@sebastienrousseau/crypto-kms 0.0.7

package/LICENSE

@@ -0,0 +1,8 @@
+This project is dual-licensed under either of:
+
+  * Apache License, Version 2.0 — see LICENSE-APACHE
+  * MIT license — see LICENSE-MIT
+
+at your option.
+
+SPDX-License-Identifier: Apache-2.0 OR MIT

package/README.md

@@ -0,0 +1,320 @@
+<!-- SPDX-License-Identifier: Apache-2.0 OR MIT -->
+
+<p align="center">
+  <img src="https://raw.githubusercontent.com/sebastienrousseau/crypto-service/main/assets/crypto-kms-logo.svg" alt="crypto-kms logo" width="360" />
+</p>
+
+<h1 align="center">@sebastienrousseau/crypto-kms</h1>
+
+<p align="center">
+  Unified Key Management Service interface. AWS KMS and an in-memory local provider are implemented; GCP, Azure and Vault are stubs.
+</p>
+
+<p align="center">
+  <a href="https://github.com/sebastienrousseau/crypto-service/actions"><img src="https://img.shields.io/github/actions/workflow/status/sebastienrousseau/crypto-service/ci.yml?branch=main&style=for-the-badge&logo=github" alt="Build" /></a>
+  <a href="https://coveralls.io/github/sebastienrousseau/crypto-service?branch=main"><img src="https://img.shields.io/coveralls/github/sebastienrousseau/crypto-service?branch=main&style=for-the-badge" alt="Coverage" /></a>
+  <a href="https://www.npmjs.com/package/@sebastienrousseau/crypto-kms"><img src="https://img.shields.io/npm/v/@sebastienrousseau/crypto-kms.svg?style=for-the-badge&color=f14041&logo=npm" alt="Registry" /></a>
+  <a href="https://sebastienrousseau.github.io/crypto-service/"><img src="https://img.shields.io/badge/docs-TypeDoc-blue.svg?style=for-the-badge&labelColor=555555&logo=typescript" alt="Docs" /></a>
+  <a href="https://scorecard.dev/viewer/?uri=github.com/sebastienrousseau/crypto-service" title="ossf-scorecard"><img src="https://img.shields.io/badge/OpenSSF-Scorecard-blue?style=for-the-badge&logo=openssf" alt="OpenSSF Scorecard" /></a>
+  <a href="https://github.com/sebastienrousseau/crypto-service/blob/main/LICENSE"><img src="https://img.shields.io/badge/license-Apache--2.0%20OR%20MIT-blue.svg?style=for-the-badge" alt="License: Apache-2.0 OR MIT" /></a>
+  <a href="https://github.com/sebastienrousseau/crypto-service/blob/main/docs/POLICIES.md"><img src="https://img.shields.io/badge/Node.js-%3E%3D22-93450a.svg?style=for-the-badge&logo=node.js" alt="Node.js 22 or newer" /></a>
+</p>
+
+---
+
+## Contents
+
+**Getting started**
+
+- [Install](#install) — installation via pnpm, npm, or yarn
+- [Requirements](#requirements) — runtime floor and environment prerequisites
+- [Quick Start](#quick-start) — minimal working usage sample
+
+**The Crypto Service ecosystem**
+
+- [The Crypto Service ecosystem](#the-crypto-service-ecosystem) — full 14-package suite overview
+
+**Package reference**
+
+- [Reference & Usage](#overview) — features, configuration, and capabilities
+- [Examples](#examples) — runnable sample code
+
+**Operational**
+
+- [Development](#development) — build, lint, format, and test targets
+- [Security](#security) — vulnerability disclosure and cryptographic invariants
+- [Documentation](#documentation) — TypeDoc API docs and ecosystem guides
+- [Stability guarantees](#stability-guarantees) — SemVer axis and release policy
+- [License](#license)
+
+---
+
+## Install
+
+```bash
+pnpm add @sebastienrousseau/crypto-kms
+# or
+npm install @sebastienrousseau/crypto-kms
+# or
+yarn add @sebastienrousseau/crypto-kms
+```
+
+<p align="right"><a href="#contents">Back to Top</a></p>
+
+---
+
+## Requirements
+
+- **Node.js**: `^22.0.0` or `>=24.0.0` (active and maintenance LTS releases)
+- **Package Manager**: `pnpm >=9` (recommended) or `npm >=10`
+- **TypeScript**: `>=5.0` (when compiling with TypeScript)
+
+<p align="right"><a href="#contents">Back to Top</a></p>
+
+---
+
+## Quick Start
+
+```ts
+import { LocalKmsProvider } from "@sebastienrousseau/crypto-kms";
+
+const kms = new LocalKmsProvider();
+const key = await kms.createKey("aes-256-gcm", "encrypt");
+const encrypted = await kms.encrypt(
+  key.keyId,
+  new TextEncoder().encode("secret"),
+);
+const decrypted = await kms.decrypt(key.keyId, encrypted.ciphertext);
+console.log(new TextDecoder().decode(decrypted.plaintext)); // "secret"
+```
+
+<p align="right"><a href="#contents">Back to Top</a></p>
+
+---
+
+## The Crypto Service ecosystem
+
+Crypto Service provides a complete cryptography stack across 14 specialized packages:
+
+| Package                                                               | Role            | Description                                                                                                                            |
+| :-------------------------------------------------------------------- | :-------------- | :------------------------------------------------------------------------------------------------------------------------------------- |
