@k9o/kibo 1.1.1 → 1.3.0

package/CHANGELOG.md

@@ -0,0 +1,23 @@
+# Changelog
+
+## 1.3.0 — 2026-10-26
+
+### Changed
+
+- `vault.secrets.get(name)` looks the secret up by exact name through the list route and returns its metadata.
+- `region` is optional on every named-secret method.
+- `vault.secrets.revealChallenge` takes an optional `reason`.
+- `KIBO_WASM_ERROR` now says whether the core is missing or present but failed to load.
+- README: `encrypt` and `decrypt` are standalone exports, not methods on the client. The vault is `client.kibo.vault`.
+
+### Removed
+
+- Nothing.
+
+### Added
+
+- Nothing. `setZkWasm(core)` remains the way to supply your own core.
+
+## 1.0.0
+
+First public release.

package/README.md

@@ -2,6 +2,9 @@
 
 Kibo is the Kilimanjaro vault SDK. Store and reveal secrets, keep wrapped data keys, and encrypt on the client with keys held in your own KMS.
 
+Kilimanjaro is the AI-native foundation for building critical applications. Its products are Keep (AI Security and Governance),
+Pulse (Data Intelligence), Gate (Customer Identity and Access Management) and Kibo (Keys and Secrets Management).
+
 ## Contents
 
 - [Links](#links)
@@ -12,6 +15,11 @@ Kibo is the Kilimanjaro vault SDK. Store and reveal secrets, keep wrapped data k
 - [Encrypt and decrypt](#encrypt-and-decrypt)
 - [Handle errors](#handle-errors)
 - [Appendix](#appendix)
+  - [Client options](#client-options)
+  - [Methods](#methods)
+  - [Encrypt and decrypt fields](#encrypt-and-decrypt-fields)
+  - [Error codes](#error-codes)
+  - [Related packages](#related-packages)
 
 ## Links
 
@@ -19,11 +27,6 @@ Kibo is the Kilimanjaro vault SDK. Store and reveal secrets, keep wrapped data k
 - Documentation / Developer Hub: <https://docs.kilimanjaro.dev>
 - Platform API: <https://api.k9o.io>
 - Platform Console: <https://console.k9o.io>
-  - [Client options](#client-options)
-  - [Methods](#methods)
-  - [Encrypt and decrypt fields](#encrypt-and-decrypt-fields)
-  - [Error codes](#error-codes)
-  - [Related packages](#related-packages)
 
 ## Install
 
@@ -34,8 +37,9 @@ npm install @k9o/kibo @k9o/core
 Bun works too: `bun add @k9o/kibo @k9o/core`.
 
 - Needs a runtime with global `fetch`: Node 18+, Bun 1.1+, or a modern browser.
-- Needs `@k9o/core`, which provides the client. The vault is available as `client.kibo`.
-- `encrypt` and `decrypt` also need the Kibo core (WebAssembly). See [encrypt and decrypt](#encrypt-and-decrypt).
+- Needs `@k9o/core`, which provides the client. The vault is `client.kibo.vault`.
+- `encrypt` and `decrypt` are standalone exports of `@k9o/kibo`, not methods on the client.
+- They use the Kibo core (WebAssembly), which the package ships. See [encrypt and decrypt](#encrypt-and-decrypt).
 
 ## Quick start
 
@@ -53,13 +57,12 @@ const client = createClient({
 
 For a custom host, pass the full organization host as `baseUrl` and `projectSlug`, and leave out `orgSlug`. See [client options](#client-options).
 
-Create a secret. `region` is required for every secret method except `list`.
+Create a secret. `region` is optional on every secret method. Pass it to pin a region, such as `region: "de01"`.
 
 ```ts
 const created = await client.kibo.vault.secrets.create({
   name: "tasks/webhook-signing-key",
   value: "whsec_example",
-  region: "de01",
 });
 const secret = created.data;
 
@@ -85,16 +88,30 @@ for (const item of secrets) {
 tasks/webhook-signing-key 1
 ```
 
+Read one secret's metadata by its exact name. This does not reveal the value.
+
+```ts
+const found = await client.kibo.vault.secrets.get("tasks/webhook-signing-key");
+
+console.log(found.data.name, found.data.version);
+```
+
+```text
+tasks/webhook-signing-key 1
+```
+
 Every method resolves to `{ data, meta }`. See [methods](#methods) for the full list.
 
