@credo-ts/core 0.6.1-pr-2091-20241119140918 → 0.6.1

package/build/modules/kms/jwk/alg/encryption.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"encryption.mjs","names":["algs: Array<KnownJwaContentEncryptionAlgorithm | KnownJwaKeyEncryptionAlgorithm>"],"sources":["../../../../../src/modules/kms/jwk/alg/encryption.ts"],"sourcesContent":["import { TypedArrayEncoder } from '../../../../utils'\nimport { KeyManagementError } from '../../error/KeyManagementError'\nimport { getJwkHumanDescription } from '../humanDescription'\nimport type { KnownJwaContentEncryptionAlgorithm, KnownJwaKeyEncryptionAlgorithm } from '../jwa'\nimport type { KmsJwkPrivate, KmsJwkPublic } from '../knownJwk'\nimport type { KmsJwkPublicOct } from '../kty/oct/octJwk'\n\nexport function supportedEncryptionAlgsForKey(jwk: KmsJwkPrivate | Exclude<KmsJwkPublic, KmsJwkPublicOct>) {\n  const algs: Array<KnownJwaContentEncryptionAlgorithm | KnownJwaKeyEncryptionAlgorithm> = []\n\n  // Only symmetric (oct) keys can be used directly for content encryption\n  if (jwk.kty === 'oct') {\n    const keyBits = TypedArrayEncoder.fromBase64(jwk.k).length * 8\n\n    // For CBC-HMAC composite algorithms we need exact key sizes\n    if (keyBits === 256) algs.push('A128CBC-HS256')\n    if (keyBits === 384) algs.push('A192CBC-HS384')\n    if (keyBits === 512) algs.push('A256CBC-HS512')\n\n    // For GCM/CBC we just need the exact AES key size\n    if (keyBits === 128) algs.push('A128GCM', 'A128CBC', 'A128KW')\n    if (keyBits === 192) algs.push('A192GCM', 'A192KW')\n    if (keyBits === 256) algs.push('A256GCM', 'A256CBC', 'A256KW', 'C20P', 'XC20P')\n  }\n\n  return algs\n}\n\n/**\n * Get the allowed content encryption algs for a key. If takes all the known supported\n * algs and will filter these based on the optional `alg` key in the JWK.\n *\n * This does not handle the intended key `use` and `key_ops`.\n */\nexport function allowedEncryptionAlgsForKey(\n  jwk: KmsJwkPrivate | Exclude<KmsJwkPublic, KmsJwkPublicOct>\n): Array<KnownJwaContentEncryptionAlgorithm | KnownJwaKeyEncryptionAlgorithm> {\n  const supportedAlgs = supportedEncryptionAlgsForKey(jwk)\n  const allowedAlg = jwk.alg\n\n  return !allowedAlg\n    ? // If no `alg` specified on jwk, return all supported algs\n      supportedAlgs\n    : // If `alg` is specified and supported, return the allowed alg\n      allowedAlg && supportedAlgs.includes(allowedAlg as KnownJwaContentEncryptionAlgorithm)\n      ? [allowedAlg as KnownJwaContentEncryptionAlgorithm | KnownJwaKeyEncryptionAlgorithm]\n      : // Otherwise nothing is allowed (`alg` is specified but not supported)\n        []\n}\n\nexport function assertAllowedEncryptionAlgForKey(\n  jwk: KmsJwkPrivate | Exclude<KmsJwkPublic, KmsJwkPublicOct>,\n  algorithm: KnownJwaContentEncryptionAlgorithm | KnownJwaKeyEncryptionAlgorithm\n) {\n  const allowedAlgs = allowedEncryptionAlgsForKey(jwk)\n  if (!allowedAlgs.includes(algorithm)) {\n    const allowedAlgsText =\n      allowedAlgs.length > 0 ? ` Allowed algs are ${allowedAlgs.map((alg) => `'${alg}'`).join(', ')}` : ''\n    throw new KeyManagementError(\n      `${getJwkHumanDescription(\n        jwk\n      )} cannot be used with algorithm '${algorithm}' for content encryption or decryption.${allowedAlgsText}`\n    )\n  }\n}\n"],"mappings":";;;;;;;;AAOA,SAAgB,8BAA8B,KAA6D;CACzG,MAAMA,OAAmF,EAAE;AAG3F,KAAI,IAAI,QAAQ,OAAO;EACrB,MAAM,UAAU,kBAAkB,WAAW,IAAI,EAAE,CAAC,SAAS;AAG7D,MAAI,YAAY,IAAK,MAAK,KAAK,gBAAgB;AAC/C,MAAI,YAAY,IAAK,MAAK,KAAK,gBAAgB;AAC/C,MAAI,YAAY,IAAK,MAAK,KAAK,gBAAgB;AAG/C,MAAI,YAAY,IAAK,MAAK,KAAK,WAAW,WAAW,SAAS;AAC9D,MAAI,YAAY,IAAK,MAAK,KAAK,WAAW,SAAS;AACnD,MAAI,YAAY,IAAK,MAAK,KAAK,WAAW,WAAW,UAAU,QAAQ,QAAQ;;AAGjF,QAAO;;;;;;;;AAST,SAAgB,4BACd,KAC4E;CAC5E,MAAM,gBAAgB,8BAA8B,IAAI;CACxD,MAAM,aAAa,IAAI;AAEvB,QAAO,CAAC,aAEJ,gBAEA,cAAc,cAAc,SAAS,WAAiD,GACpF,CAAC,WAAkF,GAEnF,EAAE;;AAGV,SAAgB,iCACd,KACA,WACA;CACA,MAAM,cAAc,4BAA4B,IAAI;AACpD,KAAI,CAAC,YAAY,SAAS,UAAU,EAAE;EACpC,MAAM,kBACJ,YAAY,SAAS,IAAI,qBAAqB,YAAY,KAAK,QAAQ,IAAI,IAAI,GAAG,CAAC,KAAK,KAAK,KAAK;AACpG,QAAM,IAAI,mBACR,GAAG,uBACD,IACD,CAAC,kCAAkC,UAAU,yCAAyC,kBACxF"}

package/build/modules/kms/jwk/alg/index.d.mts

@@ -0,0 +1,3 @@
+import { allowedEncryptionAlgsForKey, assertAllowedEncryptionAlgForKey, supportedEncryptionAlgsForKey } from "./encryption.mjs";
+import { allowedKeyDerivationAlgsForKey, assertAllowedKeyDerivationAlgForKey, supportedKeyDerivationAlgsForKey } from "./keyDerivation.mjs";
+import { allowedSigningAlgsForSigningKey, assertAllowedSigningAlgForKey, supportedSigningAlgsForKey } from "./signing.mjs";

package/build/modules/kms/jwk/alg/index.mjs

@@ -0,0 +1,5 @@
+
+
+import { allowedEncryptionAlgsForKey, assertAllowedEncryptionAlgForKey, supportedEncryptionAlgsForKey } from "./encryption.mjs";
+import { allowedKeyDerivationAlgsForKey, assertAllowedKeyDerivationAlgForKey, supportedKeyDerivationAlgsForKey } from "./keyDerivation.mjs";
+import { allowedSigningAlgsForSigningKey, assertAllowedSigningAlgForKey, supportedSigningAlgsForKey } from "./signing.mjs";

package/build/modules/kms/jwk/alg/keyDerivation.d.mts

@@ -0,0 +1,17 @@
+import { KnownJwaKeyAgreementAlgorithm } from "../jwa.mjs";
+import { KmsJwkPublicOct } from "../kty/oct/octJwk.mjs";
+import { KmsJwkPrivate, KmsJwkPublic } from "../knownJwk.mjs";
+
+//#region src/modules/kms/jwk/alg/keyDerivation.d.ts
+declare function supportedKeyDerivationAlgsForKey(jwk: KmsJwkPrivate | Exclude<KmsJwkPublic, KmsJwkPublicOct>): KnownJwaKeyAgreementAlgorithm[];
+/**
+ * Get the allowed key derivation algs for a key. If takes all the known supported
+ * algs and will filter these based on the optional `alg` key in the JWK.
+ *
+ * This does not handle the intended key `use` and `key_ops`.
+ */
+declare function allowedKeyDerivationAlgsForKey(jwk: KmsJwkPrivate | Exclude<KmsJwkPublic, KmsJwkPublicOct>): KnownJwaKeyAgreementAlgorithm[];
+declare function assertAllowedKeyDerivationAlgForKey(jwk: KmsJwkPrivate | Exclude<KmsJwkPublic, KmsJwkPublicOct>, algorithm: KnownJwaKeyAgreementAlgorithm): void;
+//#endregion
+export { allowedKeyDerivationAlgsForKey, assertAllowedKeyDerivationAlgForKey, supportedKeyDerivationAlgsForKey };
+//# sourceMappingURL=keyDerivation.d.mts.map

