\n    throw new Kms.KeyManagementAlgorithmNotSupportedError(\n      'ECDH-1PU+A256KW requires X25519, P-256, or P-384 recipient key',\n      'askar'\n    )\n  }\n  if (ephemeralKey.algorithm !== recipientKey.algorithm || senderKey.algorithm !== recipientKey.algorithm) {\n    throw new Kms.KeyManagementAlgorithmNotSupportedError(\n      'ECDH-1PU+A256KW sender, ephemeral, and recipient keys must be on the same curve',\n      'askar'\n    )\n  }\n\n  const askarEncryptionAlgorithm = jwkEncToAskarAlg[decryption.algorithm as keyof typeof jwkEncToAskarAlg]\n  if (!askarEncryptionAlgorithm) {\n    throw new Kms.KeyManagementAlgorithmNotSupportedError(\n      `decryption with algorithm '${decryption.algorithm}'`,\n      'askar'\n    )\n  }\n\n  const apu = keyAgreement.apu ? new Uint8Array(keyAgreement.apu) : new Uint8Array([])\n  const apv = keyAgreement.apv ? new Uint8Array(keyAgreement.apv) : new Uint8Array([])\n  const algId = TypedArrayEncoder.fromUtf8String('ECDH-1PU+A256KW')\n  // draft-madden-jose-ecdh-1pu-04 binds the JWE Authentication Tag into the KDF SuppPubInfo\n  // for the Key Wrapping variants of ECDH-1PU.\n  const decryptionTag = 'tag' in decryption ? decryption.tag : undefined\n  const ccTag = decryptionTag ? new Uint8Array(decryptionTag) : undefined\n\n  const derivedKey = new Key(\n    askar.keyDeriveEcdh1pu({\n      algorithm: KeyAlgorithm.AesA256Kw,\n      ephemeralKey,\n      senderKey,\n      recipientKey,\n      algId,\n      apu,\n      apv,\n      ccTag,\n      receive: true,\n    })\n  )\n\n  try {\n    const contentEncryptionKey = derivedKey.unwrapKey({\n      ciphertext: new Uint8Array(keyAgreement.encryptedKey.encrypted),\n      algorithm: askarEncryptionAlgorithm,\n      nonce: keyAgreement.encryptedKey.iv ? new Uint8Array(keyAgreement.encryptedKey.iv) : undefined,\n      tag: keyAgreement.encryptedKey.tag ? new Uint8Array(keyAgreement.encryptedKey.tag) : undefined,\n    })\n    return {\n      contentEncryptionKey,\n    }\n  } finally {\n    derivedKey.handle.free()\n  }\n}\n"],"mappings":";;;;;;AAMA,MAAa,uCAAuC;CAClD;CACA;CACA;CACA;CACA;AACF;;;;;;;AAgBA,SAAgB,eAAe,SAQ5B;CACD,MAAM,EAAE,OAAO,cAAc,YAAY,WAAW,cAAc,MAAM,cAAc,yBAAyB;CAE/G,MAAM,sBAAsC;EAAC,aAAa;EAAQ,aAAa;EAAa,aAAa;CAAW;CACpH,IAAI,CAAC,oBAAoB,SAAS,UAAU,SAAS,KAAK,CAAC,oBAAoB,SAAS,aAAa,SAAS,GAC5G,MAAM,IAAI,IAAI,wCACZ,8EACA,OACF;CAEF,IAAI,UAAU,cAAc,aAAa,WACvC,MAAM,IAAI,IAAI,wCACZ,uEACA,OACF;CAEF,IAAI,wBAAwB,qBAAqB,cAAc,aAAa,WAC1E,MAAM,IAAI,IAAI,wCACZ,gEACA,OACF;CAEF,MAAM,2BAA2B,iBAAiB,WAAW;CAC7D,IAAI,CAAC,0BACH,MAAM,IAAI,IAAI,wCACZ,8BAA8B,WAAW,UAAU,IACnD,OACF;CAGF,MAAM,eAAe,wBAAwB,IAAI,SAAS,aAAa,SAAS;CAChF,MAAM,mBAAmB,CAAC;CAC1B,MAAM,MAAM,aAAa,MAAM,IAAI,WAAW,aAAa,GAAG,IAAI,IAAI,WAAW,CAAC,CAAC;CACnF,MAAM,MAAM,aAAa,MAAM,IAAI,WAAW,aAAa,GAAG,IAAI,IAAI,WAAW,CAAC,CAAC;CACnF,MAAM,QAAQ,kBAAkB,eAAe,iBAAiB;CAEhE,MAAM,uBAAuB,IAAI,SAAS,wBAAwB;CAClE,IAAI;CACJ,IAAI;EACF,MAAM,aAAa,YAAY;GAAE,KAAK;GAAsB;GAAM;EAAW,CAAC;EAE9E,aAAa,IAAI,IACf,MAAM,iBAAiB;GACrB,WAAW,aAAa;GACxB;GACA;GACA;GACA;GACA;GACA;GACA,OAAO,WAAW;GAClB,SAAS;EACX,CAAC,CACH;EACA,MAAM,aAAa,WAAW,QAAQ,EAAE,OAAO,qBAAqB,CAAC;EACrE,MAAM,qBAAqB,aAAa;EAExC,OAAO;GACL,WAAW,WAAW;GACtB,IAAI,WAAW;GACf,KAAK,WAAW;GAChB,cAAc;IACZ,WAAW,IAAI,WAAW,WAAW,UAAU;IAC/C,IAAI,WAAW,QAAQ,IAAI,WAAW,WAAW,KAAK,IAAI,KAAA;IAC1D,KAAK,WAAW,MAAM,IAAI,WAAW,WAAW,GAAG,IAAI,KAAA;IACvD;GACF;EACF;CACF,UAAU;EACR,IAAI,kBAAkB,aAAa,OAAO,KAAK;EAC/C,YAAY,OAAO,KAAK;EACxB,qBAAqB,OAAO,KAAK;CACnC;AACF;AAEA,SAAgB,oBAAoB,SAMjC;CACD,MAAM,EAAE,OAAO,cAAc,YAAY,WAAW,iBAAiB;CAErE,MAAM,2BAA2B,iBAAiB,WAAW;CAC7D,IAAI,CAAC,0BACH,MAAM,IAAI,IAAI,wCACZ,8BAA8B,WAAW,UAAU,IACnD,OACF;CAIF,IAAI,aAAa,cAAc,iBAC7B,MAAM,IAAI,IAAI,wCACZ,6BAA6B,aAAa,UAAU,+BAA+B,WAAW,UAAU,IACxG,OACF;CAMF,IAAI,aAAa,cAAc,mBAC7B,MAAM,IAAI,IAAI,mBAAmB,kFAAkF;CAGrH,MAAM,4BACJ,aAAa,cAAc,YACvB,iBAAiB,aAAa,UAAU,QAAQ,YAAY,EAAE,KAC9D,KAAA;CAEN,MAAM,aAAa,IAAI,IACrB,MAAM,gBAAgB;EACpB,OAAO,kBAAkB,eACvB,aAAa,cAAc,YAAY,WAAW,YAAY,aAAa,SAC7E;EACA,SAAS;EACT,KAAK,aAAa,MAAM,IAAI,WAAW,aAAa,GAAG,IAAI,IAAI,WAAW,CAAC,CAAC;EAC5E,KAAK,aAAa,MAAM,IAAI,WAAW,aAAa,GAAG,IAAI,IAAI,WAAW,CAAC,CAAC;EAC5E,WAAW,6BAA6B;EACxC,cAAc;EACA;CAChB,CAAC,CACH;CACA,IAAI;CACJ,IAAI;CACJ,IAAI;EAEF,IAAI,aAAa,cAAc,WAAW;GACxC,uBAAuB,IAAI,SAAS,wBAAwB;GAE5D,MAAM,aAAa,WAAW,QAAQ,EACpC,OAAO,qBACT,CAAC;GACD,gCAAgC;IAC9B,WAAW,IAAI,WAAW,WAAW,UAAU;IAC/C,IAAI,IAAI,WAAW,WAAW,KAAK;IACnC,KAAK,IAAI,WAAW,WAAW,GAAG;GACpC;EACF;EAEA,OAAO;GACL,sBAAsB,wBAAwB;GAC9C;EACF;CACF,SAAS,OAAO;EACd,IAAI,sBACF,qBAAqB,OAAO,KAAK;OAKjC,WAAW,OAAO,KAAK;EAGzB,MAAM;CACR,UAAU;EAGR,IAAI,sBACF,WAAW,OAAO,KAAK;CAE3B;AACF;AAEA,SAAgB,oBAAoB,SAQjC;CACD,MAAM,EAAE,OAAO,cAAc,YAAY,WAAW,cAAc,iBAAiB;CAEnF,MAAM,2BAA2B,iBAAiB,WAAW;CAC7D,IAAI,CAAC,0BACH,MAAM,IAAI,IAAI,wCACZ,8BAA8B,WAAW,UAAU,IACnD,OACF;CAGF,IAAI,aAAa,cAAc,iBAE7B,MAAM,IAAI,IAAI,wCACZ,6BAA6B,aAAa,UAAU,+BAA+B,WAAW,UAAU,IACxG,OACF;CAIF,IAAI,aAAa,cAAc,mBAAmB;EAChD,IAAI,CAAC,cACH,MAAM,IAAI,IAAI,mBAAmB,+EAA+E;EAElH,OAAO,2BAA2B;GAChC;GACc;GACd;GACA;GACA;GACA;EACF,CAAC;CACH;CAEA,MAAM,4BACJ,aAAa,cAAc,YACvB,iBAAiB,aAAa,UAAU,QAAQ,YAAY,EAAE,KAC9D,KAAA;CAEN,MAAM,aAAa,IAAI,IACrB,MAAM,gBAAgB;EACpB,OAAO,kBAAkB,eACvB,aAAa,cAAc,YAAY,WAAW,YAAY,aAAa,SAC7E;EACA,SAAS;EACT,KAAK,aAAa,MAAM,IAAI,WAAW,aAAa,GAAG,oBAAI,IAAI,WAAW;EAC1E,KAAK,aAAa,MAAM,IAAI,WAAW,aAAa,GAAG,oBAAI,IAAI,WAAW;EAC1E,WAAW,6BAA6B;EACxC,cAAc;EACA;CAChB,CAAC,CACH;CAEA,IAAI;CACJ,IAAI;EAEF,IAAI,aAAa,cAAc,WAC7B,uBAAuB,WAAW,UAAU;GAC1C,YAAY,IAAI,WAAW,aAAa,aAAa,SAAS;GAC9D,WAAW;GACX,OAAO,aAAa,aAAa,KAAK,IAAI,WAAW,aAAa,aAAa,EAAE,IAAI,KAAA;GACrF,KAAK,aAAa,aAAa,MAAM,IAAI,WAAW,aAAa,aAAa,GAAG,IAAI,KAAA;EACvF,CAAC;EAGH,OAAO,EACL,sBAAsB,wBAAwB,WAChD;CACF,SAAS,OAAO;EACd,IAAI,sBACF,qBAAqB,OAAO,KAAK;OAEjC,WAAW,OAAO,KAAK;EAEzB,MAAM;CACR,UAAU;EACR,IAAI,sBACF,WAAW,OAAO,KAAK;CAE3B;AACF;AAEA,SAAS,2BAA2B,SAOjC;CACD,MAAM,EAAE,OAAO,cAAc,YAAY,cAAc,WAAW,iBAAiB;CAGnF,IAAI,CAAC;EADwC,aAAa;EAAQ,aAAa;EAAa,aAAa;CAClF,CAAC,CAAC,SAAS,aAAa,SAAS,GACtD,MAAM,IAAI,IAAI,wCACZ,kEACA,OACF;CAEF,IAAI,aAAa,cAAc,aAAa,aAAa,UAAU,cAAc,aAAa,WAC5F,MAAM,IAAI,IAAI,wCACZ,mFACA,OACF;CAGF,MAAM,2BAA2B,iBAAiB,WAAW;CAC7D,IAAI,CAAC,0BACH,MAAM,IAAI,IAAI,wCACZ,8BAA8B,WAAW,UAAU,IACnD,OACF;CAGF,MAAM,MAAM,aAAa,MAAM,IAAI,WAAW,aAAa,GAAG,IAAI,IAAI,WAAW,CAAC,CAAC;CACnF,MAAM,MAAM,aAAa,MAAM,IAAI,WAAW,aAAa,GAAG,IAAI,IAAI,WAAW,CAAC,CAAC;CACnF,MAAM,QAAQ,kBAAkB,eAAe,iBAAiB;CAGhE,MAAM,gBAAgB,SAAS,aAAa,WAAW,MAAM,KAAA;CAC7D,MAAM,QAAQ,gBAAgB,IAAI,WAAW,aAAa,IAAI,KAAA;CAE9D,MAAM,aAAa,IAAI,IACrB,MAAM,iBAAiB;EACrB,WAAW,aAAa;EACxB;EACA;EACA;EACA;EACA;EACA;EACA;EACA,SAAS;CACX,CAAC,CACH;CAEA,IAAI;EAOF,OAAO,EACL,sBAP2B,WAAW,UAAU;GAChD,YAAY,IAAI,WAAW,aAAa,aAAa,SAAS;GAC9D,WAAW;GACX,OAAO,aAAa,aAAa,KAAK,IAAI,WAAW,aAAa,aAAa,EAAE,IAAI,KAAA;GACrF,KAAK,aAAa,aAAa,MAAM,IAAI,WAAW,aAAa,aAAa,GAAG,IAAI,KAAA;EACvF,CAEqB,EACrB;CACF,UAAU;EACR,WAAW,OAAO,KAAK;CACzB;AACF"}