+| [`@sebastienrousseau/crypto-api`](../crypto-api)                      | API Schemas     | Shared TypeScript types and utilities for the Crypto Service Suite, defining the canonical API surface.                                |
+| [`@sebastienrousseau/crypto-cli`](../crypto-cli)                      | Terminal CLI    | An interactive command-line interface for cryptographic operations, supporting both legacy OpenPGP and modern post-quantum algorithms. |
+| [`@sebastienrousseau/crypto-edge`](../crypto-edge)                    | Edge Runtime    | Edge-runtime cryptographic operations using the Web Crypto API, optimized for Cloudflare Workers, Vercel Edge, and Deno.               |
+| **[`@sebastienrousseau/crypto-kms`](../crypto-kms)** _(this package)_ | **Cloud KMS**   | **Unified KMS interface: AWS KMS and local providers implemented; GCP, Azure and Vault are stubs.**                                    |
+| [`@sebastienrousseau/crypto-lib`](../crypto-lib)                      | Core Library    | A modern cryptographic library for TypeScript, with post-quantum support, zero unsafe dependencies, and 100% test coverage.            |
+| [`@sebastienrousseau/crypto-middleware`](../crypto-middleware)        | Middleware      | Framework-agnostic cryptographic middleware for Express, Fastify, and Koa applications.                                                |
+| [`@sebastienrousseau/crypto-prisma`](../crypto-prisma)                | ORM Adapter     | Transparent field-level encryption extension for Prisma Client, using XChaCha20-Poly1305.                                              |
+| [`@sebastienrousseau/crypto-react`](../crypto-react)                  | React Hooks     | React hooks and context provider for client-side cryptographic operations with zero boilerplate.                                       |
+| [`@sebastienrousseau/crypto-sdk`](../crypto-sdk)                      | Client SDK      | A zero-dependency, typed HTTP client for the Crypto Service REST API, with full post-quantum support.                                  |
+| [`@sebastienrousseau/crypto-server`](../crypto-server)                | HTTP API        | A hardened Fastify REST API for cryptographic operations, with rate limiting, OpenAPI schemas, and post-quantum endpoints.             |
+| [`@sebastienrousseau/crypto-testing`](../crypto-testing)              | Test Support    | Deterministic keys, fast mocks, and test fixtures for crypto-lib                                                                       |
+| [`@sebastienrousseau/crypto-typeorm`](../crypto-typeorm)              | ORM Adapter     | TypeORM column-level encryption with a single decorator, powered by crypto-lib.                                                        |
+| [`@sebastienrousseau/crypto-vue`](../crypto-vue)                      | Vue Composables | Vue 3 composables for client-side cryptography                                                                                         |
+| [`@sebastienrousseau/crypto-wasm`](../crypto-wasm)                    | Acceleration    | Placeholder for a WebAssembly accelerator; contains no WebAssembly code yet.                                                           |
+
+<p align="right"><a href="#contents">Back to Top</a></p>
+
+---
+
+## Overview
+
+crypto-kms defines a unified `KmsProvider` interface for key
+creation, encryption, decryption, signing, verification, rotation
+and data-key generation. Two providers are implemented: AWS KMS and
+an in-memory local provider. The GCP, Azure and HashiCorp Vault
+providers are stubs: every method rejects with `Not implemented`.
+The PKCS#11 provider is an in-memory software simulation for tests
+(see below); it does not talk to an HSM.
+
+<p align="right"><a href="#contents">Back to Top</a></p>
+
+## Providers
+
+| Provider    | Class               | Backend                    | Status                                | Peer Dependency        |
+| :---------- | :------------------ | :------------------------- | :------------------------------------ | :--------------------- |
+| **AWS**     | `AwsKmsProvider`    | AWS Key Management Service | Implemented                           | `@aws-sdk/client-kms`  |
+| **GCP**     | `GcpKmsProvider`    | Google Cloud KMS           | Stub (rejects `Not implemented`)      | `@google-cloud/kms`    |
+| **Azure**   | `AzureKmsProvider`  | Azure Key Vault            | Stub (rejects `Not implemented`)      | `@azure/keyvault-keys` |
+| **Vault**   | `VaultKmsProvider`  | HashiCorp Vault Transit    | Stub (rejects `Not implemented`)      | None                   |