 ## Reveal a secret
 
 Revealing takes two calls: ask for a single-use challenge, then present it.
+A plain read of a secret is a reveal, so it is refused without the challenge.
 
 ```ts
-const challenge = await client.kibo.vault.secrets.revealChallenge("tasks/webhook-signing-key", { region: "de01" });
+const challenge = await client.kibo.vault.secrets.revealChallenge("tasks/webhook-signing-key", {
+  reason: "rotate the webhook endpoint",
+});
 const revealed = await client.kibo.vault.secrets.reveal("tasks/webhook-signing-key", {
-  region: "de01",
   challenge: challenge.data.challenge,
 });
 
@@ -127,22 +144,23 @@ aws-kms
 
 ## Encrypt and decrypt
 
-`encrypt` and `decrypt` run on your machine against your own KMS. They wrap the Kibo core, a WebAssembly module.
-This package has no cryptography of its own.
+`encrypt` and `decrypt` run on your machine against your own KMS. They make no call to the platform.
+They wrap the Kibo core, a WebAssembly module. This package has no cryptography of its own.
 
-- The core is loaded from `wasm/kibo_kms_rest_ffi.js` inside the package.
-- Or load it yourself and pass it to `setZkWasm`.
-- Without the core, both calls fail with `KIBO_WASM_ERROR`. See [handle errors](#handle-errors).
+- The package ships the core under `wasm/` and loads it on first use.
+- To use your own build, load it and pass it to `setZkWasm(core)`.
+- A missing or unloadable core fails with `KIBO_WASM_ERROR`. The message says which. See [handle errors](#handle-errors).
 - The vault methods above work without the core.
 
 ```ts
 import { encrypt, decrypt } from "@k9o/kibo";
+import type { KiboEncryptInput } from "@k9o/kibo";
 
 const kmsToken = process.env.KMS_FEDERATED_TOKEN ?? "";
 const context = [{ key: "collection", value: "tasks" }];
 const title = new TextEncoder().encode("Write the README");
 
-const sealed = await encrypt({
+const input: KiboEncryptInput = {
   provider: "aws-kms",
   posture: "byok",
   kms_cred: { secret: kmsToken, expires_at_unix_secs: 1_800_000_000 },
@@ -151,7 +169,9 @@ const sealed = await encrypt({
   attestation_tier: "software",
   encryption_context: context,
   plaintext: title,
-});
+};
+
+const sealed = await encrypt(input);
 
 const opened = await decrypt({
   kms_cred: { secret: kmsToken, expires_at_unix_secs: 1_800_000_000 },
@@ -175,7 +195,7 @@ Write the README
 
 ## Handle errors
 
-Every failure is a `KError` from `@k9o/core`. Check `code`.
+Every failure is a `KError` from `@k9o/core`. Check `code`. The `input` is the one from the previous section.
 
 ```ts
 import { KError } from "@k9o/core";
@@ -185,15 +205,17 @@ try {
   await encrypt(input);
 } catch (error) {
   if (error instanceof KError && error.code === "KIBO_WASM_ERROR") {
-    console.log(error.message);
+    console.log(error.code);
   }
 }
 ```
 
 ```text
-the Kibo zero-knowledge core (wasm) is not bundled in this build of @k9o/kibo; encrypt and decrypt are unavailable
+KIBO_WASM_ERROR
 ```
 
+The `message` says whether the core is missing or is present but failed to load.
+
 See [error codes](#error-codes).
 
 ## Appendix
@@ -216,14 +238,14 @@ All are under `client.kibo.vault`.
 | Method | What it does |
 |---|---|
 | `secrets.list({ prefix?, cursor?, limit? })` | List secret metadata |
-| `secrets.get(name, { region })` | Read one secret's metadata |
-| `secrets.create({ name, value, region, visibility?, metadata? })` | Seal a new secret |
-| `secrets.revealChallenge(name, { region })` | Mint a single-use reveal challenge |
-| `secrets.reveal(name, { region, challenge })` | Return the plaintext value |
-| `secrets.update(name, { region, value, metadata? })` | Set a new value and bump the version |
-| `secrets.rotate(name, { region })` | Re-wrap the secret under a fresh key |
-| `secrets.move(name, { region, newPath })` | Rename the secret's path |
-| `secrets.delete(name, { region })` | Retire the secret |
+| `secrets.get(name)` | Find one secret by exact name through the list route; returns its metadata |
+| `secrets.create({ name, value, region?, visibility?, metadata? })` | Seal a new secret |
+| `secrets.revealChallenge(name, { region?, reason? })` | Mint a single-use reveal challenge |
+| `secrets.reveal(name, { challenge, region? })` | Return the plaintext value |
+| `secrets.update(name, { value, region?, metadata? })` | Set a new value and bump the version |
+| `secrets.rotate(name, { region? })` | Re-wrap the secret under a fresh key |
+| `secrets.move(name, { newPath, region? })` | Rename the secret's path |
+| `secrets.delete(name, { region? })` | Retire the secret |
 | `zkDeks.store({ envelope, provider, keyVersionRef })` | Store a wrapped data key envelope |
 | `zkDeks.fetch(id)` | Fetch a stored envelope by its handle |
 
