@credo-ts/core 0.6.1-pr-2091-20241119140918 → 0.6.2-alpha-20251210145840

package/build/modules/kms/KeyManagementApi.mjs

@@ -0,0 +1,205 @@
+
+
+import { AgentContext } from "../../agent/context/AgentContext.mjs";
+import { __decorateMetadata } from "../../_virtual/_@oxc-project_runtime@0.99.0/helpers/decorateMetadata.mjs";
+import { __decorate } from "../../_virtual/_@oxc-project_runtime@0.99.0/helpers/decorate.mjs";
+import "../../agent/index.mjs";
+import { KeyManagementError } from "./error/KeyManagementError.mjs";
+import { KeyManagementKeyNotFoundError } from "./error/KeyManagementKeyNotFoundError.mjs";
+import { getJwkHumanDescription } from "./jwk/humanDescription.mjs";
+import { createKeyTypeForSigningAlgorithm } from "./jwk/alg/signing.mjs";
+import { zParseWithErrorHandling } from "../../utils/zod.mjs";
+import "./jwk/index.mjs";
+import { KeyManagementModuleConfig } from "./KeyManagementModuleConfig.mjs";
+import { getKmsOperationHumanDescription } from "./options/KmsOperation.mjs";
+import "./options/index.mjs";
+import { zWithBackend } from "./options/backend.mjs";
+import { zKmsCreateKeyForSignatureAlgorithmOptions, zKmsCreateKeyOptions } from "./options/KmsCreateKeyOptions.mjs";
+import { zKmsEncryptOptions } from "./options/KmsEncryptOptions.mjs";
+import { zKmsDecryptOptions } from "./options/KmsDecryptOptions.mjs";
+import { zKmsDeleteKeyOptions } from "./options/KmsDeleteKeyOptions.mjs";
+import { zKmsGetPublicKeyOptions } from "./options/KmsGetPublicKeyOptions.mjs";
+import { zKmsImportKeyOptions } from "./options/KmsImportKeyOptions.mjs";
+import { zKmsRandomBytesOptions } from "./options/KmsRandomBytesOptions.mjs";
+import { zKmsSignOptions } from "./options/KmsSignOptions.mjs";
+import { zKmsVerifyOptions } from "./options/KmsVerifyOptions.mjs";
+import { injectable } from "tsyringe";
+
+//#region src/modules/kms/KeyManagementApi.ts
+var _ref, _ref2;
+let KeyManagementApi = class KeyManagementApi$1 {
+	constructor(keyManagementConfig, agentContext) {
+		this.keyManagementConfig = keyManagementConfig;
+		this.agentContext = agentContext;
+	}
+	/**
+	* Whether an operation is supported.
+	*
+	* @returns a list of backends that support the operation. In case
+	* no backends are supported it returns an empty array
+	*/
+	supportedBackendsForOperation(operation) {
+		const supportedBackends = [];
+		for (const kms of this.keyManagementConfig.backends) if (kms.isOperationSupported(this.agentContext, operation)) supportedBackends.push(kms.backend);
+		return supportedBackends;
+	}
+	/**
+	* Create a key.
+	*/
+	async createKey(options) {
+		const { backend, ...kmsOptions } = zParseWithErrorHandling(zWithBackend(zKmsCreateKeyOptions), options, "Invalid options provided to createKey method");
+		const key = await this.getKms(this.agentContext, backend, {
+			operation: "createKey",
+			type: options.type
+		}).createKey(this.agentContext, kmsOptions);
+		key.publicJwk.kid = key.keyId;
+		this.agentContext.config.logger.debug(`Created key ${getJwkHumanDescription(key.publicJwk)} with key id '${key.keyId}'`);
+		return key;
+	}
+	/**
+	* Create a key.
+	*/
+	async createKeyForSignatureAlgorithm(options) {
+		const { backend, algorithm, ...kmsOptions } = zParseWithErrorHandling(zWithBackend(zKmsCreateKeyForSignatureAlgorithmOptions), options, "Invalid options provided to createKeyForSignatureAlgorithm method");
+		const type = createKeyTypeForSigningAlgorithm(algorithm);
+		const key = await this.getKms(this.agentContext, backend, {
+			operation: "createKey",
+			type
+		}).createKey(this.agentContext, {
+			...kmsOptions,
+			type
+		});
+		key.publicJwk.kid = key.keyId;
+		return key;
+	}
+	/**
+	* Sign using a key.
+	*/
+	async sign(options) {
+		const { backend, ...kmsOptions } = zParseWithErrorHandling(zWithBackend(zKmsSignOptions), options, "Invalid options provided to sign method");
+		const operation = {
+			operation: "sign",
+			algorithm: options.algorithm
+		};
+		return await (backend ? this.getKms(this.agentContext, backend, operation) : (await this.getKmsForOperationAndKeyId(this.agentContext, options.keyId, operation)).kms).sign(this.agentContext, kmsOptions);
+	}
+	/**
+	* Verify using a key.
+	*/
+	async verify(options) {
+		const { backend, ...kmsOptions } = zParseWithErrorHandling(zWithBackend(zKmsVerifyOptions), options, "Invalid options provided to verify method");
+		const operation = {
+			operation: "verify",
+			algorithm: options.algorithm
+		};
+		return await (backend || typeof options.key !== "string" ? this.getKms(this.agentContext, backend, operation) : (await this.getKmsForOperationAndKeyId(this.agentContext, options.key, operation)).kms).verify(this.agentContext, kmsOptions);
+	}
+	/**
+	* Encrypt.
+	*/
+	async encrypt(options) {
+		const { backend, ...kmsOptions } = zParseWithErrorHandling(zWithBackend(zKmsEncryptOptions), options, "Invalid options provided to encrypt method");
+		const operation = {
+			operation: "encrypt",
+			encryption: options.encryption,
+			keyAgreement: options.key.keyAgreement
+		};
+		return await (backend || typeof options.key !== "string" ? this.getKms(this.agentContext, backend, operation) : (await this.getKmsForOperationAndKeyId(this.agentContext, options.key, operation)).kms).encrypt(this.agentContext, kmsOptions);
+	}
+	/**
+	* Decrypt.
+	*/
+	async decrypt(options) {
+		const { backend, ...kmsOptions } = zParseWithErrorHandling(zWithBackend(zKmsDecryptOptions), options, "Invalid options provided to decrypt method");
+		const operation = {
+			operation: "decrypt",
+			decryption: options.decryption,
+			keyAgreement: options.key.keyAgreement
+		};
+		return await (backend || typeof options.key !== "string" ? this.getKms(this.agentContext, backend, operation) : (await this.getKmsForOperationAndKeyId(this.agentContext, options.key, operation)).kms).decrypt(this.agentContext, kmsOptions);
+	}
+	/**
+	* Import a key.
+	*/
+	async importKey(options) {
+		const { backend, ...kmsOptions } = zParseWithErrorHandling(zWithBackend(zKmsImportKeyOptions), options, "Invalid options provided to importKey method");
+		const operation = {
+			operation: "importKey",
+			privateJwk: options.privateJwk
+		};
+		const key = await this.getKms(this.agentContext, backend, operation).importKey(this.agentContext, kmsOptions);
+		this.agentContext.config.logger.trace(`Imported key ${getJwkHumanDescription(key.publicJwk)} with key id '${key.keyId}'`);
+		return key;
+	}
+	/**
+	* Get a public key.
+	*/
+	async getPublicKey(options) {
+		const { backend, keyId } = zParseWithErrorHandling(zWithBackend(zKmsGetPublicKeyOptions), options, "Invalid options provided to getPublicKey method");
+		if (backend) {
+			if (!await this.getKms(this.agentContext, backend).getPublicKey(this.agentContext, keyId)) throw new KeyManagementKeyNotFoundError(keyId, [backend]);
+		}
+		const { publicKey } = await this.getKmsForOperationAndKeyId(this.agentContext, options.keyId);
+		return publicKey;
+	}
+	/**
+	* Delete a key.
+	*/
+	async deleteKey(options) {
+		const { backend, ...kmsOptions } = zParseWithErrorHandling(zWithBackend(zKmsDeleteKeyOptions), options, "Invalid options provided to deleteKey method");
+		return await this.getKms(this.agentContext, backend, { operation: "deleteKey" }).deleteKey(this.agentContext, kmsOptions);
+	}
+	/**
+	* Generate random bytes
+	*/
+	randomBytes(options) {
+		const { backend, ...kmsOptions } = zParseWithErrorHandling(zWithBackend(zKmsRandomBytesOptions), options, "Invalid options provided to randomBytes method");
+		return this.getKms(this.agentContext, backend, { operation: "randomBytes" }).randomBytes(this.agentContext, kmsOptions);
+	}
+	/**
+	* Get the kms associated with a specific `keyId`.
+	*
+	* This uses a naive approach of fetching the key for each configured kms
+	* until it finds the registered key.
+	*
+	* In the future this approach might be optimized based on:
+	* - caching
+	* - keeping a registry
+	* - backend specific key prefixes
+	*/
+	async getKmsForOperationAndKeyId(agentContext, keyId, operation) {
+		for (const kms of this.keyManagementConfig.backends) {
+			if (!(operation ? kms.isOperationSupported(agentContext, operation) : true)) continue;
+			const publicKey = await kms.getPublicKey(this.agentContext, keyId);
+			if (publicKey) return {
+				publicKey,
+				kms
+			};
+		}
+		if (operation) throw new KeyManagementKeyNotFoundError(keyId, this.keyManagementConfig.backends.map((b) => b.backend), `The key may exist in one of the key management services in which case the key management service does not support the ${getKmsOperationHumanDescription(operation)}`);
+		throw new KeyManagementKeyNotFoundError(keyId, this.keyManagementConfig.backends.map((b) => b.backend));
+	}
+	/**
+	* Get the kms backend for a specific operation.
+	*
+	* If a backend is provided, it will be checked if the backend supports
+	* the operation. Otherwise the first backend that supports the operation
+	* will be used.
+	*/
+	getKms(agentContext, backend, operation) {
+		if (backend) {
+			const kms = this.keyManagementConfig.backends.find((kms$1) => kms$1.backend === backend);
+			if (!kms) throw new KeyManagementError(`No key management service is configured for backend '${backend}'. Available backends are ${this.keyManagementConfig.backends.map((kms$1) => `'${kms$1.backend}'`).join(", ")}`);
+			if (!(operation ? kms.isOperationSupported(agentContext, operation) : true) && operation) throw new KeyManagementError(`Key management service backend '${backend}' does not support ${getKmsOperationHumanDescription(operation)}`);
+			return kms;
+		}
+		for (const kms of this.keyManagementConfig.backends) if (operation ? kms.isOperationSupported(agentContext, operation) : true) return kms;
+		if (operation) throw new KeyManagementError(`No key management service backend found that supports ${getKmsOperationHumanDescription(operation)}`);
+		throw new KeyManagementError("No key management service backend found.");
+	}
+};
+KeyManagementApi = __decorate([injectable(), __decorateMetadata("design:paramtypes", [typeof (_ref = typeof KeyManagementModuleConfig !== "undefined" && KeyManagementModuleConfig) === "function" ? _ref : Object, typeof (_ref2 = typeof AgentContext !== "undefined" && AgentContext) === "function" ? _ref2 : Object])], KeyManagementApi);
+
+//#endregion
+export { KeyManagementApi };
+//# sourceMappingURL=KeyManagementApi.mjs.map