+| **Local**   | `LocalKmsProvider`  | In-memory (crypto-lib)     | Implemented                           | None                   |
+| **PKCS#11** | `Pkcs11HsmProvider` | None (in-memory)           | Software simulation; `simulate: true` | None                   |
+
+`Pkcs11HsmProvider` has no PKCS#11 binding: it never loads a module,
+accepts any PIN, keeps keys in process memory and reports
+`fipsLevel: "none (software simulation)"`. Its constructor throws
+unless you pass `{ simulate: true }`. Use it only in tests.
+
+<p align="right"><a href="#contents">Back to Top</a></p>
+
+## API Reference
+
+Every provider exposes the `KmsProvider` interface:
+
+| Method                                       | Description                                  |
+| :------------------------------------------- | :------------------------------------------- |
+| `listKeys(filters?)`                         | List all managed keys, with optional filters |
+| `getKey(keyId)`                              | Retrieve metadata for a specific key         |
+| `createKey(algorithm, usage, metadata?)`     | Create a new managed key                     |
+| `enableKey(keyId)`                           | Enable a disabled key                        |
+| `disableKey(keyId)`                          | Disable a key (soft delete)                  |
+| `scheduleKeyDeletion(keyId, days?)`          | Schedule a key for deletion                  |
+| `encrypt(keyId, plaintext, context?)`        | Encrypt plaintext with a managed key         |
+| `decrypt(keyId, ciphertext, context?)`       | Decrypt ciphertext with a managed key        |
+| `sign(keyId, data, algorithm?)`              | Sign data with a managed signing key         |
+| `verify(keyId, data, signature, algorithm?)` | Verify a signature                           |
+| `rotateKey(keyId)`                           | Add a new current key version                |
+| `destroyKeyVersion?(keyId, version)`         | Destroy a retired version (optional method)  |
+| `generateDataKey(keyId, keySpec?)`           | Generate a wrapped data encryption key       |
+
+### Key rotation and versions
+
+`LocalKmsProvider` and `Pkcs11HsmProvider` keep every version of a key.
+`rotateKey` adds a new current version; it does not replace the old
+material. New ciphertext and signatures use the current version, and
+each ciphertext records the version that produced it, so data encrypted
+before a rotation still decrypts and signatures made before it still
+verify. `getKey` reports `currentVersion`; `encrypt` and `decrypt`
+report `keyVersion`.
+
+A version stays usable until you destroy it with
+`destroyKeyVersion(keyId, version)`. After that, ciphertext from that
+version rejects with `VERSION_DESTROYED` and its signatures no longer
+verify. The current version cannot be destroyed; rotate first.
+`disableKey` and `scheduleKeyDeletion` still block every operation on
+the key, all versions included.
+
+```ts
+const key = await kms.createKey("aes-256-gcm", "encrypt");
+const old = await kms.encrypt(key.keyId, data); // old.keyVersion === 1
+await kms.rotateKey(key.keyId); // currentVersion === 2
+await kms.decrypt(key.keyId, old.ciphertext); // still decrypts with version 1
+await kms.destroyKeyVersion(key.keyId, 1); // version 1 is gone for good
+```
+
+The ciphertext of these two providers is the base64 of: a format byte
+(`0x01`), the key version (4 bytes, big-endian), the AES-GCM IV (12
+bytes), the tag (16 bytes) and the AES-256-GCM ciphertext. Ciphertext
+produced by 0.0.6 and earlier is not accepted; neither provider persists
+keys, so none can outlive the process that made it.
+
+### Encryption context
+
+The encryption context is bound to the ciphertext as AES-GCM additional
+authenticated data. It is canonicalised first (entries sorted by key),
+so `{ a: "1", b: "2" }` and `{ b: "2", a: "1" }` are the same context.
+Values must be strings; anything else rejects with `INVALID_ARGUMENT`.
+An empty context is the same as no context.
+
+### Errors
+
+Providers reject with `KmsError`, which extends `Error` and carries a
+`code` (and the `keyId` when there is one). Branch on the code, not the
+message:
+
+| Code                 | Meaning                                                        |
+| :------------------- | :------------------------------------------------------------- |
+| `NOT_FOUND`          | Unknown key, or a ciphertext names a version the key never had |
+| `DISABLED`           | The key is disabled or scheduled for deletion                  |
+| `INVALID_USAGE`      | The key's usage does not allow the operation                   |
+| `INVALID_ARGUMENT`   | Malformed argument, or destroying the current version          |
+| `INVALID_CIPHERTEXT` | Truncated ciphertext or an unknown format                      |
