@noy-db/at-aws-kms 0.2.0-pre.16 → 0.2.0-pre.18

package/dist/index.cjs

@@ -20,9 +20,11 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/index.ts
 var index_exports = {};
 __export(index_exports, {
+  awsKmsRecipientSealer: () => awsKmsRecipientSealer,
   awsKmsSealingProvider: () => awsKmsSealingProvider
 });
 module.exports = __toCommonJS(index_exports);
+var import_hub = require("@noy-db/hub");
 var import_client_kms = require("@aws-sdk/client-kms");
 function awsKmsSealingProvider(opts) {
   const client = opts.client ?? new import_client_kms.KMSClient({});
@@ -46,8 +48,72 @@ function awsKmsSealingProvider(opts) {
     }
   };
 }
+var SUPPORTED_RSA_KEY_SPECS = /* @__PURE__ */ new Set(["RSA_2048", "RSA_3072", "RSA_4096"]);
+function derSpkiToPem(der) {
+  let binary = "";
+  for (let i = 0; i < der.length; i++) binary += String.fromCharCode(der[i]);
+  const b64 = btoa(binary);
+  return "-----BEGIN PUBLIC KEY-----\n" + (b64.match(/.{1,64}/g) ?? []).join("\n") + "\n-----END PUBLIC KEY-----\n";
+}
+function awsKmsRecipientSealer(opts) {
+  const client = opts.client ?? new import_client_kms.KMSClient(opts.region ? { region: opts.region } : {});
+  const id = `aws-kms-recipient:${opts.keyId}`;
+  return {
+    id,
+    async publishRecipientHint() {
+      const out = await client.send(
+        new import_client_kms.GetPublicKeyCommand({ KeyId: opts.keyId })
+      );
+      if (out.KeyUsage !== "ENCRYPT_DECRYPT") {
+        throw new Error(
+          `@noy-db/at-aws-kms: awsKmsRecipientSealer requires an ENCRYPT_DECRYPT key, got KeyUsage='${String(out.KeyUsage)}' for ${opts.keyId}`
+        );
+      }
+      if (!out.KeySpec || !SUPPORTED_RSA_KEY_SPECS.has(out.KeySpec)) {
+        throw new Error(
+          `@noy-db/at-aws-kms: awsKmsRecipientSealer requires an RSA key (RSA_2048/3072/4096), got KeySpec='${String(out.KeySpec)}' for ${opts.keyId}`
+        );
+      }
+      const der = out.PublicKey;
+      if (!der) throw new Error("@noy-db/at-aws-kms: KMS GetPublicKey returned no PublicKey");
+      const derBytes = der instanceof Uint8Array ? der : new Uint8Array(der);
+      const publicKeyPem = derSpkiToPem(derBytes);
+      return { v: 1, pid: id, alg: "rsa-oaep-sha256", material: { publicKeyPem } };
+    },
+    async sealForRecipient(plaintext, hint) {
+      if (hint.v !== 1) {
+        throw new Error(`@noy-db/at-aws-kms: awsKmsRecipientSealer.sealForRecipient: unsupported hint.v ${String(hint.v)} (expected 1)`);
+      }
+      if (hint.alg !== "rsa-oaep-sha256") {
+        throw new Error(`@noy-db/at-aws-kms: awsKmsRecipientSealer.sealForRecipient: unsupported hint.alg '${String(hint.alg)}' (expected 'rsa-oaep-sha256')`);
+      }
+      const pem = hint.material["publicKeyPem"];
+      if (typeof pem !== "string") {
+        throw new Error("@noy-db/at-aws-kms: awsKmsRecipientSealer.sealForRecipient: hint.material.publicKeyPem missing or not a string");
+      }
+      return (0, import_hub.sealRsaOaepTlv)(plaintext, pem);
+    },
+    async unseal(sealed) {
+      const { wrapped, iv, ct } = (0, import_hub.parseRsaOaepTlv)(sealed);
+      const out = await client.send(
+        new import_client_kms.DecryptCommand({
+          KeyId: opts.keyId,
+          CiphertextBlob: wrapped,
+          EncryptionAlgorithm: "RSAES_OAEP_SHA_256"
+        })
+      );
+      const cek = out.Plaintext;
+      if (!cek) throw new Error("@noy-db/at-aws-kms: KMS Decrypt returned no Plaintext (CEK)");
+      const cekBytes = cek instanceof Uint8Array ? cek : new Uint8Array(cek);
+      const pt = await (0, import_hub.aesGcmOpen)(cekBytes, iv, ct);
+      cekBytes.fill(0);
+      return pt;
+    }
+  };
+}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  awsKmsRecipientSealer,
   awsKmsSealingProvider
 });
 //# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts"],"sourcesContent":["/**\n * **@noy-db/at-aws-kms** — AWS KMS sealing key provider for noy-db\n * managed-passphrase mode.\n *\n * An `at-*` provider that seals and unseals the hub-generated random\n * passphrase via AWS KMS Encrypt / Decrypt. Every seal and unseal is an\n * authenticated KMS API call, giving you a CloudTrail-backed access log of\n * every time a user's vault is opened — no additional instrumentation\n * required.\n *\n * ## When to use\n *\n * - Compliance regimes requiring auditable key access logs (FedRAMP, HIPAA\n *   with managed-encryption requirements, SOC 2 Type II).\n * - Workloads already running on AWS where a KMS key costs less than\n *   engineering an equivalent audit trail.\n * - Any case where you want automatic CMK rotation without rotating your\n *   app's sealing key material manually.\n *\n * ## Setup\n *\n * ```bash\n * # 1. Create a KMS key (one-time, in your AWS console or CLI):\n * aws kms create-key --description \"noy-db sealing key\"\n * # Note the KeyId/ARN from the output.\n *\n * # 2. Grant the host's IAM role kms:Encrypt + kms:Decrypt on that key.\n * # Credentials are picked up automatically from the SDK's ambient chain\n * # (IAM role, ~/.aws/credentials, env vars — see AWS SDK docs).\n * ```\n *\n * ```ts\n * // 3. In your app:\n * import { createNoydb } from '@noy-db/hub'\n * import { awsKmsSealingProvider } from '@noy-db/at-aws-kms'\n * import { shamirRecoveryProvider } from '@noy-db/on-shamir'\n *\n * const db = await createNoydb({\n *   store,\n *   user: 'alice',\n *   passphraseMode: 'managed',\n *   sealingKey: awsKmsSealingProvider({ keyId: 'arn:aws:kms:us-east-1:123:key/abc' }),\n *   shamirRecovery: shamirRecoveryProvider(),\n * })\n * ```\n *\n * @packageDocumentation\n */\n\nimport type { SealingKeyProvider } from '@noy-db/hub'\nimport {\n  KMSClient,\n  EncryptCommand,\n  DecryptCommand,\n  type EncryptCommandOutput,\n  type DecryptCommandOutput,\n} from '@aws-sdk/client-kms'\n\n/** Options for {@link awsKmsSealingProvider}. */\nexport interface AwsKmsSealingProviderOptions {\n  /** KMS key id or ARN (e.g. `arn:aws:kms:us-east-1:123:key/abc`). */\n  readonly keyId: string\n  /** Optional pre-built client (DI for tests). Default `new KMSClient({})` (ambient creds). */\n  readonly client?: Pick<KMSClient, 'send'>\n}\n\n/**\n * Build a {@link SealingKeyProvider} backed by AWS KMS Encrypt / Decrypt.