package/build/modules/kms/jwk/alg/keyDerivation.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keyDerivation.d.mts","names":[],"sources":["../../../../../src/modules/kms/jwk/alg/keyDerivation.ts"],"sourcesContent":[],"mappings":";;;;;iBAagB,gCAAA,MACT,gBAAgB,QAAQ,cAAc,mBAC1C;;;;AAFH;;;AAC6C,iBAwB7B,8BAAA,CAxB6B,GAAA,EAyBtC,aAzBsC,GAyBtB,OAzBsB,CAyBd,YAzBc,EAyBA,eAzBA,CAAA,CAAA,EA0B1C,6BA1B0C,EAAA;AAAtB,iBAwCP,mCAAA,CAxCO,GAAA,EAyChB,aAzCgB,GAyCA,OAzCA,CAyCQ,YAzCR,EAyCsB,eAzCtB,CAAA,EAAA,SAAA,EA0CV,6BA1CU,CAAA,EAAA,IAAA"}

package/build/modules/kms/jwk/alg/keyDerivation.mjs

@@ -0,0 +1,43 @@
+
+
+import { KeyManagementError } from "../../error/KeyManagementError.mjs";
+import { getJwkHumanDescription } from "../humanDescription.mjs";
+
+//#region src/modules/kms/jwk/alg/keyDerivation.ts
+function isCrvJwk(jwk) {
+	return jwk.kty === "EC" || jwk.kty === "OKP";
+}
+function supportedKeyDerivationAlgsForKey(jwk) {
+	const algs = [];
+	if (isCrvJwk(jwk) && [
+		"P-256",
+		"P-384",
+		"P-521",
+		"X25519",
+		"secp256k1"
+	].includes(jwk.crv)) algs.push("ECDH-ES", "ECDH-ES+A128KW", "ECDH-ES+A192KW", "ECDH-ES+A256KW");
+	if (jwk.kty === "OKP" && (jwk.crv === "X25519" || jwk.crv === "Ed25519")) algs.push("ECDH-HSALSA20");
+	return algs;
+}
+/**
+* Get the allowed key derivation algs for a key. If takes all the known supported
+* algs and will filter these based on the optional `alg` key in the JWK.
+*
+* This does not handle the intended key `use` and `key_ops`.
+*/
+function allowedKeyDerivationAlgsForKey(jwk) {
+	const supportedAlgs = supportedKeyDerivationAlgsForKey(jwk);
+	const allowedAlg = jwk.alg;
+	return !allowedAlg ? supportedAlgs : allowedAlg && supportedAlgs.includes(allowedAlg) ? [allowedAlg] : [];
+}
+function assertAllowedKeyDerivationAlgForKey(jwk, algorithm) {
+	const allowedAlgs = allowedKeyDerivationAlgsForKey(jwk);
+	if (!allowedAlgs.includes(algorithm)) {
+		const allowedAlgsText = allowedAlgs.length > 0 ? ` Allowed algs are ${allowedAlgs.map((alg) => `'${alg}'`).join(", ")}` : "";
+		throw new KeyManagementError(`${getJwkHumanDescription(jwk)} cannot be used with algorithm '${algorithm}' for key derivation.${allowedAlgsText}`);
+	}
+}
+
+//#endregion
+export { allowedKeyDerivationAlgsForKey, assertAllowedKeyDerivationAlgForKey, supportedKeyDerivationAlgsForKey };
+//# sourceMappingURL=keyDerivation.mjs.map

package/build/modules/kms/jwk/alg/keyDerivation.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"keyDerivation.mjs","names":["algs: KnownJwaKeyAgreementAlgorithm[]"],"sources":["../../../../../src/modules/kms/jwk/alg/keyDerivation.ts"],"sourcesContent":["import { KeyManagementError } from '../../error/KeyManagementError'\nimport { getJwkHumanDescription } from '../humanDescription'\nimport type { KnownJwaKeyAgreementAlgorithm } from '../jwa'\nimport type { KmsJwkPrivate, KmsJwkPublic, KmsJwkPublicCrv } from '../knownJwk'\nimport type { KmsJwkPrivateOct, KmsJwkPublicOct } from '../kty/oct/octJwk'\nimport type { KmsJwkPrivateRsa, KmsJwkPublicRsa } from '../kty/rsa/rsaJwk'\n\nfunction isCrvJwk<Jwk extends KmsJwkPrivate | KmsJwkPublic>(\n  jwk: Jwk\n): jwk is Exclude<Jwk, KmsJwkPrivateOct | KmsJwkPrivateRsa | KmsJwkPublicOct | KmsJwkPublicRsa> {\n  return jwk.kty === 'EC' || jwk.kty === 'OKP'\n}\n\nexport function supportedKeyDerivationAlgsForKey(\n  jwk: KmsJwkPrivate | Exclude<KmsJwkPublic, KmsJwkPublicOct>\n): KnownJwaKeyAgreementAlgorithm[] {\n  const algs: KnownJwaKeyAgreementAlgorithm[] = []\n\n  const allowedCurves: KmsJwkPublicCrv['crv'][] = ['P-256', 'P-384', 'P-521', 'X25519', 'secp256k1']\n  if (isCrvJwk(jwk) && allowedCurves.includes(jwk.crv)) {\n    algs.push('ECDH-ES', 'ECDH-ES+A128KW', 'ECDH-ES+A192KW', 'ECDH-ES+A256KW')\n  }\n\n  // Special case where we allow Ed25519 for X25519 based operation, since that is\n  // how DIDComm v1 works.\n  if (jwk.kty === 'OKP' && (jwk.crv === 'X25519' || jwk.crv === 'Ed25519')) {\n    algs.push('ECDH-HSALSA20')\n  }\n\n  return algs\n}\n\n/**\n * Get the allowed key derivation algs for a key. If takes all the known supported\n * algs and will filter these based on the optional `alg` key in the JWK.\n *\n * This does not handle the intended key `use` and `key_ops`.\n */\nexport function allowedKeyDerivationAlgsForKey(\n  jwk: KmsJwkPrivate | Exclude<KmsJwkPublic, KmsJwkPublicOct>\n): KnownJwaKeyAgreementAlgorithm[] {\n  const supportedAlgs = supportedKeyDerivationAlgsForKey(jwk)\n  const allowedAlg = jwk.alg\n\n  return !allowedAlg\n    ? // If no `alg` specified on jwk, return all supported algs\n      supportedAlgs\n    : // If `alg` is specified and supported, return the allowed alg\n      allowedAlg && supportedAlgs.includes(allowedAlg as KnownJwaKeyAgreementAlgorithm)\n      ? [allowedAlg as KnownJwaKeyAgreementAlgorithm]\n      : // Otherwise nothing is allowed (`alg` is specified but not supported)\n        []\n}\n\nexport function assertAllowedKeyDerivationAlgForKey(\n  jwk: KmsJwkPrivate | Exclude<KmsJwkPublic, KmsJwkPublicOct>,\n  algorithm: KnownJwaKeyAgreementAlgorithm\n) {\n  const allowedAlgs = allowedKeyDerivationAlgsForKey(jwk)\n  if (!allowedAlgs.includes(algorithm)) {\n    const allowedAlgsText =\n      allowedAlgs.length > 0 ? ` Allowed algs are ${allowedAlgs.map((alg) => `'${alg}'`).join(', ')}` : ''\n    throw new KeyManagementError(\n      `${getJwkHumanDescription(\n        jwk\n      )} cannot be used with algorithm '${algorithm}' for key derivation.${allowedAlgsText}`\n    )\n  }\n}\n"],"mappings":";;;;;;AAOA,SAAS,SACP,KAC8F;AAC9F,QAAO,IAAI,QAAQ,QAAQ,IAAI,QAAQ;;AAGzC,SAAgB,iCACd,KACiC;CACjC,MAAMA,OAAwC,EAAE;AAGhD,KAAI,SAAS,IAAI,IAD+B;EAAC;EAAS;EAAS;EAAS;EAAU;EAAY,CAC/D,SAAS,IAAI,IAAI,CAClD,MAAK,KAAK,WAAW,kBAAkB,kBAAkB,iBAAiB;AAK5E,KAAI,IAAI,QAAQ,UAAU,IAAI,QAAQ,YAAY,IAAI,QAAQ,WAC5D,MAAK,KAAK,gBAAgB;AAG5B,QAAO;;;;;;;;AAST,SAAgB,+BACd,KACiC;CACjC,MAAM,gBAAgB,iCAAiC,IAAI;CAC3D,MAAM,aAAa,IAAI;AAEvB,QAAO,CAAC,aAEJ,gBAEA,cAAc,cAAc,SAAS,WAA4C,GAC/E,CAAC,WAA4C,GAE7C,EAAE;;AAGV,SAAgB,oCACd,KACA,WACA;CACA,MAAM,cAAc,+BAA+B,IAAI;AACvD,KAAI,CAAC,YAAY,SAAS,UAAU,EAAE;EACpC,MAAM,kBACJ,YAAY,SAAS,IAAI,qBAAqB,YAAY,KAAK,QAAQ,IAAI,IAAI,GAAG,CAAC,KAAK,KAAK,KAAK;AACpG,QAAM,IAAI,mBACR,GAAG,uBACD,IACD,CAAC,kCAAkC,UAAU,uBAAuB,kBACtE"}