package/build/modules/kms/KeyManagementApi.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"KeyManagementApi.mjs","names":["KeyManagementApi","keyManagementConfig: KeyManagementModuleConfig","agentContext: AgentContext","supportedBackends: string[]","kms"],"sources":["../../../src/modules/kms/KeyManagementApi.ts"],"sourcesContent":["import { injectable } from 'tsyringe'\n\nimport { AgentContext } from '../../agent'\nimport { zParseWithErrorHandling } from '../../utils/zod'\nimport { KeyManagementError } from './error/KeyManagementError'\nimport { KeyManagementKeyNotFoundError } from './error/KeyManagementKeyNotFoundError'\nimport { getJwkHumanDescription, type KmsJwkPrivate } from './jwk'\nimport { createKeyTypeForSigningAlgorithm } from './jwk/alg/signing'\nimport { KeyManagementModuleConfig } from './KeyManagementModuleConfig'\nimport {\n  getKmsOperationHumanDescription,\n  type KmsDecryptOptions,\n  type KmsDeleteKeyOptions,\n  type KmsGetPublicKeyOptions,\n  type KmsImportKeyOptions,\n  type KmsOperation,\n  type KmsRandomBytesOptions,\n} from './options'\nimport { type WithBackend, zWithBackend } from './options/backend'\nimport {\n  type KmsCreateKeyForSignatureAlgorithmOptions,\n  type KmsCreateKeyOptions,\n  type KmsCreateKeyReturn,\n  type KmsCreateKeyType,\n  type KmsCreateKeyTypeAssymetric,\n  zKmsCreateKeyForSignatureAlgorithmOptions,\n  zKmsCreateKeyOptions,\n} from './options/KmsCreateKeyOptions'\nimport { zKmsDecryptOptions } from './options/KmsDecryptOptions'\nimport { zKmsDeleteKeyOptions } from './options/KmsDeleteKeyOptions'\nimport { type KmsEncryptOptions, zKmsEncryptOptions } from './options/KmsEncryptOptions'\nimport { zKmsGetPublicKeyOptions } from './options/KmsGetPublicKeyOptions'\nimport { type KmsImportKeyReturn, zKmsImportKeyOptions } from './options/KmsImportKeyOptions'\nimport { zKmsRandomBytesOptions } from './options/KmsRandomBytesOptions'\nimport { type KmsSignOptions, zKmsSignOptions } from './options/KmsSignOptions'\nimport { type KmsVerifyOptions, zKmsVerifyOptions } from './options/KmsVerifyOptions'\n\n@injectable()\nexport class KeyManagementApi {\n  public constructor(\n    private keyManagementConfig: KeyManagementModuleConfig,\n    private agentContext: AgentContext\n  ) {}\n\n  /**\n   * Whether an operation is supported.\n   *\n   * @returns a list of backends that support the operation. In case\n   * no backends are supported it returns an empty array\n   */\n  public supportedBackendsForOperation(operation: KmsOperation): string[] {\n    const supportedBackends: string[] = []\n\n    for (const kms of this.keyManagementConfig.backends) {\n      const isOperationSupported = kms.isOperationSupported(this.agentContext, operation)\n      if (isOperationSupported) {\n        supportedBackends.push(kms.backend)\n      }\n    }\n\n    return supportedBackends\n  }\n\n  /**\n   * Create a key.\n   */\n  public async createKey<Type extends KmsCreateKeyType>(\n    options: WithBackend<KmsCreateKeyOptions<Type>>\n  ): Promise<KmsCreateKeyReturn<Type>> {\n    const { backend, ...kmsOptions } = zParseWithErrorHandling(\n      zWithBackend(zKmsCreateKeyOptions),\n      options,\n      'Invalid options provided to createKey method'\n    )\n\n    const kms = this.getKms(this.agentContext, backend, {\n      operation: 'createKey',\n      type: options.type,\n    })\n\n    const key = await kms.createKey(this.agentContext, kmsOptions)\n    key.publicJwk.kid = key.keyId\n\n    this.agentContext.config.logger.debug(\n      `Created key ${getJwkHumanDescription(key.publicJwk)} with key id '${key.keyId}'`\n    )\n\n    return key\n  }\n\n  /**\n   * Create a key.\n   */\n  public async createKeyForSignatureAlgorithm(\n    options: WithBackend<KmsCreateKeyForSignatureAlgorithmOptions>\n  ): Promise<KmsCreateKeyReturn<KmsCreateKeyTypeAssymetric>> {\n    const { backend, algorithm, ...kmsOptions } = zParseWithErrorHandling(\n      zWithBackend(zKmsCreateKeyForSignatureAlgorithmOptions),\n      options,\n      'Invalid options provided to createKeyForSignatureAlgorithm method'\n    )\n\n    const type = createKeyTypeForSigningAlgorithm(algorithm)\n    const kms = this.getKms(this.agentContext, backend, {\n      operation: 'createKey',\n      type,\n    })\n\n    // Ensure the kid is set to the keyId\n    const key = await kms.createKey(this.agentContext, {\n      ...kmsOptions,\n      type,\n    })\n    key.publicJwk.kid = key.keyId\n\n    return key\n  }\n\n  /**\n   * Sign using a key.\n   */\n  public async sign(options: WithBackend<KmsSignOptions>) {\n    const { backend, ...kmsOptions } = zParseWithErrorHandling(\n      zWithBackend(zKmsSignOptions),\n      options,\n      'Invalid options provided to sign method'\n    )\n\n    const operation = {\n      operation: 'sign',\n      algorithm: options.algorithm,\n    } as const\n\n    const kms = backend\n      ? this.getKms(this.agentContext, backend, operation)\n      : (await this.getKmsForOperationAndKeyId(this.agentContext, options.keyId, operation)).kms\n    return await kms.sign(this.agentContext, kmsOptions)\n  }\n\n  /**\n   * Verify using a key.\n   */\n  public async verify(options: WithBackend<KmsVerifyOptions>) {\n    const { backend, ...kmsOptions } = zParseWithErrorHandling(\n      zWithBackend(zKmsVerifyOptions),\n      options,\n      'Invalid options provided to verify method'\n    )\n\n    const operation = { operation: 'verify', algorithm: options.algorithm } as const\n    const kms =\n      backend || typeof options.key !