\n *\n * Credentials are resolved by the SDK's ambient chain — IAM instance roles,\n * environment variables, or `~/.aws/credentials`. Never pass raw credentials\n * in the options; inject a pre-configured client for non-default auth instead.\n *\n * @throws Error when KMS returns no ciphertext or no plaintext (guards\n * against unexpected SDK-response shapes).\n * Any KMS API error (AccessDenied, InvalidKeyUsage, etc.) propagates as-is.\n */\nexport function awsKmsSealingProvider(opts: AwsKmsSealingProviderOptions): SealingKeyProvider {\n  const client = opts.client ?? new KMSClient({})\n  return {\n    id: `aws-kms:${opts.keyId}`,\n\n    async seal(passphrase) {\n      const out: EncryptCommandOutput = await client.send(\n        new EncryptCommand({ KeyId: opts.keyId, Plaintext: passphrase }),\n      )\n      const blob = out.CiphertextBlob\n      if (!blob) throw new Error('@noy-db/at-aws-kms: KMS Encrypt returned no CiphertextBlob')\n      return blob instanceof Uint8Array ? blob : new Uint8Array(blob)\n    },\n\n    async unseal(sealed) {\n      const out: DecryptCommandOutput = await client.send(\n        new DecryptCommand({ CiphertextBlob: sealed, KeyId: opts.keyId }),\n      )\n      const pt = out.Plaintext\n      if (!pt) throw new Error('@noy-db/at-aws-kms: KMS Decrypt returned no Plaintext')\n      return pt instanceof Uint8Array ? pt : new Uint8Array(pt)\n    },\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAkDA,wBAMO;AAqBA,SAAS,sBAAsB,MAAwD;AAC5F,QAAM,SAAS,KAAK,UAAU,IAAI,4BAAU,CAAC,CAAC;AAC9C,SAAO;AAAA,IACL,IAAI,WAAW,KAAK,KAAK;AAAA,IAEzB,MAAM,KAAK,YAAY;AACrB,YAAM,MAA4B,MAAM,OAAO;AAAA,QAC7C,IAAI,iCAAe,EAAE,OAAO,KAAK,OAAO,WAAW,WAAW,CAAC;AAAA,MACjE;AACA,YAAM,OAAO,IAAI;AACjB,UAAI,CAAC,KAAM,OAAM,IAAI,MAAM,4DAA4D;AACvF,aAAO,gBAAgB,aAAa,OAAO,IAAI,WAAW,IAAI;AAAA,IAChE;AAAA,IAEA,MAAM,OAAO,QAAQ;AACnB,YAAM,MAA4B,MAAM,OAAO;AAAA,QAC7C,IAAI,iCAAe,EAAE,gBAAgB,QAAQ,OAAO,KAAK,MAAM,CAAC;AAAA,MAClE;AACA,YAAM,KAAK,IAAI;AACf,UAAI,CAAC,GAAI,OAAM,IAAI,MAAM,uDAAuD;AAChF,aAAO,cAAc,aAAa,KAAK,IAAI,WAAW,EAAE;AAAA,IAC1D;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["/**\n * **@noy-db/at-aws-kms** — AWS KMS sealing key provider for noy-db\n * managed-passphrase mode.\n *\n * An `at-*` provider that seals and unseals the hub-generated random\n * passphrase via AWS KMS Encrypt / Decrypt. Every seal and unseal is an\n * authenticated KMS API call, giving you a CloudTrail-backed access log of\n * every time a user's vault is opened — no additional instrumentation\n * required.\n *\n * ## When to use\n *\n * - Compliance regimes requiring auditable key access logs (FedRAMP, HIPAA\n *   with managed-encryption requirements, SOC 2 Type II).\n * - Workloads already running on AWS where a KMS key costs less than\n *   engineering an equivalent audit trail.\n * - Any case where you want automatic CMK rotation without rotating your\n *   app's sealing key material manually.\n *\n * ## Setup\n *\n * ```bash\n * # 1. Create a KMS key (one-time, in your AWS console or CLI):\n * aws kms create-key --description \"noy-db sealing key\"\n * # Note the KeyId/ARN from the output.\n *\n * # 2. Grant the host's IAM role kms:Encrypt + kms:Decrypt on that key.\n * # Credentials are picked up automatically from the SDK's ambient chain\n * # (IAM role, ~/.aws/credentials, env vars — see AWS SDK docs).\n * ```\n *\n * ```ts\n * // 3. In your app:\n * import { createNoydb } from '@noy-db/hub'\n * import { awsKmsSealingProvider } from '@noy-db/at-aws-kms'\n * import { shamirRecoveryProvider } from '@noy-db/on-shamir'\n *\n * const db = await createNoydb({\n *   store,\n *   user: 'alice',\n *   passphraseMode: 'managed',\n *   sealingKey: awsKmsSealingProvider({ keyId: 'arn:aws:kms:us-east-1:123:key/abc' }),\n *   shamirRecovery: shamirRecoveryProvider(),\n * })\n * ```\n *\n * @packageDocumentation\n */\n\nimport type { SealingKeyProvider, RecipientSealer, RecipientHint } from '@noy-db/hub'\nimport { sealRsaOaepTlv, parseRsaOaepTlv, aesGcmOpen } from '@noy-db/hub'\nimport {\n  KMSClient,\n  EncryptCommand,\n  DecryptCommand,\n  GetPublicKeyCommand,\n  type EncryptCommandOutput,\n  type DecryptCommandOutput,\n  type GetPublicKeyCommandOutput,\n} from '@aws-sdk/client-kms'\n\n/** Options for {@link awsKmsSealingProvider}. */\nexport interface AwsKmsSealingProviderOptions {\n  /** KMS key id or ARN (e.g. `arn:aws:kms:us-east-1:123:key/abc`). */\n  readonly keyId: string\n  /** Optional pre-built client (DI for tests). Default `new KMSClient({})` (ambient creds). */\n  readonly client?: Pick<KMSClient, 'send'>\n}\n\n/**\n * Build a {@link SealingKeyProvider} backed by AWS KMS Encrypt / Decrypt.\n *\n * Credentials are resolved by the SDK's ambient chain — IAM instance roles,\n * environment variables, or `~/.aws/credentials`. Never pass raw credentials\n * in the options; inject a pre-configured client for non-default auth instead.\n *\n * @throws Error when KMS returns no ciphertext or no plaintext (guards\n * against unexpected SDK-response shapes).\n * Any KMS API error (AccessDenied, InvalidKeyUsage, etc.) propagates as-is.