+| `DECRYPTION_FAILED`  | Wrong context, wrong key, or tampered ciphertext               |
+| `VERSION_DESTROYED`  | The ciphertext's key version has been destroyed                |
+| `NOT_IMPLEMENTED`    | Stub provider (GCP, Azure, Vault)                              |
+| `DEPENDENCY_MISSING` | The AWS SDK peer dependency is not installed                   |
+
+Errors raised by the AWS SDK itself are passed through unchanged. No
+provider method takes a timeout or an `AbortSignal` yet.
+
+<p align="right"><a href="#contents">Back to Top</a></p>
+
+## Authentication
+
+| Provider  | Credentials                                                                        |
+| :-------- | :--------------------------------------------------------------------------------- |
+| **AWS**   | Pass `credentials` in `AwsKmsOptions`, or rely on the default AWS credential chain |
+| **GCP**   | Not applicable yet (stub provider)                                                 |
+| **Azure** | Not applicable yet (stub provider)                                                 |
+| **Vault** | Not applicable yet (stub provider)                                                 |
+| **Local** | No authentication required                                                         |
+
+<p align="right"><a href="#contents">Back to Top</a></p>
+
+## Examples
+
+All examples are self-contained TypeScript files in the `examples/`
+directory. Run any example with:
+
+```bash
+npx ts-node examples/<name>.ts
+```
+
+| Category | Example                             | Purpose                                                  |
+| :------- | :---------------------------------- | :------------------------------------------------------- |
+| Local    | [local.ts](examples/local.ts)       | Create keys, encrypt/decrypt with the in-memory provider |
+| AWS      | [aws.ts](examples/aws.ts)           | AWS KMS setup and usage pattern                          |
+| Envelope | [envelope.ts](examples/envelope.ts) | Envelope encryption with `generateDataKey`               |
+| Rotation | [rotation.ts](examples/rotation.ts) | Rotate, decrypt old data, destroy a retired version      |
+| Multi    | [multi.ts](examples/multi.ts)       | Provider-agnostic code across multiple backends          |
+
+<p align="right"><a href="#contents">Back to Top</a></p>
+
+<p align="right"><a href="#contents">Back to Top</a></p>
+
+---
+
+## Development
+
+```bash
+pnpm --filter @sebastienrousseau/crypto-kms run build
+pnpm --filter @sebastienrousseau/crypto-kms run test
+pnpm --filter @sebastienrousseau/crypto-kms run lint
+pnpm --filter @sebastienrousseau/crypto-kms run format
+```
+
+All 18 packages in the Crypto Service workspace maintain a **100% coverage floor** across statements, branches, functions, and lines.
+
+<p align="right"><a href="#contents">Back to Top</a></p>
+
+---
+
+## Security
+
+Report vulnerabilities privately via [GitHub Security Advisories](https://github.com/sebastienrousseau/crypto-service/security/advisories) or according to [`SECURITY.md`](../../SECURITY.md). Never report security issues publicly.
+
+The local and simulated PKCS#11 providers run AES-256-GCM through Node.js `crypto` and Ed25519 through crypto-lib (`@noble/curves`). Neither is a validated cryptographic module, and neither zeroes key material held in memory.
+
+<p align="right"><a href="#contents">Back to Top</a></p>
+
+---
+
+## Documentation
+
+- [Full Suite Documentation](https://sebastienrousseau.github.io/crypto-service/)
+- [API Reference (TypeDoc)](https://sebastienrousseau.github.io/crypto-service/)
+- [Developer Guide](../../DEVELOPMENT.md)
+- [Security Policy](../../SECURITY.md)
+- [Architecture & Design](../../ARCHITECTURE.md)
+
+<p align="right"><a href="#contents">Back to Top</a></p>
+
+---
+
+## Stability guarantees
+
+Versions advance strictly one step at a time on the `0.0.x` line (`v0.0.1` → `v0.0.2` → `v0.0.3` ... → `v0.0.999` → `v0.1.0`). Work for every release iteration begins on a dedicated `feat/v<version>` branch.
+
+All 18 packages in the workspace move in lockstep. Public API signatures, cipher output formats, and serialization schemas are strictly versioned. Breaking changes to serialized formats or algorithm defaults are considered major breaking changes. Minimum toolchain upgrades (e.g. Node.js LTS floor) are governed by [POLICIES.md](../../docs/POLICIES.md).
+
+<p align="right"><a href="#contents">Back to Top</a></p>
+
+---
+
+## License
+
+Dual-licensed under [Apache 2.0](https://www.apache.org/licenses/LICENSE-2.0) or [MIT](https://opensource.org/licenses/MIT), at your option.
+
+Copyright (c) 2022-2026 Sebastien Rousseau and The Crypto Service Suite contributors.
+
+<p align="right"><a href="#contents">Back to Top</a></p>

