@noy-db/at-aws-kms 0.6.0 → 0.7.0-pre.1

package/README.md

@@ -28,14 +28,14 @@ aws kms create-key --description "noy-db sealing key"
 ```ts
 // 3. In your app:
 import { createNoydb } from '@noy-db/hub'
-import { awsKmsSealingProvider } from '@noy-db/at-aws-kms'
+import { atAwsKms } from '@noy-db/at-aws-kms'
 import { shamirRecoveryProvider } from '@noy-db/on-shamir'
 
 const db = await createNoydb({
   store,
   user: 'alice',
   secretMode: 'managed',
-  sealingKey: awsKmsSealingProvider({ keyId: 'arn:aws:kms:us-east-1:123456789012:key/abc' }),
+  sealingKey: atAwsKms({ keyId: 'arn:aws:kms:us-east-1:123456789012:key/abc' }),
   shamirRecovery: shamirRecoveryProvider(),
 })
 
@@ -55,7 +55,7 @@ const vault = await db.openVault('acme')
 ## When NOT to use this provider
 
 - ❌ Non-AWS or multi-cloud deployments where adding an AWS dependency is undesirable. Use [`@noy-db/at-env`](../at-env) for a zero-extra-dependency option.
-- ❌ Local dev / CI where you don't want real KMS calls or AWS credentials in CI. Use [`@noy-db/at-env`](../at-env) or `MemorySealingKeyProvider` from `@noy-db/hub` instead.
+- ❌ Local dev / CI where you don't want real KMS calls or AWS credentials in CI. Use [`@noy-db/at-env`](../at-env) or `MemorySealer` from `@noy-db/hub` instead.
 
 ## Key rotation
 
@@ -64,15 +64,15 @@ KMS supports automatic key rotation for symmetric keys. Enable it on the CMK and
 ## API
 
 ```ts
-function awsKmsSealingProvider(opts: {
+function atAwsKms(opts: {
   keyId: string                    // KMS key id or full ARN
   client?: Pick<KMSClient, 'send'> // optional pre-built client (useful for tests)
-}): SealingKeyProvider
+}): NoydbSealer
 ```
 
 Never pass raw AWS credentials in the options — inject a pre-configured `KMSClient` for non-default auth. The default `new KMSClient({})` resolves credentials via the SDK's ambient chain.
 
-Returns a [`SealingKeyProvider`](../hub/src/team/managed-secret.ts) — the contract `@noy-db/hub`'s managed-secret mode consumes.
+Returns a [`NoydbSealer`](../hub/src/port/at/index.ts) — importable as `@noy-db/hub/at` — the contract `@noy-db/hub`'s managed-secret mode consumes.
 
 ## License
 

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-import { RecipientSealer, SealingKeyProvider } from '@noy-db/hub';
+import { NoydbSealer, RecipientSealer } from '@noy-db/hub/at';
 import { KMSClient } from '@aws-sdk/client-kms';
 
 /**
@@ -35,14 +35,14 @@ import { KMSClient } from '@aws-sdk/client-kms';
  * ```ts
  * // 3. In your app:
  * import { createNoydb } from '@noy-db/hub'
- * import { awsKmsSealingProvider } from '@noy-db/at-aws-kms'
+ * import { atAwsKms } from '@noy-db/at-aws-kms'
  * import { shamirRecoveryProvider } from '@noy-db/on-shamir'
  *
  * const db = await createNoydb({
  *   store,
  *   user: 'alice',
  *   secretMode: 'managed',
- *   sealingKey: awsKmsSealingProvider({ keyId: 'arn:aws:kms:us-east-1:123:key/abc' }),
+ *   sealingKey: atAwsKms({ keyId: 'arn:aws:kms:us-east-1:123:key/abc' }),
  *   shamirRecovery: shamirRecoveryProvider(),
  * })
  * ```
@@ -50,15 +50,15 @@ import { KMSClient } from '@aws-sdk/client-kms';
  * @packageDocumentation
  */
 
-/** Options for {@link awsKmsSealingProvider}. */
-interface AwsKmsSealingProviderOptions {
+/** Options for {@link atAwsKms}. */
+interface AtAwsKmsOptions {
     /** KMS key id or ARN (e.g. `arn:aws:kms:us-east-1:123:key/abc`). */
     readonly keyId: string;
     /** Optional pre-built client (DI for tests). Default `new KMSClient({})` (ambient creds). */
     readonly client?: Pick<KMSClient, 'send'>;
 }
 /**
- * Build a {@link SealingKeyProvider} backed by AWS KMS Encrypt / Decrypt.
+ * Build a {@link NoydbSealer} backed by AWS KMS Encrypt / Decrypt.
  *
  * Credentials are resolved by the SDK's ambient chain — IAM instance roles,
  * environment variables, or `~/.aws/credentials`. Never pass raw credentials
@@ -68,7 +68,7 @@ interface AwsKmsSealingProviderOptions {
  * against unexpected SDK-response shapes).
  * Any KMS API error (AccessDenied, InvalidKeyUsage, etc.) propagates as-is.
  */
-declare function awsKmsSealingProvider(opts: AwsKmsSealingProviderOptions): SealingKeyProvider;
+declare function atAwsKms(opts: AtAwsKmsOptions): NoydbSealer;
 /** Options for {@link awsKmsRecipientSealer}. */
 interface AwsKmsRecipientSealerOptions {
     /**
@@ -97,7 +97,7 @@ interface AwsKmsRecipientSealerOptions {
  * wire-compatible (RSAES-OAEP, SHA-256, MGF1-SHA256, empty label). KMS
  * asymmetric keys do not support an encryption context, so none is used.