\n */\nexport function awsKmsSealingProvider(opts: AwsKmsSealingProviderOptions): SealingKeyProvider {\n  const client = opts.client ?? new KMSClient({})\n  return {\n    id: `aws-kms:${opts.keyId}`,\n\n    async seal(passphrase) {\n      const out: EncryptCommandOutput = await client.send(\n        new EncryptCommand({ KeyId: opts.keyId, Plaintext: passphrase }),\n      )\n      const blob = out.CiphertextBlob\n      if (!blob) throw new Error('@noy-db/at-aws-kms: KMS Encrypt returned no CiphertextBlob')\n      return blob instanceof Uint8Array ? blob : new Uint8Array(blob)\n    },\n\n    async unseal(sealed) {\n      const out: DecryptCommandOutput = await client.send(\n        new DecryptCommand({ CiphertextBlob: sealed, KeyId: opts.keyId }),\n      )\n      const pt = out.Plaintext\n      if (!pt) throw new Error('@noy-db/at-aws-kms: KMS Decrypt returned no Plaintext')\n      return pt instanceof Uint8Array ? pt : new Uint8Array(pt)\n    },\n  }\n}\n\n/** Options for {@link awsKmsRecipientSealer}. */\nexport interface AwsKmsRecipientSealerOptions {\n  /**\n   * KMS key id or ARN of an **asymmetric RSA** key with `KeyUsage:\n   * ENCRYPT_DECRYPT` and `KeySpec` one of `RSA_2048` / `RSA_3072` /\n   * `RSA_4096`. The private key never leaves KMS — unseal runs `Decrypt`.\n   */\n  readonly keyId: string\n  /** Optional region passed to the default `KMSClient` when no `client` is given. */\n  readonly region?: string\n  /** Optional pre-built client (DI for tests). Default `new KMSClient({ region? })` (ambient creds). */\n  readonly client?: Pick<KMSClient, 'send'>\n}\n\n/** KMS asymmetric key specs this recipient sealer accepts (RSA-OAEP-SHA256 wrap). */\nconst SUPPORTED_RSA_KEY_SPECS = new Set(['RSA_2048', 'RSA_3072', 'RSA_4096'])\n\n/** DER SPKI bytes (from KMS `GetPublicKey`) → PEM SubjectPublicKeyInfo. */\nfunction derSpkiToPem(der: Uint8Array): string {\n  let binary = ''\n  for (let i = 0; i < der.length; i++) binary += String.fromCharCode(der[i]!)\n  const b64 = btoa(binary)\n  return '-----BEGIN PUBLIC KEY-----\\n'\n    + (b64.match(/.{1,64}/g) ?? []).join('\\n')\n    + '\\n-----END PUBLIC KEY-----\\n'\n}\n\n/**\n * A {@link RecipientSealer} (plus `unseal`) backed by an **asymmetric RSA**\n * AWS KMS key. Lets an `at-aws-kms` host act as a recipient target: a grantor\n * obtains the host's published {@link RecipientHint} (the KMS public key as\n * PEM) and seals bytes to it *locally* — no KMS call on the seal path. The\n * host unseals via KMS `Decrypt` with `EncryptionAlgorithm:\n * RSAES_OAEP_SHA_256`; the private key never leaves KMS.\n *\n * Wire format is the canonical recipient-target TLV\n * ({@link sealRsaOaepTlv}/{@link parseRsaOaepTlv}) shared with hub's\n * `MemoryRecipientSealer`, so a blob sealed by either side unseals on the\n * other. WebCrypto RSA-OAEP/SHA-256 and KMS `RSAES_OAEP_SHA_256` are\n * wire-compatible (RSAES-OAEP, SHA-256, MGF1-SHA256, empty label). KMS\n * asymmetric keys do not support an encryption context, so none is used.\n *\n * Separate from {@link awsKmsSealingProvider} (symmetric self-seal for the\n * managed passphrase) — this factory targets an asymmetric key.\n *\n * @throws Error from `publishRecipientHint` when the key is not an RSA\n * `ENCRYPT_DECRYPT` key, or `GetPublicKey` returns no public key.\n * @throws Error from `sealForRecipient` on an unsupported `hint.v`/`hint.alg`.\n * Any KMS API error (AccessDenied, etc.) propagates as-is.\n */\nexport function awsKmsRecipientSealer(\n  opts: AwsKmsRecipientSealerOptions,\n): RecipientSealer & { unseal(sealed: Uint8Array): Promise<Uint8Array> } {\n  const client = opts.client ?? new KMSClient(opts.region ? { region: opts.region } : {})\n  const id = `aws-kms-recipient:${opts.keyId}`\n  return {\n    id,\n\n    async publishRecipientHint(): Promise<RecipientHint> {\n      const out: GetPublicKeyCommandOutput = await client.send(\n        new GetPublicKeyCommand({ KeyId: opts.keyId }),\n      )\n      if (out.KeyUsage !== 'ENCRYPT_DECRYPT') {\n        throw new Error(\n          `@noy-db/at-aws-kms: awsKmsRecipientSealer requires an ENCRYPT_DECRYPT key, got KeyUsage='${String(out.KeyUsage)}' for ${opts.keyId}`,\n        )\n      }\n      if (!out.KeySpec || !SUPPORTED_RSA_KEY_SPECS.has(out.KeySpec)) {\n        throw new Error(\n          `@noy-db/at-aws-kms: awsKmsRecipientSealer requires an RSA key (RSA_2048/3072/4096), got KeySpec='${String(out.KeySpec)}' for ${opts.keyId}`,\n        )\n      }\n      const der = out.PublicKey\n      if (!der) throw new Error('@noy-db/at-aws-kms: KMS GetPublicKey returned no PublicKey')\n      const derBytes = der instanceof Uint8Array ? der : new Uint8Array(der)\n      const publicKeyPem = derSpkiToPem(derBytes)\n      return { v: 1, pid: id, alg: 'rsa-oaep-sha256', material: { publicKeyPem } }\n    },\n\n    async sealForRecipient(plaintext: Uint8Array, hint: RecipientHint): Promise<Uint8Array> {\n      if (hint.v !== 1) {\n        throw new Error(`@noy-db/at-aws-kms: awsKmsRecipientSealer.sealForRecipient: unsupported hint.v ${String(hint.v)} (expected 1)`)\n      }\n      if (hint.alg !== 'rsa-oaep-sha256') {\n        throw new Error(`@noy-db/at-aws-kms: awsKmsRecipientSealer.sealForRecipient: unsupported hint.alg '${String(hint.alg)}' (expected 'rsa-oaep-sha256')`)\n      }\n      const pem = hint.material['publicKeyPem']\n      if (typeof pem !== 'string') {\n        throw new Error('@noy-db/at-aws-kms: awsKmsRecipientSealer.sealForRecipient: hint.material.publicKeyPem missing or not a string')\n      }\n      // Grantor seals LOCALLY — no KMS call.\n      return sealRsaOaepTlv(plaintext, pem)\n    },\n\n    async unseal(sealed: Uint8Array): Promise<Uint8Array> {\n      const { wrapped, iv, ct } = parseRsaOaepTlv(sealed)\n      // RSA-unwrap the CEK via KMS — the private key never leaves KMS.