@credo-ts/node 0.8.0-alpha-20260915104201 → 0.8.0-alpha-20260928074804

package/build/NodeFileSystem.d.mts

@@ -1,7 +1,6 @@
 import { DownloadToFileOptions, FileSystem } from "@credo-ts/core";
-
 //#region src/NodeFileSystem.d.ts
-declare class NodeFileSystem implements FileSystem {
+export declare class NodeFileSystem implements FileSystem {
   readonly dataPath: string;
   readonly cachePath: string;
   readonly tempPath: string;
@@ -29,5 +28,4 @@ declare class NodeFileSystem implements FileSystem {
   downloadToFile(url: string, path: string, options: DownloadToFileOptions): Promise<void>;
 }
 //#endregion
-export { NodeFileSystem };
 //# sourceMappingURL=NodeFileSystem.d.mts.map

package/build/NodeFileSystem.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"NodeFileSystem.d.mts","names":[],"sources":["../src/NodeFileSystem.ts"],"mappings":";;;cAWa,cAAA,YAA0B,UAAA;EAAA,SACrB,QAAA;EAAA,SACA,SAAA;EAAA,SACA,QAAA;;;;;;;;;;;cAYG,OAAA;IAAY,YAAA;IAAuB,aAAA;IAAwB,YAAA;EAAA;EAMjE,MAAA,CAAO,IAAA,WAAY,OAAA;EASnB,eAAA,CAAgB,IAAA,WAAe,OAAA;EAI/B,QAAA,CAAS,UAAA,UAAoB,eAAA,WAA0B,OAAA;EAIvD,KAAA,CAAM,IAAA,UAAc,IAAA,WAAe,OAAA;EAOnC,IAAA,CAAK,IAAA,WAAe,OAAA;EAIpB,MAAA,CAAO,IAAA,WAAe,OAAA;EAItB,cAAA,CAAe,GAAA,UAAa,IAAA,UAAc,OAAA,EAAS,qBAAA,GAAqB,OAAA;AAAA"}
+{"version":3,"file":"NodeFileSystem.d.mts","names":[],"sources":["../src/NodeFileSystem.ts"],"mappings":";;qBAWa,0BAA0B;WACrB;WACA;WACA;;;;;;;;;;;EAYG,YAAA;IAAY;IAAuB;IAAwB;;EAMjE,OAAO,eAAY;EASnB,gBAAgB,eAAe;EAI/B,SAAS,oBAAoB,0BAA0B;EAIvD,MAAM,cAAc,eAAe;EAOnC,KAAK,eAAe;EAIpB,OAAO,eAAe;EAItB,eAAe,aAAa,cAAc,SAAS,wBAAqB"}

package/build/NodeFileSystem.mjs

@@ -5,7 +5,6 @@ import http from "http";
 import https from "https";
 import { homedir, tmpdir } from "os";
 import { dirname } from "path";
-
 //#region src/NodeFileSystem.ts
 const { access, readFile, writeFile, mkdir, rm, unlink, copyFile } = promises;
 var NodeFileSystem = class {
@@ -80,7 +79,7 @@ var NodeFileSystem = class {
 		});
 	}
 };
-
 //#endregion
 export { NodeFileSystem };
+
 //# sourceMappingURL=NodeFileSystem.mjs.map

package/build/NodeFileSystem.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"NodeFileSystem.mjs","names":[],"sources":["../src/NodeFileSystem.ts"],"sourcesContent":["import type { DownloadToFileOptions, FileSystem } from '@credo-ts/core'\nimport { CredoError, TypedArrayEncoder } from '@credo-ts/core'\nimport { createHash } from 'crypto'\nimport fs, { promises } from 'fs'\nimport http from 'http'\nimport https from 'https'\nimport { homedir, tmpdir } from 'os'\nimport { dirname } from 'path'\n\nconst { access, readFile, writeFile, mkdir, rm, unlink, copyFile } = promises\n\nexport class NodeFileSystem implements FileSystem {\n  public readonly dataPath\n  public readonly cachePath\n  public readonly tempPath\n\n  /**\n   * Create new NodeFileSystem class instance.\n   *\n   * @param baseDataPath The base path to use for reading and writing data files used within the framework.\n   * Files will be created under baseDataPath/.afj directory. If not specified, it will be set to homedir()\n   * @param baseCachePath The base path to use for reading and writing cache files used within the framework.\n   * Files will be created under baseCachePath/.afj directory. If not specified, it will be set to homedir()\n   * @param baseTempPath The base path to use for reading and writing temporary files within the framework.\n   * Files will be created under baseTempPath/.afj directory. If not specified, it will be set to tmpdir()\n   */\n  public constructor(options?: { baseDataPath?: string; baseCachePath?: string; baseTempPath?: string }) {\n    this.dataPath = options?.baseDataPath ? `${options?.baseDataPath}/.afj` : `${homedir()}/.afj/data`\n    this.cachePath = options?.baseCachePath ? `${options?.baseCachePath}/.afj` : `${homedir()}/.afj/cache`\n    this.tempPath = `${options?.baseTempPath ?? tmpdir()}/.afj`\n  }\n\n  public async exists(path: string) {\n    try {\n      await access(path)\n      return true\n    } catch {\n      return false\n    }\n  }\n\n  public async createDirectory(path: string): Promise<void> {\n    await mkdir(dirname(path), { recursive: true })\n  }\n\n  public async copyFile(sourcePath: string, destinationPath: string): Promise<void> {\n    await copyFile(sourcePath, destinationPath)\n  }\n\n  public async write(path: string, data: string): Promise<void> {\n    // Make sure parent directories exist\n    await mkdir(dirname(path), { recursive: true })\n\n    return writeFile(path, data, { encoding: 'utf-8' })\n  }\n\n  public async read(path: string): Promise<string> {\n    return readFile(path, { encoding: 'utf-8' })\n  }\n\n  public async delete(path: string): Promise<void> {\n    await rm(path, { recursive: true, force: true })\n  }\n\n  public async downloadToFile(url: string, path: string, options: DownloadToFileOptions) {\n    const httpMethod = url.startsWith('https') ? https : http\n\n    // Make sure parent directories exist\n    await mkdir(dirname(path), { recursive: true })\n\n    const file = fs.createWriteStream(path)\n    const hash = options.verifyHash ? createHash('sha256') : undefined\n\n    return new Promise<void>((resolve, reject) => {\n      httpMethod\n        .get(url, (response) => {\n          // check if response is success\n          if (response.statusCode !== 200) {\n            reject(`Unable to download file from url: ${url}. Response status was ${response.statusCode}`)\n          }\n\n          hash && response.pipe(hash)\n          response.pipe(file)\n          file.on('finish', async () => {\n            file.close()\n\n            if (hash && options.verifyHash?.hash) {\n              hash.end()\n              const digest = hash.digest()\n              if (digest.compare(options.verifyHash.hash) !== 0) {\n                await fs.promises.unlink(path)\n\n                reject(\n                  new CredoError(\n                    `Hash of downloaded file does not match expected hash. Expected: ${\n                      options.verifyHash.hash\n                    }, Actual: ${TypedArrayEncoder.toUtf8String(digest)})}`\n                  )\n                )\n              }\n            }\n            resolve()\n          })\n        })\n        .on('error', async (error) => {\n          // Handle errors\n          await unlink(path) // Delete the file async. (But we don't check the result)\n          reject(`Unable to download file from url: ${url}. ${error.message}`)\n        })\n    })\n  }\n}\n"],"mappings":";;;;;;;;;AASA,MAAM,EAAE,QAAQ,UAAU,WAAW,OAAO,IAAI,QAAQ,aAAa;AAErE,IAAa,iBAAb,MAAkD;;;;;;;;;;;CAehD,AAAO,YAAY,SAAoF;AACrG,OAAK,WAAW,SAAS,eAAe,GAAG,SAAS,aAAa,SAAS,GAAG,SAAS,CAAC;AACvF,OAAK,YAAY,SAAS,gBAAgB,GAAG,SAAS,cAAc,SAAS,GAAG,SAAS,CAAC;AAC1F,OAAK,WAAW,GAAG,SAAS,gBAAgB,QAAQ,CAAC;;CAGvD,MAAa,OAAO,MAAc;AAChC,MAAI;AACF,SAAM,OAAO,KAAK;AAClB,UAAO;UACD;AACN,UAAO;;;CAIX,MAAa,gBAAgB,MAA6B;AACxD,QAAM,MAAM,QAAQ,KAAK,EAAE,EAAE,WAAW,MAAM,CAAC;;CAGjD,MAAa,SAAS,YAAoB,iBAAwC;AAChF,QAAM,SAAS,YAAY,gBAAgB;;CAG7C,MAAa,MAAM,MAAc,MAA6B;AAE5D,QAAM,MAAM,QAAQ,KAAK,EAAE,EAAE,WAAW,MAAM,CAAC;AAE/C,SAAO,UAAU,MAAM,MAAM,EAAE,UAAU,SAAS,CAAC;;CAGrD,MAAa,KAAK,MAA+B;AAC/C,SAAO,SAAS,MAAM,EAAE,UAAU,SAAS,CAAC;;CAG9C,MAAa,OAAO,MAA6B;AAC/C,QAAM,GAAG,MAAM;GAAE,WAAW;GAAM,OAAO;GAAM,CAAC;;CAGlD,MAAa,eAAe,KAAa,MAAc,SAAgC;EACrF,MAAM,aAAa,IAAI,WAAW,QAAQ,GAAG,QAAQ;AAGrD,QAAM,MAAM,QAAQ,KAAK,EAAE,EAAE,WAAW,MAAM,CAAC;EAE/C,MAAM,OAAO,GAAG,kBAAkB,KAAK;EACvC,MAAM,OAAO,QAAQ,aAAa,WAAW,SAAS,GAAG;AAEzD,SAAO,IAAI,SAAe,SAAS,WAAW;AAC5C,cACG,IAAI,MAAM,aAAa;AAEtB,QAAI,SAAS,eAAe,IAC1B,QAAO,qCAAqC,IAAI,wBAAwB,SAAS,aAAa;AAGhG,YAAQ,SAAS,KAAK,KAAK;AAC3B,aAAS,KAAK,KAAK;AACnB,SAAK,GAAG,UAAU,YAAY;AAC5B,UAAK,OAAO;AAEZ,SAAI,QAAQ,QAAQ,YAAY,MAAM;AACpC,WAAK,KAAK;MACV,MAAM,SAAS,KAAK,QAAQ;AAC5B,UAAI,OAAO,QAAQ,QAAQ,WAAW,KAAK,KAAK,GAAG;AACjD,aAAM,GAAG,SAAS,OAAO,KAAK;AAE9B,cACE,IAAI,WACF,mEACE,QAAQ,WAAW,KACpB,YAAY,kBAAkB,aAAa,OAAO,CAAC,IACrD,CACF;;;AAGL,cAAS;MACT;KACF,CACD,GAAG,SAAS,OAAO,UAAU;AAE5B,UAAM,OAAO,KAAK;AAClB,WAAO,qCAAqC,IAAI,IAAI,MAAM,UAAU;KACpE;IACJ"}
+{"version":3,"file":"NodeFileSystem.mjs","names":[],"sources":["../src/NodeFileSystem.ts"],"sourcesContent":["import type { DownloadToFileOptions, FileSystem } from '@credo-ts/core'\nimport { CredoError, TypedArrayEncoder } from '@credo-ts/core'\nimport { createHash } from 'crypto'\nimport fs, { promises } from 'fs'\nimport http from 'http'\nimport https from 'https'\nimport { homedir, tmpdir } from 'os'\nimport { dirname } from 'path'\n\nconst { access, readFile, writeFile, mkdir, rm, unlink, copyFile } = promises\n\nexport class NodeFileSystem implements FileSystem {\n  public readonly dataPath\n  public readonly cachePath\n  public readonly tempPath\n\n  /**\n   * Create new NodeFileSystem class instance.\n   *\n   * @param baseDataPath The base path to use for reading and writing data files used within the framework.\n   * Files will be created under baseDataPath/.afj directory. If not specified, it will be set to homedir()\n   * @param baseCachePath The base path to use for reading and writing cache files used within the framework.\n   * Files will be created under baseCachePath/.afj directory. If not specified, it will be set to homedir()\n   * @param baseTempPath The base path to use for reading and writing temporary files within the framework.\n   * Files will be created under baseTempPath/.afj directory. If not specified, it will be set to tmpdir()\n   */\n  public constructor(options?: { baseDataPath?: string; baseCachePath?: string; baseTempPath?: string }) {\n    this.dataPath = options?.baseDataPath ? `${options?.baseDataPath}/.afj` : `${homedir()}/.afj/data`\n    this.cachePath = options?.baseCachePath ? `${options?.baseCachePath}/.afj` : `${homedir()}/.afj/cache`\n    this.tempPath = `${options?.baseTempPath ?? tmpdir()}/.afj`\n  }\n\n  public async exists(path: string) {\n    try {\n      await access(path)\n      return true\n    } catch {\n      return false\n    }\n  }\n\n  public async createDirectory(path: string): Promise<void> {\n    await mkdir(dirname(path), { recursive: true })\n  }\n\n  public async copyFile(sourcePath: string, destinationPath: string): Promise<void> {\n    await copyFile(sourcePath, destinationPath)\n  }\n\n  public async write(path: string, data: string): Promise<void> {\n    // Make sure parent directories exist\n    await mkdir(dirname(path), { recursive: true })\n\n    return writeFile(path, data, { encoding: 'utf-8' })\n  }\n\n  public async read(path: string): Promise<string> {\n    return readFile(path, { encoding: 'utf-8' })\n  }\n\n  public async delete(path: string): Promise<void> {\n    await rm(path, { recursive: true, force: true })\n  }\n\n  public async downloadToFile(url: string, path: string, options: DownloadToFileOptions) {\n    const httpMethod = url.startsWith('https') ? https : http\n\n    // Make sure parent directories exist\n    await mkdir(dirname(path), { recursive: true })\n\n    const file = fs.createWriteStream(path)\n    const hash = options.verifyHash ? createHash('sha256') : undefined\n\n    return new Promise<void>((resolve, reject) => {\n      httpMethod\n        .get(url, (response) => {\n          // check if response is success\n          if (response.statusCode !== 200) {\n            reject(`Unable to download file from url: ${url}. Response status was ${response.statusCode}`)\n          }\n\n          hash && response.pipe(hash)\n          response.pipe(file)\n          file.on('finish', async () => {\n            file.close()\n\n            if (hash && options.verifyHash?.hash) {\n              hash.end()\n              const digest = hash.digest()\n              if (digest.compare(options.verifyHash.hash) !== 0) {\n                await fs.promises.unlink(path)\n\n                reject(\n                  new CredoError(\n                    `Hash of downloaded file does not match expected hash. Expected: ${\n                      options.verifyHash.hash\n                    }, Actual: ${TypedArrayEncoder.toUtf8String(digest)})}`\n                  )\n                )\n              }\n            }\n            resolve()\n          })\n        })\n        .on('error', async (error) => {\n          // Handle errors\n          await unlink(path) // Delete the file async. (But we don't check the result)\n          reject(`Unable to download file from url: ${url}. ${error.message}`)\n        })\n    })\n  }\n}\n"],"mappings":";;;;;;;;AASA,MAAM,EAAE,QAAQ,UAAU,WAAW,OAAO,IAAI,QAAQ,aAAa;AAErE,IAAa,iBAAb,MAAkD;;;;;;;;;;;CAehD,YAAmB,SAAoF;EACrG,KAAK,WAAW,SAAS,eAAe,GAAG,SAAS,aAAa,SAAS,GAAG,QAAQ,EAAE;EACvF,KAAK,YAAY,SAAS,gBAAgB,GAAG,SAAS,cAAc,SAAS,GAAG,QAAQ,EAAE;EAC1F,KAAK,WAAW,GAAG,SAAS,gBAAgB,OAAO,EAAE;CACvD;CAEA,MAAa,OAAO,MAAc;EAChC,IAAI;GACF,MAAM,OAAO,IAAI;GACjB,OAAO;EACT,QAAQ;GACN,OAAO;EACT;CACF;CAEA,MAAa,gBAAgB,MAA6B;EACxD,MAAM,MAAM,QAAQ,IAAI,GAAG,EAAE,WAAW,KAAK,CAAC;CAChD;CAEA,MAAa,SAAS,YAAoB,iBAAwC;EAChF,MAAM,SAAS,YAAY,eAAe;CAC5C;CAEA,MAAa,MAAM,MAAc,MAA6B;EAE5D,MAAM,MAAM,QAAQ,IAAI,GAAG,EAAE,WAAW,KAAK,CAAC;EAE9C,OAAO,UAAU,MAAM,MAAM,EAAE,UAAU,QAAQ,CAAC;CACpD;CAEA,MAAa,KAAK,MAA+B;EAC/C,OAAO,SAAS,MAAM,EAAE,UAAU,QAAQ,CAAC;CAC7C;CAEA,MAAa,OAAO,MAA6B;EAC/C,MAAM,GAAG,MAAM;GAAE,WAAW;GAAM,OAAO;EAAK,CAAC;CACjD;CAEA,MAAa,eAAe,KAAa,MAAc,SAAgC;EACrF,MAAM,aAAa,IAAI,WAAW,OAAO,IAAI,QAAQ;EAGrD,MAAM,MAAM,QAAQ,IAAI,GAAG,EAAE,WAAW,KAAK,CAAC;EAE9C,MAAM,OAAO,GAAG,kBAAkB,IAAI;EACtC,MAAM,OAAO,QAAQ,aAAa,WAAW,QAAQ,IAAI,KAAA;EAEzD,OAAO,IAAI,SAAe,SAAS,WAAW;GAC5C,WACG,IAAI,MAAM,aAAa;IAEtB,IAAI,SAAS,eAAe,KAC1B,OAAO,qCAAqC,IAAI,wBAAwB,SAAS,YAAY;IAG/F,QAAQ,SAAS,KAAK,IAAI;IAC1B,SAAS,KAAK,IAAI;IAClB,KAAK,GAAG,UAAU,YAAY;KAC5B,KAAK,MAAM;KAEX,IAAI,QAAQ,QAAQ,YAAY,MAAM;MACpC,KAAK,IAAI;MACT,MAAM,SAAS,KAAK,OAAO;MAC3B,IAAI,OAAO,QAAQ,QAAQ,WAAW,IAAI,MAAM,GAAG;OACjD,MAAM,GAAG,SAAS,OAAO,IAAI;OAE7B,OACE,IAAI,WACF,mEACE,QAAQ,WAAW,KACpB,YAAY,kBAAkB,aAAa,MAAM,EAAE,GACtD,CACF;MACF;KACF;KACA,QAAQ;IACV,CAAC;GACH,CAAC,CAAC,CACD,GAAG,SAAS,OAAO,UAAU;IAE5B,MAAM,OAAO,IAAI;IACjB,OAAO,qCAAqC,IAAI,IAAI,MAAM,SAAS;GACrE,CAAC;EACL,CAAC;CACH;AACF"}

package/build/_virtual/{_@oxc-project_runtime@0.112.0/helpers → _@oxc-project_runtime@0.151.0/helpers/esm}/assertClassBrand.mjs