  *
- * Separate from {@link awsKmsSealingProvider} (symmetric self-seal for the
+ * Separate from {@link atAwsKms} (symmetric self-seal for the
  * managed secret) — this factory targets an asymmetric key.
  *
  * @throws Error from `publishRecipientHint` when the key is not an RSA
@@ -109,4 +109,4 @@ declare function awsKmsRecipientSealer(opts: AwsKmsRecipientSealerOptions): Reci
     unseal(sealed: Uint8Array): Promise<Uint8Array>;
 };
 
-export { type AwsKmsRecipientSealerOptions, type AwsKmsSealingProviderOptions, awsKmsRecipientSealer, awsKmsSealingProvider };
+export { type AtAwsKmsOptions, type AwsKmsRecipientSealerOptions, atAwsKms, awsKmsRecipientSealer };

package/dist/index.js

@@ -6,7 +6,7 @@ import {
   DecryptCommand,
   GetPublicKeyCommand
 } from "@aws-sdk/client-kms";
-function awsKmsSealingProvider(opts) {
+function atAwsKms(opts) {
   const client = opts.client ?? new KMSClient({});
   return {
     id: `aws-kms:${opts.keyId}`,
@@ -92,7 +92,7 @@ function awsKmsRecipientSealer(opts) {
   };
 }
 export {
-  awsKmsRecipientSealer,
-  awsKmsSealingProvider
+  atAwsKms,
+  awsKmsRecipientSealer
 };
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts"],"sourcesContent":["/**\n * **@noy-db/at-aws-kms** — AWS KMS sealing key provider for noy-db\n * managed-secret mode.\n *\n * An `at-*` provider that seals and unseals the hub-generated random\n * secret via AWS KMS Encrypt / Decrypt. Every seal and unseal is an\n * authenticated KMS API call, giving you a CloudTrail-backed access log of\n * every time a user's vault is opened — no additional instrumentation\n * required.\n *\n * ## When to use\n *\n * - Compliance regimes requiring auditable key access logs (FedRAMP, HIPAA\n *   with managed-encryption requirements, SOC 2 Type II).\n * - Workloads already running on AWS where a KMS key costs less than\n *   engineering an equivalent audit trail.\n * - Any case where you want automatic CMK rotation without rotating your\n *   app's sealing key material manually.\n *\n * ## Setup\n *\n * ```bash\n * # 1. Create a KMS key (one-time, in your AWS console or CLI):\n * aws kms create-key --description \"noy-db sealing key\"\n * # Note the KeyId/ARN from the output.\n *\n * # 2. Grant the host's IAM role kms:Encrypt + kms:Decrypt on that key.\n * # Credentials are picked up automatically from the SDK's ambient chain\n * # (IAM role, ~/.aws/credentials, env vars — see AWS SDK docs).\n * ```\n *\n * ```ts\n * // 3. In your app:\n * import { createNoydb } from '@noy-db/hub'\n * import { awsKmsSealingProvider } from '@noy-db/at-aws-kms'\n * import { shamirRecoveryProvider } from '@noy-db/on-shamir'\n *\n * const db = await createNoydb({\n *   store,\n *   user: 'alice',\n *   secretMode: 'managed',\n *   sealingKey: awsKmsSealingProvider({ keyId: 'arn:aws:kms:us-east-1:123:key/abc' }),\n *   shamirRecovery: shamirRecoveryProvider(),\n * })\n * ```\n *\n * @packageDocumentation\n */\n\nimport type { SealingKeyProvider, RecipientSealer, RecipientHint } from '@noy-db/hub'\nimport { sealRsaOaepTlv, parseRsaOaepTlv, aesGcmOpen } from '@noy-db/hub'\nimport {\n  KMSClient,\n  EncryptCommand,\n  DecryptCommand,\n  GetPublicKeyCommand,\n  type EncryptCommandOutput,\n  type DecryptCommandOutput,\n  type GetPublicKeyCommandOutput,\n} from '@aws-sdk/client-kms'\n\n/** Options for {@link awsKmsSealingProvider}. */\nexport interface AwsKmsSealingProviderOptions {\n  /** KMS key id or ARN (e.g. `arn:aws:kms:us-east-1:123:key/abc`). */\n  readonly keyId: string\n  /** Optional pre-built client (DI for tests). Default `new KMSClient({})` (ambient creds). */\n  readonly client?: Pick<KMSClient, 'send'>\n}\n\n/**\n * Build a {@link SealingKeyProvider} backed by AWS KMS Encrypt / Decrypt.