package/dist/errors.d.ts

@@ -0,0 +1,8 @@
+export type KmsErrorCode = "NOT_FOUND" | "DISABLED" | "INVALID_USAGE" | "INVALID_ARGUMENT" | "INVALID_CIPHERTEXT" | "DECRYPTION_FAILED" | "VERSION_DESTROYED" | "NOT_IMPLEMENTED" | "DEPENDENCY_MISSING";
+export declare class KmsError extends Error {
+    readonly name = "KmsError";
+    readonly code: KmsErrorCode;
+    readonly keyId: string | undefined;
+    constructor(code: KmsErrorCode, message: string, keyId?: string);
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AA0BA,MAAM,MAAM,YAAY,GACpB,WAAW,GACX,UAAU,GACV,eAAe,GACf,kBAAkB,GAClB,oBAAoB,GACpB,mBAAmB,GACnB,mBAAmB,GACnB,iBAAiB,GACjB,oBAAoB,CAAC;AAmBzB,qBAAa,QAAS,SAAQ,KAAK;IAEjC,SAAkB,IAAI,cAAc;IAEpC,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAE5B,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;gBAGvB,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM;CAKhE"}

package/dist/errors.js

@@ -0,0 +1,15 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.KmsError = void 0;
+class KmsError extends Error {
+    name = "KmsError";
+    code;
+    keyId;
+    constructor(code, message, keyId) {
+        super(message);
+        this.code = code;
+        this.keyId = keyId;
+    }
+}
+exports.KmsError = KmsError;
+//# sourceMappingURL=errors.js.map