@@ -233,7 +255,7 @@ Exported from `@k9o/kibo` directly:
 |---|---|
 | `encrypt(input)` | Encrypt bytes with your KMS; returns `{ envelope }` |
 | `decrypt(input)` | Decrypt an envelope; returns `{ plaintext }` |
-| `setZkWasm(core)` | Supply the Kibo core yourself |
+| `setZkWasm(core)` | Supply your own Kibo core instead of the shipped one |
 | `createKiboClient(config)` | Build a vault client from a core HTTP config |
 
 `visibility` is `{ kind: "private" }` (default) or `{ kind: "shared", principals?, roles? }`.
@@ -259,7 +281,7 @@ Exported from `@k9o/kibo` directly:
 
 | Code | When |
 |---|---|
-| `KIBO_WASM_ERROR` | The Kibo core is not bundled in your build and was not supplied |
+| `KIBO_WASM_ERROR` | The Kibo core is missing, or is present but failed to load; the message says which |
 | `KIBO_WASM_DECODE_ERROR` | The core returned something other than bytes |
 | `K9O_CRYPTO_POSTURE_FLOOR_VIOLATION` | `posture` is below the floor in `posture_policy`; `context` has `dimension`, `requested`, `declared` |
 | `UPSTREAM_KMS_ERROR` | Your own KMS failed the call |
@@ -271,7 +293,7 @@ Other codes from the core are passed through unchanged.
 
 | Package | Purpose |
 |---|---|
-| `@k9o/core` | The platform SDK; composes this package as `client.kibo` |
+| `@k9o/core` | The platform SDK; exposes the vault as `client.kibo.vault` |
 | `@k9o/kibo-react-native` | Client-side encryption for React Native |
 | `@k9o/cli` | `k9o vault-secret` works with the same secrets |
 

package/dist/index.d.ts

@@ -4,18 +4,17 @@ import { StoreZkDekInput, ZkDekHandle, ZkDekRecord, ListSecretsInput, ListSecret
 export { AttestationTier, SecretVisibility } from './types.js';
 
 /**
- * `client.kibo.vault.*` — the Kibo vault surface.
+ * `client.kibo.vault.*` - the Kibo vault surface.
  *
- * `vault.zkDeks.{store,fetch}` — member-plane,
- * project-scoped storage of the opaque customer-wrapped DEK envelope. Zero
- * crypto SDK-side: this is a plain authenticated REST round-trip carrying an
- * opaque blob (the wrapping happens in the ZK core, piece C). The encryption
- * surface (`kibo.encrypt`/`decrypt`) is provided by the ZK core binding when it is
- * bundled.
+ * `vault.zkDeks.{store,fetch}` store and fetch the opaque customer-wrapped DEK envelope, project-scoped. There is
+ * no cryptography in this client: it is a plain authenticated REST round-trip carrying an opaque blob (the
+ * wrapping happens in the standalone `encrypt`/`decrypt`, which never call the platform).
+ * `vault.secrets.*` is the typed secrets family.
  */
 