\n *\n * Credentials are resolved by the SDK's ambient chain — IAM instance roles,\n * environment variables, or `~/.aws/credentials`. Never pass raw credentials\n * in the options; inject a pre-configured client for non-default auth instead.\n *\n * @throws Error when KMS returns no ciphertext or no plaintext (guards\n * against unexpected SDK-response shapes).\n * Any KMS API error (AccessDenied, InvalidKeyUsage, etc.) propagates as-is.\n */\nexport function awsKmsSealingProvider(opts: AwsKmsSealingProviderOptions): SealingKeyProvider {\n  const client = opts.client ?? new KMSClient({})\n  return {\n    id: `aws-kms:${opts.keyId}`,\n\n    async seal(secret) {\n      const out: EncryptCommandOutput = await client.send(\n        new EncryptCommand({ KeyId: opts.keyId, Plaintext: secret }),\n      )\n      const blob = out.CiphertextBlob\n      if (!blob) throw new Error('@noy-db/at-aws-kms: KMS Encrypt returned no CiphertextBlob')\n      return blob instanceof Uint8Array ? blob : new Uint8Array(blob)\n    },\n\n    async unseal(sealed) {\n      const out: DecryptCommandOutput = await client.send(\n        new DecryptCommand({ CiphertextBlob: sealed, KeyId: opts.keyId }),\n      )\n      const pt = out.Plaintext\n      if (!pt) throw new Error('@noy-db/at-aws-kms: KMS Decrypt returned no Plaintext')\n      return pt instanceof Uint8Array ? pt : new Uint8Array(pt)\n    },\n  }\n}\n\n/** Options for {@link awsKmsRecipientSealer}. */\nexport interface AwsKmsRecipientSealerOptions {\n  /**\n   * KMS key id or ARN of an **asymmetric RSA** key with `KeyUsage:\n   * ENCRYPT_DECRYPT` and `KeySpec` one of `RSA_2048` / `RSA_3072` /\n   * `RSA_4096`. The private key never leaves KMS — unseal runs `Decrypt`.\n   */\n  readonly keyId: string\n  /** Optional region passed to the default `KMSClient` when no `client` is given. */\n  readonly region?: string\n  /** Optional pre-built client (DI for tests). Default `new KMSClient({ region? })` (ambient creds). */\n  readonly client?: Pick<KMSClient, 'send'>\n}\n\n/** KMS asymmetric key specs this recipient sealer accepts (RSA-OAEP-SHA256 wrap). */\nconst SUPPORTED_RSA_KEY_SPECS = new Set(['RSA_2048', 'RSA_3072', 'RSA_4096'])\n\n/** DER SPKI bytes (from KMS `GetPublicKey`) → PEM SubjectPublicKeyInfo. */\nfunction derSpkiToPem(der: Uint8Array): string {\n  let binary = ''\n  for (let i = 0; i < der.length; i++) binary += String.fromCharCode(der[i]!)\n  const b64 = btoa(binary)\n  return '-----BEGIN PUBLIC KEY-----\\n'\n    + (b64.match(/.{1,64}/g) ?? []).join('\\n')\n    + '\\n-----END PUBLIC KEY-----\\n'\n}\n\n/**\n * A {@link RecipientSealer} (plus `unseal`) backed by an **asymmetric RSA**\n * AWS KMS key. Lets an `at-aws-kms` host act as a recipient target: a grantor\n * obtains the host's published {@link RecipientHint} (the KMS public key as\n * PEM) and seals bytes to it *locally* — no KMS call on the seal path. The\n * host unseals via KMS `Decrypt` with `EncryptionAlgorithm:\n * RSAES_OAEP_SHA_256`; the private key never leaves KMS.\n *\n * Wire format is the canonical recipient-target TLV\n * ({@link sealRsaOaepTlv}/{@link parseRsaOaepTlv}) shared with hub's\n * `MemoryRecipientSealer`, so a blob sealed by either side unseals on the\n * other. WebCrypto RSA-OAEP/SHA-256 and KMS `RSAES_OAEP_SHA_256` are\n * wire-compatible (RSAES-OAEP, SHA-256, MGF1-SHA256, empty label). KMS\n * asymmetric keys do not support an encryption context, so none is used.\n *\n * Separate from {@link awsKmsSealingProvider} (symmetric self-seal for the\n * managed secret) — this factory targets an asymmetric key.