package/dist/index.d.ts

@@ -0,0 +1,15 @@
+export type { KmsProvider, KmsKeyMetadata, KmsEncryptResult, KmsDecryptResult, KmsSignResult, } from "./types";
+export { KmsError } from "./errors";
+export type { KmsErrorCode } from "./errors";
+export { AwsKmsProvider } from "./providers/aws";
+export type { AwsKmsOptions } from "./providers/aws";
+export { GcpKmsProvider } from "./providers/gcp";
+export type { GcpKmsOptions } from "./providers/gcp";
+export { AzureKmsProvider } from "./providers/azure";
+export type { AzureKmsOptions } from "./providers/azure";
+export { VaultKmsProvider } from "./providers/vault";
+export type { VaultKmsOptions } from "./providers/vault";
+export { LocalKmsProvider } from "./providers/local";
+export { Pkcs11HsmProvider } from "./providers/pkcs11";
+export type { Pkcs11HsmOptions, HsmSessionInfo } from "./providers/pkcs11";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAWA,YAAY,EACV,WAAW,EACX,cAAc,EACd,gBAAgB,EAChB,gBAAgB,EAChB,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AAEpC,YAAY,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAC7C,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEjD,YAAY,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEjD,YAAY,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAErD,YAAY,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAErD,YAAY,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAEvD,YAAY,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC"}

package/dist/index.js

@@ -0,0 +1,18 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Pkcs11HsmProvider = exports.LocalKmsProvider = exports.VaultKmsProvider = exports.AzureKmsProvider = exports.GcpKmsProvider = exports.AwsKmsProvider = exports.KmsError = void 0;
+var errors_1 = require("./errors");
+Object.defineProperty(exports, "KmsError", { enumerable: true, get: function () { return errors_1.KmsError; } });
+var aws_1 = require("./providers/aws");
+Object.defineProperty(exports, "AwsKmsProvider", { enumerable: true, get: function () { return aws_1.AwsKmsProvider; } });
+var gcp_1 = require("./providers/gcp");
+Object.defineProperty(exports, "GcpKmsProvider", { enumerable: true, get: function () { return gcp_1.GcpKmsProvider; } });
+var azure_1 = require("./providers/azure");
+Object.defineProperty(exports, "AzureKmsProvider", { enumerable: true, get: function () { return azure_1.AzureKmsProvider; } });
+var vault_1 = require("./providers/vault");
+Object.defineProperty(exports, "VaultKmsProvider", { enumerable: true, get: function () { return vault_1.VaultKmsProvider; } });
+var local_1 = require("./providers/local");
+Object.defineProperty(exports, "LocalKmsProvider", { enumerable: true, get: function () { return local_1.LocalKmsProvider; } });
+var pkcs11_1 = require("./providers/pkcs11");
+Object.defineProperty(exports, "Pkcs11HsmProvider", { enumerable: true, get: function () { return pkcs11_1.Pkcs11HsmProvider; } });
+//# sourceMappingURL=index.js.map

package/dist/providers/aws.d.ts

@@ -0,0 +1,36 @@
+import type { KmsProvider, KmsKeyMetadata, KmsEncryptResult, KmsDecryptResult, KmsSignResult } from "../types";
+export interface AwsKmsOptions {
+    region: string;
+    credentials?: {
+        accessKeyId: string;
+        secretAccessKey: string;
+        sessionToken?: string;
+    };
+    endpoint?: string;
+}
+export declare class AwsKmsProvider implements KmsProvider {
+    readonly name = "aws";
+    private readonly options;
+    private client;
+    constructor(options: AwsKmsOptions);
+    private getClient;
+    listKeys(_filters?: {
+        usage?: string;
+        enabled?: boolean;
+    }): Promise<KmsKeyMetadata[]>;
+    getKey(keyId: string): Promise<KmsKeyMetadata>;
+    createKey(algorithm: string, usage: "encrypt" | "sign" | "wrap", metadata?: Record<string, string>): Promise<KmsKeyMetadata>;
+    enableKey(keyId: string): Promise<void>;
+    disableKey(keyId: string): Promise<void>;
+    scheduleKeyDeletion(keyId: string, pendingWindowDays?: number): Promise<void>;
+    encrypt(keyId: string, plaintext: Uint8Array, context?: Record<string, string>): Promise<KmsEncryptResult>;
+    decrypt(keyId: string, ciphertext: string, context?: Record<string, string>): Promise<KmsDecryptResult>;
+    sign(keyId: string, data: Uint8Array, algorithm?: string): Promise<KmsSignResult>;
+    verify(keyId: string, data: Uint8Array, signature: string, algorithm?: string): Promise<boolean>;
+    rotateKey(keyId: string): Promise<KmsKeyMetadata>;
+    generateDataKey(keyId: string, keySpec?: string): Promise<{
+        plaintext: Uint8Array;
+        ciphertext: string;
+    }>;
+}
+//# sourceMappingURL=aws.d.ts.map