== 'string'\n        ? this.getKms(this.agentContext, backend, operation)\n        : (await this.getKmsForOperationAndKeyId(this.agentContext, options.key, operation)).kms\n\n    return await kms.verify(this.agentContext, kmsOptions)\n  }\n\n  /**\n   * Encrypt.\n   */\n  public async encrypt(options: WithBackend<KmsEncryptOptions>) {\n    const { backend, ...kmsOptions } = zParseWithErrorHandling(\n      zWithBackend(zKmsEncryptOptions),\n      options,\n      'Invalid options provided to encrypt method'\n    )\n\n    const operation = {\n      operation: 'encrypt',\n      encryption: options.encryption,\n      keyAgreement: options.key.keyAgreement,\n    } as const\n    const kms =\n      backend || typeof options.key !== 'string'\n        ? this.getKms(this.agentContext, backend, operation)\n        : (await this.getKmsForOperationAndKeyId(this.agentContext, options.key, operation)).kms\n\n    return await kms.encrypt(this.agentContext, kmsOptions)\n  }\n\n  /**\n   * Decrypt.\n   */\n  public async decrypt(options: WithBackend<KmsDecryptOptions>) {\n    const { backend, ...kmsOptions } = zParseWithErrorHandling(\n      zWithBackend(zKmsDecryptOptions),\n      options,\n      'Invalid options provided to decrypt method'\n    )\n\n    const operation = {\n      operation: 'decrypt',\n      decryption: options.decryption,\n      keyAgreement: options.key.keyAgreement,\n    } as const\n    const kms =\n      backend || typeof options.key !== 'string'\n        ? this.getKms(\n            this.agentContext,\n\n            backend,\n            operation\n          )\n        : (await this.getKmsForOperationAndKeyId(this.agentContext, options.key, operation)).kms\n\n    return await kms.decrypt(this.agentContext, kmsOptions)\n  }\n\n  /**\n   * Import a key.\n   */\n  public async importKey<Jwk extends KmsJwkPrivate>(\n    options: WithBackend<KmsImportKeyOptions<Jwk>>\n  ): Promise<KmsImportKeyReturn<Jwk>> {\n    const { backend, ...kmsOptions } = zParseWithErrorHandling(\n      zWithBackend(zKmsImportKeyOptions),\n      options,\n      'Invalid options provided to importKey method'\n    )\n\n    const operation = {\n      operation: 'importKey',\n      privateJwk: options.privateJwk,\n    } as const\n    const kms = this.getKms(this.agentContext, backend, operation)\n\n    const key = await kms.importKey(this.agentContext, kmsOptions)\n\n    this.agentContext.config.logger.trace(\n      `Imported key ${getJwkHumanDescription(key.publicJwk)} with key id '${key.keyId}'`\n    )\n\n    return key\n  }\n\n  /**\n   * Get a public key.\n   */\n  public async getPublicKey(options: WithBackend<KmsGetPublicKeyOptions>) {\n    const { backend, keyId } = zParseWithErrorHandling(\n      zWithBackend(zKmsGetPublicKeyOptions),\n      options,\n      'Invalid options provided to getPublicKey method'\n    )\n\n    if (backend) {\n      const kms = this.getKms(this.agentContext, backend)\n      const publicKey = await kms.getPublicKey(this.agentContext, keyId)\n\n      if (!publicKey) {\n        throw new KeyManagementKeyNotFoundError(keyId, [backend])\n      }\n    }\n\n    const { publicKey } = await this.getKmsForOperationAndKeyId(this.agentContext, options.keyId)\n    return publicKey\n  }\n\n  /**\n   * Delete a key.\n   */\n  public async deleteKey(options: WithBackend<KmsDeleteKeyOptions>) {\n    const { backend, ...kmsOptions } = zParseWithErrorHandling(\n      zWithBackend(zKmsDeleteKeyOptions),\n      options,\n      'Invalid options provided to deleteKey method'\n    )\n\n    const operation = {\n      operation: 'deleteKey',\n    } as const\n    const kms = this.getKms(this.agentContext, backend, operation)\n    return await kms.deleteKey(this.agentContext, kmsOptions)\n  }\n\n  /**\n   * Generate random bytes\n   */\n  public randomBytes(options: WithBackend<KmsRandomBytesOptions>) {\n    const { backend, ...kmsOptions } = zParseWithErrorHandling(\n      zWithBackend(zKmsRandomBytesOptions),\n      options,\n      'Invalid options provided to randomBytes method'\n    )\n\n    const operation = {\n      operation: 'randomBytes',\n    } as const\n    const kms = this.getKms(this.agentContext, backend, operation)\n    return kms.randomBytes(this.agentContext, kmsOptions)\n  }\n\n  /**\n   * Get the kms associated with a specific `keyId`.\n   *\n   * This uses a naive approach of fetching the key for each configured kms\n   * until it finds the registered key.\n   *\n   * In the future this approach might be optimized based on:\n   * - caching\n   * - keeping a registry\n   * - backend specific key prefixes\n   */\n  private async getKmsForOperationAndKeyId(agentContext: AgentContext, keyId: string, operation?: KmsOperation) {\n    for (const kms of this.keyManagementConfig.backends) {\n      const isOperationSupported = operation ? kms.isOperationSupported(agentContext, operation) : true\n      if (!isOperationSupported) continue\n\n      const publicKey = await kms.getPublicKey(this.agentContext, keyId)\n      if (publicKey)\n        return {\n          publicKey,\n          kms,\n        }\n    }\n\n    if (operation) {\n      throw new KeyManagementKeyNotFoundError(\n        keyId,\n        this.keyManagementConfig.backends.map((b) => b.backend),\n        `The key may exist in one of the key management services in which case the key management service does not support the ${getKmsOperationHumanDescription(operation)}`\n      )\n    }\n\n    throw new KeyManagementKeyNotFoundError(\n      keyId,\n      this.keyManagementConfig.backends.map((b) => b.backend)\n    )\n  }\n\n  /**\n   * Get the kms backend for a specific operation.