package/build/modules/kms/jwk/alg/signing.d.mts

@@ -0,0 +1,19 @@
+import { KnownJwaSignatureAlgorithm } from "../jwa.mjs";
+import "../../options/index.mjs";
+import { KmsJwkPublicOct } from "../kty/oct/octJwk.mjs";
+import { KmsJwkPrivate, KmsJwkPublic } from "../knownJwk.mjs";
+
+//#region src/modules/kms/jwk/alg/signing.d.ts
+
+/**
+ * Get the allowed algs for a signing key. If takes all the known supported
+ * algs and will filter these based on the optional `alg` key in the JWK.
+ *
+ * This does not handle the intended key `use` and `key_ops`.
+ */
+declare function allowedSigningAlgsForSigningKey(jwk: KmsJwkPrivate | Exclude<KmsJwkPublic, KmsJwkPublicOct>): KnownJwaSignatureAlgorithm[];
+declare function assertAllowedSigningAlgForKey(jwk: KmsJwkPrivate | Exclude<KmsJwkPublic, KmsJwkPublicOct>, algorithm: KnownJwaSignatureAlgorithm): void;
+declare function supportedSigningAlgsForKey(jwk: KmsJwkPrivate | Exclude<KmsJwkPublic, KmsJwkPublicOct>): KnownJwaSignatureAlgorithm[];
+//#endregion
+export { allowedSigningAlgsForSigningKey, assertAllowedSigningAlgForKey, supportedSigningAlgsForKey };
+//# sourceMappingURL=signing.d.mts.map

package/build/modules/kms/jwk/alg/signing.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signing.d.mts","names":[],"sources":["../../../../../src/modules/kms/jwk/alg/signing.ts"],"sourcesContent":[],"mappings":";;;;;;;;;;;AAcA;;AAC+B,iBADf,+BAAA,CACe,GAAA,EAAxB,aAAwB,GAAR,OAAQ,CAAA,YAAA,EAAc,eAAd,CAAA,CAAA,EAC5B,0BAD4B,EAAA;AAAc,iBAe7B,6BAAA,CAf6B,GAAA,EAgBtC,aAhBsC,GAgBtB,OAhBsB,CAgBd,YAhBc,EAgBA,eAhBA,CAAA,EAAA,SAAA,EAiBhC,0BAjBgC,CAAA,EAAA,IAAA;AAAtB,iBAiCP,0BAAA,CAjCO,GAAA,EAkChB,aAlCgB,GAkCA,OAlCA,CAkCQ,YAlCR,EAkCsB,eAlCtB,CAAA,CAAA,EAmCpB,0BAnCoB,EAAA"}

package/build/modules/kms/jwk/alg/signing.mjs

@@ -0,0 +1,113 @@
+
+
+import { KeyManagementError } from "../../error/KeyManagementError.mjs";
+import { TypedArrayEncoder } from "../../../../utils/TypedArrayEncoder.mjs";
+import "../../../../utils/index.mjs";
+import { getJwkHumanDescription } from "../humanDescription.mjs";
+
+//#region src/modules/kms/jwk/alg/signing.ts
+/**
+* Get the allowed algs for a signing key. If takes all the known supported
+* algs and will filter these based on the optional `alg` key in the JWK.
+*
+* This does not handle the intended key `use` and `key_ops`.
+*/
+function allowedSigningAlgsForSigningKey(jwk) {
+	const supportedAlgs = supportedSigningAlgsForKey(jwk);
+	const allowedAlg = jwk.alg;
+	return !allowedAlg ? supportedAlgs : allowedAlg && supportedAlgs.includes(allowedAlg) ? [allowedAlg] : [];
+}
+function assertAllowedSigningAlgForKey(jwk, algorithm) {
+	const allowedAlgs = allowedSigningAlgsForSigningKey(jwk);
+	if (!allowedAlgs.includes(algorithm)) {
+		const allowedAlgsText = allowedAlgs.length > 0 ? ` Allowed algs are ${allowedAlgs.map((alg) => `'${alg}'`).join(", ")}` : "";
+		throw new KeyManagementError(`${getJwkHumanDescription(jwk)} cannot be used with algorithm '${algorithm}' for signature creation or verification.${allowedAlgsText}`);
+	}
+}
+function supportedSigningAlgsForKey(jwk) {
+	if (jwk.kty === "EC" || jwk.kty === "OKP") switch (jwk.crv) {
+		case "secp256k1": return ["ES256K"];
+		case "P-256": return ["ES256"];
+		case "P-384": return ["ES384"];
+		case "P-521": return ["ES512"];
+		case "Ed25519": return ["EdDSA", "Ed25519"];
+		default: return [];
+	}
+	if (jwk.kty === "RSA") {
+		const keyBits = TypedArrayEncoder.fromBase64(jwk.n).length * 8;
+		const minBits2048 = ["PS256", "RS256"];
+		const minBits3072 = [
+			...minBits2048,
+			"RS384",
+			"PS384"
+		];
+		const minBits4096 = [
+			...minBits3072,
+			"RS512",
+			"PS512"
+		];
+		return keyBits >= 4096 ? minBits4096 : keyBits >= 3072 ? minBits3072 : keyBits >= 2048 ? minBits2048 : [];
+	}
+	if (jwk.kty === "oct") {
+		const keyBits = TypedArrayEncoder.fromBase64(jwk.k).length * 8;
+		const minBits256 = ["HS256"];
+		const minBits384 = [...minBits256, "HS384"];
+		const minBits512 = [...minBits384, "HS512"];
+		return keyBits >= 512 ? minBits512 : keyBits >= 384 ? minBits384 : keyBits >= 256 ? minBits256 : [];
+	}
+	return [];
+}
+function createKeyTypeForSigningAlgorithm(algorithm) {
+	if (algorithm === "ES256") return {
+		kty: "EC",
+		crv: "P-256"
+	};
+	if (algorithm === "ES384") return {
+		kty: "EC",
+		crv: "P-384"
+	};
+	if (algorithm === "ES512") return {
+		kty: "EC",
+		crv: "P-521"
+	};
+	if (algorithm === "ES256K") return {
+		kty: "EC",
+		crv: "secp256k1"
+	};
+	if (algorithm === "EdDSA" || algorithm === "Ed25519") return {
+		kty: "OKP",
+		crv: "Ed25519"
+	};
+	if (algorithm === "HS256") return {
+		kty: "oct",
+		algorithm: "hmac",
+		length: 256
+	};
+	if (algorithm === "HS384") return {
+		kty: "oct",
+		algorithm: "hmac",
+		length: 384
+	};
+	if (algorithm === "HS512") return {
+		kty: "oct",
+		algorithm: "hmac",
+		length: 512
+	};
+	if (algorithm === "PS256" || algorithm === "RS256") return {
+		kty: "RSA",
+		modulusLength: 2048
+	};
+	if (algorithm === "PS384" || algorithm === "RS384") return {
+		kty: "RSA",
+		modulusLength: 3072
+	};
+	if (algorithm === "PS512" || algorithm === "RS512") return {
+		kty: "RSA",
+		modulusLength: 4096
+	};
+	throw new KeyManagementError(`unknown signature algorithm '${algorithm}' for creating key `);
+}
+
+//#endregion
+export { allowedSigningAlgsForSigningKey, assertAllowedSigningAlgForKey, createKeyTypeForSigningAlgorithm, supportedSigningAlgsForKey };
+//# sourceMappingURL=signing.mjs.map