+{"version":3,"file":"deriveKey.mjs","names":[],"sources":["../../../src/kms/crypto/deriveKey.ts"],"sourcesContent":["import { Kms, TypedArrayEncoder } from '@credo-ts/core'\nimport type { Askar } from '@openwallet-foundation/askar-shared'\nimport { Key } from '@openwallet-foundation/askar-shared'\nimport { jwkEncToAskarAlg } from '../../utils'\n\nexport const askarSupportedKeyAgreementAlgorithms = [\n  'ECDH-ES',\n  'ECDH-ES+A128KW',\n  'ECDH-ES+A256KW',\n  'ECDH-HSALSA20',\n] satisfies Kms.KnownJwaKeyAgreementAlgorithm[]\n\ntype AskarSupportedKeyAgreementEncryptOptions = Kms.KmsKeyAgreementEncryptOptions & {\n  algorithm: (typeof askarSupportedKeyAgreementAlgorithms)[number]\n}\n\ntype AskarSupportedKeyAgreementDecryptOptions = Kms.KmsKeyAgreementDecryptOptions & {\n  algorithm: (typeof askarSupportedKeyAgreementAlgorithms)[number]\n}\n\nexport function deriveEncryptionKey(options: {\n  askar: Askar\n  keyAgreement: AskarSupportedKeyAgreementEncryptOptions\n  senderKey: Key\n  recipientKey: Key\n  encryption: Kms.KmsEncryptDataContentEncryption\n}) {\n  const { askar, keyAgreement, encryption, senderKey, recipientKey } = options\n\n  const askarEncryptionAlgorithm = jwkEncToAskarAlg[encryption.algorithm as keyof typeof jwkEncToAskarAlg]\n  if (!askarEncryptionAlgorithm) {\n    throw new Kms.KeyManagementAlgorithmNotSupportedError(\n      `encryption with algorithm '${encryption.algorithm}'`,\n      'askar'\n    )\n  }\n\n  // This should be handled on a higher level as we only support combined key agreemnt + encryption\n  if (keyAgreement.algorithm === 'ECDH-HSALSA20') {\n    throw new Kms.KeyManagementAlgorithmNotSupportedError(\n      `derive key for algorithm '${keyAgreement.algorithm}' with encryption algorithm '${encryption.algorithm}'`,\n      'askar'\n    )\n  }\n\n  const askarKeyWrappingAlgorithm =\n    keyAgreement.algorithm !== 'ECDH-ES'\n      ? jwkEncToAskarAlg[keyAgreement.algorithm.replace('ECDH-ES+', '') as keyof typeof jwkEncToAskarAlg]\n      : undefined\n\n  const derivedKey = new Key(\n    askar.keyDeriveEcdhEs({\n      algId: TypedArrayEncoder.fromUtf8String(\n        keyAgreement.algorithm === 'ECDH-ES' ? encryption.algorithm : keyAgreement.algorithm\n      ),\n      receive: false,\n      apv: keyAgreement.apv ? new Uint8Array(keyAgreement.apv) : new Uint8Array([]),\n      apu: keyAgreement.apu ? new Uint8Array(keyAgreement.apu) : new Uint8Array([]),\n      algorithm: askarKeyWrappingAlgorithm ?? askarEncryptionAlgorithm,\n      ephemeralKey: senderKey,\n      recipientKey: recipientKey,\n    })\n  )\n  let contentEncryptionKey: Key | undefined\n  let encryptedContentEncryptionKey: Kms.KmsEncryptedKey | undefined\n  try {\n    // Key wrapping\n    if (keyAgreement.algorithm !