\n   *\n   * If a backend is provided, it will be checked if the backend supports\n   * the operation. Otherwise the first backend that supports the operation\n   * will be used.\n   */\n  private getKms(agentContext: AgentContext, backend?: string, operation?: KmsOperation) {\n    if (backend) {\n      const kms = this.keyManagementConfig.backends.find((kms) => kms.backend === backend)\n      if (!kms) {\n        const availableBackends = this.keyManagementConfig.backends.map((kms) => `'${kms.backend}'`)\n        throw new KeyManagementError(\n          `No key management service is configured for backend '${backend}'. Available backends are ${availableBackends.join(\n            ', '\n          )}`\n        )\n      }\n\n      const isOperationSupported = operation ? kms.isOperationSupported(agentContext, operation) : true\n      if (!isOperationSupported && operation) {\n        throw new KeyManagementError(\n          `Key management service backend '${backend}' does not support ${getKmsOperationHumanDescription(operation)}`\n        )\n      }\n\n      return kms\n    }\n\n    for (const kms of this.keyManagementConfig.backends) {\n      const isOperationSupported = operation ? kms.isOperationSupported(agentContext, operation) : true\n      if (isOperationSupported) return kms\n    }\n\n    if (operation) {\n      throw new KeyManagementError(\n        `No key management service backend found that supports ${getKmsOperationHumanDescription(operation)}`\n      )\n    }\n\n    throw new KeyManagementError('No key management service backend found.')\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsCO,6BAAMA,mBAAiB;CAC5B,AAAO,YACL,AAAQC,qBACR,AAAQC,cACR;EAFQ;EACA;;;;;;;;CASV,AAAO,8BAA8B,WAAmC;EACtE,MAAMC,oBAA8B,EAAE;AAEtC,OAAK,MAAM,OAAO,KAAK,oBAAoB,SAEzC,KAD6B,IAAI,qBAAqB,KAAK,cAAc,UAAU,CAEjF,mBAAkB,KAAK,IAAI,QAAQ;AAIvC,SAAO;;;;;CAMT,MAAa,UACX,SACmC;EACnC,MAAM,EAAE,SAAS,GAAG,eAAe,wBACjC,aAAa,qBAAqB,EAClC,SACA,+CACD;EAOD,MAAM,MAAM,MALA,KAAK,OAAO,KAAK,cAAc,SAAS;GAClD,WAAW;GACX,MAAM,QAAQ;GACf,CAAC,CAEoB,UAAU,KAAK,cAAc,WAAW;AAC9D,MAAI,UAAU,MAAM,IAAI;AAExB,OAAK,aAAa,OAAO,OAAO,MAC9B,eAAe,uBAAuB,IAAI,UAAU,CAAC,gBAAgB,IAAI,MAAM,GAChF;AAED,SAAO;;;;;CAMT,MAAa,+BACX,SACyD;EACzD,MAAM,EAAE,SAAS,WAAW,GAAG,eAAe,wBAC5C,aAAa,0CAA0C,EACvD,SACA,oEACD;EAED,MAAM,OAAO,iCAAiC,UAAU;EAOxD,MAAM,MAAM,MANA,KAAK,OAAO,KAAK,cAAc,SAAS;GAClD,WAAW;GACX;GACD,CAAC,CAGoB,UAAU,KAAK,cAAc;GACjD,GAAG;GACH;GACD,CAAC;AACF,MAAI,UAAU,MAAM,IAAI;AAExB,SAAO;;;;;CAMT,MAAa,KAAK,SAAsC;EACtD,MAAM,EAAE,SAAS,GAAG,eAAe,wBACjC,aAAa,gBAAgB,EAC7B,SACA,0CACD;EAED,MAAM,YAAY;GAChB,WAAW;GACX,WAAW,QAAQ;GACpB;AAKD,SAAO,OAHK,UACR,KAAK,OAAO,KAAK,cAAc,SAAS,UAAU,IACjD,MAAM,KAAK,2BAA2B,KAAK,cAAc,QAAQ,OAAO,UAAU,EAAE,KACxE,KAAK,KAAK,cAAc,WAAW;;;;;CAMtD,MAAa,OAAO,SAAwC;EAC1D,MAAM,EAAE,SAAS,GAAG,eAAe,wBACjC,aAAa,kBAAkB,EAC/B,SACA,4CACD;EAED,MAAM,YAAY;GAAE,WAAW;GAAU,WAAW,QAAQ;GAAW;AAMvE,SAAO,OAJL,WAAW,OAAO,QAAQ,QAAQ,WAC9B,KAAK,OAAO,KAAK,cAAc,SAAS,UAAU,IACjD,MAAM,KAAK,2BAA2B,KAAK,cAAc,QAAQ,KAAK,UAAU,EAAE,KAExE,OAAO,KAAK,cAAc,WAAW;;;;;CAMxD,MAAa,QAAQ,SAAyC;EAC5D,MAAM,EAAE,SAAS,GAAG,eAAe,wBACjC,aAAa,mBAAmB,EAChC,SACA,6CACD;EAED,MAAM,YAAY;GAChB,WAAW;GACX,YAAY,QAAQ;GACpB,cAAc,QAAQ,IAAI;GAC3B;AAMD,SAAO,OAJL,WAAW,OAAO,QAAQ,QAAQ,WAC9B,KAAK,OAAO,KAAK,cAAc,SAAS,UAAU,IACjD,MAAM,KAAK,2BAA2B,KAAK,cAAc,QAAQ,KAAK,UAAU,EAAE,KAExE,QAAQ,KAAK,cAAc,WAAW;;;;;CAMzD,MAAa,QAAQ,SAAyC;EAC5D,MAAM,EAAE,SAAS,GAAG,eAAe,wBACjC,aAAa,mBAAmB,EAChC,SACA,6CACD;EAED,MAAM,YAAY;GAChB,WAAW;GACX,YAAY,QAAQ;GACpB,cAAc,QAAQ,IAAI;GAC3B;AAWD,SAAO,OATL,WAAW,OAAO,QAAQ,QAAQ,WAC9B,KAAK,OACH,KAAK,cAEL,SACA,UACD,IACA,MAAM,KAAK,2BAA2B,KAAK,cAAc,QAAQ,KAAK,UAAU,EAAE,KAExE,QAAQ,KAAK,cAAc,WAAW;;;;;CAMzD,MAAa,UACX,SACkC;EAClC,MAAM,EAAE,SAAS,GAAG,eAAe,wBACjC,aAAa,qBAAqB,EAClC,SACA,+CACD;EAED,MAAM,YAAY;GAChB,WAAW;GACX,YAAY,QAAQ;GACrB;EAGD,MAAM,MAAM,MAFA,KAAK,OAAO,KAAK,cAAc,SAAS,UAAU,CAExC,UAAU,KAAK,cAAc,WAAW;AAE9D,OAAK,aAAa,OAAO,OAAO,MAC9B,gBAAgB,uBAAuB,IAAI,UAAU,CAAC,gBAAgB,IAAI,MAAM,GACjF;AAED,SAAO;;;;;CAMT,MAAa,aAAa,SAA8C;EACtE,MAAM,EAAE,SAAS,UAAU,wBACzB,aAAa,wBAAwB,EACrC,SACA,kDACD;AAED,MAAI,SAIF;OAAI,CAFc,MADN,KAAK,OAAO,KAAK,cAAc,QAAQ,CACvB,aAAa,KAAK,cAAc,MAAM,CAGhE,OAAM,IAAI,8BAA8B,OAAO,CAAC,QAAQ,CAAC;;EAI7D,MAAM,EAAE,cAAc,MAAM,KAAK,2BAA2B,KAAK,cAAc,QAAQ,MAAM;AAC7F,SAAO;;;;;CAMT,MAAa,UAAU,SAA2C;EAChE,MAAM,EAAE,SAAS,GAAG,eAAe,wBACjC,aAAa,qBAAqB,EAClC,SACA,+CACD;AAMD,SAAO,MADK,KAAK,OAAO,KAAK,cAAc,SAHzB,EAChB,WAAW,aACZ,CAC6D,CAC7C,UAAU,KAAK,cAAc,WAAW;;;;;CAM3D,AAAO,YAAY,SAA6C;EAC9D,MAAM,EAAE,SAAS,GAAG,eAAe,wBACjC,aAAa,uBAAuB,EACpC,SACA,iDACD;AAMD,SADY,KAAK,OAAO,KAAK,cAAc,SAHzB,EAChB,WAAW,eACZ,CAC6D,CACnD,YAAY,KAAK,cAAc,WAAW;;;;;;;;;;;;;CAcvD,MAAc,2BAA2B,cAA4B,OAAe,WAA0B;AAC5G,OAAK,MAAM,OAAO,KAAK,oBAAoB,UAAU;AAEnD,OAAI,EADyB,YAAY,IAAI,qBAAqB,cAAc,UAAU,GAAG,MAClE;GAE3B,MAAM,YAAY,MAAM,IAAI,aAAa,KAAK,cAAc,MAAM;AAClE,OAAI,UACF,QAAO;IACL;IACA;IACD;;AAGL,MAAI,UACF,OAAM,IAAI,8BACR,OACA,KAAK,oBAAoB,SAAS,KAAK,MAAM,EAAE,QAAQ,EACvD,yHAAyH,gCAAgC,UAAU,GACpK;AAGH,QAAM,IAAI,8BACR,OACA,KAAK,oBAAoB,SAAS,KAAK,MAAM,EAAE,QAAQ,CACxD;;;;;;;;;CAUH,AAAQ,OAAO,cAA4B,SAAkB,WAA0B;AACrF,MAAI,SAAS;GACX,MAAM,MAAM,KAAK,oBAAoB,SAAS,MAAM,UAAQC,MAAI,YAAY,QAAQ;AACpF,OAAI,CAAC,IAEH,OAAM,IAAI,mBACR,wDAAwD,QAAQ,4BAFxC,KAAK,oBAAoB,SAAS,KAAK,UAAQ,IAAIA,MAAI,QAAQ,GAAG,CAEoB,KAC5G,KACD,GACF;AAIH,OAAI,EADyB,YAAY,IAAI,qBAAqB,cAAc,UAAU,GAAG,SAChE,UAC3B,OAAM,IAAI,mBACR,mCAAmC,QAAQ,qBAAqB,gCAAgC,UAAU,GAC3G;AAGH,UAAO;;AAGT,OAAK,MAAM,OAAO,KAAK,oBAAoB,SAEzC,KAD6B,YAAY,IAAI,qBAAqB,cAAc,UAAU,GAAG,KACnE,QAAO;AAGnC,MAAI,UACF,OAAM,IAAI,mBACR,yDAAyD,gCAAgC,UAAU,GACpG;AAGH,QAAM,IAAI,mBAAmB,2CAA2C;;;+BA9U3E,YAAY"}