package/build/modules/kms/jwk/alg/signing.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"signing.mjs","names":["minBits2048: KnownJwaSignatureAlgorithm[]","minBits3072: KnownJwaSignatureAlgorithm[]","minBits4096: KnownJwaSignatureAlgorithm[]","minBits256: KnownJwaSignatureAlgorithm[]","minBits384: KnownJwaSignatureAlgorithm[]","minBits512: KnownJwaSignatureAlgorithm[]"],"sources":["../../../../../src/modules/kms/jwk/alg/signing.ts"],"sourcesContent":["import { TypedArrayEncoder } from '../../../../utils'\nimport { KeyManagementError } from '../../error/KeyManagementError'\nimport type { KmsCreateKeyType } from '../../options'\nimport { getJwkHumanDescription } from '../humanDescription'\nimport type { KnownJwaSignatureAlgorithm } from '../jwa'\nimport type { KmsJwkPrivate, KmsJwkPublic } from '../knownJwk'\nimport type { KmsJwkPublicOct } from '../kty/oct/octJwk'\n\n/**\n * Get the allowed algs for a signing key. If takes all the known supported\n * algs and will filter these based on the optional `alg` key in the JWK.\n *\n * This does not handle the intended key `use` and `key_ops`.\n */\nexport function allowedSigningAlgsForSigningKey(\n  jwk: KmsJwkPrivate | Exclude<KmsJwkPublic, KmsJwkPublicOct>\n): KnownJwaSignatureAlgorithm[] {\n  const supportedAlgs = supportedSigningAlgsForKey(jwk)\n  const allowedAlg = jwk.alg\n\n  return !allowedAlg\n    ? // If no `alg` specified on jwk, return all supported algs\n      supportedAlgs\n    : // If `alg` is specified and supported, return the allowed alg\n      allowedAlg && supportedAlgs.includes(allowedAlg as KnownJwaSignatureAlgorithm)\n      ? [allowedAlg as KnownJwaSignatureAlgorithm]\n      : // Otherwise nothing is allowed (`alg` is specified but not supported)\n        []\n}\n\nexport function assertAllowedSigningAlgForKey(\n  jwk: KmsJwkPrivate | Exclude<KmsJwkPublic, KmsJwkPublicOct>,\n  algorithm: KnownJwaSignatureAlgorithm\n) {\n  const allowedAlgs = allowedSigningAlgsForSigningKey(jwk)\n  if (!allowedAlgs.includes(algorithm)) {\n    const allowedAlgsText =\n      allowedAlgs.length > 0 ? ` Allowed algs are ${allowedAlgs.map((alg) => `'${alg}'`).join(', ')}` : ''\n    throw new KeyManagementError(\n      `${getJwkHumanDescription(\n        jwk\n      )} cannot be used with algorithm '${algorithm}' for signature creation or verification.${allowedAlgsText}`\n    )\n  }\n}\n\n// NOTE: this should be replaced by the PublicJwk class\n// but it woun't work for oct keys\nexport function supportedSigningAlgsForKey(\n  jwk: KmsJwkPrivate | Exclude<KmsJwkPublic, KmsJwkPublicOct>\n): KnownJwaSignatureAlgorithm[] {\n  if (jwk.kty === 'EC' || jwk.kty === 'OKP') {\n    switch (jwk.crv) {\n      case 'secp256k1':\n        return ['ES256K']\n      case 'P-256':\n        return ['ES256']\n      case 'P-384':\n        return ['ES384']\n      case 'P-521':\n        return ['ES512']\n      case 'Ed25519':\n        return ['EdDSA', 'Ed25519']\n\n      // X25519\n      default:\n        return []\n    }\n  }\n\n  if (jwk.kty === 'RSA') {\n    const keyBits = TypedArrayEncoder.fromBase64(jwk.n).length * 8\n\n    // RSA needs minimum bit lengths for each algorithm\n    const minBits2048: KnownJwaSignatureAlgorithm[] = ['PS256', 'RS256']\n    const minBits3072: KnownJwaSignatureAlgorithm[] = [...minBits2048, 'RS384', 'PS384']\n    const minBits4096: KnownJwaSignatureAlgorithm[] = [...minBits3072, 'RS512', 'PS512']\n\n    return keyBits >= 4096 ? minBits4096 : keyBits >= 3072 ? minBits3072 : keyBits >= 2048 ? minBits2048 : []\n  }\n\n  // On other layers we need to filter for alg types, as you don't want any `oct` key with enough length to used for hmac purposes\n  if (jwk.kty === 'oct') {\n    const keyBits = TypedArrayEncoder.fromBase64(jwk.k).length * 8\n\n    // hmac needs minimum bit lengths for each algorithm\n    const minBits256: KnownJwaSignatureAlgorithm[] = ['HS256']\n    const minBits384: KnownJwaSignatureAlgorithm[] = [...minBits256, 'HS384']\n    const minBits512: KnownJwaSignatureAlgorithm[] = [...minBits384, 'HS512']\n    return keyBits >= 512 ? minBits512 : keyBits >= 384 ? minBits384 : keyBits >= 256 ? minBits256 : []\n  }\n\n  return []\n}\n\n// TODO: Can we move this to the JWK classes?\nexport function createKeyTypeForSigningAlgorithm(algorithm: KnownJwaSignatureAlgorithm): KmsCreateKeyType {\n  // On JWK class we can have\n  if (algorithm === 'ES256') {\n    return {\n      kty: 'EC',\n      crv: 'P-256',\n    }\n  }\n\n  if (algorithm === 'ES384') {\n    return {\n      kty: 'EC',\n      crv: 'P-384',\n    }\n  }\n\n  if (algorithm === 'ES512') {\n    return {\n      kty: 'EC',\n      crv: 'P-521',\n    }\n  }\n\n  if (algorithm === 'ES256K') {\n    return {\n      kty: 'EC',\n      crv: 'secp256k1',\n    }\n  }\n\n  if (algorithm === 'EdDSA' || algorithm === 'Ed25519') {\n    return {\n      kty: 'OKP',\n      crv: 'Ed25519',\n    }\n  }\n\n  if (algorithm === 'HS256') {\n    return {\n      kty: 'oct',\n      algorithm: 'hmac',\n      length: 256,\n    }\n  }\n\n  if (algorithm === 'HS384') {\n    return {\n      kty: 'oct',\n      algorithm: 'hmac',\n      length: 384,\n    }\n  }\n\n  if (algorithm === 'HS512') {\n    return {\n      kty: 'oct',\n      algorithm: 'hmac',\n      length: 512,\n    }\n  }\n\n  if (algorithm === 'PS256' || algorithm === 'RS256') {\n    return {\n      kty: 'RSA',\n      modulusLength: 2048,\n    }\n  }\n\n  if (algorithm === 'PS384' || algorithm === 'RS384') {\n    return {\n      kty: 'RSA',\n      modulusLength: 3072,\n    }\n  }\n\n  if (algorithm === 'PS512' || algorithm === 'RS512') {\n    return {\n      kty: 'RSA',\n      modulusLength: 4096,\n    }\n  }\n\n  throw new KeyManagementError(`unknown signature algorithm '${algorithm}' for creating key `)\n}\n"],"mappings":";;;;;;;;;;;;;;AAcA,SAAgB,gCACd,KAC8B;CAC9B,MAAM,gBAAgB,2BAA2B,IAAI;CACrD,MAAM,aAAa,IAAI;AAEvB,QAAO,CAAC,aAEJ,gBAEA,cAAc,cAAc,SAAS,WAAyC,GAC5E,CAAC,WAAyC,GAE1C,EAAE;;AAGV,SAAgB,8BACd,KACA,WACA;CACA,MAAM,cAAc,gCAAgC,IAAI;AACxD,KAAI,CAAC,YAAY,SAAS,UAAU,EAAE;EACpC,MAAM,kBACJ,YAAY,SAAS,IAAI,qBAAqB,YAAY,KAAK,QAAQ,IAAI,IAAI,GAAG,CAAC,KAAK,KAAK,KAAK;AACpG,QAAM,IAAI,mBACR,GAAG,uBACD,IACD,CAAC,kCAAkC,UAAU,2CAA2C,kBAC1F;;;AAML,SAAgB,2BACd,KAC8B;AAC9B,KAAI,IAAI,QAAQ,QAAQ,IAAI,QAAQ,MAClC,SAAQ,IAAI,KAAZ;EACE,KAAK,YACH,QAAO,CAAC,SAAS;EACnB,KAAK,QACH,QAAO,CAAC,QAAQ;EAClB,KAAK,QACH,QAAO,CAAC,QAAQ;EAClB,KAAK,QACH,QAAO,CAAC,QAAQ;EAClB,KAAK,UACH,QAAO,CAAC,SAAS,UAAU;EAG7B,QACE,QAAO,EAAE;;AAIf,KAAI,IAAI,QAAQ,OAAO;EACrB,MAAM,UAAU,kBAAkB,WAAW,IAAI,EAAE,CAAC,SAAS;EAG7D,MAAMA,cAA4C,CAAC,SAAS,QAAQ;EACpE,MAAMC,cAA4C;GAAC,GAAG;GAAa;GAAS;GAAQ;EACpF,MAAMC,cAA4C;GAAC,GAAG;GAAa;GAAS;GAAQ;AAEpF,SAAO,WAAW,OAAO,cAAc,WAAW,OAAO,cAAc,WAAW,OAAO,cAAc,EAAE;;AAI3G,KAAI,IAAI,QAAQ,OAAO;EACrB,MAAM,UAAU,kBAAkB,WAAW,IAAI,EAAE,CAAC,SAAS;EAG7D,MAAMC,aAA2C,CAAC,QAAQ;EAC1D,MAAMC,aAA2C,CAAC,GAAG,YAAY,QAAQ;EACzE,MAAMC,aAA2C,CAAC,GAAG,YAAY,QAAQ;AACzE,SAAO,WAAW,MAAM,aAAa,WAAW,MAAM,aAAa,WAAW,MAAM,aAAa,EAAE;;AAGrG,QAAO,EAAE;;AAIX,SAAgB,iCAAiC,WAAyD;AAExG,KAAI,cAAc,QAChB,QAAO;EACL,KAAK;EACL,KAAK;EACN;AAGH,KAAI,cAAc,QAChB,QAAO;EACL,KAAK;EACL,KAAK;EACN;AAGH,KAAI,cAAc,QAChB,QAAO;EACL,KAAK;EACL,KAAK;EACN;AAGH,KAAI,cAAc,SAChB,QAAO;EACL,KAAK;EACL,KAAK;EACN;AAGH,KAAI,cAAc,WAAW,cAAc,UACzC,QAAO;EACL,KAAK;EACL,KAAK;EACN;AAGH,KAAI,cAAc,QAChB,QAAO;EACL,KAAK;EACL,WAAW;EACX,QAAQ;EACT;AAGH,KAAI,cAAc,QAChB,QAAO;EACL,KAAK;EACL,WAAW;EACX,QAAQ;EACT;AAGH,KAAI,cAAc,QAChB,QAAO;EACL,KAAK;EACL,WAAW;EACX,QAAQ;EACT;AAGH,KAAI,cAAc,WAAW,cAAc,QACzC,QAAO;EACL,KAAK;EACL,eAAe;EAChB;AAGH,KAAI,cAAc,WAAW,cAAc,QACzC,QAAO;EACL,KAAK;EACL,eAAe;EAChB;AAGH,KAAI,cAAc,WAAW,cAAc,QACzC,QAAO;EACL,KAAK;EACL,eAAe;EAChB;AAGH,OAAM,IAAI,mBAAmB,gCAAgC,UAAU,qBAAqB"}