\n *\n * @throws Error from `publishRecipientHint` when the key is not an RSA\n * `ENCRYPT_DECRYPT` key, or `GetPublicKey` returns no public key.\n * @throws Error from `sealForRecipient` on an unsupported `hint.v`/`hint.alg`.\n * Any KMS API error (AccessDenied, etc.) propagates as-is.\n */\nexport function awsKmsRecipientSealer(\n  opts: AwsKmsRecipientSealerOptions,\n): RecipientSealer & { unseal(sealed: Uint8Array): Promise<Uint8Array> } {\n  const client = opts.client ?? new KMSClient(opts.region ? { region: opts.region } : {})\n  const id = `aws-kms-recipient:${opts.keyId}`\n  return {\n    id,\n\n    async publishRecipientHint(): Promise<RecipientHint> {\n      const out: GetPublicKeyCommandOutput = await client.send(\n        new GetPublicKeyCommand({ KeyId: opts.keyId }),\n      )\n      if (out.KeyUsage !== 'ENCRYPT_DECRYPT') {\n        throw new Error(\n          `@noy-db/at-aws-kms: awsKmsRecipientSealer requires an ENCRYPT_DECRYPT key, got KeyUsage='${String(out.KeyUsage)}' for ${opts.keyId}`,\n        )\n      }\n      if (!out.KeySpec || !SUPPORTED_RSA_KEY_SPECS.has(out.KeySpec)) {\n        throw new Error(\n          `@noy-db/at-aws-kms: awsKmsRecipientSealer requires an RSA key (RSA_2048/3072/4096), got KeySpec='${String(out.KeySpec)}' for ${opts.keyId}`,\n        )\n      }\n      const der = out.PublicKey\n      if (!der) throw new Error('@noy-db/at-aws-kms: KMS GetPublicKey returned no PublicKey')\n      const derBytes = der instanceof Uint8Array ? der : new Uint8Array(der)\n      const publicKeyPem = derSpkiToPem(derBytes)\n      return { v: 1, pid: id, alg: 'rsa-oaep-sha256', material: { publicKeyPem } }\n    },\n\n    async sealForRecipient(plaintext: Uint8Array, hint: RecipientHint): Promise<Uint8Array> {\n      if (hint.v !== 1) {\n        throw new Error(`@noy-db/at-aws-kms: awsKmsRecipientSealer.sealForRecipient: unsupported hint.v ${String(hint.v)} (expected 1)`)\n      }\n      if (hint.alg !== 'rsa-oaep-sha256') {\n        throw new Error(`@noy-db/at-aws-kms: awsKmsRecipientSealer.sealForRecipient: unsupported hint.alg '${String(hint.alg)}' (expected 'rsa-oaep-sha256')`)\n      }\n      const pem = hint.material['publicKeyPem']\n      if (typeof pem !== 'string') {\n        throw new Error('@noy-db/at-aws-kms: awsKmsRecipientSealer.sealForRecipient: hint.material.publicKeyPem missing or not a string')\n      }\n      // Grantor seals LOCALLY — no KMS call.\n      return sealRsaOaepTlv(plaintext, pem)\n    },\n\n    async unseal(sealed: Uint8Array): Promise<Uint8Array> {\n      const { wrapped, iv, ct } = parseRsaOaepTlv(sealed)\n      // RSA-unwrap the CEK via KMS — the private key never leaves KMS.\n      const out: DecryptCommandOutput = await client.send(\n        new DecryptCommand({\n          KeyId: opts.keyId,\n          CiphertextBlob: wrapped,\n          EncryptionAlgorithm: 'RSAES_OAEP_SHA_256',\n        }),\n      )\n      const cek = out.Plaintext\n      if (!cek) throw new Error('@noy-db/at-aws-kms: KMS Decrypt returned no Plaintext (CEK)')\n      const cekBytes = cek instanceof Uint8Array ? cek : new Uint8Array(cek)\n      const pt = await aesGcmOpen(cekBytes, iv, ct)\n      cekBytes.fill(0)\n      return pt\n    },\n  }\n}\n"],"mappings":";AAkDA,SAAS,gBAAgB,iBAAiB,kBAAkB;AAC5D;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAIK;AAqBA,SAAS,sBAAsB,MAAwD;AAC5F,QAAM,SAAS,KAAK,UAAU,IAAI,UAAU,CAAC,CAAC;AAC9C,SAAO;AAAA,IACL,IAAI,WAAW,KAAK,KAAK;AAAA,IAEzB,MAAM,KAAK,QAAQ;AACjB,YAAM,MAA4B,MAAM,OAAO;AAAA,QAC7C,IAAI,eAAe,EAAE,OAAO,KAAK,OAAO,WAAW,OAAO,CAAC;AAAA,MAC7D;AACA,YAAM,OAAO,IAAI;AACjB,UAAI,CAAC,KAAM,OAAM,IAAI,MAAM,4DAA4D;AACvF,aAAO,gBAAgB,aAAa,OAAO,IAAI,WAAW,IAAI;AAAA,IAChE;AAAA,IAEA,MAAM,OAAO,QAAQ;AACnB,YAAM,MAA4B,MAAM,OAAO;AAAA,QAC7C,IAAI,eAAe,EAAE,gBAAgB,QAAQ,OAAO,KAAK,MAAM,CAAC;AAAA,MAClE;AACA,YAAM,KAAK,IAAI;AACf,UAAI,CAAC,GAAI,OAAM,IAAI,MAAM,uDAAuD;AAChF,aAAO,cAAc,aAAa,KAAK,IAAI,WAAW,EAAE;AAAA,IAC1D;AAAA,EACF;AACF;AAiBA,IAAM,0BAA0B,oBAAI,IAAI,CAAC,YAAY,YAAY,UAAU,CAAC;AAG5E,SAAS,aAAa,KAAyB;AAC7C,MAAI,SAAS;AACb,WAAS,IAAI,GAAG,IAAI,IAAI,QAAQ,IAAK,WAAU,OAAO,aAAa,IAAI,CAAC,CAAE;AAC1E,QAAM,MAAM,KAAK,MAAM;AACvB,SAAO,kCACF,IAAI,MAAM,UAAU,KAAK,CAAC,GAAG,KAAK,IAAI,IACvC;AACN;AAyBO,SAAS,sBACd,MACuE;AACvE,QAAM,SAAS,KAAK,UAAU,IAAI,UAAU,KAAK,SAAS,EAAE,QAAQ,KAAK,OAAO,IAAI,CAAC,CAAC;AACtF,QAAM,KAAK,qBAAqB,KAAK,KAAK;AAC1C,SAAO;AAAA,IACL;AAAA,IAEA,MAAM,uBAA+C;AACnD,YAAM,MAAiC,MAAM,OAAO;AAAA,QAClD,IAAI,oBAAoB,EAAE,OAAO,KAAK,MAAM,CAAC;AAAA,MAC/C;AACA,UAAI,IAAI,aAAa,mBAAmB;AACtC,cAAM,IAAI;AAAA,UACR,4FAA4F,OAAO,IAAI,QAAQ,CAAC,SAAS,KAAK,KAAK;AAAA,QACrI;AAAA,MACF;AACA,UAAI,CAAC,IAAI,WAAW,CAAC,wBAAwB,IAAI,IAAI,OAAO,GAAG;AAC7D,cAAM,IAAI;AAAA,UACR,oGAAoG,OAAO,IAAI,OAAO,CAAC,SAAS,KAAK,KAAK;AAAA,QAC5I;AAAA,MACF;AACA,YAAM,MAAM,IAAI;AAChB,UAAI,CAAC,IAAK,OAAM,IAAI,MAAM,4DAA4D;AACtF,YAAM,WAAW,eAAe,aAAa,MAAM,IAAI,WAAW,GAAG;AACrE,YAAM,eAAe,aAAa,QAAQ;AAC1C,aAAO,EAAE,GAAG,GAAG,KAAK,IAAI,KAAK,mBAAmB,UAAU,EAAE,aAAa,EAAE;AAAA,IAC7E;AAAA,IAEA,MAAM,iBAAiB,WAAuB,MAA0C;AACtF,UAAI,KAAK,MAAM,GAAG;AAChB,cAAM,IAAI,MAAM,kFAAkF,OAAO,KAAK,CAAC,CAAC,eAAe;AAAA,MACjI;AACA,UAAI,KAAK,QAAQ,mBAAmB;AAClC,cAAM,IAAI,MAAM,qFAAqF,OAAO,KAAK,GAAG,CAAC,gCAAgC;AAAA,MACvJ;AACA,YAAM,MAAM,KAAK,SAAS,cAAc;AACxC,UAAI,OAAO,QAAQ,UAAU;AAC3B,cAAM,IAAI,MAAM,gHAAgH;AAAA,MAClI;AAEA,aAAO,eAAe,WAAW,GAAG;AAAA,IACtC;AAAA,IAEA,MAAM,OAAO,QAAyC;AACpD,YAAM,EAAE,SAAS,IAAI,GAAG,IAAI,gBAAgB,MAAM;AAElD,YAAM,MAA4B,MAAM,OAAO;AAAA,QAC7C,IAAI,eAAe;AAAA,UACjB,OAAO,KAAK;AAAA,UACZ,gBAAgB;AAAA,UAChB,qBAAqB;AAAA,QACvB,CAAC;AAAA,MACH;AACA,YAAM,MAAM,IAAI;AAChB,UAAI,CAAC,IAAK,OAAM,IAAI,MAAM,6DAA6D;AACvF,YAAM,WAAW,eAAe,aAAa,MAAM,IAAI,WAAW,GAAG;AACrE,YAAM,KAAK,MAAM,WAAW,UAAU,IAAI,EAAE;AAC5C,eAAS,KAAK,CAAC;AACf,aAAO;AAAA,IACT;AAAA,EACF;AACF;","names":[]}
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["/**\n * **@noy-db/at-aws-kms** — AWS KMS sealing key provider for noy-db\n * managed-secret mode.\n *\n * An `at-*` provider that seals and unseals the hub-generated random\n * secret via AWS KMS Encrypt / Decrypt. Every seal and unseal is an\n * authenticated KMS API call, giving you a CloudTrail-backed access log of\n * every time a user's vault is opened — no additional instrumentation\n * required.\n *\n * ## When to use\n *\n * - Compliance regimes requiring auditable key access logs (FedRAMP, HIPAA\n *   with managed-encryption requirements, SOC 2 Type II).\n * - Workloads already running on AWS where a KMS key costs less than\n *   engineering an equivalent audit trail.\n * - Any case where you want automatic CMK rotation without rotating your\n *   app's sealing key material manually.\n *\n * ## Setup\n *\n * ```bash\n * # 1. Create a KMS key (one-time, in your AWS console or CLI):\n * aws kms create-key --description \"noy-db sealing key\"\n * # Note the KeyId/ARN from the output.\n *\n * # 2. Grant the host's IAM role kms:Encrypt + kms:Decrypt on that key.\n * # Credentials are picked up automatically from the SDK's ambient chain\n * # (IAM role, ~/.aws/credentials, env vars — see AWS SDK docs).