@@ -1,8 +1,7 @@
-//#region \0@oxc-project+runtime@0.112.0/helpers/assertClassBrand.js
+//#region \0@oxc-project+runtime@0.151.0/helpers/esm/assertClassBrand.js
 function _assertClassBrand(e, t, n) {
 	if ("function" == typeof e ? e === t : e.has(t)) return arguments.length < 3 ? t : n;
 	throw new TypeError("Private element is not present on this object");
 }
-
 //#endregion
-export { _assertClassBrand };
+export { _assertClassBrand as default };

package/build/_virtual/{_@oxc-project_runtime@0.112.0/helpers → _@oxc-project_runtime@0.151.0/helpers/esm}/checkPrivateRedeclaration.mjs

@@ -1,7 +1,6 @@
-//#region \0@oxc-project+runtime@0.112.0/helpers/checkPrivateRedeclaration.js
+//#region \0@oxc-project+runtime@0.151.0/helpers/esm/checkPrivateRedeclaration.js
 function _checkPrivateRedeclaration(e, t) {
 	if (t.has(e)) throw new TypeError("Cannot initialize the same private elements twice on an object");
 }
-
 //#endregion
-export { _checkPrivateRedeclaration };
+export { _checkPrivateRedeclaration as default };

package/build/_virtual/_@oxc-project_runtime@0.151.0/helpers/esm/classPrivateFieldGet2.mjs

@@ -0,0 +1,7 @@
+import _assertClassBrand from "./assertClassBrand.mjs";
+//#region \0@oxc-project+runtime@0.151.0/helpers/esm/classPrivateFieldGet2.js
+function _classPrivateFieldGet2(s, a) {
+	return s.get(_assertClassBrand(s, a));
+}
+//#endregion
+export { _classPrivateFieldGet2 as default };

package/build/_virtual/_@oxc-project_runtime@0.151.0/helpers/esm/classPrivateFieldInitSpec.mjs

@@ -0,0 +1,7 @@
+import _checkPrivateRedeclaration from "./checkPrivateRedeclaration.mjs";
+//#region \0@oxc-project+runtime@0.151.0/helpers/esm/classPrivateFieldInitSpec.js
+function _classPrivateFieldInitSpec(e, t, a) {
+	_checkPrivateRedeclaration(e, t), t.set(e, a);
+}
+//#endregion
+export { _classPrivateFieldInitSpec as default };

package/build/_virtual/_@oxc-project_runtime@0.151.0/helpers/esm/classPrivateFieldSet2.mjs

@@ -0,0 +1,7 @@
+import _assertClassBrand from "./assertClassBrand.mjs";
+//#region \0@oxc-project+runtime@0.151.0/helpers/esm/classPrivateFieldSet2.js
+function _classPrivateFieldSet2(s, a, r) {
+	return s.set(_assertClassBrand(s, a), r), r;
+}
+//#endregion
+export { _classPrivateFieldSet2 as default };

package/build/index.d.mts

@@ -5,7 +5,6 @@ import { NodeKeyManagementStorage } from "./kms/NodeKeyManagementStorage.mjs";
 import { NodeInMemoryKeyManagementStorage } from "./kms/NodeInMemoryKeyManagementStorage.mjs";
 import { NodeKeyManagementService } from "./kms/NodeKeyManagementService.mjs";
 import { AgentDependencies } from "@credo-ts/core";
-
 //#region src/index.d.ts
 declare const agentDependencies: AgentDependencies;
 //#endregion

package/build/index.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.mts","names":[],"sources":["../src/index.ts"],"mappings":";;;;;;;;;cAaM,iBAAA,EAAmB,iBAAA"}
+{"version":3,"file":"index.d.mts","names":[],"sources":["../src/index.ts"],"mappings":";;;;;;;;cAaM,mBAAmB"}

package/build/index.mjs

@@ -4,16 +4,15 @@ import { DidCommWsInboundTransport } from "./transport/DidCommWsInboundTransport
 import { NodeInMemoryKeyManagementStorage } from "./kms/NodeInMemoryKeyManagementStorage.mjs";
 import { NodeKeyManagementService } from "./kms/NodeKeyManagementService.mjs";
 import { EventEmitter } from "events";
-import { WebSocket as WebSocket$1 } from "ws";
-
+import { WebSocket } from "ws";
 //#region src/index.ts
 const agentDependencies = {
 	FileSystem: NodeFileSystem,
 	fetch,
 	EventEmitterClass: EventEmitter,
-	WebSocketClass: WebSocket$1
+	WebSocketClass: WebSocket
 };
-
 //#endregion
 export { DidCommHttpInboundTransport, DidCommWsInboundTransport, NodeFileSystem, NodeInMemoryKeyManagementStorage, NodeKeyManagementService, agentDependencies };
+
 //# sourceMappingURL=index.mjs.map

package/build/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","names":["WebSocket"],"sources":["../src/index.ts"],"sourcesContent":["import type { AgentDependencies } from '@credo-ts/core'\n\nimport { EventEmitter } from 'events'\nimport { WebSocket } from 'ws'\n\nimport { NodeFileSystem } from './NodeFileSystem'\nimport { DidCommHttpInboundTransport } from './transport/DidCommHttpInboundTransport'\nimport { DidCommWsInboundTransport } from './transport/DidCommWsInboundTransport'\n\nexport { NodeInMemoryKeyManagementStorage } from './kms/NodeInMemoryKeyManagementStorage'\nexport { NodeKeyManagementService } from './kms/NodeKeyManagementService'\nexport type { NodeKeyManagementStorage } from './kms/NodeKeyManagementStorage'\n\nconst agentDependencies: AgentDependencies = {\n  FileSystem: NodeFileSystem,\n  fetch,\n  EventEmitterClass: EventEmitter,\n  WebSocketClass: WebSocket,\n}\n\nexport { agentDependencies, DidCommHttpInboundTransport, DidCommWsInboundTransport, NodeFileSystem }\n"],"mappings":";;;;;;;;;AAaA,MAAM,oBAAuC;CAC3C,YAAY;CACZ;CACA,mBAAmB;CACnB,gBAAgBA;CACjB"}
+{"version":3,"file":"index.mjs","names":[],"sources":["../src/index.ts"],"sourcesContent":["import type { AgentDependencies } from '@credo-ts/core'\n\nimport { EventEmitter } from 'events'\nimport { WebSocket } from 'ws'\n\nimport { NodeFileSystem } from './NodeFileSystem'\nimport { DidCommHttpInboundTransport } from './transport/DidCommHttpInboundTransport'\nimport { DidCommWsInboundTransport } from './transport/DidCommWsInboundTransport'\n\nexport { NodeInMemoryKeyManagementStorage } from './kms/NodeInMemoryKeyManagementStorage'\nexport { NodeKeyManagementService } from './kms/NodeKeyManagementService'\nexport type { NodeKeyManagementStorage } from './kms/NodeKeyManagementStorage'\n\nconst agentDependencies: AgentDependencies = {\n  FileSystem: NodeFileSystem,\n  fetch,\n  EventEmitterClass: EventEmitter,\n  WebSocketClass: WebSocket,\n}\n\nexport { agentDependencies, DidCommHttpInboundTransport, DidCommWsInboundTransport, NodeFileSystem }\n"],"mappings":";;;;;;;;AAaA,MAAM,oBAAuC;CAC3C,YAAY;CACZ;CACA,mBAAmB;CACnB,gBAAgB;AAClB"}

package/build/kms/NodeInMemoryKeyManagementStorage.d.mts

@@ -1,8 +1,7 @@
 import { NodeKeyManagementStorage } from "./NodeKeyManagementStorage.mjs";
 import { AgentContext, Kms } from "@credo-ts/core";
-
 //#region src/kms/NodeInMemoryKeyManagementStorage.d.ts
-declare class NodeInMemoryKeyManagementStorage implements NodeKeyManagementStorage {
+export declare class NodeInMemoryKeyManagementStorage implements NodeKeyManagementStorage {
   #private;
   get(agentContext: AgentContext, keyId: string): Promise<{
     d: string;
@@ -77,5 +76,4 @@ declare class NodeInMemoryKeyManagementStorage implements NodeKeyManagementStora
   private storageForContext;
 }
 //#endregion
-export { NodeInMemoryKeyManagementStorage };
 //# sourceMappingURL=NodeInMemoryKeyManagementStorage.d.mts.map

package/build/kms/NodeInMemoryKeyManagementStorage.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"NodeInMemoryKeyManagementStorage.d.mts","names":[],"sources":["../../src/kms/NodeInMemoryKeyManagementStorage.ts"],"mappings":";;;;cAGa,gCAAA,YAA4C,wBAAA;EAAA;EAG1C,GAAA,CAAI,YAAA,EAAc,YAAA,EAAc,KAAA,WAAa,OAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAInD,GAAA,CAAI,YAAA,EAAc,YAAA,EAAc,KAAA;EAIhC,GAAA,CAAI,YAAA,EAAc,YAAA,EAAc,KAAA,UAAe,GAAA,EAAK,GAAA,CAAI,aAAA;EAIxD,MAAA,CAAO,YAAA,EAAc,YAAA,EAAc,KAAA;EAAA,QAIlC,iBAAA;AAAA"}
+{"version":3,"file":"NodeInMemoryKeyManagementStorage.d.mts","names":[],"sources":["../../src/kms/NodeInMemoryKeyManagementStorage.ts"],"mappings":";;;qBAGa,4CAA4C;;EAG1C,IAAI,cAAc,cAAc,gBAAa;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAInD,IAAI,cAAc,cAAc;EAIhC,IAAI,cAAc,cAAc,eAAe,KAAK,IAAI;EAIxD,OAAO,cAAc,cAAc;UAIlC"}

package/build/kms/NodeInMemoryKeyManagementStorage.mjs

@@ -1,6 +1,5 @@
-import { _classPrivateFieldInitSpec } from "../_virtual/_@oxc-project_runtime@0.112.0/helpers/classPrivateFieldInitSpec.mjs";
-import { _classPrivateFieldGet2 } from "../_virtual/_@oxc-project_runtime@0.112.0/helpers/classPrivateFieldGet2.mjs";
-
+import _classPrivateFieldInitSpec from "../_virtual/_@oxc-project_runtime@0.151.0/helpers/esm/classPrivateFieldInitSpec.mjs";
+import _classPrivateFieldGet2 from "../_virtual/_@oxc-project_runtime@0.151.0/helpers/esm/classPrivateFieldGet2.mjs";
 //#region src/kms/NodeInMemoryKeyManagementStorage.ts
 var _storage = /* @__PURE__ */ new WeakMap();
 var NodeInMemoryKeyManagementStorage = class {
@@ -28,7 +27,7 @@ var NodeInMemoryKeyManagementStorage = class {
 		return storage;
 	}
 };
-
 //#endregion
 export { NodeInMemoryKeyManagementStorage };
+
 //# sourceMappingURL=NodeInMemoryKeyManagementStorage.mjs.map

package/build/kms/NodeInMemoryKeyManagementStorage.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"NodeInMemoryKeyManagementStorage.mjs","names":[],"sources":["../../src/kms/NodeInMemoryKeyManagementStorage.ts"],"sourcesContent":["import type { AgentContext, Kms } from '@credo-ts/core'\nimport type { NodeKeyManagementStorage } from './NodeKeyManagementStorage'\n\nexport class NodeInMemoryKeyManagementStorage implements NodeKeyManagementStorage {\n  #storage = new Map<string, Map<string, Kms.KmsJwkPrivate>>()\n\n  public async get(agentContext: AgentContext, keyId: string) {\n    return this.storageForContext(agentContext).get(keyId) ?? null\n  }\n\n  public has(agentContext: AgentContext, keyId: string) {\n    return this.storageForContext(agentContext).has(keyId)\n  }\n\n  public set(agentContext: AgentContext, keyId: string, jwk: Kms.KmsJwkPrivate) {\n    this.storageForContext(agentContext).set(keyId, jwk)\n  }\n\n  public delete(agentContext: AgentContext, keyId: string) {\n    return this.storageForContext(agentContext).delete(keyId)\n  }\n\n  private storageForContext(agentContext: AgentContext) {\n    let storage = this.#storage.get(agentContext.contextCorrelationId)\n\n    if (!storage) {\n      storage = new Map()\n      this.#storage.set(agentContext.contextCorrelationId, storage)\n    }\n\n    return storage\n  }\n}\n"],"mappings":";;;;;AAGA,IAAa,mCAAb,MAAkF;;6DACrE,IAAI,KAA6C;;CAE5D,MAAa,IAAI,cAA4B,OAAe;AAC1D,SAAO,KAAK,kBAAkB,aAAa,CAAC,IAAI,MAAM,IAAI;;CAG5D,AAAO,IAAI,cAA4B,OAAe;AACpD,SAAO,KAAK,kBAAkB,aAAa,CAAC,IAAI,MAAM;;CAGxD,AAAO,IAAI,cAA4B,OAAe,KAAwB;AAC5E,OAAK,kBAAkB,aAAa,CAAC,IAAI,OAAO,IAAI;;CAGtD,AAAO,OAAO,cAA4B,OAAe;AACvD,SAAO,KAAK,kBAAkB,aAAa,CAAC,OAAO,MAAM;;CAG3D,AAAQ,kBAAkB,cAA4B;EACpD,IAAI,2CAAU,KAAa,CAAC,IAAI,aAAa,qBAAqB;AAElE,MAAI,CAAC,SAAS;AACZ,6BAAU,IAAI,KAAK;AACnB,yCAAa,CAAC,IAAI,aAAa,sBAAsB,QAAQ;;AAG/D,SAAO"}
+{"version":3,"file":"NodeInMemoryKeyManagementStorage.mjs","names":[],"sources":["../../src/kms/NodeInMemoryKeyManagementStorage.ts"],"sourcesContent":["import type { AgentContext, Kms } from '@credo-ts/core'\nimport type { NodeKeyManagementStorage } from './NodeKeyManagementStorage'\n\nexport class NodeInMemoryKeyManagementStorage implements NodeKeyManagementStorage {\n  #storage = new Map<string, Map<string, Kms.KmsJwkPrivate>>()\n\n  public async get(agentContext: AgentContext, keyId: string) {\n    return this.storageForContext(agentContext).get(keyId) ?? null\n  }\n\n  public has(agentContext: AgentContext, keyId: string) {\n    return this.storageForContext(agentContext).has(keyId)\n  }\n\n  public set(agentContext: AgentContext, keyId: string, jwk: Kms.KmsJwkPrivate) {\n    this.storageForContext(agentContext).set(keyId, jwk)\n  }\n\n  public delete(agentContext: AgentContext, keyId: string) {\n    return this.storageForContext(agentContext).delete(keyId)\n  }\n\n  private storageForContext(agentContext: AgentContext) {\n    let storage = this.#storage.get(agentContext.contextCorrelationId)\n\n    if (!storage) {\n      storage = new Map()\n      this.#storage.set(agentContext.contextCorrelationId, storage)\n    }\n\n    return storage\n  }\n}\n"],"mappings":";;;;AAGA,IAAa,mCAAb,MAAkF;;EACrE,2BAAA,MAAA,0BAAA,IAAI,IAA4C,CAAA;;CAE3D,MAAa,IAAI,cAA4B,OAAe;EAC1D,OAAO,KAAK,kBAAkB,YAAY,CAAC,CAAC,IAAI,KAAK,KAAK;CAC5D;CAEA,IAAW,cAA4B,OAAe;EACpD,OAAO,KAAK,kBAAkB,YAAY,CAAC,CAAC,IAAI,KAAK;CACvD;CAEA,IAAW,cAA4B,OAAe,KAAwB;EAC5E,KAAK,kBAAkB,YAAY,CAAC,CAAC,IAAI,OAAO,GAAG;CACrD;CAEA,OAAc,cAA4B,OAAe;EACvD,OAAO,KAAK,kBAAkB,YAAY,CAAC,CAAC,OAAO,KAAK;CAC1D;CAEA,kBAA0B,cAA4B;EACpD,IAAI,UAAA,uBAAA,UAAU,IAAA,CAAA,CAAc,IAAI,aAAa,oBAAoB;EAEjE,IAAI,CAAC,SAAS;GACZ,0BAAU,IAAI,IAAI;GAClB,uBAAA,UAAA,IAAA,CAAA,CAAc,IAAI,aAAa,sBAAsB,OAAO;EAC9D;EAEA,OAAO;CACT;AACF"}