package/build/modules/kms/jwk/assertSupported.d.mts

@@ -0,0 +1,17 @@
+import { KnownJwaContentEncryptionAlgorithm, KnownJwaKeyAgreementAlgorithm, KnownJwaKeyEncryptionAlgorithm } from "./jwa.mjs";
+import { KmsDecryptDataDecryption } from "../options/KmsDecryptOptions.mjs";
+import { KmsEncryptDataEncryption } from "../options/KmsEncryptOptions.mjs";
+import { KmsKeyAgreementDecryptOptions } from "../options/KmsKeyAgreementDecryptOptions.mjs";
+import { KmsKeyAgreementEncryptOptions } from "../options/KmsKeyAgreementEncryptOptions.mjs";
+import "../options/index.mjs";
+
+//#region src/modules/kms/jwk/assertSupported.d.ts
+declare function assertSupportedKeyAgreementAlgorithm<KeyAgreement extends KmsKeyAgreementEncryptOptions | KmsKeyAgreementDecryptOptions, SupportedAlgorithms extends KnownJwaKeyAgreementAlgorithm[]>(keyAgreement: KeyAgreement, supportedAlgorithms: SupportedAlgorithms, backend: string): asserts keyAgreement is KeyAgreement & {
+  algorithm: SupportedAlgorithms[number];
+};
+declare function assertSupportedEncryptionAlgorithm<Encryption extends KmsEncryptDataEncryption | KmsDecryptDataDecryption, SupportedAlgorithms extends Array<KnownJwaContentEncryptionAlgorithm | KnownJwaKeyEncryptionAlgorithm>>(encryption: Encryption, supportedAlgorithms: SupportedAlgorithms, backend: string): asserts encryption is Encryption & {
+  algorithm: SupportedAlgorithms[number];
+};
+//#endregion
+export { assertSupportedEncryptionAlgorithm, assertSupportedKeyAgreementAlgorithm };
+//# sourceMappingURL=assertSupported.d.mts.map

package/build/modules/kms/jwk/assertSupported.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"assertSupported.d.mts","names":[],"sources":["../../../../src/modules/kms/jwk/assertSupported.ts"],"sourcesContent":[],"mappings":";;;;;;;;iBAagB,0DACO,gCAAgC,2DACzB,+CAEd,mCACO,+DAEI;aAA4B;;iBASvC,sDACK,2BAA2B,sDAClB,MAAM,qCAAqC,6CAE3D,iCACS,6DAEE;aAA0B"}

package/build/modules/kms/jwk/assertSupported.mjs

@@ -0,0 +1,15 @@
+
+
+import { KeyManagementAlgorithmNotSupportedError } from "../error/KeyManagementAlgorithmNotSupportedError.mjs";
+
+//#region src/modules/kms/jwk/assertSupported.ts
+function assertSupportedKeyAgreementAlgorithm(keyAgreement, supportedAlgorithms, backend) {
+	if (!supportedAlgorithms.includes(keyAgreement.algorithm)) throw new KeyManagementAlgorithmNotSupportedError(`JWA key agreement algorithm '${keyAgreement.algorithm}'`, backend);
+}
+function assertSupportedEncryptionAlgorithm(encryption, supportedAlgorithms, backend) {
+	if (!supportedAlgorithms.includes(encryption.algorithm)) throw new KeyManagementAlgorithmNotSupportedError(`JWA encryption algorithm '${encryption.algorithm}'`, backend);
+}
+
+//#endregion
+export { assertSupportedEncryptionAlgorithm, assertSupportedKeyAgreementAlgorithm };
+//# sourceMappingURL=assertSupported.mjs.map

package/build/modules/kms/jwk/assertSupported.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"assertSupported.mjs","names":[],"sources":["../../../../src/modules/kms/jwk/assertSupported.ts"],"sourcesContent":["import { KeyManagementAlgorithmNotSupportedError } from '../error/KeyManagementAlgorithmNotSupportedError'\nimport type {\n  KmsDecryptDataDecryption,\n  KmsEncryptDataEncryption,\n  KmsKeyAgreementDecryptOptions,\n  KmsKeyAgreementEncryptOptions,\n} from '../options'\nimport type {\n  KnownJwaContentEncryptionAlgorithm,\n  KnownJwaKeyAgreementAlgorithm,\n  KnownJwaKeyEncryptionAlgorithm,\n} from './jwa'\n\nexport function assertSupportedKeyAgreementAlgorithm<\n  KeyAgreement extends KmsKeyAgreementEncryptOptions | KmsKeyAgreementDecryptOptions,\n  SupportedAlgorithms extends KnownJwaKeyAgreementAlgorithm[],\n>(\n  keyAgreement: KeyAgreement,\n  supportedAlgorithms: SupportedAlgorithms,\n  backend: string\n): asserts keyAgreement is KeyAgreement & { algorithm: SupportedAlgorithms[number] } {\n  if (!supportedAlgorithms.includes(keyAgreement.algorithm as (typeof supportedAlgorithms)[number])) {\n    throw new KeyManagementAlgorithmNotSupportedError(\n      `JWA key agreement algorithm '${keyAgreement.algorithm}'`,\n      backend\n    )\n  }\n}\n\nexport function assertSupportedEncryptionAlgorithm<\n  Encryption extends KmsEncryptDataEncryption | KmsDecryptDataDecryption,\n  SupportedAlgorithms extends Array<KnownJwaContentEncryptionAlgorithm | KnownJwaKeyEncryptionAlgorithm>,\n>(\n  encryption: Encryption,\n  supportedAlgorithms: SupportedAlgorithms,\n  backend: string\n): asserts encryption is Encryption & { algorithm: SupportedAlgorithms[number] } {\n  if (!supportedAlgorithms.includes(encryption.algorithm as (typeof supportedAlgorithms)[number])) {\n    throw new KeyManagementAlgorithmNotSupportedError(`JWA encryption algorithm '${encryption.algorithm}'`, backend)\n  }\n}\n"],"mappings":";;;;;AAaA,SAAgB,qCAId,cACA,qBACA,SACmF;AACnF,KAAI,CAAC,oBAAoB,SAAS,aAAa,UAAkD,CAC/F,OAAM,IAAI,wCACR,gCAAgC,aAAa,UAAU,IACvD,QACD;;AAIL,SAAgB,mCAId,YACA,qBACA,SAC+E;AAC/E,KAAI,CAAC,oBAAoB,SAAS,WAAW,UAAkD,CAC7F,OAAM,IAAI,wCAAwC,6BAA6B,WAAW,UAAU,IAAI,QAAQ"}