\n * ```\n *\n * ```ts\n * // 3. In your app:\n * import { createNoydb } from '@noy-db/hub'\n * import { atAwsKms } from '@noy-db/at-aws-kms'\n * import { shamirRecoveryProvider } from '@noy-db/on-shamir'\n *\n * const db = await createNoydb({\n *   store,\n *   user: 'alice',\n *   secretMode: 'managed',\n *   sealingKey: atAwsKms({ keyId: 'arn:aws:kms:us-east-1:123:key/abc' }),\n *   shamirRecovery: shamirRecoveryProvider(),\n * })\n * ```\n *\n * @packageDocumentation\n */\n\nimport type { NoydbSealer, RecipientSealer, RecipientHint } from '@noy-db/hub/at'\nimport { sealRsaOaepTlv, parseRsaOaepTlv, aesGcmOpen } from '@noy-db/hub'\nimport {\n  KMSClient,\n  EncryptCommand,\n  DecryptCommand,\n  GetPublicKeyCommand,\n  type EncryptCommandOutput,\n  type DecryptCommandOutput,\n  type GetPublicKeyCommandOutput,\n} from '@aws-sdk/client-kms'\n\n/** Options for {@link atAwsKms}. */\nexport interface AtAwsKmsOptions {\n  /** KMS key id or ARN (e.g. `arn:aws:kms:us-east-1:123:key/abc`). */\n  readonly keyId: string\n  /** Optional pre-built client (DI for tests). Default `new KMSClient({})` (ambient creds). */\n  readonly client?: Pick<KMSClient, 'send'>\n}\n\n/**\n * Build a {@link NoydbSealer} backed by AWS KMS Encrypt / Decrypt.\n *\n * Credentials are resolved by the SDK's ambient chain — IAM instance roles,\n * environment variables, or `~/.aws/credentials`. Never pass raw credentials\n * in the options; inject a pre-configured client for non-default auth instead.\n *\n * @throws Error when KMS returns no ciphertext or no plaintext (guards\n * against unexpected SDK-response shapes).\n * Any KMS API error (AccessDenied, InvalidKeyUsage, etc.) propagates as-is.\n */\nexport function atAwsKms(opts: AtAwsKmsOptions): NoydbSealer {\n  const client = opts.client ?? new KMSClient({})\n  return {\n    id: `aws-kms:${opts.keyId}`,\n\n    async seal(secret) {\n      const out: EncryptCommandOutput = await client.send(\n        new EncryptCommand({ KeyId: opts.keyId, Plaintext: secret }),\n      )\n      const blob = out.CiphertextBlob\n      if (!blob) throw new Error('@noy-db/at-aws-kms: KMS Encrypt returned no CiphertextBlob')\n      return blob instanceof Uint8Array ? blob : new Uint8Array(blob)\n    },\n\n    async unseal(sealed) {\n      const out: DecryptCommandOutput = await client.send(\n        new DecryptCommand({ CiphertextBlob: sealed, KeyId: opts.keyId }),\n      )\n      const pt = out.Plaintext\n      if (!pt) throw new Error('@noy-db/at-aws-kms: KMS Decrypt returned no Plaintext')\n      return pt instanceof Uint8Array ? pt : new Uint8Array(pt)\n    },\n  }\n}\n\n/** Options for {@link awsKmsRecipientSealer}. */\nexport interface AwsKmsRecipientSealerOptions {\n  /**\n   * KMS key id or ARN of an **asymmetric RSA** key with `KeyUsage:\n   * ENCRYPT_DECRYPT` and `KeySpec` one of `RSA_2048` / `RSA_3072` /\n   * `RSA_4096`. The private key never leaves KMS — unseal runs `Decrypt`.\n   */\n  readonly keyId: string\n  /** Optional region passed to the default `KMSClient` when no `client` is given. */\n  readonly region?: string\n  /** Optional pre-built client (DI for tests). Default `new KMSClient({ region? })` (ambient creds). */\n  readonly client?: Pick<KMSClient, 'send'>\n}\n\n/** KMS asymmetric key specs this recipient sealer accepts (RSA-OAEP-SHA256 wrap). */\nconst SUPPORTED_RSA_KEY_SPECS = new Set(['RSA_2048', 'RSA_3072', 'RSA_4096'])\n\n/** DER SPKI bytes (from KMS `GetPublicKey`) → PEM SubjectPublicKeyInfo. */\nfunction derSpkiToPem(der: Uint8Array): string {\n  let binary = ''\n  for (let i = 0; i < der.length; i++) binary += String.fromCharCode(der[i]!)\n  const b64 = btoa(binary)\n  return '-----BEGIN PUBLIC KEY-----\\n'\n    + (b64.match(/.{1,64}/g) ?? []).join('\\n')\n    + '\\n-----END PUBLIC KEY-----\\n'\n}\n\n/**\n * A {@link RecipientSealer} (plus `unseal`) backed by an **asymmetric RSA**\n * AWS KMS key. Lets an `at-aws-kms` host act as a recipient target: a grantor\n * obtains the host's published {@link RecipientHint} (the KMS public key as\n * PEM) and seals bytes to it *locally* — no KMS call on the seal path. The\n * host unseals via KMS `Decrypt` with `EncryptionAlgorithm:\n * RSAES_OAEP_SHA_256`; the private key never leaves KMS.