+/** @internal */
 declare function makeVaultNamespace(config: HttpClientConfig): {
-    /** ZK-DEK opaque store/fetch (F.5). */
+    /** Opaque store/fetch of a customer-wrapped DEK envelope. */
     zkDeks: {
         /**
          * Store an opaque customer-wrapped DEK envelope.
@@ -31,78 +30,65 @@ declare function makeVaultNamespace(config: HttpClientConfig): {
         fetch(id: string): Promise<Envelope<ZkDekRecord>>;
     };
     /**
-     * typed secrets surface (`services/gateway/src/routes/vault-secrets.ts`) — the full family:
-     * list/get/create/revealChallenge/reveal/update/rotate/move/delete. Every operation on a NAMED
-     * secret (everything except `list`) requires `region` — live-verified against staging, not
-     * documented in the route's OpenAPI schema. `list` is the one exception (verified it does NOT
-     * need `region`).
+     * Typed secrets surface (`/@<projectSlug>/vault/secrets`): list / get / create / revealChallenge / reveal /
+     * update / rotate / move / delete.
      *
-     * Response shapes for `update`/`rotate`/`move` are typed to what the gateway ACTUALLY returns
-     * (live-verified), not the OpenAPI's documented (and inaccurate for these three) `SecretSummary` —
-     * see the 🔴 notes on `UpdateSecretResult`/`RotateSecretResult`/`MoveSecretResult` in `types.ts`.
+     * `region`: the gateway sets the residency region of every vault call itself and discards a caller-supplied
+     * `region` query parameter, so it is optional on every method. When given, it is still sent (older gateways
+     * required it).
+     *
+     * Response shapes for `update`/`rotate`/`move` are typed to what the gateway returns, not the OpenAPI's
+     * `SecretSummary` (see `UpdateSecretResult`/`RotateSecretResult`/`MoveSecretResult` in `types.ts`).
      */
     secrets: {
-        /** List secrets (metadata only — never lists ciphertext). `GET /@<projectSlug>/vault/secrets`.
-         *  The one secrets operation that does NOT need `region` (live-verified). */
-        list(input?: ListSecretsInput): Promise<Envelope<ListSecretsResult>>;
+        /** List secrets (metadata only, never ciphertext). `GET /@<projectSlug>/vault/secrets`. */
+        list: (input?: ListSecretsInput) => Promise<Envelope<ListSecretsResult>>;
         /**
-         * Read a secret's metadata (never its value — use `revealChallenge`+`reveal` for that).
-         * `GET /@<projectSlug>/vault/secrets/<name>?region=<region>`.
+         * Read one secret's metadata (never its value; use `revealChallenge` + `reveal` for that).
          *
-         * 🔴 KNOWN LIVE BUG (staging, 2026-09-05): this call currently fails with
-         * `K9O_REVEAL_CHALLENGE_REQUIRED` on every attempt — the gateway/kibo does not honor the
-         * documented "no `X-K9O-Reveal-Challenge` header ⇒ return metadata" behavior; it demands a
-         * challenge unconditionally. Implemented per the documented contract (this is a backend defect,
-         * not a client workaround); `list({prefix: exactName})` is the current working alternative for a
-         * single secret's metadata until the gateway/kibo side is fixed.
+         * Vault answers a `GET /@<projectSlug>/vault/secrets/<name>` only as a reveal: with no
+         * `X-K9O-Reveal-Challenge` header it refuses with 401 `K9O_REVEAL_CHALLENGE_REQUIRED`, whatever the caller's
+         * rights. There is no plain metadata read on that route, so `get` reads the metadata the route that exists
+         * for it returns: it lists by the exact name as prefix and picks the exact match. It throws `K9O_NOT_FOUND`
+         * (status 404) when no secret has that name.
          */
-        get(name: string, opts: {
-            region: string;
+        get(name: string, _opts?: {
+            region?: string;
         }): Promise<Envelope<SecretSummary>>;
         /**
          * Create a secret under the caller's own auth.
-         * `POST /@<projectSlug>/vault/secrets/<name>?region=<region>` → the `sec_<base62>` summary.
-         *
-         * 🔴 `region` is REQUIRED on the query string, live-verified against staging — the vault-forward