\n      const out: DecryptCommandOutput = await client.send(\n        new DecryptCommand({\n          KeyId: opts.keyId,\n          CiphertextBlob: wrapped,\n          EncryptionAlgorithm: 'RSAES_OAEP_SHA_256',\n        }),\n      )\n      const cek = out.Plaintext\n      if (!cek) throw new Error('@noy-db/at-aws-kms: KMS Decrypt returned no Plaintext (CEK)')\n      const cekBytes = cek instanceof Uint8Array ? cek : new Uint8Array(cek)\n      const pt = await aesGcmOpen(cekBytes, iv, ct)\n      cekBytes.fill(0)\n      return pt\n    },\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAkDA,iBAA4D;AAC5D,wBAQO;AAqBA,SAAS,sBAAsB,MAAwD;AAC5F,QAAM,SAAS,KAAK,UAAU,IAAI,4BAAU,CAAC,CAAC;AAC9C,SAAO;AAAA,IACL,IAAI,WAAW,KAAK,KAAK;AAAA,IAEzB,MAAM,KAAK,YAAY;AACrB,YAAM,MAA4B,MAAM,OAAO;AAAA,QAC7C,IAAI,iCAAe,EAAE,OAAO,KAAK,OAAO,WAAW,WAAW,CAAC;AAAA,MACjE;AACA,YAAM,OAAO,IAAI;AACjB,UAAI,CAAC,KAAM,OAAM,IAAI,MAAM,4DAA4D;AACvF,aAAO,gBAAgB,aAAa,OAAO,IAAI,WAAW,IAAI;AAAA,IAChE;AAAA,IAEA,MAAM,OAAO,QAAQ;AACnB,YAAM,MAA4B,MAAM,OAAO;AAAA,QAC7C,IAAI,iCAAe,EAAE,gBAAgB,QAAQ,OAAO,KAAK,MAAM,CAAC;AAAA,MAClE;AACA,YAAM,KAAK,IAAI;AACf,UAAI,CAAC,GAAI,OAAM,IAAI,MAAM,uDAAuD;AAChF,aAAO,cAAc,aAAa,KAAK,IAAI,WAAW,EAAE;AAAA,IAC1D;AAAA,EACF;AACF;AAiBA,IAAM,0BAA0B,oBAAI,IAAI,CAAC,YAAY,YAAY,UAAU,CAAC;AAG5E,SAAS,aAAa,KAAyB;AAC7C,MAAI,SAAS;AACb,WAAS,IAAI,GAAG,IAAI,IAAI,QAAQ,IAAK,WAAU,OAAO,aAAa,IAAI,CAAC,CAAE;AAC1E,QAAM,MAAM,KAAK,MAAM;AACvB,SAAO,kCACF,IAAI,MAAM,UAAU,KAAK,CAAC,GAAG,KAAK,IAAI,IACvC;AACN;AAyBO,SAAS,sBACd,MACuE;AACvE,QAAM,SAAS,KAAK,UAAU,IAAI,4BAAU,KAAK,SAAS,EAAE,QAAQ,KAAK,OAAO,IAAI,CAAC,CAAC;AACtF,QAAM,KAAK,qBAAqB,KAAK,KAAK;AAC1C,SAAO;AAAA,IACL;AAAA,IAEA,MAAM,uBAA+C;AACnD,YAAM,MAAiC,MAAM,OAAO;AAAA,QAClD,IAAI,sCAAoB,EAAE,OAAO,KAAK,MAAM,CAAC;AAAA,MAC/C;AACA,UAAI,IAAI,aAAa,mBAAmB;AACtC,cAAM,IAAI;AAAA,UACR,4FAA4F,OAAO,IAAI,QAAQ,CAAC,SAAS,KAAK,KAAK;AAAA,QACrI;AAAA,MACF;AACA,UAAI,CAAC,IAAI,WAAW,CAAC,wBAAwB,IAAI,IAAI,OAAO,GAAG;AAC7D,cAAM,IAAI;AAAA,UACR,oGAAoG,OAAO,IAAI,OAAO,CAAC,SAAS,KAAK,KAAK;AAAA,QAC5I;AAAA,MACF;AACA,YAAM,MAAM,IAAI;AAChB,UAAI,CAAC,IAAK,OAAM,IAAI,MAAM,4DAA4D;AACtF,YAAM,WAAW,eAAe,aAAa,MAAM,IAAI,WAAW,GAAG;AACrE,YAAM,eAAe,aAAa,QAAQ;AAC1C,aAAO,EAAE,GAAG,GAAG,KAAK,IAAI,KAAK,mBAAmB,UAAU,EAAE,aAAa,EAAE;AAAA,IAC7E;AAAA,IAEA,MAAM,iBAAiB,WAAuB,MAA0C;AACtF,UAAI,KAAK,MAAM,GAAG;AAChB,cAAM,IAAI,MAAM,kFAAkF,OAAO,KAAK,CAAC,CAAC,eAAe;AAAA,MACjI;AACA,UAAI,KAAK,QAAQ,mBAAmB;AAClC,cAAM,IAAI,MAAM,qFAAqF,OAAO,KAAK,GAAG,CAAC,gCAAgC;AAAA,MACvJ;AACA,YAAM,MAAM,KAAK,SAAS,cAAc;AACxC,UAAI,OAAO,QAAQ,UAAU;AAC3B,cAAM,IAAI,MAAM,gHAAgH;AAAA,MAClI;AAEA,iBAAO,2BAAe,WAAW,GAAG;AAAA,IACtC;AAAA,IAEA,MAAM,OAAO,QAAyC;AACpD,YAAM,EAAE,SAAS,IAAI,GAAG,QAAI,4BAAgB,MAAM;AAElD,YAAM,MAA4B,MAAM,OAAO;AAAA,QAC7C,IAAI,iCAAe;AAAA,UACjB,OAAO,KAAK;AAAA,UACZ,gBAAgB;AAAA,UAChB,qBAAqB;AAAA,QACvB,CAAC;AAAA,MACH;AACA,YAAM,MAAM,IAAI;AAChB,UAAI,CAAC,IAAK,OAAM,IAAI,MAAM,6DAA6D;AACvF,YAAM,WAAW,eAAe,aAAa,MAAM,IAAI,WAAW,GAAG;AACrE,YAAM,KAAK,UAAM,uBAAW,UAAU,IAAI,EAAE;AAC5C,eAAS,KAAK,CAAC;AACf,aAAO;AAAA,IACT;AAAA,EACF;AACF;","names":[]}

package/dist/index.d.cts

@@ -1,4 +1,4 @@
-import { SealingKeyProvider } from '@noy-db/hub';
+import { RecipientSealer, SealingKeyProvider } from '@noy-db/hub';
 import { KMSClient } from '@aws-sdk/client-kms';
 
 /**
@@ -69,5 +69,44 @@ interface AwsKmsSealingProviderOptions {
  * Any KMS API error (AccessDenied, InvalidKeyUsage, etc.) propagates as-is.
  */
 declare function awsKmsSealingProvider(opts: AwsKmsSealingProviderOptions): SealingKeyProvider;
+/** Options for {@link awsKmsRecipientSealer}. */
+interface AwsKmsRecipientSealerOptions {
+    /**
+     * KMS key id or ARN of an **asymmetric RSA** key with `KeyUsage:
+     * ENCRYPT_DECRYPT` and `KeySpec` one of `RSA_2048` / `RSA_3072` /
+     * `RSA_4096`. The private key never leaves KMS — unseal runs `Decrypt`.
+     */
+    readonly keyId: string;
+    /** Optional region passed to the default `KMSClient` when no `client` is given. */
+    readonly region?: string;
+    /** Optional pre-built client (DI for tests). Default `new KMSClient({ region? })` (ambient creds). */
+    readonly client?: Pick<KMSClient, 'send'>;
+}
+/**
+ * A {@link RecipientSealer} (plus `unseal`) backed by an **asymmetric RSA**
+ * AWS KMS key. Lets an `at-aws-kms` host act as a recipient target: a grantor
+ * obtains the host's published {@link RecipientHint} (the KMS public key as
+ * PEM) and seals bytes to it *locally* — no KMS call on the seal path. The
+ * host unseals via KMS `Decrypt` with `EncryptionAlgorithm:
+ * RSAES_OAEP_SHA_256`; the private key never leaves KMS.
+ *
+ * Wire format is the canonical recipient-target TLV
+ * ({@link sealRsaOaepTlv}/{@link parseRsaOaepTlv}) shared with hub's
+ * `MemoryRecipientSealer`, so a blob sealed by either side unseals on the
+ * other. WebCrypto RSA-OAEP/SHA-256 and KMS `RSAES_OAEP_SHA_256` are
+ * wire-compatible (RSAES-OAEP, SHA-256, MGF1-SHA256, empty label). KMS
+ * asymmetric keys do not support an encryption context, so none is used.
+ *
+ * Separate from {@link awsKmsSealingProvider} (symmetric self-seal for the
+ * managed passphrase) — this factory targets an asymmetric key.
+ *
+ * @throws Error from `publishRecipientHint` when the key is not an RSA
+ * `ENCRYPT_DECRYPT` key, or `GetPublicKey` returns no public key.
+ * @throws Error from `sealForRecipient` on an unsupported `hint.v`/`hint.alg`.
+ * Any KMS API error (AccessDenied, etc.) propagates as-is.
+ */
+declare function awsKmsRecipientSealer(opts: AwsKmsRecipientSealerOptions): RecipientSealer & {
+    unseal(sealed: Uint8Array): Promise<Uint8Array>;
+};
 
-export { type AwsKmsSealingProviderOptions, awsKmsSealingProvider };
+export { type AwsKmsRecipientSealerOptions, type AwsKmsSealingProviderOptions, awsKmsRecipientSealer, awsKmsSealingProvider };

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-import { SealingKeyProvider } from '@noy-db/hub';
+import { RecipientSealer, SealingKeyProvider } from '@noy-db/hub';
 import { KMSClient } from '@aws-sdk/client-kms';
 
 /**
@@ -69,5 +69,44 @@ interface AwsKmsSealingProviderOptions {
  * Any KMS API error (AccessDenied, InvalidKeyUsage, etc.) propagates as-is.