\n *\n * Wire format is the canonical recipient-target TLV\n * ({@link sealRsaOaepTlv}/{@link parseRsaOaepTlv}) shared with hub's\n * `MemoryRecipientSealer`, so a blob sealed by either side unseals on the\n * other. WebCrypto RSA-OAEP/SHA-256 and KMS `RSAES_OAEP_SHA_256` are\n * wire-compatible (RSAES-OAEP, SHA-256, MGF1-SHA256, empty label). KMS\n * asymmetric keys do not support an encryption context, so none is used.\n *\n * Separate from {@link atAwsKms} (symmetric self-seal for the\n * managed secret) — this factory targets an asymmetric key.\n *\n * @throws Error from `publishRecipientHint` when the key is not an RSA\n * `ENCRYPT_DECRYPT` key, or `GetPublicKey` returns no public key.\n * @throws Error from `sealForRecipient` on an unsupported `hint.v`/`hint.alg`.\n * Any KMS API error (AccessDenied, etc.) propagates as-is.\n */\nexport function awsKmsRecipientSealer(\n  opts: AwsKmsRecipientSealerOptions,\n): RecipientSealer & { unseal(sealed: Uint8Array): Promise<Uint8Array> } {\n  const client = opts.client ?? new KMSClient(opts.region ? { region: opts.region } : {})\n  const id = `aws-kms-recipient:${opts.keyId}`\n  return {\n    id,\n\n    async publishRecipientHint(): Promise<RecipientHint> {\n      const out: GetPublicKeyCommandOutput = await client.send(\n        new GetPublicKeyCommand({ KeyId: opts.keyId }),\n      )\n      if (out.KeyUsage !== 'ENCRYPT_DECRYPT') {\n        throw new Error(\n          `@noy-db/at-aws-kms: awsKmsRecipientSealer requires an ENCRYPT_DECRYPT key, got KeyUsage='${String(out.KeyUsage)}' for ${opts.keyId}`,\n        )\n      }\n      if (!out.KeySpec || !SUPPORTED_RSA_KEY_SPECS.has(out.KeySpec)) {\n        throw new Error(\n          `@noy-db/at-aws-kms: awsKmsRecipientSealer requires an RSA key (RSA_2048/3072/4096), got KeySpec='${String(out.KeySpec)}' for ${opts.keyId}`,\n        )\n      }\n      const der = out.PublicKey\n      if (!der) throw new Error('@noy-db/at-aws-kms: KMS GetPublicKey returned no PublicKey')\n      const derBytes = der instanceof Uint8Array ? der : new Uint8Array(der)\n      const publicKeyPem = derSpkiToPem(derBytes)\n      return { v: 1, pid: id, alg: 'rsa-oaep-sha256', material: { publicKeyPem } }\n    },\n\n    async sealForRecipient(plaintext: Uint8Array, hint: RecipientHint): Promise<Uint8Array> {\n      if (hint.v !== 1) {\n        throw new Error(`@noy-db/at-aws-kms: awsKmsRecipientSealer.sealForRecipient: unsupported hint.v ${String(hint.v)} (expected 1)`)\n      }\n      if (hint.alg !== 'rsa-oaep-sha256') {\n        throw new Error(`@noy-db/at-aws-kms: awsKmsRecipientSealer.sealForRecipient: unsupported hint.alg '${String(hint.alg)}' (expected 'rsa-oaep-sha256')`)\n      }\n      const pem = hint.material['publicKeyPem']\n      if (typeof pem !== 'string') {\n        throw new Error('@noy-db/at-aws-kms: awsKmsRecipientSealer.sealForRecipient: hint.material.publicKeyPem missing or not a string')\n      }\n      // Grantor seals LOCALLY — no KMS call.\n      return sealRsaOaepTlv(plaintext, pem)\n    },\n\n    async unseal(sealed: Uint8Array): Promise<Uint8Array> {\n      const { wrapped, iv, ct } = parseRsaOaepTlv(sealed)\n      // RSA-unwrap the CEK via KMS — the private key never leaves KMS.