-         * proxy fail-closes with `K9O_INVALID_FIELD_VALUE` ("this request requires an authoritative
-         * region") without it. Distinct from any `region` carried inside `input.value`'s envelope (e.g.
-         * the BYOS aws_sigv4 STS-signing region): this one scopes the vault WRITE itself, mirroring the
-         * gateway's `gatewayRegion()` residency guard (region-guard.ts) that closed a 2026-08 wrong-region
-         * incident for the audit path — the request-shape unit tests never caught this because they don't
-         * exercise a real gateway.
+         * `POST /@<projectSlug>/vault/secrets/<name>` -> the `sec_<base62>` summary.
          */
         create(input: CreateSecretInput): Promise<Envelope<SecretSummary>>;
-        /** Mint a single-use reveal challenge — present it as `X-K9O-Reveal-Challenge` on the
-         *  immediately-following `reveal()` call. `POST .../<name>?op=reveal-challenge&region=<region>`. */
-        revealChallenge(name: string, opts: {
-            region: string;
+        /** Mint a single-use reveal challenge; pass it to the immediately-following `reveal()`.
+         *  `POST .../<name>?op=reveal-challenge`. The optional `reason` is accepted by the gateway and not forwarded. */
+        revealChallenge(name: string, opts?: {
+            region?: string;
+            reason?: string;
         }): Promise<Envelope<RevealChallenge>>;
         /** Reveal a secret's plaintext value using a single-use challenge from `revealChallenge()`.
-         *  `GET .../<name>?region=<region>` with `X-K9O-Reveal-Challenge`. Decodes the wire's base64
-         *  `value` back to plaintext (live-verified: the reveal response's `value` is base64, symmetric
-         *  with `create`'s encode). */
+         *  `GET .../<name>` with `X-K9O-Reveal-Challenge`. Decodes the wire's base64 `value` back to plaintext
+         *  (symmetric with `create`'s encode). */
         reveal(name: string, opts: {
-            region: string;
+            region?: string;
             challenge: string;
         }): Promise<Envelope<RevealSecretResult>>;
-        /** Update a secret's value (bumps version) — owner-only. `PUT .../<name>?region=<region>`.
-         *  🔴 Returns only `{id, name, version}` live (see `UpdateSecretResult`), not the full summary
-         *  the OpenAPI schema documents — call `get()` after if you need the rest. */
+        /** Update a secret's value (bumps version), owner-only. `PUT .../<name>`.
+         *  Returns only `{id, name, version}` (see `UpdateSecretResult`); call `get()` after for the rest. */
         update(name: string, input: UpdateSecretInput): Promise<Envelope<UpdateSecretResult>>;
-        /** Rotate a secret's wrapping key (re-wraps under a fresh `kid`; content unchanged) — owner-only.
-         *  `POST .../<name>?op=rotate&region=<region>`. */
-        rotate(name: string, opts: {
-            region: string;
+        /** Rotate a secret's wrapping key (re-wraps under a fresh `kid`; content unchanged), owner-only.
+         *  `POST .../<name>?op=rotate`. */
+        rotate(name: string, opts?: {
+            region?: string;
         }): Promise<Envelope<RotateSecretResult>>;
-        /** Move (rename) a secret's hierarchical path — owner-only.
-         *  `POST .../<name>?op=move&region=<region>`. */
+        /** Move (rename) a secret's hierarchical path, owner-only. `POST .../<name>?op=move`. */
         move(name: string, opts: {
-            region: string;
+            region?: string;
             newPath: string;
         }): Promise<Envelope<MoveSecretResult>>;
-        /** Retire a secret — owner-only. `DELETE .../<name>?region=<region>` → `204 No Content`. */
-        delete(name: string, opts: {
-            region: string;
+        /** Retire a secret, owner-only. `DELETE .../<name>`. */
+        delete(name: string, opts?: {
+            region?: string;
         }): Promise<Envelope<void>>;
     };
 };
@@ -118,7 +104,7 @@ declare function makeVaultNamespace(config: HttpClientConfig): {
 