  */
 declare function awsKmsSealingProvider(opts: AwsKmsSealingProviderOptions): SealingKeyProvider;
+/** Options for {@link awsKmsRecipientSealer}. */
+interface AwsKmsRecipientSealerOptions {
+    /**
+     * KMS key id or ARN of an **asymmetric RSA** key with `KeyUsage:
+     * ENCRYPT_DECRYPT` and `KeySpec` one of `RSA_2048` / `RSA_3072` /
+     * `RSA_4096`. The private key never leaves KMS — unseal runs `Decrypt`.
+     */
+    readonly keyId: string;
+    /** Optional region passed to the default `KMSClient` when no `client` is given. */
+    readonly region?: string;
+    /** Optional pre-built client (DI for tests). Default `new KMSClient({ region? })` (ambient creds). */
+    readonly client?: Pick<KMSClient, 'send'>;
+}
+/**
+ * A {@link RecipientSealer} (plus `unseal`) backed by an **asymmetric RSA**
+ * AWS KMS key. Lets an `at-aws-kms` host act as a recipient target: a grantor
+ * obtains the host's published {@link RecipientHint} (the KMS public key as
+ * PEM) and seals bytes to it *locally* — no KMS call on the seal path. The
+ * host unseals via KMS `Decrypt` with `EncryptionAlgorithm:
+ * RSAES_OAEP_SHA_256`; the private key never leaves KMS.
+ *
+ * Wire format is the canonical recipient-target TLV
+ * ({@link sealRsaOaepTlv}/{@link parseRsaOaepTlv}) shared with hub's
+ * `MemoryRecipientSealer`, so a blob sealed by either side unseals on the
+ * other. WebCrypto RSA-OAEP/SHA-256 and KMS `RSAES_OAEP_SHA_256` are
+ * wire-compatible (RSAES-OAEP, SHA-256, MGF1-SHA256, empty label). KMS
+ * asymmetric keys do not support an encryption context, so none is used.
+ *
+ * Separate from {@link awsKmsSealingProvider} (symmetric self-seal for the
+ * managed passphrase) — this factory targets an asymmetric key.
+ *
+ * @throws Error from `publishRecipientHint` when the key is not an RSA
+ * `ENCRYPT_DECRYPT` key, or `GetPublicKey` returns no public key.
+ * @throws Error from `sealForRecipient` on an unsupported `hint.v`/`hint.alg`.
+ * Any KMS API error (AccessDenied, etc.) propagates as-is.
+ */
+declare function awsKmsRecipientSealer(opts: AwsKmsRecipientSealerOptions): RecipientSealer & {
+    unseal(sealed: Uint8Array): Promise<Uint8Array>;
+};
 
-export { type AwsKmsSealingProviderOptions, awsKmsSealingProvider };
+export { type AwsKmsRecipientSealerOptions, type AwsKmsSealingProviderOptions, awsKmsRecipientSealer, awsKmsSealingProvider };

package/dist/index.js

@@ -1,8 +1,10 @@
 // src/index.ts
+import { sealRsaOaepTlv, parseRsaOaepTlv, aesGcmOpen } from "@noy-db/hub";
 import {
   KMSClient,
   EncryptCommand,
-  DecryptCommand
+  DecryptCommand,
+  GetPublicKeyCommand
 } from "@aws-sdk/client-kms";
 function awsKmsSealingProvider(opts) {
   const client = opts.client ?? new KMSClient({});
@@ -26,7 +28,71 @@ function awsKmsSealingProvider(opts) {
     }
   };
 }
+var SUPPORTED_RSA_KEY_SPECS = /* @__PURE__ */ new Set(["RSA_2048", "RSA_3072", "RSA_4096"]);
+function derSpkiToPem(der) {
+  let binary = "";
+  for (let i = 0; i < der.length; i++) binary += String.fromCharCode(der[i]);
+  const b64 = btoa(binary);
+  return "-----BEGIN PUBLIC KEY-----\n" + (b64.match(/.{1,64}/g) ?? []).join("\n") + "\n-----END PUBLIC KEY-----\n";
+}
+function awsKmsRecipientSealer(opts) {
+  const client = opts.client ?? new KMSClient(opts.region ? { region: opts.region } : {});
+  const id = `aws-kms-recipient:${opts.keyId}`;
+  return {
+    id,
+    async publishRecipientHint() {
+      const out = await client.send(
+        new GetPublicKeyCommand({ KeyId: opts.keyId })
+      );
+      if (out.KeyUsage !== "ENCRYPT_DECRYPT") {
+        throw new Error(
+          `@noy-db/at-aws-kms: awsKmsRecipientSealer requires an ENCRYPT_DECRYPT key, got KeyUsage='${String(out.KeyUsage)}' for ${opts.keyId}`
+        );
+      }
+      if (!out.KeySpec || !SUPPORTED_RSA_KEY_SPECS.has(out.KeySpec)) {
+        throw new Error(
+          `@noy-db/at-aws-kms: awsKmsRecipientSealer requires an RSA key (RSA_2048/3072/4096), got KeySpec='${String(out.KeySpec)}' for ${opts.keyId}`
+        );
+      }
+      const der = out.PublicKey;
+      if (!der) throw new Error("@noy-db/at-aws-kms: KMS GetPublicKey returned no PublicKey");
+      const derBytes = der instanceof Uint8Array ? der : new Uint8Array(der);
+      const publicKeyPem = derSpkiToPem(derBytes);
+      return { v: 1, pid: id, alg: "rsa-oaep-sha256", material: { publicKeyPem } };
+    },
+    async sealForRecipient(plaintext, hint) {
+      if (hint.v !== 1) {
+        throw new Error(`@noy-db/at-aws-kms: awsKmsRecipientSealer.sealForRecipient: unsupported hint.v ${String(hint.v)} (expected 1)`);
+      }
+      if (hint.alg !== "rsa-oaep-sha256") {
+        throw new Error(`@noy-db/at-aws-kms: awsKmsRecipientSealer.sealForRecipient: unsupported hint.alg '${String(hint.alg)}' (expected 'rsa-oaep-sha256')`);
+      }
+      const pem = hint.material["publicKeyPem"];
+      if (typeof pem !== "string") {
+        throw new Error("@noy-db/at-aws-kms: awsKmsRecipientSealer.sealForRecipient: hint.material.publicKeyPem missing or not a string");
+      }
+      return sealRsaOaepTlv(plaintext, pem);
+    },
+    async unseal(sealed) {
+      const { wrapped, iv, ct } = parseRsaOaepTlv(sealed);
+      const out = await client.send(
+        new DecryptCommand({
+          KeyId: opts.keyId,
+          CiphertextBlob: wrapped,
+          EncryptionAlgorithm: "RSAES_OAEP_SHA_256"
+        })
+      );
+      const cek = out.Plaintext;
+      if (!cek) throw new Error("@noy-db/at-aws-kms: KMS Decrypt returned no Plaintext (CEK)");
+      const cekBytes = cek instanceof Uint8Array ? cek : new Uint8Array(cek);
+      const pt = await aesGcmOpen(cekBytes, iv, ct);
+      cekBytes.fill(0);
+      return pt;
+    }
+  };
+}
 export {