package/build/modules/kms/jwk/equals.d.mts

@@ -0,0 +1,21 @@
+import { KmsJwkPrivateAsymmetric, KmsJwkPublicAsymmetric } from "./knownJwk.mjs";
+
+//#region src/modules/kms/jwk/equals.d.ts
+/**
+ * Checks if two JWK public keys have matching key types
+ * Supports EC, OKP, and RSA key types
+ */
+declare function assymetricJwkKeyTypeMatches(first: KmsJwkPublicAsymmetric | KmsJwkPrivateAsymmetric, second: KmsJwkPublicAsymmetric | KmsJwkPrivateAsymmetric): boolean;
+/**
+ * Checks if two JWK public keys have matching key types
+ * Supports EC, OKP, and RSA key types
+ */
+declare function assertAsymmetricJwkKeyTypeMatches(first: KmsJwkPublicAsymmetric | KmsJwkPrivateAsymmetric, second: KmsJwkPublicAsymmetric | KmsJwkPrivateAsymmetric): asserts first is typeof second;
+/**
+ * Checks if two JWK public keys have matching key material
+ * Supports EC, OKP, and RSA key types
+ */
+declare function asymmetricPublicJwkMatches(first: KmsJwkPublicAsymmetric, second: KmsJwkPublicAsymmetric): boolean;
+//#endregion
+export { assertAsymmetricJwkKeyTypeMatches, assymetricJwkKeyTypeMatches, asymmetricPublicJwkMatches };
+//# sourceMappingURL=equals.d.mts.map

package/build/modules/kms/jwk/equals.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"equals.d.mts","names":[],"sources":["../../../../src/modules/kms/jwk/equals.ts"],"sourcesContent":[],"mappings":";;;;;;;AAQgB,iBAAA,2BAAA,CAA2B,KAAA,EAClC,sBADkC,GACT,uBADS,EAAA,MAAA,EAEjC,sBAFiC,GAER,uBAFQ,CAAA,EAAA,OAAA;;;;;AAEe,iBAyB1C,iCAAA,CAzB0C,KAAA,EA0BjD,sBA1BiD,GA0BxB,uBA1BwB,EAAA,MAAA,EA2BhD,sBA3BgD,GA2BvB,uBA3BuB,CAAA,EAAA,QAAA,KAAA,IAAA,OA4B/B,MA5B+B;AAyB1D;;;;AAEmC,iBAanB,0BAAA,CAbmB,KAAA,EAae,sBAbf,EAAA,MAAA,EAa+C,sBAb/C,CAAA,EAAA,OAAA"}

package/build/modules/kms/jwk/equals.mjs

@@ -0,0 +1,39 @@
+
+
+import { KeyManagementError } from "../error/KeyManagementError.mjs";
+import { getJwkHumanDescription } from "./humanDescription.mjs";
+
+//#region src/modules/kms/jwk/equals.ts
+/**
+* Checks if two JWK public keys have matching key types
+* Supports EC, OKP, and RSA key types
+*/
+function assymetricJwkKeyTypeMatches(first, second) {
+	if (first.kty !== second.kty) return false;
+	if (first.kty === "EC" && second.kty === "EC") return first.crv === second.crv;
+	if (first.kty === "OKP" && second.kty === "OKP") return first.crv === second.crv;
+	if (first.kty === "RSA" && second.kty === "RSA") return true;
+	return false;
+}
+/**
+* Checks if two JWK public keys have matching key types
+* Supports EC, OKP, and RSA key types
+*/
+function assertAsymmetricJwkKeyTypeMatches(first, second) {
+	if (!assymetricJwkKeyTypeMatches(first, second)) throw new KeyManagementError(`Expected jwk types to match, but found ${getJwkHumanDescription(first)} and ${getJwkHumanDescription(second)}`);
+}
+/**
+* Checks if two JWK public keys have matching key material
+* Supports EC, OKP, and RSA key types
+*/
+function asymmetricPublicJwkMatches(first, second) {
+	if (!assymetricJwkKeyTypeMatches(first, second)) return false;
+	if (first.kty === "EC" && second.kty === "EC") return first.x === second.x && first.y === second.y;
+	if (first.kty === "OKP" && second.kty === "OKP") return first.x === second.x;
+	if (first.kty === "RSA" && second.kty === "RSA") return first.n === second.n && first.e === second.e;
+	return false;
+}
+
+//#endregion
+export { assertAsymmetricJwkKeyTypeMatches, assymetricJwkKeyTypeMatches, asymmetricPublicJwkMatches };
+//# sourceMappingURL=equals.mjs.map

package/build/modules/kms/jwk/equals.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"equals.mjs","names":[],"sources":["../../../../src/modules/kms/jwk/equals.ts"],"sourcesContent":["import { KeyManagementError } from '../error/KeyManagementError'\nimport { getJwkHumanDescription } from './humanDescription'\nimport type { KmsJwkPrivateAsymmetric, KmsJwkPublicAsymmetric } from './knownJwk'\n\n/**\n * Checks if two JWK public keys have matching key types\n * Supports EC, OKP, and RSA key types\n */\nexport function assymetricJwkKeyTypeMatches(\n  first: KmsJwkPublicAsymmetric | KmsJwkPrivateAsymmetric,\n  second: KmsJwkPublicAsymmetric | KmsJwkPrivateAsymmetric\n): boolean {\n  if (first.kty !== second.kty) return false\n\n  if (first.kty === 'EC' && second.kty === 'EC') {\n    return first.crv === second.crv\n  }\n\n  if (first.kty === 'OKP' && second.kty === 'OKP') {\n    return first.crv === second.crv\n  }\n\n  if (first.kty === 'RSA' && second.kty === 'RSA') {\n    // RSA doesn't have curve parameter, so key type match is sufficient\n    return true\n  }\n\n  // Unknown key type\n  return false\n}\n\n/**\n * Checks if two JWK public keys have matching key types\n * Supports EC, OKP, and RSA key types\n */\nexport function assertAsymmetricJwkKeyTypeMatches(\n  first: KmsJwkPublicAsymmetric | KmsJwkPrivateAsymmetric,\n  second: KmsJwkPublicAsymmetric | KmsJwkPrivateAsymmetric\n): asserts first is typeof second {\n  if (!assymetricJwkKeyTypeMatches(first, second)) {\n    throw new KeyManagementError(\n      `Expected jwk types to match, but found ${getJwkHumanDescription(first)} and ${getJwkHumanDescription(second)}`\n    )\n  }\n}\n\n/**\n * Checks if two JWK public keys have matching key material\n * Supports EC, OKP, and RSA key types\n */\nexport function asymmetricPublicJwkMatches(first: KmsJwkPublicAsymmetric, second: KmsJwkPublicAsymmetric): boolean {\n  // First check that types match\n  if (!assymetricJwkKeyTypeMatches(first, second)) {\n    return false\n  }\n\n  // For EC keys, compare x and y coordinates\n  if (first.kty === 'EC' && second.kty === 'EC') {\n    return first.x === second.x && first.y === second.y\n  }\n\n  // For OKP keys, compare x coordinate (Ed25519, X25519, etc.)\n  if (first.kty === 'OKP' && second.kty === 'OKP') {\n    return first.x === second.x\n  }\n\n  // For RSA keys, compare modulus (n) and exponent (e)\n  if (first.kty === 'RSA' && second.kty === 'RSA') {\n    return first.n === second.n && first.e === second.e\n  }\n\n  // Unknown key type\n  return false\n}\n"],"mappings":";;;;;;;;;;AAQA,SAAgB,4BACd,OACA,QACS;AACT,KAAI,MAAM,QAAQ,OAAO,IAAK,QAAO;AAErC,KAAI,MAAM,QAAQ,QAAQ,OAAO,QAAQ,KACvC,QAAO,MAAM,QAAQ,OAAO;AAG9B,KAAI,MAAM,QAAQ,SAAS,OAAO,QAAQ,MACxC,QAAO,MAAM,QAAQ,OAAO;AAG9B,KAAI,MAAM,QAAQ,SAAS,OAAO,QAAQ,MAExC,QAAO;AAIT,QAAO;;;;;;AAOT,SAAgB,kCACd,OACA,QACgC;AAChC,KAAI,CAAC,4BAA4B,OAAO,OAAO,CAC7C,OAAM,IAAI,mBACR,0CAA0C,uBAAuB,MAAM,CAAC,OAAO,uBAAuB,OAAO,GAC9G;;;;;;AAQL,SAAgB,2BAA2B,OAA+B,QAAyC;AAEjH,KAAI,CAAC,4BAA4B,OAAO,OAAO,CAC7C,QAAO;AAIT,KAAI,MAAM,QAAQ,QAAQ,OAAO,QAAQ,KACvC,QAAO,MAAM,MAAM,OAAO,KAAK,MAAM,MAAM,OAAO;AAIpD,KAAI,MAAM,QAAQ,SAAS,OAAO,QAAQ,MACxC,QAAO,MAAM,MAAM,OAAO;AAI5B,KAAI,MAAM,QAAQ,SAAS,OAAO,QAAQ,MACxC,QAAO,MAAM,MAAM,OAAO,KAAK,MAAM,MAAM,OAAO;AAIpD,QAAO"}