 /** Shape of the per-instance client returned by `createKiboClient`. */
 type KiboClient = {
-    /** Vault surface — `client.kibo.vault.zkDeks.{store,fetch}` (F.5). */
+    /** Vault surface: `vault.secrets.*` and `vault.zkDeks.{store,fetch}`. */
     vault: ReturnType<typeof makeVaultNamespace>;
 };
 /** Construct a Kibo client bound to the supplied (core) HTTP config. */
@@ -126,7 +112,7 @@ declare function createKiboClient(config: HttpClientConfig): KiboClient;
 
 /**
  * TS contract for the ZK encrypt/decrypt FFI surface — mirrors the Rust
- * `kibo-kms-rest-ffi::types` (the bound core, piece C) field-for-field.
+ * `kibo-kms-rest-ffi::types` (the bound core) field-for-field.
  *
  * These types cross the wasm boundary as plain JS objects (serde-wasm-bindgen),
  * so the field names + enum wire-tokens must match the Rust serde exactly:
@@ -156,7 +142,7 @@ interface KiboAllowedOracleModes {
     brokered: boolean;
     direct: boolean;
 }
-/** Project-declared crypto-posture floor. Omit fields for the
+/** Project-declared crypto-posture floor . Omit fields for the
  *  most-permissive default (`platform_managed` floor + both oracle modes). */
 interface KiboPosturePolicy {
     min_custody_posture?: KiboMinPosture;
@@ -225,7 +211,7 @@ interface KiboDecryptOutput {
 
 /**
  * ZK encrypt/decrypt — the thin TS wrapper over the bound crypto core
- * (`kibo-kms-rest-ffi`, piece C) compiled to wasm. ZERO crypto here: every
+ * (`kibo-kms-rest-ffi`) compiled to wasm. ZERO crypto here: every
  * wrap/unwrap, envelope framing, posture-floor enforcement, and KMS round-trip
  * lives in the audited Rust core. This layer only marshals the typed input
  * across the wasm boundary and maps the core's error string → `KError`.
@@ -234,9 +220,9 @@ interface KiboDecryptOutput {
  * objects via serde-wasm-bindgen, and rejecting with the `ZkFfiError` display
  * string (`"<K9O_CODE>: <message>"`, optionally with a posture-violation tail).
  *
- * Composes into `@k9o/core` as `client.kibo.encrypt`/`decrypt`; the F.5
- * `vault.zkDeks.{store,fetch}` surface (envelope persistence) is separate +
- * decoupled (the core never sees the store).
+ * These are standalone exports (`import { encrypt, decrypt } from "@k9o/kibo"`), not methods of the client: they run
+ * locally against the customer's own KMS and make no platform call. The `vault.zkDeks.{store,fetch}` surface
+ * (envelope persistence) is separate and decoupled (the core never sees the store).
  */
 
 /** The minimal surface the bound ZK-core wasm exposes. */
@@ -252,7 +238,7 @@ interface ZkWasm {
 declare function setZkWasm(mod: ZkWasm): void;
 /**
  * Encrypt `input.plaintext` via the customer KMS, client-side. Returns the
- * opaque ZKFE envelope — store it via `vault.zkDeks.store` (F.5) or keep it
+ * opaque ZKFE envelope — store it via `vault.zkDeks.store`  or keep it
  * yourself; it is meaningless to the platform.
  */
 declare function encrypt(input: KiboEncryptInput): Promise<KiboEncryptOutput>;
@@ -263,4 +249,4 @@ declare function encrypt(input: KiboEncryptInput): Promise<KiboEncryptOutput>;
  */
 declare function decrypt(input: KiboDecryptInput): Promise<KiboDecryptOutput>;
 
-export { CreateSecretInput, type KiboAllowedOracleModes, type KiboAttestationTier, type KiboClient, type KiboCredential, type KiboDecryptInput, type KiboDecryptOutput, type KiboEncryptInput, type KiboEncryptOutput, type KiboKeyRef, type KiboKvPair, type KiboMinPosture, type KiboOracleMode, type KiboPosture, type KiboPosturePolicy, type KiboProviderConfig, type KiboStrategy, KmsProvider, ListSecretsInput, ListSecretsResult, MoveSecretResult, RevealChallenge, RevealSecretResult, RotateSecretResult, SecretSummary, StoreZkDekInput, UpdateSecretInput, UpdateSecretResult, ZkDekHandle, ZkDekRecord, type ZkWasm, createKiboClient, decrypt, encrypt, makeVaultNamespace, setZkWasm };
+export { CreateSecretInput, type KiboAllowedOracleModes, type KiboAttestationTier, type KiboClient, type KiboCredential, type KiboDecryptInput, type KiboDecryptOutput, type KiboEncryptInput, type KiboEncryptOutput, type KiboKeyRef, type KiboKvPair, type KiboMinPosture, type KiboOracleMode, type KiboPosture, type KiboPosturePolicy, type KiboProviderConfig, type KiboStrategy, KmsProvider, ListSecretsInput, ListSecretsResult, MoveSecretResult, RevealChallenge, RevealSecretResult, RotateSecretResult, SecretSummary, StoreZkDekInput, UpdateSecretInput, UpdateSecretResult, ZkDekHandle, ZkDekRecord, type ZkWasm, createKiboClient, decrypt, encrypt, setZkWasm };