+  awsKmsRecipientSealer,
   awsKmsSealingProvider
 };
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts"],"sourcesContent":["/**\n * **@noy-db/at-aws-kms** — AWS KMS sealing key provider for noy-db\n * managed-passphrase mode.\n *\n * An `at-*` provider that seals and unseals the hub-generated random\n * passphrase via AWS KMS Encrypt / Decrypt. Every seal and unseal is an\n * authenticated KMS API call, giving you a CloudTrail-backed access log of\n * every time a user's vault is opened — no additional instrumentation\n * required.\n *\n * ## When to use\n *\n * - Compliance regimes requiring auditable key access logs (FedRAMP, HIPAA\n *   with managed-encryption requirements, SOC 2 Type II).\n * - Workloads already running on AWS where a KMS key costs less than\n *   engineering an equivalent audit trail.\n * - Any case where you want automatic CMK rotation without rotating your\n *   app's sealing key material manually.\n *\n * ## Setup\n *\n * ```bash\n * # 1. Create a KMS key (one-time, in your AWS console or CLI):\n * aws kms create-key --description \"noy-db sealing key\"\n * # Note the KeyId/ARN from the output.\n *\n * # 2. Grant the host's IAM role kms:Encrypt + kms:Decrypt on that key.\n * # Credentials are picked up automatically from the SDK's ambient chain\n * # (IAM role, ~/.aws/credentials, env vars — see AWS SDK docs).\n * ```\n *\n * ```ts\n * // 3. In your app:\n * import { createNoydb } from '@noy-db/hub'\n * import { awsKmsSealingProvider } from '@noy-db/at-aws-kms'\n * import { shamirRecoveryProvider } from '@noy-db/on-shamir'\n *\n * const db = await createNoydb({\n *   store,\n *   user: 'alice',\n *   passphraseMode: 'managed',\n *   sealingKey: awsKmsSealingProvider({ keyId: 'arn:aws:kms:us-east-1:123:key/abc' }),\n *   shamirRecovery: shamirRecoveryProvider(),\n * })\n * ```\n *\n * @packageDocumentation\n */\n\nimport type { SealingKeyProvider } from '@noy-db/hub'\nimport {\n  KMSClient,\n  EncryptCommand,\n  DecryptCommand,\n  type EncryptCommandOutput,\n  type DecryptCommandOutput,\n} from '@aws-sdk/client-kms'\n\n/** Options for {@link awsKmsSealingProvider}. */\nexport interface AwsKmsSealingProviderOptions {\n  /** KMS key id or ARN (e.g. `arn:aws:kms:us-east-1:123:key/abc`). */\n  readonly keyId: string\n  /** Optional pre-built client (DI for tests). Default `new KMSClient({})` (ambient creds). */\n  readonly client?: Pick<KMSClient, 'send'>\n}\n\n/**\n * Build a {@link SealingKeyProvider} backed by AWS KMS Encrypt / Decrypt.\n *\n * Credentials are resolved by the SDK's ambient chain — IAM instance roles,\n * environment variables, or `~/.aws/credentials`. Never pass raw credentials\n * in the options; inject a pre-configured client for non-default auth instead.\n *\n * @throws Error when KMS returns no ciphertext or no plaintext (guards\n * against unexpected SDK-response shapes).\n * Any KMS API error (AccessDenied, InvalidKeyUsage, etc.) propagates as-is.\n */\nexport function awsKmsSealingProvider(opts: AwsKmsSealingProviderOptions): SealingKeyProvider {\n  const client = opts.client ?? new KMSClient({})\n  return {\n    id: `aws-kms:${opts.keyId}`,\n\n    async seal(passphrase) {\n      const out: EncryptCommandOutput = await client.send(\n        new EncryptCommand({ KeyId: opts.keyId, Plaintext: passphrase }),\n      )\n      const blob = out.CiphertextBlob\n      if (!blob) throw new Error('@noy-db/at-aws-kms: KMS Encrypt returned no CiphertextBlob')\n      return blob instanceof Uint8Array ? blob : new Uint8Array(blob)\n    },\n\n    async unseal(sealed) {\n      const out: DecryptCommandOutput = await client.send(\n        new DecryptCommand({ CiphertextBlob: sealed, KeyId: opts.keyId }),\n      )\n      const pt = out.Plaintext\n      if (!pt) throw new Error('@noy-db/at-aws-kms: KMS Decrypt returned no Plaintext')\n      return pt instanceof Uint8Array ? pt : new Uint8Array(pt)\n    },\n  }\n}\n"],"mappings":";AAkDA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OAGK;AAqBA,SAAS,sBAAsB,MAAwD;AAC5F,QAAM,SAAS,KAAK,UAAU,IAAI,UAAU,CAAC,CAAC;AAC9C,SAAO;AAAA,IACL,IAAI,WAAW,KAAK,KAAK;AAAA,IAEzB,MAAM,KAAK,YAAY;AACrB,YAAM,MAA4B,MAAM,OAAO;AAAA,QAC7C,IAAI,eAAe,EAAE,OAAO,KAAK,OAAO,WAAW,WAAW,CAAC;AAAA,MACjE;AACA,YAAM,OAAO,IAAI;AACjB,UAAI,CAAC,KAAM,OAAM,IAAI,MAAM,4DAA4D;AACvF,aAAO,gBAAgB,aAAa,OAAO,IAAI,WAAW,IAAI;AAAA,IAChE;AAAA,IAEA,MAAM,OAAO,QAAQ;AACnB,YAAM,MAA4B,MAAM,OAAO;AAAA,QAC7C,IAAI,eAAe,EAAE,gBAAgB,QAAQ,OAAO,KAAK,MAAM,CAAC;AAAA,MAClE;AACA,YAAM,KAAK,IAAI;AACf,UAAI,CAAC,GAAI,OAAM,IAAI,MAAM,uDAAuD;AAChF,aAAO,cAAc,aAAa,KAAK,IAAI,WAAW,EAAE;AAAA,IAC1D;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["/**\n * **@noy-db/at-aws-kms** — AWS KMS sealing key provider for noy-db\n * managed-passphrase mode.\n *\n * An `at-*` provider that seals and unseals the hub-generated random\n * passphrase via AWS KMS Encrypt / Decrypt. Every seal and unseal is an\n * authenticated KMS API call, giving you a CloudTrail-backed access log of\n * every time a user's vault is opened — no additional instrumentation\n * required.\n *\n * ## When to use\n *\n * - Compliance regimes requiring auditable key access logs (FedRAMP, HIPAA\n *   with managed-encryption requirements, SOC 2 Type II).\n * - Workloads already running on AWS where a KMS key costs less than\n *   engineering an equivalent audit trail.\n * - Any case where you want automatic CMK rotation without rotating your\n *   app's sealing key material manually.\n *\n * ## Setup\n *\n * ```bash\n * # 1. Create a KMS key (one-time, in your AWS console or CLI):\n * aws kms create-key --description \"noy-db sealing key\"\n * # Note the KeyId/ARN from the output.\n *\n * # 2. Grant the host's IAM role kms:Encrypt + kms:Decrypt on that key.