package/build/kms/NodeKeyManagementService.d.mts

@@ -1,8 +1,7 @@
 import { NodeKeyManagementStorage } from "./NodeKeyManagementStorage.mjs";
 import { AgentContext, Kms } from "@credo-ts/core";
-
 //#region src/kms/NodeKeyManagementService.d.ts
-declare class NodeKeyManagementService implements Kms.KeyManagementService {
+export declare class NodeKeyManagementService implements Kms.KeyManagementService {
   #private;
   readonly backend = "node";
   constructor(storage: NodeKeyManagementStorage);
@@ -20,5 +19,4 @@ declare class NodeKeyManagementService implements Kms.KeyManagementService {
   private assertKeyNotExists;
 }
 //#endregion
-export { NodeKeyManagementService };
 //# sourceMappingURL=NodeKeyManagementService.d.mts.map

package/build/kms/NodeKeyManagementService.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"NodeKeyManagementService.d.mts","names":[],"sources":["../../src/kms/NodeKeyManagementService.ts"],"mappings":";;;;cAmBa,wBAAA,YAAoC,GAAA,CAAI,oBAAA;EAAA;WACnC,OAAA;cAIG,OAAA,EAAS,wBAAA;EAIrB,oBAAA,CAAqB,aAAA,EAAe,YAAA,EAAc,SAAA,EAAW,GAAA,CAAI,YAAA;EAmFjE,WAAA,CAAY,aAAA,EAAe,YAAA,EAAc,OAAA,EAAS,GAAA,CAAI,qBAAA,GAAwB,GAAA,CAAI,oBAAA;EAI5E,YAAA,CAAa,YAAA,EAAc,YAAA,EAAc,KAAA,WAAgB,OAAA,CAAQ,GAAA,CAAI,YAAA;EAOrE,SAAA,aAAsB,GAAA,CAAI,aAAA,CAAA,CACrC,YAAA,EAAc,YAAA,EACd,OAAA,EAAS,GAAA,CAAI,mBAAA,CAAoB,GAAA,IAChC,OAAA,CAAQ,GAAA,CAAI,kBAAA,CAAmB,GAAA;EAyDrB,SAAA,CAAU,YAAA,EAAc,YAAA,EAAc,OAAA,EAAS,GAAA,CAAI,mBAAA,GAAsB,OAAA;EAIzE,SAAA,cAAuB,GAAA,CAAI,gBAAA,CAAA,CACtC,YAAA,EAAc,YAAA,EACd,OAAA,EAAS,GAAA,CAAI,mBAAA,CAAoB,IAAA,IAChC,OAAA,CAAQ,GAAA,CAAI,kBAAA,CAAmB,IAAA;EAuCrB,IAAA,CAAK,YAAA,EAAc,YAAA,EAAc,OAAA,EAAS,GAAA,CAAI,cAAA,GAAiB,OAAA,CAAQ,GAAA,CAAI,aAAA;EAwB3E,MAAA,CAAO,YAAA,EAAc,YAAA,EAAc,OAAA,EAAS,GAAA,CAAI,gBAAA,GAAmB,OAAA,CAAQ,GAAA,CAAI,eAAA;EA2C/E,OAAA,CAAQ,YAAA,EAAc,YAAA,EAAc,OAAA,EAAS,GAAA,CAAI,iBAAA,GAAoB,OAAA,CAAQ,GAAA,CAAI,gBAAA;EA4DjF,OAAA,CAAQ,YAAA,EAAc,YAAA,EAAc,OAAA,EAAS,GAAA,CAAI,iBAAA,GAAoB,OAAA,CAAQ,GAAA,CAAI,gBAAA;EAAA,QAqDhF,cAAA;EAAA,QASA,kBAAA;AAAA"}
+{"version":3,"file":"NodeKeyManagementService.d.mts","names":[],"sources":["../../src/kms/NodeKeyManagementService.ts"],"mappings":";;;qBAoBa,oCAAoC,IAAI;;WACnC;EAIG,YAAA,SAAS;EAIrB,qBAAqB,eAAe,cAAc,WAAW,IAAI;EAmGjE,YAAY,eAAe,cAAc,SAAS,IAAI,wBAAwB,IAAI;EAI5E,aAAa,cAAc,cAAc,gBAAgB,QAAQ,IAAI;EAOrE,UAAU,YAAY,IAAI,eACrC,cAAc,cACd,SAAS,IAAI,oBAAoB,OAChC,QAAQ,IAAI,mBAAmB;EAyDrB,UAAU,cAAc,cAAc,SAAS,IAAI,sBAAsB;EAIzE,UAAU,aAAa,IAAI,kBACtC,cAAc,cACd,SAAS,IAAI,oBAAoB,QAChC,QAAQ,IAAI,mBAAmB;EAuCrB,KAAK,cAAc,cAAc,SAAS,IAAI,iBAAiB,QAAQ,IAAI;EAwB3E,OAAO,cAAc,cAAc,SAAS,IAAI,mBAAmB,QAAQ,IAAI;EA2C/E,QAAQ,cAAc,cAAc,SAAS,IAAI,oBAAoB,QAAQ,IAAI;EAqFjF,QAAQ,cAAc,cAAc,SAAS,IAAI,oBAAoB,QAAQ,IAAI;UAoFhF;UASA"}

package/build/kms/NodeKeyManagementService.mjs

@@ -1,15 +1,15 @@
-import { _classPrivateFieldInitSpec } from "../_virtual/_@oxc-project_runtime@0.112.0/helpers/classPrivateFieldInitSpec.mjs";
-import { _classPrivateFieldGet2 } from "../_virtual/_@oxc-project_runtime@0.112.0/helpers/classPrivateFieldGet2.mjs";
+import _classPrivateFieldInitSpec from "../_virtual/_@oxc-project_runtime@0.151.0/helpers/esm/classPrivateFieldInitSpec.mjs";
+import _classPrivateFieldGet2 from "../_virtual/_@oxc-project_runtime@0.151.0/helpers/esm/classPrivateFieldGet2.mjs";
 import { assertNodeSupportedEcCrv, assertNodeSupportedOctAlgorithm, assertNodeSupportedOkpCrv, createEcKey, createOctKey, createOkpKey, createRsaKey } from "./crypto/createKey.mjs";
 import { nodeSupportedJwaAlgorithm, performSign } from "./crypto/sign.mjs";
 import { performDecrypt } from "./crypto/decrypt.mjs";
 import { deriveDecryptionKey, deriveEncryptionKey, nodeSupportedKeyAgreementAlgorithms } from "./crypto/deriveKey.mjs";
 import { nodeSupportedEncryptionAlgorithms, performEncrypt } from "./crypto/encrypt.mjs";
+import { hpkeOpen, hpkeSeal, nodeSupportedHpkeAlgorithms } from "./crypto/hpke.mjs";
 import { performVerify } from "./crypto/verify.mjs";
-import { _classPrivateFieldSet2 } from "../_virtual/_@oxc-project_runtime@0.112.0/helpers/classPrivateFieldSet2.mjs";
+import _classPrivateFieldSet2 from "../_virtual/_@oxc-project_runtime@0.151.0/helpers/esm/classPrivateFieldSet2.mjs";
 import { Kms, TypedArrayEncoder } from "@credo-ts/core";
 import { createPrivateKey, createSecretKey, randomBytes, randomUUID } from "node:crypto";
-
 //#region src/kms/NodeKeyManagementService.ts
 var _storage = /* @__PURE__ */ new WeakMap();
 var NodeKeyManagementService = class {
@@ -61,13 +61,22 @@ var NodeKeyManagementService = class {
 			return false;
 		}
 		if (operation.operation === "sign" || operation.operation === "verify") return nodeSupportedJwaAlgorithm.includes(operation.algorithm);
-		if (operation.operation === "encrypt") {
-			if (!nodeSupportedEncryptionAlgorithms.includes(operation.encryption.algorithm)) return false;
-			if (!operation.keyAgreement) return true;
-			return nodeSupportedKeyAgreementAlgorithms.includes(operation.keyAgreement.algorithm);
-		}
-		if (operation.operation === "decrypt") {
-			if (!nodeSupportedEncryptionAlgorithms.includes(operation.decryption.algorithm)) return false;
+		if (operation.operation === "encrypt" || operation.operation === "decrypt") {
+			const encryption = operation.operation === "encrypt" ? operation.encryption : operation.decryption;
+			if (operation.keyAgreement && "externalPublicJwk" in operation.keyAgreement && operation.keyAgreement.externalPublicJwk) {
+				const externalPublicJwk = operation.keyAgreement.externalPublicJwk;
+				try {
+					if (externalPublicJwk.kty === "EC") assertNodeSupportedEcCrv(externalPublicJwk);
+					else assertNodeSupportedOkpCrv(externalPublicJwk);
+				} catch {
+					return false;
+				}
+			}
+			if (encryption.algorithm === "HPKE") {
+				if (!operation.keyAgreement || !Kms.isJwaHpkeAlgorithm(operation.keyAgreement.algorithm)) return false;
+				return nodeSupportedHpkeAlgorithms.includes(operation.keyAgreement.algorithm);
+			}
+			if (!nodeSupportedEncryptionAlgorithms.includes(encryption.algorithm)) return false;
 			if (!operation.keyAgreement) return true;
 			return nodeSupportedKeyAgreementAlgorithms.includes(operation.keyAgreement.algorithm);
 		}
@@ -197,6 +206,24 @@ var NodeKeyManagementService = class {
 	}
 	async encrypt(agentContext, options) {
 		const { data, encryption, key } = options;
+		if (encryption.algorithm === "HPKE") {
+			if (!key.keyAgreement || !Kms.isKmsKeyAgreementEncryptHpke(key.keyAgreement)) throw new Kms.KeyManagementError(`Encryption algorithm 'HPKE' can only be used with an integrated-encryption HPKE key agreement algorithm`);
+			const { keyAgreement } = key;
+			Kms.assertAllowedKeyDerivationAlgForKey(keyAgreement.externalPublicJwk, keyAgreement.algorithm);
+			Kms.assertKeyAllowsDerive(keyAgreement.externalPublicJwk);
+			try {
+				return await hpkeSeal({
+					algorithm: keyAgreement.algorithm,
+					recipientPublicJwk: keyAgreement.externalPublicJwk,
+					data,
+					info: keyAgreement.info,
+					aad: encryption.aad
+				});
+			} catch (error) {
+				if (error instanceof Kms.KeyManagementError) throw error;
+				throw new Kms.KeyManagementError("Error encrypting", { cause: error });
+			}
+		}
 		Kms.assertSupportedEncryptionAlgorithm(encryption, nodeSupportedEncryptionAlgorithms, this.backend);
 		let encryptionKey;
 		let encryptedKey;
@@ -224,7 +251,7 @@ var NodeKeyManagementService = class {
 			Kms.assertAllowedEncryptionAlgForKey(encryptionKey, encryption.algorithm);
 			Kms.assertKeyAllowsEncrypt(encryptionKey);
 			return {
-				...await performEncrypt(encryptionKey, options.encryption, data),
+				...await performEncrypt(encryptionKey, encryption, data),
 				encryptedKey
 			};
 		} catch (error) {
@@ -234,6 +261,27 @@ var NodeKeyManagementService = class {
 	}
 	async decrypt(agentContext, options) {
 		const { decryption, encrypted, key } = options;
+		if (decryption.algorithm === "HPKE") {
+			if (!key.keyAgreement || !Kms.isKmsKeyAgreementDecryptHpke(key.keyAgreement)) throw new Kms.KeyManagementError(`Decryption algorithm 'HPKE' can only be used with an integrated-encryption HPKE key agreement algorithm`);
+			const { keyAgreement } = key;
+			const recipientPrivateJwk = await this.getKeyAsserted(agentContext, keyAgreement.keyId);
+			Kms.assertJwkAsymmetric(recipientPrivateJwk, keyAgreement.keyId);
+			Kms.assertAllowedKeyDerivationAlgForKey(recipientPrivateJwk, keyAgreement.algorithm);
+			Kms.assertKeyAllowsDerive(recipientPrivateJwk);
+			try {
+				return { data: await hpkeOpen({
+					algorithm: keyAgreement.algorithm,
+					recipientPrivateJwk,
+					encapsulatedKey: keyAgreement.encapsulatedKey,
+					encrypted,
+					info: keyAgreement.info,
+					aad: decryption.aad
+				}) };
+			} catch (error) {
+				if (error instanceof Kms.KeyManagementError) throw error;
+				throw new Kms.KeyManagementError("Error decrypting", { cause: error });
+			}
+		}
 		Kms.assertSupportedEncryptionAlgorithm(decryption, nodeSupportedEncryptionAlgorithms, this.backend);
 		let decryptionKey;
 		if (key.keyId) decryptionKey = await this.getKeyAsserted(agentContext, key.keyId);
@@ -273,7 +321,7 @@ var NodeKeyManagementService = class {
 		if (await _classPrivateFieldGet2(_storage, this).get(agentContext, keyId)) throw new Kms.KeyManagementKeyExistsError(keyId, this.backend);
 	}
 };
-
 //#endregion
 export { NodeKeyManagementService };
+
 //# sourceMappingURL=NodeKeyManagementService.mjs.map