package/build/modules/kms/jwk/humanDescription.d.mts

@@ -0,0 +1,16 @@
+import { KmsJwkPrivate, KmsJwkPublic } from "./knownJwk.mjs";
+
+//#region src/modules/kms/jwk/humanDescription.d.ts
+
+/**
+ * Gets text description of a key.
+ *
+ * - `EC key with crv '<crv>'`
+ * - `RSA key with bith length <bitLength>
+ * - `oct key`
+ * - `'<kty>' key`
+ */
+declare function getJwkHumanDescription(jwk: KmsJwkPrivate | KmsJwkPublic): string;
+//#endregion
+export { getJwkHumanDescription };
+//# sourceMappingURL=humanDescription.d.mts.map

package/build/modules/kms/jwk/humanDescription.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"humanDescription.d.mts","names":[],"sources":["../../../../src/modules/kms/jwk/humanDescription.ts"],"sourcesContent":[],"mappings":";;;;;;;;AAWA;;;;iBAAgB,sBAAA,MAA4B,gBAAgB"}

package/build/modules/kms/jwk/humanDescription.mjs

@@ -0,0 +1,24 @@
+
+
+import { TypedArrayEncoder } from "../../../utils/TypedArrayEncoder.mjs";
+import "../../../utils/index.mjs";
+
+//#region src/modules/kms/jwk/humanDescription.ts
+/**
+* Gets text description of a key.
+*
+* - `EC key with crv '<crv>'`
+* - `RSA key with bith length <bitLength>
+* - `oct key`
+* - `'<kty>' key`
+*/
+function getJwkHumanDescription(jwk) {
+	if (jwk.kty === "EC" || jwk.kty === "OKP") return `${jwk.kty} key with crv '${jwk.crv}'`;
+	if (jwk.kty === "RSA") return `RSA key with bit length ${TypedArrayEncoder.fromBase64(jwk.n).length * 8}`;
+	if (jwk.kty === "oct") return "oct key";
+	return `'${jwk.kty}' key'`;
+}
+
+//#endregion
+export { getJwkHumanDescription };
+//# sourceMappingURL=humanDescription.mjs.map

package/build/modules/kms/jwk/humanDescription.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"humanDescription.mjs","names":[],"sources":["../../../../src/modules/kms/jwk/humanDescription.ts"],"sourcesContent":["import { TypedArrayEncoder } from '../../../utils'\nimport type { KmsJwkPrivate, KmsJwkPublic } from './knownJwk'\n\n/**\n * Gets text description of a key.\n *\n * - `EC key with crv '<crv>'`\n * - `RSA key with bith length <bitLength>\n * - `oct key`\n * - `'<kty>' key`\n */\nexport function getJwkHumanDescription(jwk: KmsJwkPrivate | KmsJwkPublic) {\n  if (jwk.kty === 'EC' || jwk.kty === 'OKP') {\n    return `${jwk.kty} key with crv '${jwk.crv}'`\n  }\n\n  if (jwk.kty === 'RSA') {\n    // n is the modulus, base64url encoded. Decode to get bit length\n    const nBytes = TypedArrayEncoder.fromBase64(jwk.n).length\n    const bitLength = nBytes * 8\n    return `RSA key with bit length ${bitLength}`\n  }\n  if (jwk.kty === 'oct') {\n    return 'oct key'\n  }\n\n  // @ts-expect-error\n  return `'${jwk.kty}' key'`\n}\n"],"mappings":";;;;;;;;;;;;;;AAWA,SAAgB,uBAAuB,KAAmC;AACxE,KAAI,IAAI,QAAQ,QAAQ,IAAI,QAAQ,MAClC,QAAO,GAAG,IAAI,IAAI,iBAAiB,IAAI,IAAI;AAG7C,KAAI,IAAI,QAAQ,MAId,QAAO,2BAFQ,kBAAkB,WAAW,IAAI,EAAE,CAAC,SACxB;AAG7B,KAAI,IAAI,QAAQ,MACd,QAAO;AAIT,QAAO,IAAI,IAAI,IAAI"}

package/build/modules/kms/jwk/index.d.mts

@@ -0,0 +1,25 @@
+import { KnownJwaContentEncryptionAlgorithm, KnownJwaContentEncryptionAlgorithms, KnownJwaKeyAgreementAlgorithm, KnownJwaKeyAgreementAlgorithms, KnownJwaKeyEncryptionAlgorithm, KnownJwaKeyEncryptionAlgorithms, KnownJwaSignatureAlgorithm, KnownJwaSignatureAlgorithms } from "./jwa.mjs";
+import { KmsJwkPrivateEc, KmsJwkPublicEc } from "./kty/ec/ecJwk.mjs";
+import { KmsJwkPrivateOct, KmsJwkPublicOct } from "./kty/oct/octJwk.mjs";
+import { KmsJwkPrivateOkp, KmsJwkPublicOkp } from "./kty/okp/okpJwk.mjs";
+import { KmsJwkPrivateRsa, KmsJwkPublicRsa } from "./kty/rsa/rsaJwk.mjs";
+import { KmsJwkPrivate, KmsJwkPrivateAsymmetric, KmsJwkPrivateFromKmsJwkPublic, KmsJwkPublic, KmsJwkPublicAsymmetric, KmsJwkPublicFromCreateType, KmsJwkPublicFromKmsJwkPrivate, assertJwkAsymmetric, isJwkAsymmetric, publicJwkFromPrivateJwk } from "./knownJwk.mjs";
+import { allowedEncryptionAlgsForKey, assertAllowedEncryptionAlgForKey, supportedEncryptionAlgsForKey } from "./alg/encryption.mjs";
+import { allowedKeyDerivationAlgsForKey, assertAllowedKeyDerivationAlgForKey, supportedKeyDerivationAlgsForKey } from "./alg/keyDerivation.mjs";
+import { allowedSigningAlgsForSigningKey, assertAllowedSigningAlgForKey, supportedSigningAlgsForKey } from "./alg/signing.mjs";
+import "./alg/index.mjs";
+import { assertSupportedEncryptionAlgorithm, assertSupportedKeyAgreementAlgorithm } from "./assertSupported.mjs";
+import { assertAsymmetricJwkKeyTypeMatches, assymetricJwkKeyTypeMatches, asymmetricPublicJwkMatches } from "./equals.mjs";
+import { getJwkHumanDescription } from "./humanDescription.mjs";
+import { Jwk, JwkCommon } from "./jwk.mjs";
+import { assertKeyAllowsDecrypt, assertKeyAllowsDerive, assertKeyAllowsEncrypt, assertKeyAllowsSign, assertKeyAllowsVerify, keyAllowsDecrypt, keyAllowsEncrypt, keyAllowsSign, keyAllowsVerify } from "./keyOps.mjs";
+import { derEcSignatureToRaw, rawEcSignatureToDer } from "./kty/ec/ecSignature.mjs";
+import { P256PublicJwk } from "./kty/ec/P256PublicJwk.mjs";
+import { P384PublicJwk } from "./kty/ec/P384PublicJwk.mjs";
+import { P521PublicJwk } from "./kty/ec/P521PublicJwk.mjs";
+import { Secp256k1PublicJwk } from "./kty/ec/Secp256k1PublicJwk.mjs";
+import { Ed25519PublicJwk } from "./kty/okp/Ed25519PublicJwk.mjs";
+import { X25519PublicJwk } from "./kty/okp/X25519PublicJwk.mjs";
+import { RsaPublicJwk } from "./kty/rsa/RsaPublicJwk.mjs";
+import "./kty/index.mjs";
+import { PublicJwk } from "./PublicJwk.mjs";