package/dist/providers/aws.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"aws.d.ts","sourceRoot":"","sources":["../../src/providers/aws.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EACV,WAAW,EACX,cAAc,EACd,gBAAgB,EAChB,gBAAgB,EAChB,aAAa,EACd,MAAM,UAAU,CAAC;AAkBlB,MAAM,WAAW,aAAa;IAE5B,MAAM,EAAE,MAAM,CAAC;IAEf,WAAW,CAAC,EAAE;QAEZ,WAAW,EAAE,MAAM,CAAC;QAEpB,eAAe,EAAE,MAAM,CAAC;QAExB,YAAY,CAAC,EAAE,MAAM,CAAC;KACvB,CAAC;IAEF,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAqBD,qBAAa,cAAe,YAAW,WAAW;IAEhD,QAAQ,CAAC,IAAI,SAAS;IAEtB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAgB;IAExC,OAAO,CAAC,MAAM,CAAsB;gBAGxB,OAAO,EAAE,aAAa;YAMpB,SAAS;IAqBjB,QAAQ,CAAC,QAAQ,CAAC,EAAE;QACxB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,OAAO,CAAC,EAAE,OAAO,CAAC;KACnB,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;IAevB,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IAgB9C,SAAS,CACb,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,SAAS,GAAG,MAAM,GAAG,MAAM,EAClC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAChC,OAAO,CAAC,cAAc,CAAC;IA+BpB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAOvC,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAOxC,mBAAmB,CACvB,KAAK,EAAE,MAAM,EACb,iBAAiB,SAAK,GACrB,OAAO,CAAC,IAAI,CAAC;IAYV,OAAO,CACX,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,UAAU,EACrB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC/B,OAAO,CAAC,gBAAgB,CAAC;IAqBtB,OAAO,CACX,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC/B,OAAO,CAAC,gBAAgB,CAAC;IAiBtB,IAAI,CACR,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,UAAU,EAChB,SAAS,SAAuB,GAC/B,OAAO,CAAC,aAAa,CAAC;IAmBnB,MAAM,CACV,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,UAAU,EAChB,SAAS,EAAE,MAAM,EACjB,SAAS,SAAuB,GAC/B,OAAO,CAAC,OAAO,CAAC;IAgBb,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IAQjD,eAAe,CACnB,KAAK,EAAE,MAAM,EACb,OAAO,SAAY,GAClB,OAAO,CAAC;QAET,SAAS,EAAE,UAAU,CAAC;QAEtB,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC;CAcH"}