package/build/kms/NodeKeyManagementService.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"NodeKeyManagementService.mjs","names":[],"sources":["../../src/kms/NodeKeyManagementService.ts"],"sourcesContent":["import { createPrivateKey, createSecretKey, randomBytes, randomUUID } from 'node:crypto'\nimport type { AgentContext } from '@credo-ts/core'\nimport { Kms, TypedArrayEncoder } from '@credo-ts/core'\nimport {\n  assertNodeSupportedEcCrv,\n  assertNodeSupportedOctAlgorithm,\n  assertNodeSupportedOkpCrv,\n  createEcKey,\n  createOctKey,\n  createOkpKey,\n  createRsaKey,\n} from './crypto/createKey'\nimport { performDecrypt } from './crypto/decrypt'\nimport { deriveDecryptionKey, deriveEncryptionKey, nodeSupportedKeyAgreementAlgorithms } from './crypto/deriveKey'\nimport { nodeSupportedEncryptionAlgorithms, performEncrypt } from './crypto/encrypt'\nimport { nodeSupportedJwaAlgorithm, performSign } from './crypto/sign'\nimport { performVerify } from './crypto/verify'\nimport type { NodeKeyManagementStorage } from './NodeKeyManagementStorage'\n\nexport class NodeKeyManagementService implements Kms.KeyManagementService {\n  public readonly backend = 'node'\n\n  #storage: NodeKeyManagementStorage\n\n  public constructor(storage: NodeKeyManagementStorage) {\n    this.#storage = storage\n  }\n\n  public isOperationSupported(_agentContext: AgentContext, operation: Kms.KmsOperation): boolean {\n    if (operation.operation === 'deleteKey') return true\n    if (operation.operation === 'randomBytes') return true\n\n    if (operation.operation === 'createKey') {\n      // TODO: probably clean to split the assert methods so we don't need try/catch here\n      try {\n        if (operation.type.kty === 'RSA') {\n          return true\n        }\n\n        if (operation.type.kty === 'EC') {\n          assertNodeSupportedEcCrv(operation.type)\n          return true\n        }\n\n        if (operation.type.kty === 'OKP') {\n          assertNodeSupportedOkpCrv(operation.type)\n          return true\n        }\n\n        if (operation.type.kty === 'oct') {\n          assertNodeSupportedOctAlgorithm(operation.type)\n          return true\n        }\n      } catch {\n        return false\n      }\n\n      return false\n    }\n\n    if (operation.operation === 'importKey') {\n      try {\n        if (operation.privateJwk.kty === 'RSA' || operation.privateJwk.kty === 'oct') {\n          return true\n        }\n\n        if (operation.privateJwk.kty === 'EC') {\n          assertNodeSupportedEcCrv({ kty: operation.privateJwk.kty, crv: operation.privateJwk.crv })\n          return true\n        }\n\n        if (operation.privateJwk.kty === 'OKP') {\n          assertNodeSupportedOkpCrv({ kty: operation.privateJwk.kty, crv: operation.privateJwk.crv })\n          return true\n        }\n      } catch {\n        return false\n      }\n    }\n\n    if (operation.operation === 'sign' || operation.operation === 'verify') {\n      return nodeSupportedJwaAlgorithm.includes(operation.algorithm)\n    }\n\n    if (operation.operation === 'encrypt') {\n      const isSupportedEncryptionAlgorithm = nodeSupportedEncryptionAlgorithms.includes(\n        operation.encryption.algorithm as (typeof nodeSupportedEncryptionAlgorithms)[number]\n      )\n      if (!isSupportedEncryptionAlgorithm) return false\n      if (!operation.keyAgreement) return true\n\n      return nodeSupportedKeyAgreementAlgorithms.includes(\n        operation.keyAgreement.algorithm as (typeof nodeSupportedKeyAgreementAlgorithms)[number]\n      )\n    }\n\n    if (operation.operation === 'decrypt') {\n      const isSupportedEncryptionAlgorithm = nodeSupportedEncryptionAlgorithms.includes(\n        operation.decryption.algorithm as (typeof nodeSupportedEncryptionAlgorithms)[number]\n      )\n      if (!isSupportedEncryptionAlgorithm) return false\n      if (!operation.keyAgreement) return true\n\n      return nodeSupportedKeyAgreementAlgorithms.includes(\n        operation.keyAgreement.algorithm as (typeof nodeSupportedKeyAgreementAlgorithms)[number]\n      )\n    }\n\n    return false\n  }\n\n  public randomBytes(_agentContext: AgentContext, options: Kms.KmsRandomBytesOptions): Kms.KmsRandomBytesReturn {\n    return randomBytes(options.length)\n  }\n\n  public async getPublicKey(agentContext: AgentContext, keyId: string): Promise<Kms.KmsJwkPublic | null> {\n    const privateJwk = await this.#storage.get(agentContext, keyId)\n    if (!privateJwk) return null\n\n    return Kms.publicJwkFromPrivateJwk(privateJwk)\n  }\n\n  public async importKey<Jwk extends Kms.KmsJwkPrivate>(\n    agentContext: AgentContext,\n    options: Kms.KmsImportKeyOptions<Jwk>\n  ): Promise<Kms.KmsImportKeyReturn<Jwk>> {\n    const { kid } = options.privateJwk\n\n    if (kid) await this.assertKeyNotExists(agentContext, kid)\n\n    const privateJwk = {\n      ...options.privateJwk,\n      kid: kid ?? randomUUID(),\n    }\n\n    try {\n      if (privateJwk.kty === 'oct') {\n        // Just check if we can create a secret key instance\n        createSecretKey(TypedArrayEncoder.fromBase64Url(privateJwk.k)).export({ format: 'jwk' })\n      } else if (privateJwk.kty === 'EC') {\n        assertNodeSupportedEcCrv({ kty: privateJwk.kty, crv: privateJwk.crv })\n        // This validates the JWK\n        createPrivateKey({\n          format: 'jwk',\n          key: privateJwk,\n        })\n      } else if (privateJwk.kty === 'OKP') {\n        assertNodeSupportedOkpCrv({ kty: privateJwk.kty, crv: privateJwk.crv })\n        // This validates the JWK\n        createPrivateKey({\n          format: 'jwk',\n          key: privateJwk,\n        })\n      } else if (privateJwk.kty === 'RSA') {\n        // This validates the JWK\n        createPrivateKey({\n          format: 'jwk',\n          key: privateJwk,\n        })\n      } else {\n        // All kty values supported for now, but can change in the future\n        // @ts-expect-error\n        throw new Kms.KeyManagementAlgorithmNotSupportedError(`kty '${privateJwk.kty}'`, this.backend)\n      }\n\n      await this.#storage.set(agentContext, privateJwk.kid, privateJwk)\n      const publicJwk = Kms.publicJwkFromPrivateJwk(privateJwk)\n\n      return {\n        keyId: privateJwk.kid,\n        publicJwk: {\n          ...publicJwk,\n          kid: privateJwk.kid,\n        },\n      } as Kms.KmsImportKeyReturn<Jwk>\n    } catch (error) {\n      if (error instanceof Kms.KeyManagementError) throw error\n\n      throw new Kms.KeyManagementError('Error importing key', { cause: error })\n    }\n  }\n\n  public async deleteKey(agentContext: AgentContext, options: Kms.KmsDeleteKeyOptions): Promise<boolean> {\n    return await this.#storage.delete(agentContext, options.keyId)\n  }\n\n  public async createKey<Type extends Kms.KmsCreateKeyType>(\n    agentContext: AgentContext,\n    options: Kms.KmsCreateKeyOptions<Type>\n  ): Promise<Kms.KmsCreateKeyReturn<Type>> {\n    const { type, keyId } = options\n\n    if (keyId) await this.assertKeyNotExists(agentContext, keyId)\n\n    try {\n      let jwks: { publicJwk: Kms.KmsJwkPublic; privateJwk: Kms.KmsJwkPrivate }\n      if (type.kty === 'EC') {\n        assertNodeSupportedEcCrv(type)\n        jwks = await createEcKey(type)\n      } else if (type.kty === 'OKP') {\n        assertNodeSupportedOkpCrv(type)\n        jwks = await createOkpKey(type)\n      } else if (type.kty === 'RSA') {\n        jwks = await createRsaKey(type)\n      } else if (type.kty === 'oct') {\n        assertNodeSupportedOctAlgorithm(type)\n        jwks = await createOctKey(type)\n      } else {\n        // @ts-expect-error\n        throw new Kms.KeyManagementAlgorithmNotSupportedError(`kty '${type.kty}'`, this.backend)\n      }\n\n      jwks.privateJwk.kid = keyId ?? randomUUID()\n      jwks.publicJwk.kid = jwks.privateJwk.kid\n\n      await this.#storage.set(agentContext, jwks.privateJwk.kid, jwks.privateJwk)\n\n      return {\n        publicJwk: jwks.publicJwk as Kms.KmsCreateKeyReturn<Type>['publicJwk'],\n        keyId: jwks.publicJwk.kid,\n      }\n    } catch (error) {\n      if (error instanceof Kms.KeyManagementError) throw error\n\n      throw new Kms.KeyManagementError('Error creating key', { cause: error })\n    }\n  }\n\n  public async sign(agentContext: AgentContext, options: Kms.KmsSignOptions): Promise<Kms.KmsSignReturn> {\n    const { keyId, algorithm, data } = options\n\n    // 1. Retrieve the key\n    const key = await this.getKeyAsserted(agentContext, keyId)\n\n    try {\n      // 2. Validate alg and use for key\n      Kms.assertAllowedSigningAlgForKey(key, algorithm)\n      Kms.assertKeyAllowsSign(key)\n\n      // 3. Perform the signing operation\n      const signature = await performSign(key, algorithm, data)\n\n      return {\n        signature,\n      }\n    } catch (error) {\n      if (error instanceof Kms.KeyManagementError) throw error\n\n      throw new Kms.KeyManagementError('Error signing with key', { cause: error })\n    }\n  }\n\n  public async verify(agentContext: AgentContext, options: Kms.KmsVerifyOptions): Promise<Kms.KmsVerifyReturn> {\n    const { algorithm, data, signature } = options\n\n    try {\n      let key: Exclude<Kms.KmsJwkPublic, Kms.KmsJwkPublicOct> | Kms.KmsJwkPrivate\n      if (options.key.keyId) {\n        key = await this.getKeyAsserted(agentContext, options.key.keyId)\n      } else if (options.key.publicJwk?.kty === 'EC') {\n        assertNodeSupportedEcCrv(options.key.publicJwk)\n        key = options.key.publicJwk\n      } else if (options.key.publicJwk?.kty === 'OKP') {\n        assertNodeSupportedOkpCrv(options.key.publicJwk)\n        key = options.key.publicJwk\n      } else if (options.key.publicJwk?.kty === 'RSA') {\n        key = options.key.publicJwk\n      } else {\n        // @ts-expect-error\n        throw new Kms.KeyManagementAlgorithmNotSupportedError(`kty ${options.key.kty}`, this.backend)\n      }\n\n      // 2. Validate alg and use for key\n      Kms.assertAllowedSigningAlgForKey(key, algorithm)\n      Kms.assertKeyAllowsVerify(key)\n\n      // 3. Perform the verify operation\n      const verified = await performVerify(key, algorithm, data, signature)\n      if (verified) {\n        return {\n          verified: true,\n          publicJwk: Kms.publicJwkFromPrivateJwk(key),\n        }\n      }\n\n      return {\n        verified: false,\n      }\n    } catch (error) {\n      if (error instanceof Kms.KeyManagementError) throw error\n\n      throw new Kms.KeyManagementError('Error verifying with key', { cause: error })\n    }\n  }\n\n  public async encrypt(agentContext: AgentContext, options: Kms.KmsEncryptOptions): Promise<Kms.KmsEncryptReturn> {\n    const { data, encryption, key } = options\n\n    Kms.assertSupportedEncryptionAlgorithm(encryption, nodeSupportedEncryptionAlgorithms, this.backend)\n\n    let encryptionKey: Kms.KmsJwkPrivate\n    let encryptedKey: Kms.KmsEncryptedKey | undefined\n\n    if (key.keyId) {\n      encryptionKey = await this.getKeyAsserted(agentContext, key.keyId)\n    } else if (key.privateJwk) {\n      encryptionKey = key.privateJwk\n    } else if (key.keyAgreement) {\n      Kms.assertAllowedKeyDerivationAlgForKey(key.keyAgreement.externalPublicJwk, key.keyAgreement.algorithm)\n      Kms.assertKeyAllowsDerive(key.keyAgreement.externalPublicJwk)\n      Kms.assertSupportedKeyAgreementAlgorithm(key.keyAgreement, nodeSupportedKeyAgreementAlgorithms, this.backend)\n\n      const privateJwk = await this.getKeyAsserted(agentContext, key.keyAgreement.keyId)\n      Kms.assertJwkAsymmetric(privateJwk, key.keyAgreement.keyId)\n      Kms.assertAllowedKeyDerivationAlgForKey(privateJwk, key.keyAgreement.algorithm)\n      Kms.assertKeyAllowsDerive(privateJwk)\n      Kms.assertAsymmetricJwkKeyTypeMatches(privateJwk, key.keyAgreement.externalPublicJwk)\n\n      const { contentEncryptionKey, encryptedContentEncryptionKey } = await deriveEncryptionKey({\n        keyAgreement: key.keyAgreement,\n        encryption,\n        privateJwk,\n      })\n\n      encryptionKey = contentEncryptionKey\n      encryptedKey = encryptedContentEncryptionKey\n    } else {\n      throw new Kms.KeyManagementError('Unexpected key parameter for encrypt')\n    }\n\n    if (encryptionKey.kty !== 'oct') {\n      throw new Kms.KeyManagementAlgorithmNotSupportedError(\n        `kty '${encryptionKey.kty} for content encryption'`,\n        this.backend\n      )\n    }\n\n    try {\n      // 2. Validate alg and use for key\n      Kms.assertAllowedEncryptionAlgForKey(encryptionKey, encryption.algorithm)\n      Kms.assertKeyAllowsEncrypt(encryptionKey)\n\n      // 3. Perform the encryption operation\n      const encrypted = await performEncrypt(encryptionKey, options.encryption, data)\n      return {\n        ...encrypted,\n        encryptedKey,\n      }\n    } catch (error) {\n      if (error instanceof Kms.KeyManagementError) throw error\n\n      throw new Kms.KeyManagementError('Error encrypting', { cause: error })\n    }\n  }\n\n  public async decrypt(agentContext: AgentContext, options: Kms.KmsDecryptOptions): Promise<Kms.KmsDecryptReturn> {\n    const { decryption, encrypted, key } = options\n\n    Kms.assertSupportedEncryptionAlgorithm(decryption, nodeSupportedEncryptionAlgorithms, this.backend)\n\n    let decryptionKey: Kms.KmsJwkPrivate\n    if (key.keyId) {\n      decryptionKey = await this.getKeyAsserted(agentContext, key.keyId)\n    } else if (key.privateJwk) {\n      decryptionKey = key.privateJwk\n    } else if (key.keyAgreement) {\n      Kms.assertSupportedKeyAgreementAlgorithm(key.keyAgreement, nodeSupportedKeyAgreementAlgorithms, this.backend)\n      Kms.assertAllowedKeyDerivationAlgForKey(key.keyAgreement.externalPublicJwk, key.keyAgreement.algorithm)\n      Kms.assertKeyAllowsDerive(key.keyAgreement.externalPublicJwk)\n\n      const privateJwk = await this.getKeyAsserted(agentContext, key.keyAgreement.keyId)\n      Kms.assertJwkAsymmetric(privateJwk, key.keyAgreement.keyId)\n      Kms.assertAllowedKeyDerivationAlgForKey(privateJwk, key.keyAgreement.algorithm)\n      Kms.assertKeyAllowsDerive(privateJwk)\n      Kms.assertAsymmetricJwkKeyTypeMatches(privateJwk, key.keyAgreement.externalPublicJwk)\n\n      const { contentEncryptionKey } = await deriveDecryptionKey({\n        keyAgreement: key.keyAgreement,\n        decryption,\n        privateJwk,\n      })\n\n      decryptionKey = contentEncryptionKey\n    } else {\n      throw new Kms.KeyManagementError('Unexpected key parameter for decrypt')\n    }\n\n    if (decryptionKey.kty !== 'oct') {\n      throw new Kms.KeyManagementAlgorithmNotSupportedError(\n        `kty '${decryptionKey.kty}' for content encryption`,\n        this.backend\n      )\n    }\n\n    try {\n      // 2. Validate alg and use for key\n      Kms.assertAllowedEncryptionAlgForKey(decryptionKey, decryption.algorithm)\n      Kms.assertKeyAllowsEncrypt(decryptionKey)\n\n      // 3. Perform the decryption operation\n      return await performDecrypt(decryptionKey, decryption, encrypted)\n    } catch (error) {\n      if (error instanceof Kms.KeyManagementError) throw error\n\n      throw new Kms.KeyManagementError('Error decrypting', { cause: error })\n    }\n  }\n\n  private async getKeyAsserted(agentContext: AgentContext, keyId: string) {\n    const storageKey = await this.#storage.get(agentContext, keyId)\n    if (!storageKey) {\n      throw new Kms.KeyManagementKeyNotFoundError(keyId, [this.backend])\n    }\n\n    return storageKey\n  }\n\n  private async assertKeyNotExists(agentContext: AgentContext, keyId: string) {\n    const storageKey = await this.