package/build/modules/kms/KeyManagementModule.d.mts

@@ -0,0 +1,19 @@
+import { KeyManagementModuleConfig, KeyManagementModuleConfigOptions } from "./KeyManagementModuleConfig.mjs";
+import { KeyManagementApi } from "./KeyManagementApi.mjs";
+import { DependencyManager } from "../../plugins/DependencyManager.mjs";
+import { Module } from "../../plugins/Module.mjs";
+import "../../plugins/index.mjs";
+
+//#region src/modules/kms/KeyManagementModule.d.ts
+declare class KeyManagementModule implements Module {
+  readonly api: typeof KeyManagementApi;
+  readonly config: KeyManagementModuleConfig;
+  constructor(config: KeyManagementModuleConfigOptions);
+  /**
+   * Registers the dependencies of the key management module.
+   */
+  register(dependencyManager: DependencyManager): void;
+}
+//#endregion
+export { KeyManagementModule };
+//# sourceMappingURL=KeyManagementModule.d.mts.map

package/build/modules/kms/KeyManagementModule.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"KeyManagementModule.d.mts","names":[],"sources":["../../../src/modules/kms/KeyManagementModule.ts"],"sourcesContent":[],"mappings":";;;;;;;cAKa,mBAAA,YAA+B;uBACvB;mBACK;sBAEG;;AAJ7B;;EAE0B,QAAA,CAAA,iBAAA,EASW,iBATX,CAAA,EAAA,IAAA"}

package/build/modules/kms/KeyManagementModule.mjs

@@ -0,0 +1,22 @@
+
+
+import { KeyManagementModuleConfig } from "./KeyManagementModuleConfig.mjs";
+import { KeyManagementApi } from "./KeyManagementApi.mjs";
+
+//#region src/modules/kms/KeyManagementModule.ts
+var KeyManagementModule = class {
+	constructor(config) {
+		this.api = KeyManagementApi;
+		this.config = new KeyManagementModuleConfig(config);
+	}
+	/**
+	* Registers the dependencies of the key management module.
+	*/
+	register(dependencyManager) {
+		dependencyManager.registerInstance(KeyManagementModuleConfig, this.config);
+	}
+};
+
+//#endregion
+export { KeyManagementModule };
+//# sourceMappingURL=KeyManagementModule.mjs.map

package/build/modules/kms/KeyManagementModule.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"KeyManagementModule.mjs","names":[],"sources":["../../../src/modules/kms/KeyManagementModule.ts"],"sourcesContent":["import type { DependencyManager, Module } from '../../plugins'\nimport { KeyManagementApi } from './KeyManagementApi'\nimport type { KeyManagementModuleConfigOptions } from './KeyManagementModuleConfig'\nimport { KeyManagementModuleConfig } from './KeyManagementModuleConfig'\n\nexport class KeyManagementModule implements Module {\n  public readonly api = KeyManagementApi\n  public readonly config: KeyManagementModuleConfig\n\n  public constructor(config: KeyManagementModuleConfigOptions) {\n    this.config = new KeyManagementModuleConfig(config)\n  }\n\n  /**\n   * Registers the dependencies of the key management module.\n   */\n  public register(dependencyManager: DependencyManager) {\n    // Config\n    dependencyManager.registerInstance(KeyManagementModuleConfig, this.config)\n  }\n}\n"],"mappings":";;;;;;AAKA,IAAa,sBAAb,MAAmD;CAIjD,AAAO,YAAY,QAA0C;OAH7C,MAAM;AAIpB,OAAK,SAAS,IAAI,0BAA0B,OAAO;;;;;CAMrD,AAAO,SAAS,mBAAsC;AAEpD,oBAAkB,iBAAiB,2BAA2B,KAAK,OAAO"}

package/build/modules/kms/KeyManagementModuleConfig.d.mts

@@ -0,0 +1,29 @@
+import { KeyManagementService } from "./KeyManagementService.mjs";
+
+//#region src/modules/kms/KeyManagementModuleConfig.d.ts
+interface KeyManagementModuleConfigOptions {
+  /**
+   * The backends to use for key management and cryptographic operations.
+   */
+  backends?: KeyManagementService[];
+  /**
+   * The default backend to use, indicated by the `backend` property
+   * on the `KeyManagementService` instance.
+   *
+   * If provided and it doesn't match an entry in the `backends` array
+   * an error will be thrown.
+   *
+   * If not provided, the first backend from the `backends` array will be used.
+   */
+  defaultBackend?: string;
+}
+declare class KeyManagementModuleConfig {
+  #private;
+  constructor(options: KeyManagementModuleConfigOptions);
+  get backends(): KeyManagementService[];
+  registerBackend(backend: KeyManagementService): void;
+  get defaultBackend(): KeyManagementService;
+}
+//#endregion
+export { KeyManagementModuleConfig, KeyManagementModuleConfigOptions };
+//# sourceMappingURL=KeyManagementModuleConfig.d.mts.map

package/build/modules/kms/KeyManagementModuleConfig.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"KeyManagementModuleConfig.d.mts","names":[],"sources":["../../../src/modules/kms/KeyManagementModuleConfig.ts"],"sourcesContent":[],"mappings":";;;UAGiB,gCAAA;;;;EAAA,QAAA,CAAA,EAIJ,oBAJI,EAAA;EAkBJ;;;;;;;;;;;cAAA,yBAAA;;uBAIiB;kBAcT;2BAIa;wBAIP"}