\n * # Credentials are picked up automatically from the SDK's ambient chain\n * # (IAM role, ~/.aws/credentials, env vars — see AWS SDK docs).\n * ```\n *\n * ```ts\n * // 3. In your app:\n * import { createNoydb } from '@noy-db/hub'\n * import { awsKmsSealingProvider } from '@noy-db/at-aws-kms'\n * import { shamirRecoveryProvider } from '@noy-db/on-shamir'\n *\n * const db = await createNoydb({\n *   store,\n *   user: 'alice',\n *   passphraseMode: 'managed',\n *   sealingKey: awsKmsSealingProvider({ keyId: 'arn:aws:kms:us-east-1:123:key/abc' }),\n *   shamirRecovery: shamirRecoveryProvider(),\n * })\n * ```\n *\n * @packageDocumentation\n */\n\nimport type { SealingKeyProvider, RecipientSealer, RecipientHint } from '@noy-db/hub'\nimport { sealRsaOaepTlv, parseRsaOaepTlv, aesGcmOpen } from '@noy-db/hub'\nimport {\n  KMSClient,\n  EncryptCommand,\n  DecryptCommand,\n  GetPublicKeyCommand,\n  type EncryptCommandOutput,\n  type DecryptCommandOutput,\n  type GetPublicKeyCommandOutput,\n} from '@aws-sdk/client-kms'\n\n/** Options for {@link awsKmsSealingProvider}. */\nexport interface AwsKmsSealingProviderOptions {\n  /** KMS key id or ARN (e.g. `arn:aws:kms:us-east-1:123:key/abc`). */\n  readonly keyId: string\n  /** Optional pre-built client (DI for tests). Default `new KMSClient({})` (ambient creds). */\n  readonly client?: Pick<KMSClient, 'send'>\n}\n\n/**\n * Build a {@link SealingKeyProvider} backed by AWS KMS Encrypt / Decrypt.\n *\n * Credentials are resolved by the SDK's ambient chain — IAM instance roles,\n * environment variables, or `~/.aws/credentials`. Never pass raw credentials\n * in the options; inject a pre-configured client for non-default auth instead.\n *\n * @throws Error when KMS returns no ciphertext or no plaintext (guards\n * against unexpected SDK-response shapes).\n * Any KMS API error (AccessDenied, InvalidKeyUsage, etc.) propagates as-is.\n */\nexport function awsKmsSealingProvider(opts: AwsKmsSealingProviderOptions): SealingKeyProvider {\n  const client = opts.client ?? new KMSClient({})\n  return {\n    id: `aws-kms:${opts.keyId}`,\n\n    async seal(passphrase) {\n      const out: EncryptCommandOutput = await client.send(\n        new EncryptCommand({ KeyId: opts.keyId, Plaintext: passphrase }),\n      )\n      const blob = out.CiphertextBlob\n      if (!blob) throw new Error('@noy-db/at-aws-kms: KMS Encrypt returned no CiphertextBlob')\n      return blob instanceof Uint8Array ? blob : new Uint8Array(blob)\n    },\n\n    async unseal(sealed) {\n      const out: DecryptCommandOutput = await client.send(\n        new DecryptCommand({ CiphertextBlob: sealed, KeyId: opts.keyId }),\n      )\n      const pt = out.Plaintext\n      if (!pt) throw new Error('@noy-db/at-aws-kms: KMS Decrypt returned no Plaintext')\n      return pt instanceof Uint8Array ? pt : new Uint8Array(pt)\n    },\n  }\n}\n\n/** Options for {@link awsKmsRecipientSealer}. */\nexport interface AwsKmsRecipientSealerOptions {\n  /**\n   * KMS key id or ARN of an **asymmetric RSA** key with `KeyUsage:\n   * ENCRYPT_DECRYPT` and `KeySpec` one of `RSA_2048` / `RSA_3072` /\n   * `RSA_4096`. The private key never leaves KMS — unseal runs `Decrypt`.\n   */\n  readonly keyId: string\n  /** Optional region passed to the default `KMSClient` when no `client` is given. */\n  readonly region?: string\n  /** Optional pre-built client (DI for tests). Default `new KMSClient({ region? })` (ambient creds). */\n  readonly client?: Pick<KMSClient, 'send'>\n}\n\n/** KMS asymmetric key specs this recipient sealer accepts (RSA-OAEP-SHA256 wrap). */\nconst SUPPORTED_RSA_KEY_SPECS = new Set(['RSA_2048', 'RSA_3072', 'RSA_4096'])\n\n/** DER SPKI bytes (from KMS `GetPublicKey`) → PEM SubjectPublicKeyInfo. */\nfunction derSpkiToPem(der: Uint8Array): string {\n  let binary = ''\n  for (let i = 0; i < der.length; i++) binary += String.fromCharCode(der[i]!)\n  const b64 = btoa(binary)\n  return '-----BEGIN PUBLIC KEY-----\\n'\n    + (b64.match(/.{1,64}/g) ?? []).join('\\n')\n    + '\\n-----END PUBLIC KEY-----\\n'\n}\n\n/**\n * A {@link RecipientSealer} (plus `unseal`) backed by an **asymmetric RSA**\n * AWS KMS key. Lets an `at-aws-kms` host act as a recipient target: a grantor\n * obtains the host's published {@link RecipientHint} (the KMS public key as\n * PEM) and seals bytes to it *locally* — no KMS call on the seal path. The\n * host unseals via KMS `Decrypt` with `EncryptionAlgorithm:\n * RSAES_OAEP_SHA_256`; the private key never leaves KMS.\n *\n * Wire format is the canonical recipient-target TLV\n * ({@link sealRsaOaepTlv}/{@link parseRsaOaepTlv}) shared with hub's\n * `MemoryRecipientSealer`, so a blob sealed by either side unseals on the\n * other. WebCrypto RSA-OAEP/SHA-256 and KMS `RSAES_OAEP_SHA_256` are\n * wire-compatible (RSAES-OAEP, SHA-256, MGF1-SHA256, empty label). KMS\n * asymmetric keys do not support an encryption context, so none is used.\n *\n * Separate from {@link awsKmsSealingProvider} (symmetric self-seal for the\n * managed passphrase) — this factory targets an asymmetric key.\n *\n * @throws Error from `publishRecipientHint` when the key is not an RSA\n * `ENCRYPT_DECRYPT` key, or `GetPublicKey` returns no public key.\n * @throws Error from `sealForRecipient` on an unsupported `hint.v`/`hint.alg`.\n * Any KMS API error (AccessDenied, etc.) propagates as-is.\n */\nexport function awsKmsRecipientSealer(\n  opts: AwsKmsRecipientSealerOptions,\n): RecipientSealer & { unseal(sealed: Uint8Array): Promise<Uint8Array> } {\n  const client = opts.client ?? new KMSClient(opts.region ? { region: opts.region } : {})\n  const id = `aws-kms-recipient:${opts.keyId}`\n  return {\n    id,\n\n    async publishRecipientHint(): Promise<RecipientHint> {\n      const out: GetPublicKeyCommandOutput = await client.send(\n        new GetPublicKeyCommand({ KeyId: opts.keyId }),\n      )\n      if (out.KeyUsage !