#storage.get(agentContext, keyId)\n\n    if (storageKey) {\n      throw new Kms.KeyManagementKeyExistsError(keyId, this.backend)\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;AAmBA,IAAa,2BAAb,MAA0E;CAKxE,AAAO,YAAY,SAAmC;OAJtC,UAAU;;AAKxB,yCAAgB,QAAO;;CAGzB,AAAO,qBAAqB,eAA6B,WAAsC;AAC7F,MAAI,UAAU,cAAc,YAAa,QAAO;AAChD,MAAI,UAAU,cAAc,cAAe,QAAO;AAElD,MAAI,UAAU,cAAc,aAAa;AAEvC,OAAI;AACF,QAAI,UAAU,KAAK,QAAQ,MACzB,QAAO;AAGT,QAAI,UAAU,KAAK,QAAQ,MAAM;AAC/B,8BAAyB,UAAU,KAAK;AACxC,YAAO;;AAGT,QAAI,UAAU,KAAK,QAAQ,OAAO;AAChC,+BAA0B,UAAU,KAAK;AACzC,YAAO;;AAGT,QAAI,UAAU,KAAK,QAAQ,OAAO;AAChC,qCAAgC,UAAU,KAAK;AAC/C,YAAO;;WAEH;AACN,WAAO;;AAGT,UAAO;;AAGT,MAAI,UAAU,cAAc,YAC1B,KAAI;AACF,OAAI,UAAU,WAAW,QAAQ,SAAS,UAAU,WAAW,QAAQ,MACrE,QAAO;AAGT,OAAI,UAAU,WAAW,QAAQ,MAAM;AACrC,6BAAyB;KAAE,KAAK,UAAU,WAAW;KAAK,KAAK,UAAU,WAAW;KAAK,CAAC;AAC1F,WAAO;;AAGT,OAAI,UAAU,WAAW,QAAQ,OAAO;AACtC,8BAA0B;KAAE,KAAK,UAAU,WAAW;KAAK,KAAK,UAAU,WAAW;KAAK,CAAC;AAC3F,WAAO;;UAEH;AACN,UAAO;;AAIX,MAAI,UAAU,cAAc,UAAU,UAAU,cAAc,SAC5D,QAAO,0BAA0B,SAAS,UAAU,UAAU;AAGhE,MAAI,UAAU,cAAc,WAAW;AAIrC,OAAI,CAHmC,kCAAkC,SACvE,UAAU,WAAW,UACtB,CACoC,QAAO;AAC5C,OAAI,CAAC,UAAU,aAAc,QAAO;AAEpC,UAAO,oCAAoC,SACzC,UAAU,aAAa,UACxB;;AAGH,MAAI,UAAU,cAAc,WAAW;AAIrC,OAAI,CAHmC,kCAAkC,SACvE,UAAU,WAAW,UACtB,CACoC,QAAO;AAC5C,OAAI,CAAC,UAAU,aAAc,QAAO;AAEpC,UAAO,oCAAoC,SACzC,UAAU,aAAa,UACxB;;AAGH,SAAO;;CAGT,AAAO,YAAY,eAA6B,SAA8D;AAC5G,SAAO,YAAY,QAAQ,OAAO;;CAGpC,MAAa,aAAa,cAA4B,OAAiD;EACrG,MAAM,aAAa,uCAAM,KAAa,CAAC,IAAI,cAAc,MAAM;AAC/D,MAAI,CAAC,WAAY,QAAO;AAExB,SAAO,IAAI,wBAAwB,WAAW;;CAGhD,MAAa,UACX,cACA,SACsC;EACtC,MAAM,EAAE,QAAQ,QAAQ;AAExB,MAAI,IAAK,OAAM,KAAK,mBAAmB,cAAc,IAAI;EAEzD,MAAM,aAAa;GACjB,GAAG,QAAQ;GACX,KAAK,OAAO,YAAY;GACzB;AAED,MAAI;AACF,OAAI,WAAW,QAAQ,MAErB,iBAAgB,kBAAkB,cAAc,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,QAAQ,OAAO,CAAC;YAC/E,WAAW,QAAQ,MAAM;AAClC,6BAAyB;KAAE,KAAK,WAAW;KAAK,KAAK,WAAW;KAAK,CAAC;AAEtE,qBAAiB;KACf,QAAQ;KACR,KAAK;KACN,CAAC;cACO,WAAW,QAAQ,OAAO;AACnC,8BAA0B;KAAE,KAAK,WAAW;KAAK,KAAK,WAAW;KAAK,CAAC;AAEvE,qBAAiB;KACf,QAAQ;KACR,KAAK;KACN,CAAC;cACO,WAAW,QAAQ,MAE5B,kBAAiB;IACf,QAAQ;IACR,KAAK;IACN,CAAC;OAIF,OAAM,IAAI,IAAI,wCAAwC,QAAQ,WAAW,IAAI,IAAI,KAAK,QAAQ;AAGhG,0CAAM,KAAa,CAAC,IAAI,cAAc,WAAW,KAAK,WAAW;GACjE,MAAM,YAAY,IAAI,wBAAwB,WAAW;AAEzD,UAAO;IACL,OAAO,WAAW;IAClB,WAAW;KACT,GAAG;KACH,KAAK,WAAW;KACjB;IACF;WACM,OAAO;AACd,OAAI,iBAAiB,IAAI,mBAAoB,OAAM;AAEnD,SAAM,IAAI,IAAI,mBAAmB,uBAAuB,EAAE,OAAO,OAAO,CAAC;;;CAI7E,MAAa,UAAU,cAA4B,SAAoD;AACrG,SAAO,uCAAM,KAAa,CAAC,OAAO,cAAc,QAAQ,MAAM;;CAGhE,MAAa,UACX,cACA,SACuC;EACvC,MAAM,EAAE,MAAM,UAAU;AAExB,MAAI,MAAO,OAAM,KAAK,mBAAmB,cAAc,MAAM;AAE7D,MAAI;GACF,IAAI;AACJ,OAAI,KAAK,QAAQ,MAAM;AACrB,6BAAyB,KAAK;AAC9B,WAAO,MAAM,YAAY,KAAK;cACrB,KAAK,QAAQ,OAAO;AAC7B,8BAA0B,KAAK;AAC/B,WAAO,MAAM,aAAa,KAAK;cACtB,KAAK,QAAQ,MACtB,QAAO,MAAM,aAAa,KAAK;YACtB,KAAK,QAAQ,OAAO;AAC7B,oCAAgC,KAAK;AACrC,WAAO,MAAM,aAAa,KAAK;SAG/B,OAAM,IAAI,IAAI,wCAAwC,QAAQ,KAAK,IAAI,IAAI,KAAK,QAAQ;AAG1F,QAAK,WAAW,MAAM,SAAS,YAAY;AAC3C,QAAK,UAAU,MAAM,KAAK,WAAW;AAErC,0CAAM,KAAa,CAAC,IAAI,cAAc,KAAK,WAAW,KAAK,KAAK,WAAW;AAE3E,UAAO;IACL,WAAW,KAAK;IAChB,OAAO,KAAK,UAAU;IACvB;WACM,OAAO;AACd,OAAI,iBAAiB,IAAI,mBAAoB,OAAM;AAEnD,SAAM,IAAI,IAAI,mBAAmB,sBAAsB,EAAE,OAAO,OAAO,CAAC;;;CAI5E,MAAa,KAAK,cAA4B,SAAyD;EACrG,MAAM,EAAE,OAAO,WAAW,SAAS;EAGnC,MAAM,MAAM,MAAM,KAAK,eAAe,cAAc,MAAM;AAE1D,MAAI;AAEF,OAAI,8BAA8B,KAAK,UAAU;AACjD,OAAI,oBAAoB,IAAI;AAK5B,UAAO,EACL,WAHgB,MAAM,YAAY,KAAK,WAAW,KAAK,EAIxD;WACM,OAAO;AACd,OAAI,iBAAiB,IAAI,mBAAoB,OAAM;AAEnD,SAAM,IAAI,IAAI,mBAAmB,0BAA0B,EAAE,OAAO,OAAO,CAAC;;;CAIhF,MAAa,OAAO,cAA4B,SAA6D;EAC3G,MAAM,EAAE,WAAW,MAAM,cAAc;AAEvC,MAAI;GACF,IAAI;AACJ,OAAI,QAAQ,IAAI,MACd,OAAM,MAAM,KAAK,eAAe,cAAc,QAAQ,IAAI,MAAM;YACvD,QAAQ,IAAI,WAAW,QAAQ,MAAM;AAC9C,6BAAyB,QAAQ,IAAI,UAAU;AAC/C,UAAM,QAAQ,IAAI;cACT,QAAQ,IAAI,WAAW,QAAQ,OAAO;AAC/C,8BAA0B,QAAQ,IAAI,UAAU;AAChD,UAAM,QAAQ,IAAI;cACT,QAAQ,IAAI,WAAW,QAAQ,MACxC,OAAM,QAAQ,IAAI;OAGlB,OAAM,IAAI,IAAI,wCAAwC,OAAO,QAAQ,IAAI,OAAO,KAAK,QAAQ;AAI/F,OAAI,8BAA8B,KAAK,UAAU;AACjD,OAAI,sBAAsB,IAAI;AAI9B,OADiB,MAAM,cAAc,KAAK,WAAW,MAAM,UAAU,CAEnE,QAAO;IACL,UAAU;IACV,WAAW,IAAI,wBAAwB,IAAI;IAC5C;AAGH,UAAO,EACL,UAAU,OACX;WACM,OAAO;AACd,OAAI,iBAAiB,IAAI,mBAAoB,OAAM;AAEnD,SAAM,IAAI,IAAI,mBAAmB,4BAA4B,EAAE,OAAO,OAAO,CAAC;;;CAIlF,MAAa,QAAQ,cAA4B,SAA+D;EAC9G,MAAM,EAAE,MAAM,YAAY,QAAQ;AAElC,MAAI,mCAAmC,YAAY,mCAAmC,KAAK,QAAQ;EAEnG,IAAI;EACJ,IAAI;AAEJ,MAAI,IAAI,MACN,iBAAgB,MAAM,KAAK,eAAe,cAAc,IAAI,MAAM;WACzD,IAAI,WACb,iBAAgB,IAAI;WACX,IAAI,cAAc;AAC3B,OAAI,oCAAoC,IAAI,aAAa,mBAAmB,IAAI,aAAa,UAAU;AACvG,OAAI,sBAAsB,IAAI,aAAa,kBAAkB;AAC7D,OAAI,qCAAqC,IAAI,cAAc,qCAAqC,KAAK,QAAQ;GAE7G,MAAM,aAAa,MAAM,KAAK,eAAe,cAAc,IAAI,aAAa,MAAM;AAClF,OAAI,oBAAoB,YAAY,IAAI,aAAa,MAAM;AAC3D,OAAI,oCAAoC,YAAY,IAAI,aAAa,UAAU;AAC/E,OAAI,sBAAsB,WAAW;AACrC,OAAI,kCAAkC,YAAY,IAAI,aAAa,kBAAkB;GAErF,MAAM,EAAE,sBAAsB,kCAAkC,MAAM,oBAAoB;IACxF,cAAc,IAAI;IAClB;IACA;IACD,CAAC;AAEF,mBAAgB;AAChB,kBAAe;QAEf,OAAM,IAAI,IAAI,mBAAmB,uCAAuC;AAG1E,MAAI,cAAc,QAAQ,MACxB,OAAM,IAAI,IAAI,wCACZ,QAAQ,cAAc,IAAI,2BAC1B,KAAK,QACN;AAGH,MAAI;AAEF,OAAI,iCAAiC,eAAe,WAAW,UAAU;AACzE,OAAI,uBAAuB,cAAc;AAIzC,UAAO;IACL,GAFgB,MAAM,eAAe,eAAe,QAAQ,YAAY,KAAK;IAG7E;IACD;WACM,OAAO;AACd,OAAI,iBAAiB,IAAI,mBAAoB,OAAM;AAEnD,SAAM,IAAI,IAAI,mBAAmB,oBAAoB,EAAE,OAAO,OAAO,CAAC;;;CAI1E,MAAa,QAAQ,cAA4B,SAA+D;EAC9G,MAAM,EAAE,YAAY,WAAW,QAAQ;AAEvC,MAAI,mCAAmC,YAAY,mCAAmC,KAAK,QAAQ;EAEnG,IAAI;AACJ,MAAI,IAAI,MACN,iBAAgB,MAAM,KAAK,eAAe,cAAc,IAAI,MAAM;WACzD,IAAI,WACb,iBAAgB,IAAI;WACX,IAAI,cAAc;AAC3B,OAAI,qCAAqC,IAAI,cAAc,qCAAqC,KAAK,QAAQ;AAC7G,OAAI,oCAAoC,IAAI,aAAa,mBAAmB,IAAI,aAAa,UAAU;AACvG,OAAI,sBAAsB,IAAI,aAAa,kBAAkB;GAE7D,MAAM,aAAa,MAAM,KAAK,eAAe,cAAc,IAAI,aAAa,MAAM;AAClF,OAAI,oBAAoB,YAAY,IAAI,aAAa,MAAM;AAC3D,OAAI,oCAAoC,YAAY,IAAI,aAAa,UAAU;AAC/E,OAAI,sBAAsB,WAAW;AACrC,OAAI,kCAAkC,YAAY,IAAI,aAAa,kBAAkB;GAErF,MAAM,EAAE,yBAAyB,MAAM,oBAAoB;IACzD,cAAc,IAAI;IAClB;IACA;IACD,CAAC;AAEF,mBAAgB;QAEhB,OAAM,IAAI,IAAI,mBAAmB,uCAAuC;AAG1E,MAAI,cAAc,QAAQ,MACxB,OAAM,IAAI,IAAI,wCACZ,QAAQ,cAAc,IAAI,2BAC1B,KAAK,QACN;AAGH,MAAI;AAEF,OAAI,iCAAiC,eAAe,WAAW,UAAU;AACzE,OAAI,uBAAuB,cAAc;AAGzC,UAAO,MAAM,eAAe,eAAe,YAAY,UAAU;WAC1D,OAAO;AACd,OAAI,iBAAiB,IAAI,mBAAoB,OAAM;AAEnD,SAAM,IAAI,IAAI,mBAAmB,oBAAoB,EAAE,OAAO,OAAO,CAAC;;;CAI1E,MAAc,eAAe,cAA4B,OAAe;EACtE,MAAM,aAAa,uCAAM,KAAa,CAAC,IAAI,cAAc,MAAM;AAC/D,MAAI,CAAC,WACH,OAAM,IAAI,IAAI,8BAA8B,OAAO,CAAC,KAAK,QAAQ,CAAC;AAGpE,SAAO;;CAGT,MAAc,mBAAmB,cAA4B,OAAe;AAG1E,MAFmB,uCAAM,KAAa,CAAC,IAAI,cAAc,MAAM,CAG7D,OAAM,IAAI,IAAI,4BAA4B,OAAO,KAAK,QAAQ"}
+{"version":3,"file":"NodeKeyManagementService.mjs","names":[],"sources":["../../src/kms/NodeKeyManagementService.ts"],"sourcesContent":["import { createPrivateKey, createSecretKey, randomBytes, randomUUID } from 'node:crypto'\nimport type { AgentContext } from '@credo-ts/core'\nimport { Kms, TypedArrayEncoder } from '@credo-ts/core'\nimport {\n  assertNodeSupportedEcCrv,\n  assertNodeSupportedOctAlgorithm,\n  assertNodeSupportedOkpCrv,\n  createEcKey,\n  createOctKey,\n  createOkpKey,\n  createRsaKey,\n} from './crypto/createKey'\nimport { performDecrypt } from './crypto/decrypt'\nimport { deriveDecryptionKey, deriveEncryptionKey, nodeSupportedKeyAgreementAlgorithms } from './crypto/deriveKey'\nimport { nodeSupportedEncryptionAlgorithms, performEncrypt } from './crypto/encrypt'\nimport { hpkeOpen, hpkeSeal, nodeSupportedHpkeAlgorithms } from './crypto/hpke'\nimport { nodeSupportedJwaAlgorithm, performSign } from './crypto/sign'\nimport { performVerify } from './crypto/verify'\nimport type { NodeKeyManagementStorage } from './NodeKeyManagementStorage'\n\nexport class NodeKeyManagementService implements Kms.KeyManagementService {\n  public readonly backend = 'node'\n\n  #storage: NodeKeyManagementStorage\n\n  public constructor(storage: NodeKeyManagementStorage) {\n    this.#storage = storage\n  }\n\n  public isOperationSupported(_agentContext: AgentContext, operation: Kms.KmsOperation): boolean {\n    if (operation.operation === 'deleteKey') return true\n    if (operation.operation === 'randomBytes') return true\n\n    if (operation.operation === 'createKey') {\n      // TODO: probably clean to split the assert methods so we don't need try/catch here\n      try {\n        if (operation.type.kty === 'RSA') {\n          return true\n        }\n\n        if (operation.type.kty === 'EC') {\n          assertNodeSupportedEcCrv(operation.type)\n          return true\n        }\n\n        if (operation.type.kty === 'OKP') {\n          assertNodeSupportedOkpCrv(operation.type)\n          return true\n        }\n\n        if (operation.type.kty === 'oct') {\n          assertNodeSupportedOctAlgorithm(operation.type)\n          return true\n        }\n      } catch {\n        return false\n      }\n\n      return false\n    }\n\n    if (operation.operation === 'importKey') {\n      try {\n        if (operation.privateJwk.kty === 'RSA' || operation.privateJwk.kty === 'oct') {\n          return true\n        }\n\n        if (operation.privateJwk.kty === 'EC') {\n          assertNodeSupportedEcCrv({ kty: operation.privateJwk.kty, crv: operation.privateJwk.crv })\n          return true\n        }\n\n        if (operation.privateJwk.kty === 'OKP') {\n          assertNodeSupportedOkpCrv({ kty: operation.privateJwk.kty, crv: operation.privateJwk.crv })\n          return true\n        }\n      } catch {\n        return false\n      }\n    }\n\n    if (operation.operation === 'sign' || operation.operation === 'verify') {\n      return nodeSupportedJwaAlgorithm.includes(operation.algorithm)\n    }\n\n    if (operation.operation === 'encrypt' || operation.operation === 'decrypt') {\n      const encryption = operation.operation === 'encrypt' ? operation.encryption : operation.decryption\n\n      // We can only perform key agreement with curves we support. We also can't create the\n      // ephemeral key for e.g. ECDH-ES if the curve is not supported.\n      if (\n        operation.keyAgreement &&\n        'externalPublicJwk' in operation.keyAgreement &&\n        operation.keyAgreement.externalPublicJwk\n      ) {\n        const externalPublicJwk = operation.keyAgreement.externalPublicJwk\n        try {\n          if (externalPublicJwk.kty === 'EC') assertNodeSupportedEcCrv(externalPublicJwk)\n          else assertNodeSupportedOkpCrv(externalPublicJwk)\n        } catch {\n          return false\n        }\n      }\n\n      // HPKE is an integrated encryption mode: the suite fixes the AEAD, so the HPKE key agreement\n      // algorithm is all there is to check.\n      if (encryption.algorithm === 'HPKE') {\n        if (!operation.keyAgreement || !Kms.isJwaHpkeAlgorithm(operation.keyAgreement.algorithm)) return false\n\n        return nodeSupportedHpkeAlgorithms.includes(\n          operation.keyAgreement.algorithm as (typeof nodeSupportedHpkeAlgorithms)[number]\n        )\n      }\n\n      const isSupportedEncryptionAlgorithm = nodeSupportedEncryptionAlgorithms.includes(\n        encryption.algorithm as (typeof nodeSupportedEncryptionAlgorithms)[number]\n      )\n      if (!isSupportedEncryptionAlgorithm) return false\n      if (!operation.keyAgreement) return true\n\n      return nodeSupportedKeyAgreementAlgorithms.includes(\n        operation.keyAgreement.algorithm as (typeof nodeSupportedKeyAgreementAlgorithms)[number]\n      )\n    }\n\n    return false\n  }\n\n  public randomBytes(_agentContext: AgentContext, options: Kms.KmsRandomBytesOptions): Kms.KmsRandomBytesReturn {\n    return randomBytes(options.length)\n  }\n\n  public async getPublicKey(agentContext: AgentContext, keyId: string): Promise<Kms.KmsJwkPublic | null> {\n    const privateJwk = await this.#storage.get(agentContext, keyId)\n    if (!privateJwk) return null\n\n    return Kms.publicJwkFromPrivateJwk(privateJwk)\n  }\n\n  public async importKey<Jwk extends Kms.KmsJwkPrivate>(\n    agentContext: AgentContext,\n    options: Kms.KmsImportKeyOptions<Jwk>\n  ): Promise<Kms.KmsImportKeyReturn<Jwk>> {\n    const { kid } = options.privateJwk\n\n    if (kid) await this.assertKeyNotExists(agentContext, kid)\n\n    const privateJwk = {\n      ...options.privateJwk,\n      kid: kid ?? randomUUID(),\n    }\n\n    try {\n      if (privateJwk.kty === 'oct') {\n        // Just check if we can create a secret key instance\n        createSecretKey(TypedArrayEncoder.fromBase64Url(privateJwk.k)).export({ format: 'jwk' })\n      } else if (privateJwk.kty === 'EC') {\n        assertNodeSupportedEcCrv({ kty: privateJwk.kty, crv: privateJwk.crv })\n        // This validates the JWK\n        createPrivateKey({\n          format: 'jwk',\n          key: privateJwk,\n        })\n      } else if (privateJwk.kty === 'OKP') {\n        assertNodeSupportedOkpCrv({ kty: privateJwk.kty, crv: privateJwk.crv })\n        // This validates the JWK\n        createPrivateKey({\n          format: 'jwk',\n          key: privateJwk,\n        })\n      } else if (privateJwk.kty === 'RSA') {\n        // This validates the JWK\n        createPrivateKey({\n          format: 'jwk',\n          key: privateJwk,\n        })\n      } else {\n        // All kty values supported for now, but can change in the future\n        // @ts-expect-error\n        throw new Kms.KeyManagementAlgorithmNotSupportedError(`kty '${privateJwk.kty}'`, this.backend)\n      }\n\n      await this.#storage.set(agentContext, privateJwk.kid, privateJwk)\n      const publicJwk = Kms.publicJwkFromPrivateJwk(privateJwk)\n\n      return {\n        keyId: privateJwk.kid,\n        publicJwk: {\n          ...publicJwk,\n          kid: privateJwk.kid,\n        },\n      } as Kms.KmsImportKeyReturn<Jwk>\n    } catch (error) {\n      if (error instanceof Kms.KeyManagementError) throw error\n\n      throw new Kms.KeyManagementError('Error importing key', { cause: error })\n    }\n  }\n\n  public async deleteKey(agentContext: AgentContext, options: Kms.KmsDeleteKeyOptions): Promise<boolean> {\n    return await this.#storage.delete(agentContext, options.keyId)\n  }\n\n  public async createKey<Type extends Kms.KmsCreateKeyType>(\n    agentContext: AgentContext,\n    options: Kms.KmsCreateKeyOptions<Type>\n  ): Promise<Kms.KmsCreateKeyReturn<Type>> {\n    const { type, keyId } = options\n\n    if (keyId) await this.assertKeyNotExists(agentContext, keyId)\n\n    try {\n      let jwks: { publicJwk: Kms.KmsJwkPublic; privateJwk: Kms.KmsJwkPrivate }\n      if (type.kty === 'EC') {\n        assertNodeSupportedEcCrv(type)\n        jwks = await createEcKey(type)\n      } else if (type.kty === 'OKP') {\n        assertNodeSupportedOkpCrv(type)\n        jwks = await createOkpKey(type)\n      } else if (type.kty === 'RSA') {\n        jwks = await createRsaKey(type)\n      } else if (type.kty === 'oct') {\n        assertNodeSupportedOctAlgorithm(type)\n        jwks = await createOctKey(type)\n      } else {\n        // @ts-expect-error\n        throw new Kms.KeyManagementAlgorithmNotSupportedError(`kty '${type.kty}'`, this.backend)\n      }\n\n      jwks.privateJwk.kid = keyId ?? randomUUID()\n      jwks.publicJwk.kid = jwks.privateJwk.kid\n\n      await this.