package/build/modules/kms/jwk/index.mjs

@@ -0,0 +1,22 @@
+
+
+import { getJwkHumanDescription } from "./humanDescription.mjs";
+import { allowedEncryptionAlgsForKey, assertAllowedEncryptionAlgForKey, supportedEncryptionAlgsForKey } from "./alg/encryption.mjs";
+import { allowedKeyDerivationAlgsForKey, assertAllowedKeyDerivationAlgForKey, supportedKeyDerivationAlgsForKey } from "./alg/keyDerivation.mjs";
+import { allowedSigningAlgsForSigningKey, assertAllowedSigningAlgForKey, supportedSigningAlgsForKey } from "./alg/signing.mjs";
+import "./alg/index.mjs";
+import { assertSupportedEncryptionAlgorithm, assertSupportedKeyAgreementAlgorithm } from "./assertSupported.mjs";
+import { assertAsymmetricJwkKeyTypeMatches, assymetricJwkKeyTypeMatches, asymmetricPublicJwkMatches } from "./equals.mjs";
+import { KnownJwaContentEncryptionAlgorithms, KnownJwaKeyAgreementAlgorithms, KnownJwaKeyEncryptionAlgorithms, KnownJwaSignatureAlgorithms } from "./jwa.mjs";
+import { assertKeyAllowsDecrypt, assertKeyAllowsDerive, assertKeyAllowsEncrypt, assertKeyAllowsSign, assertKeyAllowsVerify, keyAllowsDecrypt, keyAllowsEncrypt, keyAllowsSign, keyAllowsVerify } from "./keyOps.mjs";
+import { assertJwkAsymmetric, isJwkAsymmetric, publicJwkFromPrivateJwk } from "./knownJwk.mjs";
+import { derEcSignatureToRaw, rawEcSignatureToDer } from "./kty/ec/ecSignature.mjs";
+import { P256PublicJwk } from "./kty/ec/P256PublicJwk.mjs";
+import { P384PublicJwk } from "./kty/ec/P384PublicJwk.mjs";
+import { P521PublicJwk } from "./kty/ec/P521PublicJwk.mjs";
+import { Secp256k1PublicJwk } from "./kty/ec/Secp256k1PublicJwk.mjs";
+import { X25519PublicJwk } from "./kty/okp/X25519PublicJwk.mjs";
+import { Ed25519PublicJwk } from "./kty/okp/Ed25519PublicJwk.mjs";
+import { RsaPublicJwk } from "./kty/rsa/RsaPublicJwk.mjs";
+import "./kty/index.mjs";
+import { PublicJwk } from "./PublicJwk.mjs";

package/build/modules/kms/jwk/jwa.d.mts

@@ -0,0 +1,97 @@
+import { z } from "zod";
+
+//#region src/modules/kms/jwk/jwa.d.ts
+declare const KnownJwaSignatureAlgorithms: {
+  readonly HS256: "HS256";
+  readonly HS384: "HS384";
+  readonly HS512: "HS512";
+  readonly RS256: "RS256";
+  readonly RS384: "RS384";
+  readonly RS512: "RS512";
+  readonly ES256: "ES256";
+  readonly ES384: "ES384";
+  readonly ES512: "ES512";
+  readonly PS256: "PS256";
+  readonly PS384: "PS384";
+  readonly PS512: "PS512";
+  readonly EdDSA: "EdDSA";
+  readonly Ed25519: "Ed25519";
+  readonly ES256K: "ES256K";
+};
+declare const zKnownJwaSignatureAlgorithm: z.ZodEnum<{
+  HS256: "HS256";
+  HS384: "HS384";
+  HS512: "HS512";
+  RS256: "RS256";
+  RS384: "RS384";
+  RS512: "RS512";
+  ES256: "ES256";
+  ES384: "ES384";
+  ES512: "ES512";
+  PS256: "PS256";
+  PS384: "PS384";
+  PS512: "PS512";
+  EdDSA: "EdDSA";
+  Ed25519: "Ed25519";
+  ES256K: "ES256K";
+}>;
+type KnownJwaSignatureAlgorithm = z.output<typeof zKnownJwaSignatureAlgorithm>;
+declare const KnownJwaContentEncryptionAlgorithms: {
+  readonly A128GCM: "A128GCM";
+  readonly A192GCM: "A192GCM";
+  readonly A256GCM: "A256GCM";
+  readonly A128CBC: "A128CBC";
+  readonly A256CBC: "A256CBC";
+  readonly C20P: "C20P";
+  readonly XC20P: "XC20P";
+  /**
+   * As is used in DIDComm v1
+   */
+  readonly 'XSALSA20-POLY1305': "XSALSA20-POLY1305";
+  readonly A128CBC_HS256: "A128CBC-HS256";
+  readonly A192CBC_HS384: "A192CBC-HS384";
+  readonly A256CBC_HS512: "A256CBC-HS512";
+};
+declare const zKnownJwaContentEncryptionAlgorithm: z.ZodEnum<{
+  A128GCM: "A128GCM";
+  A192GCM: "A192GCM";
+  A256GCM: "A256GCM";
+  A128CBC: "A128CBC";
+  A256CBC: "A256CBC";
+  C20P: "C20P";
+  XC20P: "XC20P";
+  "XSALSA20-POLY1305": "XSALSA20-POLY1305";
+  "A128CBC-HS256": "A128CBC-HS256";
+  "A192CBC-HS384": "A192CBC-HS384";
+  "A256CBC-HS512": "A256CBC-HS512";
+}>;
+type KnownJwaContentEncryptionAlgorithm = z.output<typeof zKnownJwaContentEncryptionAlgorithm>;
+declare const KnownJwaKeyEncryptionAlgorithms: {
+  readonly A128KW: "A128KW";
+  readonly A192KW: "A192KW";
+  readonly A256KW: "A256KW";
+};
+declare const zKnownJwaKeyEncryptionAlgorithm: z.ZodEnum<{
+  A128KW: "A128KW";
+  A192KW: "A192KW";
+  A256KW: "A256KW";
+}>;
+type KnownJwaKeyEncryptionAlgorithm = z.output<typeof zKnownJwaKeyEncryptionAlgorithm>;
+declare const KnownJwaKeyAgreementAlgorithms: {
+  readonly ECDH_ES: "ECDH-ES";
+  readonly ECDH_ES_A128KW: "ECDH-ES+A128KW";
+  readonly ECDH_ES_A192KW: "ECDH-ES+A192KW";
+  readonly ECDH_ES_A256KW: "ECDH-ES+A256KW";
+  readonly ECDH_HSALSA20: "ECDH-HSALSA20";
+};
+declare const zKnownJwaKeyAgreementAlgorithm: z.ZodEnum<{
+  "ECDH-ES": "ECDH-ES";
+  "ECDH-ES+A128KW": "ECDH-ES+A128KW";
+  "ECDH-ES+A192KW": "ECDH-ES+A192KW";
+  "ECDH-ES+A256KW": "ECDH-ES+A256KW";
+  "ECDH-HSALSA20": "ECDH-HSALSA20";
+}>;
+type KnownJwaKeyAgreementAlgorithm = z.output<typeof zKnownJwaKeyAgreementAlgorithm>;
+//#endregion
+export { KnownJwaContentEncryptionAlgorithm, KnownJwaContentEncryptionAlgorithms, KnownJwaKeyAgreementAlgorithm, KnownJwaKeyAgreementAlgorithms, KnownJwaKeyEncryptionAlgorithm, KnownJwaKeyEncryptionAlgorithms, KnownJwaSignatureAlgorithm, KnownJwaSignatureAlgorithms };
+//# sourceMappingURL=jwa.d.mts.map

package/build/modules/kms/jwk/jwa.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwa.d.mts","names":[],"sources":["../../../../src/modules/kms/jwk/jwa.ts"],"sourcesContent":[],"mappings":";;;cAUa;;;;EAAA,SAAA,KAAA,EAAA,OAAA;EAkBA,SAAA,KAAA,EAAA,OAAA;EACD,SAAA,KAAA,EAAA,OAAA;EAOC,SAAA,KAAA,EAAA,OAAA;EAuBA,SAAA,KAAA,EAAA,OAAA;EACD,SAAA,KAAA,EAAA,OAAA;EAEC,SAAA,KAAA,EAAA,OAAA;EAMP,SAAA,KAAA,EAAA,OAAA;EACM,SAAA,KAAA,EAAA,OAAA;EAGC,SAAA,KAAA,EAAA,OAAA;EASP,SAAA,OAAA,EAAA,SAAA;EACM,SAAA,MAAA,EAAA,QAAA;;cAtDC,6BAA2B,CAAA,CAAA;;;;;;;;;;;;;;;;;KAC5B,0BAAA,GAA6B,CAAA,CAAE,cAAc;cAO5C;;;;;;;;;;;;;;;;cAuBA,qCAAmC,CAAA,CAAA;;;;;;;;;;;;;KACpC,kCAAA,GAAqC,CAAA,CAAE,cAAc;cAEpD;;;;;cAMP,iCAA+B,CAAA,CAAA;;;;;KACzB,8BAAA,GAAiC,CAAA,CAAE,cAAc;cAGhD;;;;;;;cASP,gCAA8B,CAAA,CAAA;;;;;;;KACxB,6BAAA,GAAgC,CAAA,CAAE,cAAc"}