== 'ECDH-ES') {\n      contentEncryptionKey = Key.generate(askarEncryptionAlgorithm)\n\n      const wrappedKey = derivedKey.wrapKey({\n        other: contentEncryptionKey,\n      })\n      encryptedContentEncryptionKey = {\n        encrypted: new Uint8Array(wrappedKey.ciphertext),\n        iv: new Uint8Array(wrappedKey.nonce),\n        tag: new Uint8Array(wrappedKey.tag),\n      }\n    }\n\n    return {\n      contentEncryptionKey: contentEncryptionKey ?? derivedKey,\n      encryptedContentEncryptionKey,\n    }\n  } catch (error) {\n    if (contentEncryptionKey) {\n      contentEncryptionKey.handle.free()\n    }\n    // We only free the derived key if there is no content encryption key\n    // as in this case the derived key is already freed in the finally clause\n    else {\n      derivedKey.handle.free()\n    }\n\n    throw error\n  } finally {\n    // If there is a content encryption key, it means we can free the\n    // derived key\n    if (contentEncryptionKey) {\n      derivedKey.handle.free()\n    }\n  }\n}\n\nexport function deriveDecryptionKey(options: {\n  askar: Askar\n  keyAgreement: AskarSupportedKeyAgreementDecryptOptions\n  senderKey: Key\n  recipientKey: Key\n  decryption: Kms.KmsDecryptDataContentDecryption\n}) {\n  const { askar, keyAgreement, decryption, senderKey, recipientKey } = options\n\n  const askarEncryptionAlgorithm = jwkEncToAskarAlg[decryption.algorithm as keyof typeof jwkEncToAskarAlg]\n  if (!askarEncryptionAlgorithm) {\n    throw new Kms.KeyManagementAlgorithmNotSupportedError(\n      `decryption with algorithm '${decryption.algorithm}'`,\n      'askar'\n    )\n  }\n\n  if (keyAgreement.algorithm === 'ECDH-HSALSA20') {\n    // This should be handled on a higher level as we only support combined key agreemnt + encryption\n    throw new Kms.KeyManagementAlgorithmNotSupportedError(\n      `derive key for algorithm '${keyAgreement.algorithm}' with encryption algorithm '${decryption.algorithm}'`,\n      'askar'\n    )\n  }\n\n  const askarKeyWrappingAlgorithm =\n    keyAgreement.algorithm !