\n      const out: DecryptCommandOutput = await client.send(\n        new DecryptCommand({\n          KeyId: opts.keyId,\n          CiphertextBlob: wrapped,\n          EncryptionAlgorithm: 'RSAES_OAEP_SHA_256',\n        }),\n      )\n      const cek = out.Plaintext\n      if (!cek) throw new Error('@noy-db/at-aws-kms: KMS Decrypt returned no Plaintext (CEK)')\n      const cekBytes = cek instanceof Uint8Array ? cek : new Uint8Array(cek)\n      const pt = await aesGcmOpen(cekBytes, iv, ct)\n      cekBytes.fill(0)\n      return pt\n    },\n  }\n}\n"],"mappings":";AAkDA,SAAS,gBAAgB,iBAAiB,kBAAkB;AAC5D;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAIK;AAqBA,SAAS,SAAS,MAAoC;AAC3D,QAAM,SAAS,KAAK,UAAU,IAAI,UAAU,CAAC,CAAC;AAC9C,SAAO;AAAA,IACL,IAAI,WAAW,KAAK,KAAK;AAAA,IAEzB,MAAM,KAAK,QAAQ;AACjB,YAAM,MAA4B,MAAM,OAAO;AAAA,QAC7C,IAAI,eAAe,EAAE,OAAO,KAAK,OAAO,WAAW,OAAO,CAAC;AAAA,MAC7D;AACA,YAAM,OAAO,IAAI;AACjB,UAAI,CAAC,KAAM,OAAM,IAAI,MAAM,4DAA4D;AACvF,aAAO,gBAAgB,aAAa,OAAO,IAAI,WAAW,IAAI;AAAA,IAChE;AAAA,IAEA,MAAM,OAAO,QAAQ;AACnB,YAAM,MAA4B,MAAM,OAAO;AAAA,QAC7C,IAAI,eAAe,EAAE,gBAAgB,QAAQ,OAAO,KAAK,MAAM,CAAC;AAAA,MAClE;AACA,YAAM,KAAK,IAAI;AACf,UAAI,CAAC,GAAI,OAAM,IAAI,MAAM,uDAAuD;AAChF,aAAO,cAAc,aAAa,KAAK,IAAI,WAAW,EAAE;AAAA,IAC1D;AAAA,EACF;AACF;AAiBA,IAAM,0BAA0B,oBAAI,IAAI,CAAC,YAAY,YAAY,UAAU,CAAC;AAG5E,SAAS,aAAa,KAAyB;AAC7C,MAAI,SAAS;AACb,WAAS,IAAI,GAAG,IAAI,IAAI,QAAQ,IAAK,WAAU,OAAO,aAAa,IAAI,CAAC,CAAE;AAC1E,QAAM,MAAM,KAAK,MAAM;AACvB,SAAO,kCACF,IAAI,MAAM,UAAU,KAAK,CAAC,GAAG,KAAK,IAAI,IACvC;AACN;AAyBO,SAAS,sBACd,MACuE;AACvE,QAAM,SAAS,KAAK,UAAU,IAAI,UAAU,KAAK,SAAS,EAAE,QAAQ,KAAK,OAAO,IAAI,CAAC,CAAC;AACtF,QAAM,KAAK,qBAAqB,KAAK,KAAK;AAC1C,SAAO;AAAA,IACL;AAAA,IAEA,MAAM,uBAA+C;AACnD,YAAM,MAAiC,MAAM,OAAO;AAAA,QAClD,IAAI,oBAAoB,EAAE,OAAO,KAAK,MAAM,CAAC;AAAA,MAC/C;AACA,UAAI,IAAI,aAAa,mBAAmB;AACtC,cAAM,IAAI;AAAA,UACR,4FAA4F,OAAO,IAAI,QAAQ,CAAC,SAAS,KAAK,KAAK;AAAA,QACrI;AAAA,MACF;AACA,UAAI,CAAC,IAAI,WAAW,CAAC,wBAAwB,IAAI,IAAI,OAAO,GAAG;AAC7D,cAAM,IAAI;AAAA,UACR,oGAAoG,OAAO,IAAI,OAAO,CAAC,SAAS,KAAK,KAAK;AAAA,QAC5I;AAAA,MACF;AACA,YAAM,MAAM,IAAI;AAChB,UAAI,CAAC,IAAK,OAAM,IAAI,MAAM,4DAA4D;AACtF,YAAM,WAAW,eAAe,aAAa,MAAM,IAAI,WAAW,GAAG;AACrE,YAAM,eAAe,aAAa,QAAQ;AAC1C,aAAO,EAAE,GAAG,GAAG,KAAK,IAAI,KAAK,mBAAmB,UAAU,EAAE,aAAa,EAAE;AAAA,IAC7E;AAAA,IAEA,MAAM,iBAAiB,WAAuB,MAA0C;AACtF,UAAI,KAAK,MAAM,GAAG;AAChB,cAAM,IAAI,MAAM,kFAAkF,OAAO,KAAK,CAAC,CAAC,eAAe;AAAA,MACjI;AACA,UAAI,KAAK,QAAQ,mBAAmB;AAClC,cAAM,IAAI,MAAM,qFAAqF,OAAO,KAAK,GAAG,CAAC,gCAAgC;AAAA,MACvJ;AACA,YAAM,MAAM,KAAK,SAAS,cAAc;AACxC,UAAI,OAAO,QAAQ,UAAU;AAC3B,cAAM,IAAI,MAAM,gHAAgH;AAAA,MAClI;AAEA,aAAO,eAAe,WAAW,GAAG;AAAA,IACtC;AAAA,IAEA,MAAM,OAAO,QAAyC;AACpD,YAAM,EAAE,SAAS,IAAI,GAAG,IAAI,gBAAgB,MAAM;AAElD,YAAM,MAA4B,MAAM,OAAO;AAAA,QAC7C,IAAI,eAAe;AAAA,UACjB,OAAO,KAAK;AAAA,UACZ,gBAAgB;AAAA,UAChB,qBAAqB;AAAA,QACvB,CAAC;AAAA,MACH;AACA,YAAM,MAAM,IAAI;AAChB,UAAI,CAAC,IAAK,OAAM,IAAI,MAAM,6DAA6D;AACvF,YAAM,WAAW,eAAe,aAAa,MAAM,IAAI,WAAW,GAAG;AACrE,YAAM,KAAK,MAAM,WAAW,UAAU,IAAI,EAAE;AAC5C,eAAS,KAAK,CAAC;AACf,aAAO;AAAA,IACT;AAAA,EACF;AACF;","names":[]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@noy-db/at-aws-kms",
-  "version": "0.6.0",
+  "version": "0.7.0-pre.1",
   "description": "AWS KMS sealing key provider for noy-db managed-secret mode — seal/unseal via KMS Encrypt/Decrypt, with KMS access logs.",
   "license": "MIT",
   "author": "vLannaAi <vicio@lanna.ai>",
@@ -33,14 +33,15 @@
   },
   "peerDependencies": {
     "@aws-sdk/client-kms": "^3.0.0",
-    "@noy-db/hub": "0.6.0"
+    "@noy-db/hub": "0.7.0-pre.1"
   },
   "devDependencies": {
-    "@types/node": "^22.0.0",
     "@aws-sdk/client-kms": "^3.0.0",
-    "@noy-db/hub": "0.6.0",
-    "@noy-db/to-memory": "0.6.0",
-    "@noy-db/on-shamir": "0.6.0"
+    "@types/node": "^22.0.0",
+    "@noy-db/hub": "0.7.0-pre.1",
+    "@noy-db/on-shamir": "0.7.0-pre.1",
+    "@noy-db/test-sealer-conformance": "0.7.0-pre.1",
+    "@noy-db/to-memory": "0.7.0-pre.1"
   },
   "keywords": [
     "noy-db",