== 'ENCRYPT_DECRYPT') {\n        throw new Error(\n          `@noy-db/at-aws-kms: awsKmsRecipientSealer requires an ENCRYPT_DECRYPT key, got KeyUsage='${String(out.KeyUsage)}' for ${opts.keyId}`,\n        )\n      }\n      if (!out.KeySpec || !SUPPORTED_RSA_KEY_SPECS.has(out.KeySpec)) {\n        throw new Error(\n          `@noy-db/at-aws-kms: awsKmsRecipientSealer requires an RSA key (RSA_2048/3072/4096), got KeySpec='${String(out.KeySpec)}' for ${opts.keyId}`,\n        )\n      }\n      const der = out.PublicKey\n      if (!der) throw new Error('@noy-db/at-aws-kms: KMS GetPublicKey returned no PublicKey')\n      const derBytes = der instanceof Uint8Array ? der : new Uint8Array(der)\n      const publicKeyPem = derSpkiToPem(derBytes)\n      return { v: 1, pid: id, alg: 'rsa-oaep-sha256', material: { publicKeyPem } }\n    },\n\n    async sealForRecipient(plaintext: Uint8Array, hint: RecipientHint): Promise<Uint8Array> {\n      if (hint.v !== 1) {\n        throw new Error(`@noy-db/at-aws-kms: awsKmsRecipientSealer.sealForRecipient: unsupported hint.v ${String(hint.v)} (expected 1)`)\n      }\n      if (hint.alg !== 'rsa-oaep-sha256') {\n        throw new Error(`@noy-db/at-aws-kms: awsKmsRecipientSealer.sealForRecipient: unsupported hint.alg '${String(hint.alg)}' (expected 'rsa-oaep-sha256')`)\n      }\n      const pem = hint.material['publicKeyPem']\n      if (typeof pem !== 'string') {\n        throw new Error('@noy-db/at-aws-kms: awsKmsRecipientSealer.sealForRecipient: hint.material.publicKeyPem missing or not a string')\n      }\n      // Grantor seals LOCALLY — no KMS call.\n      return sealRsaOaepTlv(plaintext, pem)\n    },\n\n    async unseal(sealed: Uint8Array): Promise<Uint8Array> {\n      const { wrapped, iv, ct } = parseRsaOaepTlv(sealed)\n      // RSA-unwrap the CEK via KMS — the private key never leaves KMS.\n      const out: DecryptCommandOutput = await client.send(\n        new DecryptCommand({\n          KeyId: opts.keyId,\n          CiphertextBlob: wrapped,\n          EncryptionAlgorithm: 'RSAES_OAEP_SHA_256',\n        }),\n      )\n      const cek = out.Plaintext\n      if (!cek) throw new Error('@noy-db/at-aws-kms: KMS Decrypt returned no Plaintext (CEK)')\n      const cekBytes = cek instanceof Uint8Array ? cek : new Uint8Array(cek)\n      const pt = await aesGcmOpen(cekBytes, iv, ct)\n      cekBytes.fill(0)\n      return pt\n    },\n  }\n}\n"],"mappings":";AAkDA,SAAS,gBAAgB,iBAAiB,kBAAkB;AAC5D;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAIK;AAqBA,SAAS,sBAAsB,MAAwD;AAC5F,QAAM,SAAS,KAAK,UAAU,IAAI,UAAU,CAAC,CAAC;AAC9C,SAAO;AAAA,IACL,IAAI,WAAW,KAAK,KAAK;AAAA,IAEzB,MAAM,KAAK,YAAY;AACrB,YAAM,MAA4B,MAAM,OAAO;AAAA,QAC7C,IAAI,eAAe,EAAE,OAAO,KAAK,OAAO,WAAW,WAAW,CAAC;AAAA,MACjE;AACA,YAAM,OAAO,IAAI;AACjB,UAAI,CAAC,KAAM,OAAM,IAAI,MAAM,4DAA4D;AACvF,aAAO,gBAAgB,aAAa,OAAO,IAAI,WAAW,IAAI;AAAA,IAChE;AAAA,IAEA,MAAM,OAAO,QAAQ;AACnB,YAAM,MAA4B,MAAM,OAAO;AAAA,QAC7C,IAAI,eAAe,EAAE,gBAAgB,QAAQ,OAAO,KAAK,MAAM,CAAC;AAAA,MAClE;AACA,YAAM,KAAK,IAAI;AACf,UAAI,CAAC,GAAI,OAAM,IAAI,MAAM,uDAAuD;AAChF,aAAO,cAAc,aAAa,KAAK,IAAI,WAAW,EAAE;AAAA,IAC1D;AAAA,EACF;AACF;AAiBA,IAAM,0BAA0B,oBAAI,IAAI,CAAC,YAAY,YAAY,UAAU,CAAC;AAG5E,SAAS,aAAa,KAAyB;AAC7C,MAAI,SAAS;AACb,WAAS,IAAI,GAAG,IAAI,IAAI,QAAQ,IAAK,WAAU,OAAO,aAAa,IAAI,CAAC,CAAE;AAC1E,QAAM,MAAM,KAAK,MAAM;AACvB,SAAO,kCACF,IAAI,MAAM,UAAU,KAAK,CAAC,GAAG,KAAK,IAAI,IACvC;AACN;AAyBO,SAAS,sBACd,MACuE;AACvE,QAAM,SAAS,KAAK,UAAU,IAAI,UAAU,KAAK,SAAS,EAAE,QAAQ,KAAK,OAAO,IAAI,CAAC,CAAC;AACtF,QAAM,KAAK,qBAAqB,KAAK,KAAK;AAC1C,SAAO;AAAA,IACL;AAAA,IAEA,MAAM,uBAA+C;AACnD,YAAM,MAAiC,MAAM,OAAO;AAAA,QAClD,IAAI,oBAAoB,EAAE,OAAO,KAAK,MAAM,CAAC;AAAA,MAC/C;AACA,UAAI,IAAI,aAAa,mBAAmB;AACtC,cAAM,IAAI;AAAA,UACR,4FAA4F,OAAO,IAAI,QAAQ,CAAC,SAAS,KAAK,KAAK;AAAA,QACrI;AAAA,MACF;AACA,UAAI,CAAC,IAAI,WAAW,CAAC,wBAAwB,IAAI,IAAI,OAAO,GAAG;AAC7D,cAAM,IAAI;AAAA,UACR,oGAAoG,OAAO,IAAI,OAAO,CAAC,SAAS,KAAK,KAAK;AAAA,QAC5I;AAAA,MACF;AACA,YAAM,MAAM,IAAI;AAChB,UAAI,CAAC,IAAK,OAAM,IAAI,MAAM,4DAA4D;AACtF,YAAM,WAAW,eAAe,aAAa,MAAM,IAAI,WAAW,GAAG;AACrE,YAAM,eAAe,aAAa,QAAQ;AAC1C,aAAO,EAAE,GAAG,GAAG,KAAK,IAAI,KAAK,mBAAmB,UAAU,EAAE,aAAa,EAAE;AAAA,IAC7E;AAAA,IAEA,MAAM,iBAAiB,WAAuB,MAA0C;AACtF,UAAI,KAAK,MAAM,GAAG;AAChB,cAAM,IAAI,MAAM,kFAAkF,OAAO,KAAK,CAAC,CAAC,eAAe;AAAA,MACjI;AACA,UAAI,KAAK,QAAQ,mBAAmB;AAClC,cAAM,IAAI,MAAM,qFAAqF,OAAO,KAAK,GAAG,CAAC,gCAAgC;AAAA,MACvJ;AACA,YAAM,MAAM,KAAK,SAAS,cAAc;AACxC,UAAI,OAAO,QAAQ,UAAU;AAC3B,cAAM,IAAI,MAAM,gHAAgH;AAAA,MAClI;AAEA,aAAO,eAAe,WAAW,GAAG;AAAA,IACtC;AAAA,IAEA,MAAM,OAAO,QAAyC;AACpD,YAAM,EAAE,SAAS,IAAI,GAAG,IAAI,gBAAgB,MAAM;AAElD,YAAM,MAA4B,MAAM,OAAO;AAAA,QAC7C,IAAI,eAAe;AAAA,UACjB,OAAO,KAAK;AAAA,UACZ,gBAAgB;AAAA,UAChB,qBAAqB;AAAA,QACvB,CAAC;AAAA,MACH;AACA,YAAM,MAAM,IAAI;AAChB,UAAI,CAAC,IAAK,OAAM,IAAI,MAAM,6DAA6D;AACvF,YAAM,WAAW,eAAe,aAAa,MAAM,IAAI,WAAW,GAAG;AACrE,YAAM,KAAK,MAAM,WAAW,UAAU,IAAI,EAAE;AAC5C,eAAS,KAAK,CAAC;AACf,aAAO;AAAA,IACT;AAAA,EACF;AACF;","names":[]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@noy-db/at-aws-kms",
-  "version": "0.2.0-pre.16",
+  "version": "0.2.0-pre.18",
   "description": "AWS KMS sealing key provider for noy-db managed-passphrase mode — seal/unseal via KMS Encrypt/Decrypt, with KMS access logs.",
   "license": "MIT",
   "author": "vLannaAi <vicio@lanna.ai>",
@@ -40,14 +40,14 @@
   },
   "peerDependencies": {
     "@aws-sdk/client-kms": "^3.0.0",
-    "@noy-db/hub": "0.2.0-pre.16"
+    "@noy-db/hub": "0.2.0-pre.18"
   },
   "devDependencies": {
     "@types/node": "^22.0.0",
     "@aws-sdk/client-kms": "^3.0.0",
-    "@noy-db/hub": "0.2.0-pre.16",
-    "@noy-db/on-shamir": "0.2.0-pre.16",
-    "@noy-db/to-memory": "0.2.0-pre.16"
+    "@noy-db/hub": "0.2.0-pre.18",
+    "@noy-db/to-memory": "0.2.0-pre.18",
+    "@noy-db/on-shamir": "0.2.0-pre.18"
   },
   "keywords": [
     "noy-db",