package/build/modules/kms/KeyManagementModuleConfig.mjs

@@ -0,0 +1,36 @@
+
+
+import { KeyManagementError } from "./error/KeyManagementError.mjs";
+import { _classPrivateFieldInitSpec } from "../../_virtual/_@oxc-project_runtime@0.99.0/helpers/classPrivateFieldInitSpec.mjs";
+import { _classPrivateFieldSet2 } from "../../_virtual/_@oxc-project_runtime@0.99.0/helpers/classPrivateFieldSet2.mjs";
+import { _classPrivateFieldGet2 } from "../../_virtual/_@oxc-project_runtime@0.99.0/helpers/classPrivateFieldGet2.mjs";
+
+//#region src/modules/kms/KeyManagementModuleConfig.ts
+var _defaultBackend = /* @__PURE__ */ new WeakMap();
+var _backends = /* @__PURE__ */ new WeakMap();
+var KeyManagementModuleConfig = class {
+	constructor(options) {
+		_classPrivateFieldInitSpec(this, _defaultBackend, void 0);
+		_classPrivateFieldInitSpec(this, _backends, void 0);
+		_classPrivateFieldSet2(_backends, this, options.backends ?? []);
+		if (options.defaultBackend) {
+			if (!_classPrivateFieldGet2(_backends, this).find((kms) => kms.backend === options.defaultBackend)) throw new KeyManagementError(`Default backend '${options.defaultBackend}' provided in KeyManagementModuleConfig, but not found in 'backends'. Make sure the backend identifier matches with a registered backend.`);
+			_classPrivateFieldSet2(_defaultBackend, this, options.defaultBackend);
+		}
+	}
+	get backends() {
+		return _classPrivateFieldGet2(_backends, this);
+	}
+	registerBackend(backend) {
+		this.backends.push(backend);
+	}
+	get defaultBackend() {
+		const backend = this.backends.find((kms) => !_classPrivateFieldGet2(_defaultBackend, this) || _classPrivateFieldGet2(_defaultBackend, this) === kms.backend);
+		if (!backend) throw new KeyManagementError("Unable to determine default backend. ");
+		return backend;
+	}
+};
+
+//#endregion
+export { KeyManagementModuleConfig };
+//# sourceMappingURL=KeyManagementModuleConfig.mjs.map

package/build/modules/kms/KeyManagementModuleConfig.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"KeyManagementModuleConfig.mjs","names":[],"sources":["../../../src/modules/kms/KeyManagementModuleConfig.ts"],"sourcesContent":["import { KeyManagementError } from './error/KeyManagementError'\nimport type { KeyManagementService } from './KeyManagementService'\n\nexport interface KeyManagementModuleConfigOptions {\n  /**\n   * The backends to use for key management and cryptographic operations.\n   */\n  backends?: KeyManagementService[]\n\n  /**\n   * The default backend to use, indicated by the `backend` property\n   * on the `KeyManagementService` instance.\n   *\n   * If provided and it doesn't match an entry in the `backends` array\n   * an error will be thrown.\n   *\n   * If not provided, the first backend from the `backends` array will be used.\n   */\n  defaultBackend?: string\n}\n\nexport class KeyManagementModuleConfig {\n  #defaultBackend?: string\n  #backends: KeyManagementService[]\n\n  public constructor(options: KeyManagementModuleConfigOptions) {\n    this.#backends = options.backends ?? []\n\n    if (options.defaultBackend) {\n      const defaultBackend = this.#backends.find((kms) => kms.backend === options.defaultBackend)\n      if (!defaultBackend) {\n        throw new KeyManagementError(\n          `Default backend '${options.defaultBackend}' provided in KeyManagementModuleConfig, but not found in 'backends'. Make sure the backend identifier matches with a registered backend.`\n        )\n      }\n      this.#defaultBackend = options.defaultBackend\n    }\n  }\n\n  public get backends() {\n    return this.#backends\n  }\n\n  public registerBackend(backend: KeyManagementService) {\n    this.backends.push(backend)\n  }\n\n  public get defaultBackend() {\n    const backend = this.backends.find((kms) => !this.#defaultBackend || this.#defaultBackend === kms.backend)\n    if (!backend) {\n      throw new KeyManagementError('Unable to determine default backend. ')\n    }\n\n    return backend\n  }\n}\n"],"mappings":";;;;;;;;;;AAqBA,IAAa,4BAAb,MAAuC;CAIrC,AAAO,YAAY,SAA2C;;;AAC5D,0CAAiB,QAAQ,YAAY,EAAE;AAEvC,MAAI,QAAQ,gBAAgB;AAE1B,OAAI,mCADmB,KAAc,CAAC,MAAM,QAAQ,IAAI,YAAY,QAAQ,eAAe,CAEzF,OAAM,IAAI,mBACR,oBAAoB,QAAQ,eAAe,2IAC5C;AAEH,iDAAuB,QAAQ,eAAc;;;CAIjD,IAAW,WAAW;AACpB,2CAAO,KAAc;;CAGvB,AAAO,gBAAgB,SAA+B;AACpD,OAAK,SAAS,KAAK,QAAQ;;CAG7B,IAAW,iBAAiB;EAC1B,MAAM,UAAU,KAAK,SAAS,MAAM,QAAQ,yCAAC,KAAoB,4CAAI,KAAoB,KAAK,IAAI,QAAQ;AAC1G,MAAI,CAAC,QACH,OAAM,IAAI,mBAAmB,wCAAwC;AAGvE,SAAO"}

package/build/modules/kms/KeyManagementService.d.mts

@@ -0,0 +1,73 @@
+import { KmsCreateKeyOptions, KmsCreateKeyReturn, KmsCreateKeyType } from "./options/KmsCreateKeyOptions.mjs";
+import { KmsDecryptOptions, KmsDecryptReturn } from "./options/KmsDecryptOptions.mjs";
+import { KmsDeleteKeyOptions } from "./options/KmsDeleteKeyOptions.mjs";
+import { KmsEncryptOptions, KmsEncryptReturn } from "./options/KmsEncryptOptions.mjs";
+import { KmsImportKeyOptions, KmsImportKeyReturn } from "./options/KmsImportKeyOptions.mjs";
+import { KmsOperation } from "./options/KmsOperation.mjs";
+import { KmsRandomBytesOptions, KmsRandomBytesReturn } from "./options/KmsRandomBytesOptions.mjs";
+import { KmsSignOptions, KmsSignReturn } from "./options/KmsSignOptions.mjs";
+import { KmsVerifyOptions, KmsVerifyReturn } from "./options/KmsVerifyOptions.mjs";
+import "./options/index.mjs";
+import { KmsJwkPrivate, KmsJwkPublic } from "./jwk/knownJwk.mjs";
+import { AgentContext } from "../../agent/context/AgentContext.mjs";
+import "../../agent/index.mjs";
+
+//#region src/modules/kms/KeyManagementService.d.ts
+interface KeyManagementService {
+  /**
+   * The 'backend' name of this key management service
+   */
+  readonly backend: string;
+  /**
+   * Whether this backend supports an operation. Generally if no backend is provided
+   * for an operation the first supported backend will be chosen. For operations based on
+   * a key id, the first supported backed will be checked whether it can handle that specific
+   * key id.
+   */
+  isOperationSupported(agentContext: AgentContext, operation: KmsOperation): boolean;
+  /**
+   * Get the public representation of a key.
+   *
+   * In case of a symmetric key the returned JWK won't include
+   * any cryptographic key material itself, but will include
+   * all the key related metadata.
+   */
+  getPublicKey(agentContext: AgentContext, keyId: string): Promise<KmsJwkPublic | null>;
+  /**
+   * Create a key
+   */
+  createKey<Type extends KmsCreateKeyType>(agentContext: AgentContext, options: KmsCreateKeyOptions<Type>): Promise<KmsCreateKeyReturn<Type>>;
+  /**
+   * Import a key
+   */
+  importKey<Jwk extends KmsJwkPrivate>(agentContext: AgentContext, options: KmsImportKeyOptions<Jwk>): Promise<KmsImportKeyReturn<Jwk>>;
+  /**
+   * Delete a key.
+   *
+   * @returns boolean whether the key was removed.
+   */
+  deleteKey(agentContext: AgentContext, options: KmsDeleteKeyOptions): Promise<boolean>;
+  /**
+   * Sign with a specific key
+   */
+  sign(agentContext: AgentContext, options: KmsSignOptions): Promise<KmsSignReturn>;
+  /**
+   * Verify with a specific key
+   */
+  verify(agentContext: AgentContext, options: KmsVerifyOptions): Promise<KmsVerifyReturn>;
+  /**
+   * Encrypt data
+   */
+  encrypt(agentContext: AgentContext, options: KmsEncryptOptions): Promise<KmsEncryptReturn>;
+  /**
+   * Decrypt data
+   */
+  decrypt(agentContext: AgentContext, options: KmsDecryptOptions): Promise<KmsDecryptReturn>;
+  /**
+   * Generate secure random bytes
+   */
+  randomBytes(agentContext: AgentContext, options: KmsRandomBytesOptions): KmsRandomBytesReturn;
+}
+//#endregion
+export { KeyManagementService };
+//# sourceMappingURL=KeyManagementService.d.mts.map