#storage.set(agentContext, jwks.privateJwk.kid, jwks.privateJwk)\n\n      return {\n        publicJwk: jwks.publicJwk as Kms.KmsCreateKeyReturn<Type>['publicJwk'],\n        keyId: jwks.publicJwk.kid,\n      }\n    } catch (error) {\n      if (error instanceof Kms.KeyManagementError) throw error\n\n      throw new Kms.KeyManagementError('Error creating key', { cause: error })\n    }\n  }\n\n  public async sign(agentContext: AgentContext, options: Kms.KmsSignOptions): Promise<Kms.KmsSignReturn> {\n    const { keyId, algorithm, data } = options\n\n    // 1. Retrieve the key\n    const key = await this.getKeyAsserted(agentContext, keyId)\n\n    try {\n      // 2. Validate alg and use for key\n      Kms.assertAllowedSigningAlgForKey(key, algorithm)\n      Kms.assertKeyAllowsSign(key)\n\n      // 3. Perform the signing operation\n      const signature = await performSign(key, algorithm, data)\n\n      return {\n        signature,\n      }\n    } catch (error) {\n      if (error instanceof Kms.KeyManagementError) throw error\n\n      throw new Kms.KeyManagementError('Error signing with key', { cause: error })\n    }\n  }\n\n  public async verify(agentContext: AgentContext, options: Kms.KmsVerifyOptions): Promise<Kms.KmsVerifyReturn> {\n    const { algorithm, data, signature } = options\n\n    try {\n      let key: Exclude<Kms.KmsJwkPublic, Kms.KmsJwkPublicOct> | Kms.KmsJwkPrivate\n      if (options.key.keyId) {\n        key = await this.getKeyAsserted(agentContext, options.key.keyId)\n      } else if (options.key.publicJwk?.kty === 'EC') {\n        assertNodeSupportedEcCrv(options.key.publicJwk)\n        key = options.key.publicJwk\n      } else if (options.key.publicJwk?.kty === 'OKP') {\n        assertNodeSupportedOkpCrv(options.key.publicJwk)\n        key = options.key.publicJwk\n      } else if (options.key.publicJwk?.kty === 'RSA') {\n        key = options.key.publicJwk\n      } else {\n        // @ts-expect-error\n        throw new Kms.KeyManagementAlgorithmNotSupportedError(`kty ${options.key.kty}`, this.backend)\n      }\n\n      // 2. Validate alg and use for key\n      Kms.assertAllowedSigningAlgForKey(key, algorithm)\n      Kms.assertKeyAllowsVerify(key)\n\n      // 3. Perform the verify operation\n      const verified = await performVerify(key, algorithm, data, signature)\n      if (verified) {\n        return {\n          verified: true,\n          publicJwk: Kms.publicJwkFromPrivateJwk(key),\n        }\n      }\n\n      return {\n        verified: false,\n      }\n    } catch (error) {\n      if (error instanceof Kms.KeyManagementError) throw error\n\n      throw new Kms.KeyManagementError('Error verifying with key', { cause: error })\n    }\n  }\n\n  public async encrypt(agentContext: AgentContext, options: Kms.KmsEncryptOptions): Promise<Kms.KmsEncryptReturn> {\n    const { data, encryption, key } = options\n\n    if (encryption.algorithm === 'HPKE') {\n      if (!key.keyAgreement || !Kms.isKmsKeyAgreementEncryptHpke(key.keyAgreement)) {\n        throw new Kms.KeyManagementError(\n          `Encryption algorithm 'HPKE' can only be used with an integrated-encryption HPKE key agreement algorithm`\n        )\n      }\n\n      const { keyAgreement } = key\n      Kms.assertAllowedKeyDerivationAlgForKey(keyAgreement.externalPublicJwk, keyAgreement.algorithm)\n      Kms.assertKeyAllowsDerive(keyAgreement.externalPublicJwk)\n\n      try {\n        return await hpkeSeal({\n          algorithm: keyAgreement.algorithm,\n          recipientPublicJwk: keyAgreement.externalPublicJwk,\n          data,\n          info: keyAgreement.info,\n          aad: encryption.aad,\n        })\n      } catch (error) {\n        if (error instanceof Kms.KeyManagementError) throw error\n        throw new Kms.KeyManagementError('Error encrypting', { cause: error })\n      }\n    }\n\n    Kms.assertSupportedEncryptionAlgorithm(encryption, nodeSupportedEncryptionAlgorithms, this.backend)\n\n    let encryptionKey: Kms.KmsJwkPrivate\n    let encryptedKey: Kms.KmsEncryptedKey | undefined\n\n    if (key.keyId) {\n      encryptionKey = await this.getKeyAsserted(agentContext, key.keyId)\n    } else if (key.privateJwk) {\n      encryptionKey = key.privateJwk\n    } else if (key.keyAgreement) {\n      Kms.assertAllowedKeyDerivationAlgForKey(key.keyAgreement.externalPublicJwk, key.keyAgreement.algorithm)\n      Kms.assertKeyAllowsDerive(key.keyAgreement.externalPublicJwk)\n      Kms.assertSupportedKeyAgreementAlgorithm(key.keyAgreement, nodeSupportedKeyAgreementAlgorithms, this.backend)\n\n      const privateJwk = await this.getKeyAsserted(agentContext, key.keyAgreement.keyId)\n      Kms.assertJwkAsymmetric(privateJwk, key.keyAgreement.keyId)\n      Kms.assertAllowedKeyDerivationAlgForKey(privateJwk, key.keyAgreement.algorithm)\n      Kms.assertKeyAllowsDerive(privateJwk)\n      Kms.assertAsymmetricJwkKeyTypeMatches(privateJwk, key.keyAgreement.externalPublicJwk)\n\n      const { contentEncryptionKey, encryptedContentEncryptionKey } = await deriveEncryptionKey({\n        keyAgreement: key.keyAgreement,\n        encryption,\n        privateJwk,\n      })\n\n      encryptionKey = contentEncryptionKey\n      encryptedKey = encryptedContentEncryptionKey\n    } else {\n      throw new Kms.KeyManagementError('Unexpected key parameter for encrypt')\n    }\n\n    if (encryptionKey.kty !== 'oct') {\n      throw new Kms.KeyManagementAlgorithmNotSupportedError(\n        `kty '${encryptionKey.kty} for content encryption'`,\n        this.backend\n      )\n    }\n\n    try {\n      // 2. Validate alg and use for key\n      Kms.assertAllowedEncryptionAlgForKey(encryptionKey, encryption.algorithm)\n      Kms.assertKeyAllowsEncrypt(encryptionKey)\n\n      // 3. Perform the encryption operation\n      const encrypted = await performEncrypt(encryptionKey, encryption, data)\n      return {\n        ...encrypted,\n        encryptedKey,\n      }\n    } catch (error) {\n      if (error instanceof Kms.KeyManagementError) throw error\n\n      throw new Kms.KeyManagementError('Error encrypting', { cause: error })\n    }\n  }\n\n  public async decrypt(agentContext: AgentContext, options: Kms.KmsDecryptOptions): Promise<Kms.KmsDecryptReturn> {\n    const { decryption, encrypted, key } = options\n\n    if (decryption.algorithm === 'HPKE') {\n      if (!key.keyAgreement || !Kms.isKmsKeyAgreementDecryptHpke(key.keyAgreement)) {\n        throw new Kms.KeyManagementError(\n          `Decryption algorithm 'HPKE' can only be used with an integrated-encryption HPKE key agreement algorithm`\n        )\n      }\n\n      const { keyAgreement } = key\n      const recipientPrivateJwk = await this.getKeyAsserted(agentContext, keyAgreement.keyId)\n\n      Kms.assertJwkAsymmetric(recipientPrivateJwk, keyAgreement.keyId)\n      Kms.assertAllowedKeyDerivationAlgForKey(recipientPrivateJwk, keyAgreement.algorithm)\n      Kms.assertKeyAllowsDerive(recipientPrivateJwk)\n\n      try {\n        return {\n          data: await hpkeOpen({\n            algorithm: keyAgreement.algorithm,\n            recipientPrivateJwk,\n            encapsulatedKey: keyAgreement.encapsulatedKey,\n            encrypted,\n            info: keyAgreement.info,\n            aad: decryption.aad,\n          }),\n        }\n      } catch (error) {\n        if (error instanceof Kms.KeyManagementError) throw error\n        throw new Kms.KeyManagementError('Error decrypting', { cause: error })\n      }\n    }\n\n    Kms.assertSupportedEncryptionAlgorithm(decryption, nodeSupportedEncryptionAlgorithms, this.backend)\n\n    let decryptionKey: Kms.KmsJwkPrivate\n    if (key.keyId) {\n      decryptionKey = await this.getKeyAsserted(agentContext, key.keyId)\n    } else if (key.privateJwk) {\n      decryptionKey = key.privateJwk\n    } else if (key.keyAgreement) {\n      Kms.assertSupportedKeyAgreementAlgorithm(key.keyAgreement, nodeSupportedKeyAgreementAlgorithms, this.backend)\n      Kms.assertAllowedKeyDerivationAlgForKey(key.keyAgreement.externalPublicJwk, key.keyAgreement.algorithm)\n      Kms.assertKeyAllowsDerive(key.keyAgreement.externalPublicJwk)\n\n      const privateJwk = await this.getKeyAsserted(agentContext, key.keyAgreement.keyId)\n      Kms.assertJwkAsymmetric(privateJwk, key.keyAgreement.keyId)\n      Kms.assertAllowedKeyDerivationAlgForKey(privateJwk, key.keyAgreement.algorithm)\n      Kms.assertKeyAllowsDerive(privateJwk)\n      Kms.assertAsymmetricJwkKeyTypeMatches(privateJwk, key.keyAgreement.externalPublicJwk)\n\n      const { contentEncryptionKey } = await deriveDecryptionKey({\n        keyAgreement: key.keyAgreement,\n        decryption,\n        privateJwk,\n      })\n\n      decryptionKey = contentEncryptionKey\n    } else {\n      throw new Kms.KeyManagementError('Unexpected key parameter for decrypt')\n    }\n\n    if (decryptionKey.kty !== 'oct') {\n      throw new Kms.KeyManagementAlgorithmNotSupportedError(\n        `kty '${decryptionKey.kty}' for content encryption`,\n        this.backend\n      )\n    }\n\n    try {\n      // 2. Validate alg and use for key\n      Kms.assertAllowedEncryptionAlgForKey(decryptionKey, decryption.algorithm)\n      Kms.assertKeyAllowsEncrypt(decryptionKey)\n\n      // 3. Perform the decryption operation\n      return await performDecrypt(decryptionKey, decryption, encrypted)\n    } catch (error) {\n      if (error instanceof Kms.KeyManagementError) throw error\n\n      throw new Kms.KeyManagementError('Error decrypting', { cause: error })\n    }\n  }\n\n  private async getKeyAsserted(agentContext: AgentContext, keyId: string) {\n    const storageKey = await this.#storage.get(agentContext, keyId)\n    if (!storageKey) {\n      throw new Kms.KeyManagementKeyNotFoundError(keyId, [this.backend])\n    }\n\n    return storageKey\n  }\n\n  private async assertKeyNotExists(agentContext: AgentContext, keyId: string) {\n    const storageKey = await this.#storage.get(agentContext, keyId)\n\n    if (storageKey) {\n      throw new Kms.KeyManagementKeyExistsError(keyId, this.backend)\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;AAoBA,IAAa,2BAAb,MAA0E;CAKxE,YAAmB,SAAmC;EAJtD,KAAgB,UAAU;;EAKxB,uBAAA,UAAA,MAAgB,OAAA;CAClB;CAEA,qBAA4B,eAA6B,WAAsC;EAC7F,IAAI,UAAU,cAAc,aAAa,OAAO;EAChD,IAAI,UAAU,cAAc,eAAe,OAAO;EAElD,IAAI,UAAU,cAAc,aAAa;GAEvC,IAAI;IACF,IAAI,UAAU,KAAK,QAAQ,OACzB,OAAO;IAGT,IAAI,UAAU,KAAK,QAAQ,MAAM;KAC/B,yBAAyB,UAAU,IAAI;KACvC,OAAO;IACT;IAEA,IAAI,UAAU,KAAK,QAAQ,OAAO;KAChC,0BAA0B,UAAU,IAAI;KACxC,OAAO;IACT;IAEA,IAAI,UAAU,KAAK,QAAQ,OAAO;KAChC,gCAAgC,UAAU,IAAI;KAC9C,OAAO;IACT;GACF,QAAQ;IACN,OAAO;GACT;GAEA,OAAO;EACT;EAEA,IAAI,UAAU,cAAc,aAC1B,IAAI;GACF,IAAI,UAAU,WAAW,QAAQ,SAAS,UAAU,WAAW,QAAQ,OACrE,OAAO;GAGT,IAAI,UAAU,WAAW,QAAQ,MAAM;IACrC,yBAAyB;KAAE,KAAK,UAAU,WAAW;KAAK,KAAK,UAAU,WAAW;IAAI,CAAC;IACzF,OAAO;GACT;GAEA,IAAI,UAAU,WAAW,QAAQ,OAAO;IACtC,0BAA0B;KAAE,KAAK,UAAU,WAAW;KAAK,KAAK,UAAU,WAAW;IAAI,CAAC;IAC1F,OAAO;GACT;EACF,QAAQ;GACN,OAAO;EACT;EAGF,IAAI,UAAU,cAAc,UAAU,UAAU,cAAc,UAC5D,OAAO,0BAA0B,SAAS,UAAU,SAAS;EAG/D,IAAI,UAAU,cAAc,aAAa,UAAU,cAAc,WAAW;GAC1E,MAAM,aAAa,UAAU,cAAc,YAAY,UAAU,aAAa,UAAU;GAIxF,IACE,UAAU,gBACV,uBAAuB,UAAU,gBACjC,UAAU,aAAa,mBACvB;IACA,MAAM,oBAAoB,UAAU,aAAa;IACjD,IAAI;KACF,IAAI,kBAAkB,QAAQ,MAAM,yBAAyB,iBAAiB;UACzE,0BAA0B,iBAAiB;IAClD,QAAQ;KACN,OAAO;IACT;GACF;GAIA,IAAI,WAAW,cAAc,QAAQ;IACnC,IAAI,CAAC,UAAU,gBAAgB,CAAC,IAAI,mBAAmB,UAAU,aAAa,SAAS,GAAG,OAAO;IAEjG,OAAO,4BAA4B,SACjC,UAAU,aAAa,SACzB;GACF;GAKA,IAAI,CAHmC,kCAAkC,SACvE,WAAW,SAEqB,GAAG,OAAO;GAC5C,IAAI,CAAC,UAAU,cAAc,OAAO;GAEpC,OAAO,oCAAoC,SACzC,UAAU,aAAa,SACzB;EACF;EAEA,OAAO;CACT;CAEA,YAAmB,eAA6B,SAA8D;EAC5G,OAAO,YAAY,QAAQ,MAAM;CACnC;CAEA,MAAa,aAAa,cAA4B,OAAiD;EACrG,MAAM,aAAa,MAAA,uBAAA,UAAM,IAAA,CAAA,CAAc,IAAI,cAAc,KAAK;EAC9D,IAAI,CAAC,YAAY,OAAO;EAExB,OAAO,IAAI,wBAAwB,UAAU;CAC/C;CAEA,MAAa,UACX,cACA,SACsC;EACtC,MAAM,EAAE,QAAQ,QAAQ;EAExB,IAAI,KAAK,MAAM,KAAK,mBAAmB,cAAc,GAAG;EAExD,MAAM,aAAa;GACjB,GAAG,QAAQ;GACX,KAAK,OAAO,WAAW;EACzB;EAEA,IAAI;GACF,IAAI,WAAW,QAAQ,OAErB,gBAAgB,kBAAkB,cAAc,WAAW,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,QAAQ,MAAM,CAAC;QAClF,IAAI,WAAW,QAAQ,MAAM;IAClC,yBAAyB;KAAE,KAAK,WAAW;KAAK,KAAK,WAAW;IAAI,CAAC;IAErE,iBAAiB;KACf,QAAQ;KACR,KAAK;IACP,CAAC;GACH,OAAO,IAAI,WAAW,QAAQ,OAAO;IACnC,0BAA0B;KAAE,KAAK,WAAW;KAAK,KAAK,WAAW;IAAI,CAAC;IAEtE,iBAAiB;KACf,QAAQ;KACR,KAAK;IACP,CAAC;GACH,OAAO,IAAI,WAAW,QAAQ,OAE5B,iBAAiB;IACf,QAAQ;IACR,KAAK;GACP,CAAC;QAID,MAAM,IAAI,IAAI,wCAAwC,QAAQ,WAAW,IAAI,IAAI,KAAK,OAAO;GAG/F,MAAA,uBAAA,UAAM,IAAA,CAAA,CAAc,IAAI,cAAc,WAAW,KAAK,UAAU;GAChE,MAAM,YAAY,IAAI,wBAAwB,UAAU;GAExD,OAAO;IACL,OAAO,WAAW;IAClB,WAAW;KACT,GAAG;KACH,KAAK,WAAW;IAClB;GACF;EACF,SAAS,OAAO;GACd,IAAI,iBAAiB,IAAI,oBAAoB,MAAM;GAEnD,MAAM,IAAI,IAAI,mBAAmB,uBAAuB,EAAE,OAAO,MAAM,CAAC;EAC1E;CACF;CAEA,MAAa,UAAU,cAA4B,SAAoD;EACrG,OAAO,MAAA,uBAAA,UAAM,IAAA,CAAA,CAAc,OAAO,cAAc,QAAQ,KAAK;CAC/D;CAEA,MAAa,UACX,cACA,SACuC;EACvC,MAAM,EAAE,MAAM,UAAU;EAExB,IAAI,OAAO,MAAM,KAAK,mBAAmB,cAAc,KAAK;EAE5D,IAAI;GACF,IAAI;GACJ,IAAI,KAAK,QAAQ,MAAM;IACrB,yBAAyB,IAAI;IAC7B,OAAO,MAAM,YAAY,IAAI;GAC/B,OAAO,IAAI,KAAK,QAAQ,OAAO;IAC7B,0BAA0B,IAAI;IAC9B,OAAO,MAAM,aAAa,IAAI;GAChC,OAAO,IAAI,KAAK,QAAQ,OACtB,OAAO,MAAM,aAAa,IAAI;QACzB,IAAI,KAAK,QAAQ,OAAO;IAC7B,gCAAgC,IAAI;IACpC,OAAO,MAAM,aAAa,IAAI;GAChC,OAEE,MAAM,IAAI,IAAI,wCAAwC,QAAQ,KAAK,IAAI,IAAI,KAAK,OAAO;GAGzF,KAAK,WAAW,MAAM,SAAS,WAAW;GAC1C,KAAK,UAAU,MAAM,KAAK,WAAW;GAErC,MAAA,uBAAA,UAAM,IAAA,CAAA,CAAc,IAAI,cAAc,KAAK,WAAW,KAAK,KAAK,UAAU;GAE1E,OAAO;IACL,WAAW,KAAK;IAChB,OAAO,KAAK,UAAU;GACxB;EACF,SAAS,OAAO;GACd,IAAI,iBAAiB,IAAI,oBAAoB,MAAM;GAEnD,MAAM,IAAI,IAAI,mBAAmB,sBAAsB,EAAE,OAAO,MAAM,CAAC;EACzE;CACF;CAEA,MAAa,KAAK,cAA4B,SAAyD;EACrG,MAAM,EAAE,OAAO,WAAW,SAAS;EAGnC,MAAM,MAAM,MAAM,KAAK,eAAe,cAAc,KAAK;EAEzD,IAAI;GAEF,IAAI,8BAA8B,KAAK,SAAS;GAChD,IAAI,oBAAoB,GAAG;GAK3B,OAAO,EACL,WAAA,MAHsB,YAAY,KAAK,WAAW,IAAI,EAIxD;EACF,SAAS,OAAO;GACd,IAAI,iBAAiB,IAAI,oBAAoB,MAAM;GAEnD,MAAM,IAAI,IAAI,mBAAmB,0BAA0B,EAAE,OAAO,MAAM,CAAC;EAC7E;CACF;CAEA,MAAa,OAAO,cAA4B,SAA6D;EAC3G,MAAM,EAAE,WAAW,MAAM,cAAc;EAEvC,IAAI;GACF,IAAI;GACJ,IAAI,QAAQ,IAAI,OACd,MAAM,MAAM,KAAK,eAAe,cAAc,QAAQ,IAAI,KAAK;QAC1D,IAAI,QAAQ,IAAI,WAAW,QAAQ,MAAM;IAC9C,yBAAyB,QAAQ,IAAI,SAAS;IAC9C,MAAM,QAAQ,IAAI;GACpB,OAAO,IAAI,QAAQ,IAAI,WAAW,QAAQ,OAAO;IAC/C,0BAA0B,QAAQ,IAAI,SAAS;IAC/C,MAAM,QAAQ,IAAI;GACpB,OAAO,IAAI,QAAQ,IAAI,WAAW,QAAQ,OACxC,MAAM,QAAQ,IAAI;QAGlB,MAAM,IAAI,IAAI,wCAAwC,OAAO,QAAQ,IAAI,OAAO,KAAK,OAAO;GAI9F,IAAI,8BAA8B,KAAK,SAAS;GAChD,IAAI,sBAAsB,GAAG;GAI7B,IAAI,MADmB,cAAc,KAAK,WAAW,MAAM,SAAS,GAElE,OAAO;IACL,UAAU;IACV,WAAW,IAAI,wBAAwB,GAAG;GAC5C;GAGF,OAAO,EACL,UAAU,MACZ;EACF,SAAS,OAAO;GACd,IAAI,iBAAiB,IAAI,oBAAoB,MAAM;GAEnD,MAAM,IAAI,IAAI,mBAAmB,4BAA4B,EAAE,OAAO,MAAM,CAAC;EAC/E;CACF;CAEA,MAAa,QAAQ,cAA4B,SAA+D;EAC9G,MAAM,EAAE,MAAM,YAAY,QAAQ;EAElC,IAAI,WAAW,cAAc,QAAQ;GACnC,IAAI,CAAC,IAAI,gBAAgB,CAAC,IAAI,6BAA6B,IAAI,YAAY,GACzE,MAAM,IAAI,IAAI,mBACZ,yGACF;GAGF,MAAM,EAAE,iBAAiB;GACzB,IAAI,oCAAoC,aAAa,mBAAmB,aAAa,SAAS;GAC9F,IAAI,sBAAsB,aAAa,iBAAiB;GAExD,IAAI;IACF,OAAO,MAAM,SAAS;KACpB,WAAW,aAAa;KACxB,oBAAoB,aAAa;KACjC;KACA,MAAM,aAAa;KACnB,KAAK,WAAW;IAClB,CAAC;GACH,SAAS,OAAO;IACd,IAAI,iBAAiB,IAAI,oBAAoB,MAAM;IACnD,MAAM,IAAI,IAAI,mBAAmB,oBAAoB,EAAE,OAAO,MAAM,CAAC;GACvE;EACF;EAEA,IAAI,mCAAmC,YAAY,mCAAmC,KAAK,OAAO;EAElG,IAAI;EACJ,IAAI;EAEJ,IAAI,IAAI,OACN,gBAAgB,MAAM,KAAK,eAAe,cAAc,IAAI,KAAK;OAC5D,IAAI,IAAI,YACb,gBAAgB,IAAI;OACf,IAAI,IAAI,cAAc;GAC3B,IAAI,oCAAoC,IAAI,aAAa,mBAAmB,IAAI,aAAa,SAAS;GACtG,IAAI,sBAAsB,IAAI,aAAa,iBAAiB;GAC5D,IAAI,qCAAqC,IAAI,cAAc,qCAAqC,KAAK,OAAO;GAE5G,MAAM,aAAa,MAAM,KAAK,eAAe,cAAc,IAAI,aAAa,KAAK;GACjF,IAAI,oBAAoB,YAAY,IAAI,aAAa,KAAK;GAC1D,IAAI,oCAAoC,YAAY,IAAI,aAAa,SAAS;GAC9E,IAAI,sBAAsB,UAAU;GACpC,IAAI,kCAAkC,YAAY,IAAI,aAAa,iBAAiB;GAEpF,MAAM,EAAE,sBAAsB,kCAAkC,MAAM,oBAAoB;IACxF,cAAc,IAAI;IAClB;IACA;GACF,CAAC;GAED,gBAAgB;GAChB,eAAe;EACjB,OACE,MAAM,IAAI,IAAI,mBAAmB,sCAAsC;EAGzE,IAAI,cAAc,QAAQ,OACxB,MAAM,IAAI,IAAI,wCACZ,QAAQ,cAAc,IAAI,2BAC1B,KAAK,OACP;EAGF,IAAI;GAEF,IAAI,iCAAiC,eAAe,WAAW,SAAS;GACxE,IAAI,uBAAuB,aAAa;GAIxC,OAAO;IACL,GAAG,MAFmB,eAAe,eAAe,YAAY,IAAI;IAGpE;GACF;EACF,SAAS,OAAO;GACd,IAAI,iBAAiB,IAAI,oBAAoB,MAAM;GAEnD,MAAM,IAAI,IAAI,mBAAmB,oBAAoB,EAAE,OAAO,MAAM,CAAC;EACvE;CACF;CAEA,MAAa,QAAQ,cAA4B,SAA+D;EAC9G,MAAM,EAAE,YAAY,WAAW,QAAQ;EAEvC,IAAI,WAAW,cAAc,QAAQ;GACnC,IAAI,CAAC,IAAI,gBAAgB,CAAC,IAAI,6BAA6B,IAAI,YAAY,GACzE,MAAM,IAAI,IAAI,mBACZ,yGACF;GAGF,MAAM,EAAE,iBAAiB;GACzB,MAAM,sBAAsB,MAAM,KAAK,eAAe,cAAc,aAAa,KAAK;GAEtF,IAAI,oBAAoB,qBAAqB,aAAa,KAAK;GAC/D,IAAI,oCAAoC,qBAAqB,aAAa,SAAS;GACnF,IAAI,sBAAsB,mBAAmB;GAE7C,IAAI;IACF,OAAO,EACL,MAAM,MAAM,SAAS;KACnB,WAAW,aAAa;KACxB;KACA,iBAAiB,aAAa;KAC9B;KACA,MAAM,aAAa;KACnB,KAAK,WAAW;IAClB,CAAC,EACH;GACF,SAAS,OAAO;IACd,IAAI,iBAAiB,IAAI,oBAAoB,MAAM;IACnD,MAAM,IAAI,IAAI,mBAAmB,oBAAoB,EAAE,OAAO,MAAM,CAAC;GACvE;EACF;EAEA,IAAI,mCAAmC,YAAY,mCAAmC,KAAK,OAAO;EAElG,IAAI;EACJ,IAAI,IAAI,OACN,gBAAgB,MAAM,KAAK,eAAe,cAAc,IAAI,KAAK;OAC5D,IAAI,IAAI,YACb,gBAAgB,IAAI;OACf,IAAI,IAAI,cAAc;GAC3B,IAAI,qCAAqC,IAAI,cAAc,qCAAqC,KAAK,OAAO;GAC5G,IAAI,oCAAoC,IAAI,aAAa,mBAAmB,IAAI,aAAa,SAAS;GACtG,IAAI,sBAAsB,IAAI,aAAa,iBAAiB;GAE5D,MAAM,aAAa,MAAM,KAAK,eAAe,cAAc,IAAI,aAAa,KAAK;GACjF,IAAI,oBAAoB,YAAY,IAAI,aAAa,KAAK;GAC1D,IAAI,oCAAoC,YAAY,IAAI,aAAa,SAAS;GAC9E,IAAI,sBAAsB,UAAU;GACpC,IAAI,kCAAkC,YAAY,IAAI,aAAa,iBAAiB;GAEpF,MAAM,EAAE,yBAAyB,MAAM,oBAAoB;IACzD,cAAc,IAAI;IAClB;IACA;GACF,CAAC;GAED,gBAAgB;EAClB,OACE,MAAM,IAAI,IAAI,mBAAmB,sCAAsC;EAGzE,IAAI,cAAc,QAAQ,OACxB,MAAM,IAAI,IAAI,wCACZ,QAAQ,cAAc,IAAI,2BAC1B,KAAK,OACP;EAGF,IAAI;GAEF,IAAI,iCAAiC,eAAe,WAAW,SAAS;GACxE,IAAI,uBAAuB,aAAa;GAGxC,OAAO,MAAM,eAAe,eAAe,YAAY,SAAS;EAClE,SAAS,OAAO;GACd,IAAI,iBAAiB,IAAI,oBAAoB,MAAM;GAEnD,MAAM,IAAI,IAAI,mBAAmB,oBAAoB,EAAE,OAAO,MAAM,CAAC;EACvE;CACF;CAEA,MAAc,eAAe,cAA4B,OAAe;EACtE,MAAM,aAAa,MAAA,uBAAA,UAAM,IAAA,CAAA,CAAc,IAAI,cAAc,KAAK;EAC9D,IAAI,CAAC,YACH,MAAM,IAAI,IAAI,8BAA8B,OAAO,CAAC,KAAK,OAAO,CAAC;EAGnE,OAAO;CACT;CAEA,MAAc,mBAAmB,cAA4B,OAAe;EAG1E,IAAI,MAAA,uBAAA,UAFqB,IAAA,CAAA,CAAc,IAAI,cAAc,KAAK,GAG5D,MAAM,IAAI,IAAI,4BAA4B,OAAO,KAAK,OAAO;CAEjE;AACF"}