== 'ECDH-ES'\n      ? jwkEncToAskarAlg[keyAgreement.algorithm.replace('ECDH-ES+', '') as keyof typeof jwkEncToAskarAlg]\n      : undefined\n\n  const derivedKey = new Key(\n    askar.keyDeriveEcdhEs({\n      algId: TypedArrayEncoder.fromUtf8String(\n        keyAgreement.algorithm === 'ECDH-ES' ? decryption.algorithm : keyAgreement.algorithm\n      ),\n      receive: true,\n      apv: keyAgreement.apv ? new Uint8Array(keyAgreement.apv) : new Uint8Array(),\n      apu: keyAgreement.apu ? new Uint8Array(keyAgreement.apu) : new Uint8Array(),\n      algorithm: askarKeyWrappingAlgorithm ?? askarEncryptionAlgorithm,\n      ephemeralKey: senderKey,\n      recipientKey: recipientKey,\n    })\n  )\n\n  let contentEncryptionKey: Key | undefined\n  try {\n    // Key unwrapping\n    if (keyAgreement.algorithm !== 'ECDH-ES') {\n      contentEncryptionKey = derivedKey.unwrapKey({\n        ciphertext: new Uint8Array(keyAgreement.encryptedKey.encrypted),\n        algorithm: askarEncryptionAlgorithm,\n        nonce: keyAgreement.encryptedKey.iv ? new Uint8Array(keyAgreement.encryptedKey.iv) : undefined,\n        tag: keyAgreement.encryptedKey.tag ? new Uint8Array(keyAgreement.encryptedKey.tag) : undefined,\n      })\n    }\n\n    return {\n      contentEncryptionKey: contentEncryptionKey ?? derivedKey,\n    }\n  } catch (error) {\n    if (contentEncryptionKey) {\n      contentEncryptionKey.handle.free()\n    } else {\n      derivedKey.handle.free()\n    }\n    throw error\n  } finally {\n    if (contentEncryptionKey) {\n      derivedKey.handle.free()\n    }\n  }\n}\n"],"mappings":";;;;;AAKA,MAAa,uCAAuC;CAClD;CACA;CACA;CACA;AACF;AAUA,SAAgB,oBAAoB,SAMjC;CACD,MAAM,EAAE,OAAO,cAAc,YAAY,WAAW,iBAAiB;CAErE,MAAM,2BAA2B,iBAAiB,WAAW;CAC7D,IAAI,CAAC,0BACH,MAAM,IAAI,IAAI,wCACZ,8BAA8B,WAAW,UAAU,IACnD,OACF;CAIF,IAAI,aAAa,cAAc,iBAC7B,MAAM,IAAI,IAAI,wCACZ,6BAA6B,aAAa,UAAU,+BAA+B,WAAW,UAAU,IACxG,OACF;CAGF,MAAM,4BACJ,aAAa,cAAc,YACvB,iBAAiB,aAAa,UAAU,QAAQ,YAAY,EAAE,KAC9D,KAAA;CAEN,MAAM,aAAa,IAAI,IACrB,MAAM,gBAAgB;EACpB,OAAO,kBAAkB,eACvB,aAAa,cAAc,YAAY,WAAW,YAAY,aAAa,SAC7E;EACA,SAAS;EACT,KAAK,aAAa,MAAM,IAAI,WAAW,aAAa,GAAG,IAAI,IAAI,WAAW,CAAC,CAAC;EAC5E,KAAK,aAAa,MAAM,IAAI,WAAW,aAAa,GAAG,IAAI,IAAI,WAAW,CAAC,CAAC;EAC5E,WAAW,6BAA6B;EACxC,cAAc;EACA;CAChB,CAAC,CACH;CACA,IAAI;CACJ,IAAI;CACJ,IAAI;EAEF,IAAI,aAAa,cAAc,WAAW;GACxC,uBAAuB,IAAI,SAAS,wBAAwB;GAE5D,MAAM,aAAa,WAAW,QAAQ,EACpC,OAAO,qBACT,CAAC;GACD,gCAAgC;IAC9B,WAAW,IAAI,WAAW,WAAW,UAAU;IAC/C,IAAI,IAAI,WAAW,WAAW,KAAK;IACnC,KAAK,IAAI,WAAW,WAAW,GAAG;GACpC;EACF;EAEA,OAAO;GACL,sBAAsB,wBAAwB;GAC9C;EACF;CACF,SAAS,OAAO;EACd,IAAI,sBACF,qBAAqB,OAAO,KAAK;OAKjC,WAAW,OAAO,KAAK;EAGzB,MAAM;CACR,UAAU;EAGR,IAAI,sBACF,WAAW,OAAO,KAAK;CAE3B;AACF;AAEA,SAAgB,oBAAoB,SAMjC;CACD,MAAM,EAAE,OAAO,cAAc,YAAY,WAAW,iBAAiB;CAErE,MAAM,2BAA2B,iBAAiB,WAAW;CAC7D,IAAI,CAAC,0BACH,MAAM,IAAI,IAAI,wCACZ,8BAA8B,WAAW,UAAU,IACnD,OACF;CAGF,IAAI,aAAa,cAAc,iBAE7B,MAAM,IAAI,IAAI,wCACZ,6BAA6B,aAAa,UAAU,+BAA+B,WAAW,UAAU,IACxG,OACF;CAGF,MAAM,4BACJ,aAAa,cAAc,YACvB,iBAAiB,aAAa,UAAU,QAAQ,YAAY,EAAE,KAC9D,KAAA;CAEN,MAAM,aAAa,IAAI,IACrB,MAAM,gBAAgB;EACpB,OAAO,kBAAkB,eACvB,aAAa,cAAc,YAAY,WAAW,YAAY,aAAa,SAC7E;EACA,SAAS;EACT,KAAK,aAAa,MAAM,IAAI,WAAW,aAAa,GAAG,oBAAI,IAAI,WAAW;EAC1E,KAAK,aAAa,MAAM,IAAI,WAAW,aAAa,GAAG,oBAAI,IAAI,WAAW;EAC1E,WAAW,6BAA6B;EACxC,cAAc;EACA;CAChB,CAAC,CACH;CAEA,IAAI;CACJ,IAAI;EAEF,IAAI,aAAa,cAAc,WAC7B,uBAAuB,WAAW,UAAU;GAC1C,YAAY,IAAI,WAAW,aAAa,aAAa,SAAS;GAC9D,WAAW;GACX,OAAO,aAAa,aAAa,KAAK,IAAI,WAAW,aAAa,aAAa,EAAE,IAAI,KAAA;GACrF,KAAK,aAAa,aAAa,MAAM,IAAI,WAAW,aAAa,aAAa,GAAG,IAAI,KAAA;EACvF,CAAC;EAGH,OAAO,EACL,sBAAsB,wBAAwB,WAChD;CACF,SAAS,OAAO;EACd,IAAI,sBACF,qBAAqB,OAAO,KAAK;OAEjC,WAAW,OAAO,KAAK;EAEzB,MAAM;CACR,UAAU;EACR,IAAI,sBACF,WAAW,OAAO,KAAK;CAE3B;AACF"}

package/package.json

@@ -4,7 +4,7 @@
     ".": "./build/index.mjs",
     "./package.json": "./package.json"
   },
-  "version": "0.7.2-pr-2704-20260925144545",
+  "version": "0.7.2",
   "files": [
     "build"
   ],
@@ -25,7 +25,7 @@
     "hpke": "^1.1.4",
     "rxjs": "^7.8.2",
     "tsyringe": "^4.10.0",
-    "@credo-ts/core": "0.7.2-pr-2704-20260925144545"
+    "@credo-ts/core": "0.7.2"
   },
   "devDependencies": {
     "@openwallet-foundation/askar-nodejs": "0.6.0",
@@ -34,7 +34,7 @@
     "@types/ref-struct-di": "^1.1.12",
     "reflect-metadata": "0.2.2",
     "typescript": "~5.9.3",
-    "@credo-ts/tenants": "0.7.2-pr-2704-20260925144545"
+    "@credo-ts/tenants": "0.7.2"
   },
   "peerDependencies": {
     "@openwallet-foundation/askar-shared": "^0.4.3 || ^0.5.0 || ^0.6.0"