package/build/modules/kms/KeyManagementService.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"KeyManagementService.d.mts","names":[],"sources":["../../../src/modules/kms/KeyManagementService.ts"],"sourcesContent":[],"mappings":";;;;;;;;;;;;;;;UAWiB,oBAAA;;;;;;;AAAjB;;;;EAqBmE,oBAAA,CAAA,YAAA,EAT9B,YAS8B,EAAA,SAAA,EATL,YASK,CAAA,EAAA,OAAA;EAAR;;;;;;;EAQtD,YAAA,CAAA,YAAA,EARwB,YAQxB,EAAA,KAAA,EAAA,MAAA,CAAA,EARsD,OAQtD,CAR8D,YAQ9D,GAAA,IAAA,CAAA;EAKmB;;;EAEX,SAAA,CAAA,aAVY,gBAUZ,CAAA,CAAA,YAAA,EATK,YASL,EAAA,OAAA,EARA,mBAQA,CARoB,IAQpB,CAAA,CAAA,EAPR,OAOQ,CAPA,kBAOA,CAPmB,IAOnB,CAAA,CAAA;EACmB;;;EAON,SAAA,CAAA,YAVF,aAUE,CAAA,CAAA,YAAA,EATR,YASQ,EAAA,OAAA,EARb,mBAQa,CARO,GAQP,CAAA,CAAA,EAPrB,OAOqB,CAPb,kBAOa,CAPM,GAON,CAAA,CAAA;EAAuB;;;;;EAKY,SAAA,CAAA,YAAA,EALnC,YAKmC,EAAA,OAAA,EALZ,mBAKY,CAAA,EALU,OAKV,CAAA,OAAA,CAAA;EAKtC;;;EAA0C,IAAA,CAAA,YAAA,EAL5C,YAK4C,EAAA,OAAA,EALrB,cAKqB,CAAA,EALJ,OAKI,CALI,aAKJ,CAAA;EAKzC;;;EAA2C,MAAA,CAAA,YAAA,EAL5C,YAK4C,EAAA,OAAA,EALrB,gBAKqB,CAAA,EALF,OAKE,CALM,eAKN,CAAA;EAK3C;;;EAA2C,OAAA,CAAA,YAAA,EAL3C,YAK2C,EAAA,OAAA,EALpB,iBAKoB,CAAA,EALA,OAKA,CALQ,gBAKR,CAAA;EAKvC;;;EAAmE,OAAA,CAAA,YAAA,EALvE,YAKuE,EAAA,OAAA,EALhD,iBAKgD,CAAA,EAL5B,OAK4B,CALpB,gBAKoB,CAAA;;;;4BAAnE,uBAAuB,wBAAwB"}

package/build/modules/kms/cose/algorithm.d.mts

@@ -0,0 +1,37 @@
+import { z } from "zod";
+
+//#region src/modules/kms/cose/algorithm.d.ts
+declare const KnownCoseSignatureAlgorithms: {
+  readonly Ed25519: -19;
+  readonly Ed448: -53;
+  readonly EdDSA: -19;
+  readonly ESP256: -9;
+  readonly ESP384: -51;
+  readonly ESP512: -52;
+  readonly ES256K: -47;
+  readonly RS256: -257;
+  readonly RS384: -258;
+  readonly RS512: -259;
+  readonly PS256: -37;
+  readonly PS384: -38;
+  readonly PS512: -39;
+};
+declare const zKnownCoseSignatureAlgorithm: z.ZodEnum<{
+  readonly Ed25519: -19;
+  readonly Ed448: -53;
+  readonly EdDSA: -19;
+  readonly ESP256: -9;
+  readonly ESP384: -51;
+  readonly ESP512: -52;
+  readonly ES256K: -47;
+  readonly RS256: -257;
+  readonly RS384: -258;
+  readonly RS512: -259;
+  readonly PS256: -37;
+  readonly PS384: -38;
+  readonly PS512: -39;
+}>;
+type KnownCoseSignatureAlgorithm = z.output<typeof zKnownCoseSignatureAlgorithm>;
+//#endregion
+export { KnownCoseSignatureAlgorithm, KnownCoseSignatureAlgorithms };
+//# sourceMappingURL=algorithm.d.mts.map

package/build/modules/kms/cose/algorithm.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"algorithm.d.mts","names":[],"sources":["../../../../src/modules/kms/cose/algorithm.ts"],"sourcesContent":[],"mappings":";;;cAEa;;;;EAAA,SAAA,MAAA,EAAA,CAAA,CAAA;EAyBA,SAAA,MAAA,EAAA,CAAA,EAAA;EACD,SAAA,MAAA,EAAA,CAAA,EAAA;;;;;;;;;cADC,8BAA4B,CAAA,CAAA;;;;;;;;;;;;;;;KAC7B,2BAAA,GAA8B,CAAA,CAAE,cAAc"}

package/build/modules/kms/cose/algorithm.mjs

@@ -0,0 +1,25 @@
+
+
+import { z } from "zod";
+
+//#region src/modules/kms/cose/algorithm.ts
+const KnownCoseSignatureAlgorithms = {
+	Ed25519: -19,
+	Ed448: -53,
+	EdDSA: -19,
+	ESP256: -9,
+	ESP384: -51,
+	ESP512: -52,
+	ES256K: -47,
+	RS256: -257,
+	RS384: -258,
+	RS512: -259,
+	PS256: -37,
+	PS384: -38,
+	PS512: -39
+};
+const zKnownCoseSignatureAlgorithm = z.enum(KnownCoseSignatureAlgorithms);
+
+//#endregion
+export { KnownCoseSignatureAlgorithms };
+//# sourceMappingURL=algorithm.mjs.map

package/build/modules/kms/cose/algorithm.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"algorithm.mjs","names":[],"sources":["../../../../src/modules/kms/cose/algorithm.ts"],"sourcesContent":["import { z } from 'zod'\n\nexport const KnownCoseSignatureAlgorithms = {\n  // EdDSA algorithms - RFC 9864 Section 2.2\n  Ed25519: -19,\n  Ed448: -53,\n\n  // Deprecated polymorphic EdDSA - RFC 9864 Section 4.1.2\n  // Maps to Ed25519 as it's the most common use case (similar to WebAuthn's approach)\n  EdDSA: -19,\n\n  // ECDSA algorithms - RFC 9864 Section 2.1\n  // JOSE ES256/ES384/ES512 map to fully-specified COSE ESP256/ESP384/ESP512\n  ESP256: -9, // COSE ESP256 (ECDSA using P-256 curve and SHA-256)\n  ESP384: -51, // COSE ESP384 (ECDSA using P-384 curve and SHA-384)\n  ESP512: -52, // COSE ESP512 (ECDSA using P-521 curve and SHA-512)\n  ES256K: -47, // ECDSA using secp256k1 curve and SHA-256\n\n  // RSA algorithms - RFC 7518\n  RS256: -257, // RSASSA-PKCS1-v1_5 using SHA-256\n  RS384: -258, // RSASSA-PKCS1-v1_5 using SHA-384\n  RS512: -259, // RSASSA-PKCS1-v1_5 using SHA-512\n  PS256: -37, // RSASSA-PSS using SHA-256 and MGF1 with SHA-256\n  PS384: -38, // RSASSA-PSS using SHA-384 and MGF1 with SHA-384\n  PS512: -39, // RSASSA-PSS using SHA-512 and MGF1 with SHA-512\n} as const\n\nexport const zKnownCoseSignatureAlgorithm = z.enum(KnownCoseSignatureAlgorithms)\nexport type KnownCoseSignatureAlgorithm = z.output<typeof zKnownCoseSignatureAlgorithm>\n\nexport function isKnownCoseSignatureAlgorithm(coseAlg: number): coseAlg is KnownCoseSignatureAlgorithm {\n  return Object.values(KnownCoseSignatureAlgorithms).includes(coseAlg as KnownCoseSignatureAlgorithm)\n}\n"],"mappings":";;;;;AAEA,MAAa,+BAA+B;CAE1C,SAAS;CACT,OAAO;CAIP,OAAO;CAIP,QAAQ;CACR,QAAQ;CACR,QAAQ;CACR,QAAQ;CAGR,OAAO;CACP,OAAO;CACP,OAAO;CACP,OAAO;CACP,OAAO;CACP,OAAO;CACR;AAED,MAAa,+BAA+B,EAAE,KAAK,6BAA6B"}