package/build/kms/NodeKeyManagementStorage.d.mts

@@ -1,7 +1,6 @@
 import { AgentContext, CanBePromise, Kms } from "@credo-ts/core";
-
 //#region src/kms/NodeKeyManagementStorage.d.ts
-interface NodeKeyManagementStorage {
+export interface NodeKeyManagementStorage {
   get(agentContext: AgentContext, keyId: string): CanBePromise<Kms.KmsJwkPrivate | null>;
   has(agentContext: AgentContext, keyId: string): CanBePromise<boolean>;
   set(agentContext: AgentContext, keyId: string, jwk: Kms.KmsJwkPrivate): CanBePromise<void>;
@@ -11,5 +10,4 @@ interface NodeKeyManagementStorage {
   delete(agentContext: AgentContext, keyId: string): CanBePromise<boolean>;
 }
 //#endregion
-export { NodeKeyManagementStorage };
 //# sourceMappingURL=NodeKeyManagementStorage.d.mts.map

package/build/kms/NodeKeyManagementStorage.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"NodeKeyManagementStorage.d.mts","names":[],"sources":["../../src/kms/NodeKeyManagementStorage.ts"],"mappings":";;;UAEiB,wBAAA;EACf,GAAA,CAAI,YAAA,EAAc,YAAA,EAAc,KAAA,WAAgB,YAAA,CAAa,GAAA,CAAI,aAAA;EACjE,GAAA,CAAI,YAAA,EAAc,YAAA,EAAc,KAAA,WAAgB,YAAA;EAGhD,GAAA,CAAI,YAAA,EAAc,YAAA,EAAc,KAAA,UAAe,GAAA,EAAK,GAAA,CAAI,aAAA,GAAgB,YAAA;;;;EAKxE,MAAA,CAAO,YAAA,EAAc,YAAA,EAAc,KAAA,WAAgB,YAAA;AAAA"}
+{"version":3,"file":"NodeKeyManagementStorage.d.mts","names":[],"sources":["../../src/kms/NodeKeyManagementStorage.ts"],"mappings":";;iBAEiB;EACf,IAAI,cAAc,cAAc,gBAAgB,aAAa,IAAI;EACjE,IAAI,cAAc,cAAc,gBAAgB;EAGhD,IAAI,cAAc,cAAc,eAAe,KAAK,IAAI,gBAAgB;;;;EAKxE,OAAO,cAAc,cAAc,gBAAgB"}

package/build/kms/crypto/createKey.mjs

@@ -1,7 +1,6 @@
 import { Kms } from "@credo-ts/core";
 import { generateKeyPair, randomBytes } from "node:crypto";
 import { promisify } from "node:util";
-
 //#region src/kms/crypto/createKey.ts
 const generateKeyPair$1 = promisify(generateKeyPair);
 const nodeSupportedEcCrvs = [
@@ -53,7 +52,7 @@ async function createOctKey(options) {
 		publicJwk
 	};
 }
-
 //#endregion
 export { assertNodeSupportedEcCrv, assertNodeSupportedOctAlgorithm, assertNodeSupportedOkpCrv, createEcKey, createOctKey, createOkpKey, createRsaKey };
+
 //# sourceMappingURL=createKey.mjs.map

package/build/kms/crypto/createKey.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"createKey.mjs","names":["generateKeyPair","_generateKeyPair"],"sources":["../../../src/kms/crypto/createKey.ts"],"sourcesContent":["import { generateKeyPair as _generateKeyPair, randomBytes } from 'node:crypto'\nimport { promisify } from 'node:util'\nimport { Kms } from '@credo-ts/core'\n\nconst generateKeyPair = promisify(_generateKeyPair)\n\nconst nodeSupportedEcCrvs = ['P-256', 'P-384', 'P-521', 'secp256k1'] satisfies Kms.KmsJwkPublicEc['crv'][]\nexport type NodeKmsSupportedEcCrvs = (typeof nodeSupportedEcCrvs)[number]\nexport function assertNodeSupportedEcCrv(\n  options: Kms.KmsCreateKeyTypeEc\n): asserts options is Kms.KmsCreateKeyTypeEc & { crv: NodeKmsSupportedEcCrvs } {\n  if (!nodeSupportedEcCrvs.includes(options.crv as NodeKmsSupportedEcCrvs)) {\n    throw new Kms.KeyManagementAlgorithmNotSupportedError(`crv '${options.crv}' for kty '${options.kty}'`, 'node')\n  }\n}\n\nexport async function createEcKey({ crv }: Kms.KmsCreateKeyTypeEc & { crv: NodeKmsSupportedEcCrvs }) {\n  const { publicKey, privateKey } = await generateKeyPair('ec', {\n    namedCurve: crv,\n  })\n\n  const privateJwk = privateKey.export({\n    format: 'jwk',\n  })\n\n  const publicJwk = publicKey.export({\n    format: 'jwk',\n  })\n\n  return {\n    privateJwk: privateJwk as Kms.KmsJwkPrivateEc,\n    publicJwk: publicJwk as Kms.KmsJwkPublicEc,\n  }\n}\n\nexport async function createRsaKey({ modulusLength }: Kms.KmsCreateKeyTypeRsa) {\n  const { publicKey, privateKey } = await generateKeyPair('rsa', {\n    modulusLength,\n  })\n\n  const privateJwk = privateKey.export({\n    format: 'jwk',\n  })\n\n  const publicJwk = publicKey.export({\n    format: 'jwk',\n  })\n\n  return {\n    privateJwk: privateJwk as Kms.KmsJwkPrivateRsa,\n    publicJwk: publicJwk as Kms.KmsJwkPublicRsa,\n  }\n}\n\nconst nodeSupportedOkpCrvs = ['Ed25519', 'X25519'] satisfies Kms.KmsJwkPublicOkp['crv'][]\ntype NodeKmsSupportedOkpCrvs = (typeof nodeSupportedOkpCrvs)[number]\nexport function assertNodeSupportedOkpCrv(\n  options: Kms.KmsCreateKeyTypeOkp\n): asserts options is Kms.KmsCreateKeyTypeOkp & { crv: NodeKmsSupportedOkpCrvs } {\n  if (!nodeSupportedOkpCrvs.includes(options.crv as NodeKmsSupportedOkpCrvs)) {\n    throw new Kms.KeyManagementAlgorithmNotSupportedError(`crv '${options.crv}' for kty '${options.kty}'`, 'node')\n  }\n}\n\nexport async function createOkpKey({ crv }: Kms.KmsCreateKeyTypeOkp & { crv: NodeKmsSupportedOkpCrvs }) {\n  const { publicKey, privateKey } =\n    crv === 'Ed25519' ? await generateKeyPair('ed25519') : await generateKeyPair('x25519')\n\n  const privateJwk = privateKey.export({\n    format: 'jwk',\n  })\n\n  const publicJwk = publicKey.export({\n    format: 'jwk',\n  })\n\n  return {\n    privateJwk: privateJwk as Kms.KmsJwkPrivateOkp,\n    publicJwk: publicJwk as Kms.KmsJwkPublicOkp,\n  }\n}\n\nconst nodeSupportedOctAlgorithms = ['aes', 'hmac'] satisfies Kms.KmsCreateKeyTypeOct['algorithm'][]\ntype NodeSupportedOctAlgorithms = (typeof nodeSupportedOctAlgorithms)[number]\nexport function assertNodeSupportedOctAlgorithm(\n  options: Kms.KmsCreateKeyTypeOct\n): asserts options is Kms.KmsCreateKeyTypeOct & { algorithm: NodeSupportedOctAlgorithms } {\n  if (!nodeSupportedOctAlgorithms.includes(options.algorithm as NodeSupportedOctAlgorithms)) {\n    throw new Kms.KeyManagementAlgorithmNotSupportedError(\n      `algorithm '${options.algorithm}' for kty '${options.kty}'`,\n      'node'\n    )\n  }\n}\n\nexport async function createOctKey(options: Kms.KmsCreateKeyTypeOct & { algorithm: NodeSupportedOctAlgorithms }) {\n  const secretBytes = randomBytes(options.length >> 3)\n\n  const privateJwk = {\n    kty: 'oct',\n    k: secretBytes.toString('base64url'),\n  }\n\n  const { k, ...publicJwk } = privateJwk\n\n  return {\n    privateJwk: privateJwk as Kms.KmsJwkPrivateOct,\n    publicJwk: publicJwk as Kms.KmsJwkPublicOct,\n  }\n}\n"],"mappings":";;;;;AAIA,MAAMA,oBAAkB,UAAUC,gBAAiB;AAEnD,MAAM,sBAAsB;CAAC;CAAS;CAAS;CAAS;CAAY;AAEpE,SAAgB,yBACd,SAC6E;AAC7E,KAAI,CAAC,oBAAoB,SAAS,QAAQ,IAA8B,CACtE,OAAM,IAAI,IAAI,wCAAwC,QAAQ,QAAQ,IAAI,aAAa,QAAQ,IAAI,IAAI,OAAO;;AAIlH,eAAsB,YAAY,EAAE,OAAiE;CACnG,MAAM,EAAE,WAAW,eAAe,MAAMD,kBAAgB,MAAM,EAC5D,YAAY,KACb,CAAC;AAUF,QAAO;EACL,YATiB,WAAW,OAAO,EACnC,QAAQ,OACT,CAAC;EAQA,WANgB,UAAU,OAAO,EACjC,QAAQ,OACT,CAAC;EAKD;;AAGH,eAAsB,aAAa,EAAE,iBAA0C;CAC7E,MAAM,EAAE,WAAW,eAAe,MAAMA,kBAAgB,OAAO,EAC7D,eACD,CAAC;AAUF,QAAO;EACL,YATiB,WAAW,OAAO,EACnC,QAAQ,OACT,CAAC;EAQA,WANgB,UAAU,OAAO,EACjC,QAAQ,OACT,CAAC;EAKD;;AAGH,MAAM,uBAAuB,CAAC,WAAW,SAAS;AAElD,SAAgB,0BACd,SAC+E;AAC/E,KAAI,CAAC,qBAAqB,SAAS,QAAQ,IAA+B,CACxE,OAAM,IAAI,IAAI,wCAAwC,QAAQ,QAAQ,IAAI,aAAa,QAAQ,IAAI,IAAI,OAAO;;AAIlH,eAAsB,aAAa,EAAE,OAAmE;CACtG,MAAM,EAAE,WAAW,eACjB,QAAQ,YAAY,MAAMA,kBAAgB,UAAU,GAAG,MAAMA,kBAAgB,SAAS;AAUxF,QAAO;EACL,YATiB,WAAW,OAAO,EACnC,QAAQ,OACT,CAAC;EAQA,WANgB,UAAU,OAAO,EACjC,QAAQ,OACT,CAAC;EAKD;;AAGH,MAAM,6BAA6B,CAAC,OAAO,OAAO;AAElD,SAAgB,gCACd,SACwF;AACxF,KAAI,CAAC,2BAA2B,SAAS,QAAQ,UAAwC,CACvF,OAAM,IAAI,IAAI,wCACZ,cAAc,QAAQ,UAAU,aAAa,QAAQ,IAAI,IACzD,OACD;;AAIL,eAAsB,aAAa,SAA8E;CAG/G,MAAM,aAAa;EACjB,KAAK;EACL,GAJkB,YAAY,QAAQ,UAAU,EAAE,CAInC,SAAS,YAAY;EACrC;CAED,MAAM,EAAE,GAAG,GAAG,cAAc;AAE5B,QAAO;EACO;EACD;EACZ"}
+{"version":3,"file":"createKey.mjs","names":["generateKeyPair","_generateKeyPair"],"sources":["../../../src/kms/crypto/createKey.ts"],"sourcesContent":["import { generateKeyPair as _generateKeyPair, randomBytes } from 'node:crypto'\nimport { promisify } from 'node:util'\nimport { Kms } from '@credo-ts/core'\n\nconst generateKeyPair = promisify(_generateKeyPair)\n\nconst nodeSupportedEcCrvs = ['P-256', 'P-384', 'P-521', 'secp256k1'] satisfies Kms.KmsJwkPublicEc['crv'][]\nexport type NodeKmsSupportedEcCrvs = (typeof nodeSupportedEcCrvs)[number]\nexport function assertNodeSupportedEcCrv(\n  options: Kms.KmsCreateKeyTypeEc\n): asserts options is Kms.KmsCreateKeyTypeEc & { crv: NodeKmsSupportedEcCrvs } {\n  if (!nodeSupportedEcCrvs.includes(options.crv as NodeKmsSupportedEcCrvs)) {\n    throw new Kms.KeyManagementAlgorithmNotSupportedError(`crv '${options.crv}' for kty '${options.kty}'`, 'node')\n  }\n}\n\nexport async function createEcKey({ crv }: Kms.KmsCreateKeyTypeEc & { crv: NodeKmsSupportedEcCrvs }) {\n  const { publicKey, privateKey } = await generateKeyPair('ec', {\n    namedCurve: crv,\n  })\n\n  const privateJwk = privateKey.export({\n    format: 'jwk',\n  })\n\n  const publicJwk = publicKey.export({\n    format: 'jwk',\n  })\n\n  return {\n    privateJwk: privateJwk as Kms.KmsJwkPrivateEc,\n    publicJwk: publicJwk as Kms.KmsJwkPublicEc,\n  }\n}\n\nexport async function createRsaKey({ modulusLength }: Kms.KmsCreateKeyTypeRsa) {\n  const { publicKey, privateKey } = await generateKeyPair('rsa', {\n    modulusLength,\n  })\n\n  const privateJwk = privateKey.export({\n    format: 'jwk',\n  })\n\n  const publicJwk = publicKey.export({\n    format: 'jwk',\n  })\n\n  return {\n    privateJwk: privateJwk as Kms.KmsJwkPrivateRsa,\n    publicJwk: publicJwk as Kms.KmsJwkPublicRsa,\n  }\n}\n\nconst nodeSupportedOkpCrvs = ['Ed25519', 'X25519'] satisfies Kms.KmsJwkPublicOkp['crv'][]\ntype NodeKmsSupportedOkpCrvs = (typeof nodeSupportedOkpCrvs)[number]\nexport function assertNodeSupportedOkpCrv(\n  options: Kms.KmsCreateKeyTypeOkp\n): asserts options is Kms.KmsCreateKeyTypeOkp & { crv: NodeKmsSupportedOkpCrvs } {\n  if (!nodeSupportedOkpCrvs.includes(options.crv as NodeKmsSupportedOkpCrvs)) {\n    throw new Kms.KeyManagementAlgorithmNotSupportedError(`crv '${options.crv}' for kty '${options.kty}'`, 'node')\n  }\n}\n\nexport async function createOkpKey({ crv }: Kms.KmsCreateKeyTypeOkp & { crv: NodeKmsSupportedOkpCrvs }) {\n  const { publicKey, privateKey } =\n    crv === 'Ed25519' ? await generateKeyPair('ed25519') : await generateKeyPair('x25519')\n\n  const privateJwk = privateKey.export({\n    format: 'jwk',\n  })\n\n  const publicJwk = publicKey.export({\n    format: 'jwk',\n  })\n\n  return {\n    privateJwk: privateJwk as Kms.KmsJwkPrivateOkp,\n    publicJwk: publicJwk as Kms.KmsJwkPublicOkp,\n  }\n}\n\nconst nodeSupportedOctAlgorithms = ['aes', 'hmac'] satisfies Kms.KmsCreateKeyTypeOct['algorithm'][]\ntype NodeSupportedOctAlgorithms = (typeof nodeSupportedOctAlgorithms)[number]\nexport function assertNodeSupportedOctAlgorithm(\n  options: Kms.KmsCreateKeyTypeOct\n): asserts options is Kms.KmsCreateKeyTypeOct & { algorithm: NodeSupportedOctAlgorithms } {\n  if (!nodeSupportedOctAlgorithms.includes(options.algorithm as NodeSupportedOctAlgorithms)) {\n    throw new Kms.KeyManagementAlgorithmNotSupportedError(\n      `algorithm '${options.algorithm}' for kty '${options.kty}'`,\n      'node'\n    )\n  }\n}\n\nexport async function createOctKey(options: Kms.KmsCreateKeyTypeOct & { algorithm: NodeSupportedOctAlgorithms }) {\n  const secretBytes = randomBytes(options.length >> 3)\n\n  const privateJwk = {\n    kty: 'oct',\n    k: secretBytes.toString('base64url'),\n  }\n\n  const { k, ...publicJwk } = privateJwk\n\n  return {\n    privateJwk: privateJwk as Kms.KmsJwkPrivateOct,\n    publicJwk: publicJwk as Kms.KmsJwkPublicOct,\n  }\n}\n"],"mappings":";;;;AAIA,MAAMA,oBAAkB,UAAUC,eAAgB;AAElD,MAAM,sBAAsB;CAAC;CAAS;CAAS;CAAS;AAAW;AAEnE,SAAgB,yBACd,SAC6E;CAC7E,IAAI,CAAC,oBAAoB,SAAS,QAAQ,GAA6B,GACrE,MAAM,IAAI,IAAI,wCAAwC,QAAQ,QAAQ,IAAI,aAAa,QAAQ,IAAI,IAAI,MAAM;AAEjH;AAEA,eAAsB,YAAY,EAAE,OAAiE;CACnG,MAAM,EAAE,WAAW,eAAe,MAAMD,kBAAgB,MAAM,EAC5D,YAAY,IACd,CAAC;CAUD,OAAO;EACL,YATiB,WAAW,OAAO,EACnC,QAAQ,MACV,CAOuB;EACrB,WANgB,UAAU,OAAO,EACjC,QAAQ,MACV,CAIqB;CACrB;AACF;AAEA,eAAsB,aAAa,EAAE,iBAA0C;CAC7E,MAAM,EAAE,WAAW,eAAe,MAAMA,kBAAgB,OAAO,EAC7D,cACF,CAAC;CAUD,OAAO;EACL,YATiB,WAAW,OAAO,EACnC,QAAQ,MACV,CAOuB;EACrB,WANgB,UAAU,OAAO,EACjC,QAAQ,MACV,CAIqB;CACrB;AACF;AAEA,MAAM,uBAAuB,CAAC,WAAW,QAAQ;AAEjD,SAAgB,0BACd,SAC+E;CAC/E,IAAI,CAAC,qBAAqB,SAAS,QAAQ,GAA8B,GACvE,MAAM,IAAI,IAAI,wCAAwC,QAAQ,QAAQ,IAAI,aAAa,QAAQ,IAAI,IAAI,MAAM;AAEjH;AAEA,eAAsB,aAAa,EAAE,OAAmE;CACtG,MAAM,EAAE,WAAW,eACjB,QAAQ,YAAY,MAAMA,kBAAgB,SAAS,IAAI,MAAMA,kBAAgB,QAAQ;CAUvF,OAAO;EACL,YATiB,WAAW,OAAO,EACnC,QAAQ,MACV,CAOuB;EACrB,WANgB,UAAU,OAAO,EACjC,QAAQ,MACV,CAIqB;CACrB;AACF;AAEA,MAAM,6BAA6B,CAAC,OAAO,MAAM;AAEjD,SAAgB,gCACd,SACwF;CACxF,IAAI,CAAC,2BAA2B,SAAS,QAAQ,SAAuC,GACtF,MAAM,IAAI,IAAI,wCACZ,cAAc,QAAQ,UAAU,aAAa,QAAQ,IAAI,IACzD,MACF;AAEJ;AAEA,eAAsB,aAAa,SAA8E;CAG/G,MAAM,aAAa;EACjB,KAAK;EACL,GAJkB,YAAY,QAAQ,UAAU,CAInC,CAAC,CAAC,SAAS,WAAW;CACrC;CAEA,MAAM,EAAE,GAAG,GAAG,cAAc;CAE5B,OAAO;EACO;EACD;CACb;AACF"}