package/build/modules/kms/cose/index.d.mts

@@ -0,0 +1 @@
+import { KnownCoseSignatureAlgorithm, KnownCoseSignatureAlgorithms } from "./algorithm.mjs";

package/build/modules/kms/cose/index.mjs

@@ -0,0 +1,3 @@
+
+
+import { KnownCoseSignatureAlgorithms } from "./algorithm.mjs";

package/build/modules/kms/error/KeyManagementAlgorithmNotSupportedError.d.mts

@@ -0,0 +1,10 @@
+import { KeyManagementError } from "./KeyManagementError.mjs";
+
+//#region src/modules/kms/error/KeyManagementAlgorithmNotSupportedError.d.ts
+declare class KeyManagementAlgorithmNotSupportedError extends KeyManagementError {
+  backend: string;
+  constructor(notSupported: string, backend: string);
+}
+//#endregion
+export { KeyManagementAlgorithmNotSupportedError };
+//# sourceMappingURL=KeyManagementAlgorithmNotSupportedError.d.mts.map

package/build/modules/kms/error/KeyManagementAlgorithmNotSupportedError.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"KeyManagementAlgorithmNotSupportedError.d.mts","names":[],"sources":["../../../../src/modules/kms/error/KeyManagementAlgorithmNotSupportedError.ts"],"sourcesContent":[],"mappings":";;;cAEa,uCAAA,SAAgD,kBAAA"}

package/build/modules/kms/error/KeyManagementAlgorithmNotSupportedError.mjs

@@ -0,0 +1,15 @@
+
+
+import { KeyManagementError } from "./KeyManagementError.mjs";
+
+//#region src/modules/kms/error/KeyManagementAlgorithmNotSupportedError.ts
+var KeyManagementAlgorithmNotSupportedError = class extends KeyManagementError {
+	constructor(notSupported, backend) {
+		super(`${backend} backend does not support ${notSupported}.`);
+		this.backend = backend;
+	}
+};
+
+//#endregion
+export { KeyManagementAlgorithmNotSupportedError };
+//# sourceMappingURL=KeyManagementAlgorithmNotSupportedError.mjs.map

package/build/modules/kms/error/KeyManagementAlgorithmNotSupportedError.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"KeyManagementAlgorithmNotSupportedError.mjs","names":["backend: string"],"sources":["../../../../src/modules/kms/error/KeyManagementAlgorithmNotSupportedError.ts"],"sourcesContent":["import { KeyManagementError } from './KeyManagementError'\n\nexport class KeyManagementAlgorithmNotSupportedError extends KeyManagementError {\n  public constructor(\n    notSupported: string,\n    public backend: string\n  ) {\n    super(`${backend} backend does not support ${notSupported}.`)\n  }\n}\n"],"mappings":";;;;;AAEA,IAAa,0CAAb,cAA6D,mBAAmB;CAC9E,AAAO,YACL,cACA,AAAOA,SACP;AACA,QAAM,GAAG,QAAQ,4BAA4B,aAAa,GAAG;EAFtD"}

package/build/modules/kms/error/KeyManagementError.d.mts

@@ -0,0 +1,8 @@
+import { CredoError } from "../../../error/CredoError.mjs";
+import "../../../error/index.mjs";
+
+//#region src/modules/kms/error/KeyManagementError.d.ts
+declare class KeyManagementError extends CredoError {}
+//#endregion
+export { KeyManagementError };
+//# sourceMappingURL=KeyManagementError.d.mts.map

package/build/modules/kms/error/KeyManagementError.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"KeyManagementError.d.mts","names":[],"sources":["../../../../src/modules/kms/error/KeyManagementError.ts"],"sourcesContent":[],"mappings":";;;;cAEa,kBAAA,SAA2B,UAAA"}

package/build/modules/kms/error/KeyManagementError.mjs

@@ -0,0 +1,11 @@
+
+
+import { CredoError } from "../../../error/CredoError.mjs";
+import "../../../error/index.mjs";
+
+//#region src/modules/kms/error/KeyManagementError.ts
+var KeyManagementError = class extends CredoError {};
+
+//#endregion
+export { KeyManagementError };
+//# sourceMappingURL=KeyManagementError.mjs.map

package/build/modules/kms/error/KeyManagementError.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"KeyManagementError.mjs","names":[],"sources":["../../../../src/modules/kms/error/KeyManagementError.ts"],"sourcesContent":["import { CredoError } from '../../../error'\n\nexport class KeyManagementError extends CredoError {}\n"],"mappings":";;;;;;AAEA,IAAa,qBAAb,cAAwC,WAAW"}

package/build/modules/kms/error/KeyManagementKeyExistsError.d.mts

@@ -0,0 +1,9 @@
+import { KeyManagementError } from "./KeyManagementError.mjs";
+
+//#region src/modules/kms/error/KeyManagementKeyExistsError.d.ts
+declare class KeyManagementKeyExistsError extends KeyManagementError {
+  constructor(keyId: string, backend: string);
+}
+//#endregion
+export { KeyManagementKeyExistsError };
+//# sourceMappingURL=KeyManagementKeyExistsError.d.mts.map

package/build/modules/kms/error/KeyManagementKeyExistsError.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"KeyManagementKeyExistsError.d.mts","names":[],"sources":["../../../../src/modules/kms/error/KeyManagementKeyExistsError.ts"],"sourcesContent":[],"mappings":";;;cAEa,2BAAA,SAAoC,kBAAA"}

package/build/modules/kms/error/KeyManagementKeyExistsError.mjs

@@ -0,0 +1,14 @@
+
+
+import { KeyManagementError } from "./KeyManagementError.mjs";
+
+//#region src/modules/kms/error/KeyManagementKeyExistsError.ts
+var KeyManagementKeyExistsError = class extends KeyManagementError {
+	constructor(keyId, backend) {
+		super(`A key with key id '${keyId}' already exists in backend '${backend}'`);
+	}
+};
+
+//#endregion
+export { KeyManagementKeyExistsError };
+//# sourceMappingURL=KeyManagementKeyExistsError.mjs.map

package/build/modules/kms/error/KeyManagementKeyExistsError.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"KeyManagementKeyExistsError.mjs","names":[],"sources":["../../../../src/modules/kms/error/KeyManagementKeyExistsError.ts"],"sourcesContent":["import { KeyManagementError } from './KeyManagementError'\n\nexport class KeyManagementKeyExistsError extends KeyManagementError {\n  public constructor(keyId: string, backend: string) {\n    super(`A key with key id '${keyId}' already exists in backend '${backend}'`)\n  }\n}\n"],"mappings":";;;;;AAEA,IAAa,8BAAb,cAAiD,mBAAmB;CAClE,AAAO,YAAY,OAAe,SAAiB;AACjD,QAAM,sBAAsB,MAAM,+BAA+B,QAAQ,GAAG"}