package/dist/providers/aws.js

@@ -0,0 +1,214 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AwsKmsProvider = void 0;
+const errors_1 = require("../errors");
+const AWS_SDK_MISSING = "AWS KMS requires @aws-sdk/client-kms. Install it: npm install @aws-sdk/client-kms";
+class AwsKmsProvider {
+    name = "aws";
+    options;
+    client;
+    constructor(options) {
+        this.options = options;
+        this.client = null;
+    }
+    async getClient() {
+        if (!this.client) {
+            try {
+                const mod = await Promise.resolve().then(() => __importStar(require("@aws-sdk/client-kms")));
+                const config = { region: this.options.region };
+                if (this.options.credentials) {
+                    config.credentials = this.options.credentials;
+                }
+                if (this.options.endpoint) {
+                    config.endpoint = this.options.endpoint;
+                }
+                this.client = new mod.KMSClient(config);
+            }
+            catch {
+                throw new errors_1.KmsError("DEPENDENCY_MISSING", AWS_SDK_MISSING);
+            }
+        }
+        return this.client;
+    }
+    async listKeys(_filters) {
+        const client = await this.getClient();
+        const { ListKeysCommand } = await Promise.resolve().then(() => __importStar(require("@aws-sdk/client-kms")));
+        const result = await client.send(new ListKeysCommand({}));
+        return (result.Keys ?? []).map((k) => ({
+            keyId: k.KeyId ?? "",
+            algorithm: "unknown",
+            usage: "encrypt",
+            createdAt: new Date().toISOString(),
+            enabled: true,
+            provider: "aws",
+        }));
+    }
+    async getKey(keyId) {
+        const client = await this.getClient();
+        const { DescribeKeyCommand } = await Promise.resolve().then(() => __importStar(require("@aws-sdk/client-kms")));
+        const result = await client.send(new DescribeKeyCommand({ KeyId: keyId }));
+        const meta = result.KeyMetadata;
+        return {
+            keyId: meta?.KeyId ?? keyId,
+            algorithm: meta?.KeySpec ?? "unknown",
+            usage: meta?.KeyUsage === "SIGN_VERIFY" ? "sign" : "encrypt",
+            createdAt: meta?.CreationDate?.toISOString() ?? new Date().toISOString(),
+            enabled: meta?.Enabled ?? true,
+            provider: "aws",
+        };
+    }
+    async createKey(algorithm, usage, metadata) {
+        const client = await this.getClient();
+        const { CreateKeyCommand } = await Promise.resolve().then(() => __importStar(require("@aws-sdk/client-kms")));
+        const keySpec = algorithm.toUpperCase().replace(/-/g, "_");
+        const result = await client.send(new CreateKeyCommand({
+            KeyUsage: usage === "sign" ? "SIGN_VERIFY" : "ENCRYPT_DECRYPT",
+            KeySpec: keySpec,
+            ...(metadata
+                ? {
+                    Tags: Object.entries(metadata).map(([k, v]) => ({
+                        TagKey: k,
+                        TagValue: v,
+                    })),
+                }
+                : {}),
+        }));
+        return {
+            keyId: result.KeyMetadata?.KeyId ?? "",
+            algorithm,
+            usage,
+            createdAt: result.KeyMetadata?.CreationDate?.toISOString() ??
+                new Date().toISOString(),
+            enabled: true,
+            provider: "aws",
+        };
+    }
+    async enableKey(keyId) {
+        const client = await this.getClient();
+        const { EnableKeyCommand } = await Promise.resolve().then(() => __importStar(require("@aws-sdk/client-kms")));
+        await client.send(new EnableKeyCommand({ KeyId: keyId }));
+    }
+    async disableKey(keyId) {
+        const client = await this.getClient();
+        const { DisableKeyCommand } = await Promise.resolve().then(() => __importStar(require("@aws-sdk/client-kms")));
+        await client.send(new DisableKeyCommand({ KeyId: keyId }));
+    }
+    async scheduleKeyDeletion(keyId, pendingWindowDays = 30) {
+        const client = await this.getClient();
+        const { ScheduleKeyDeletionCommand } = await Promise.resolve().then(() => __importStar(require("@aws-sdk/client-kms")));
+        await client.send(new ScheduleKeyDeletionCommand({
+            KeyId: keyId,
+            PendingWindowInDays: pendingWindowDays,
+        }));
+    }
+    async encrypt(keyId, plaintext, context) {
+        const client = await this.getClient();
+        const { EncryptCommand } = await Promise.resolve().then(() => __importStar(require("@aws-sdk/client-kms")));
+        const result = await client.send(new EncryptCommand({
+            KeyId: keyId,
+            Plaintext: plaintext,
+            ...(context ? { EncryptionContext: context } : {}),
+        }));
+        const out = {
+            ciphertext: Buffer.from(result.CiphertextBlob).toString("base64"),
+            keyId: result.KeyId ?? keyId,
+        };
+        if (context) {
+            out.context = context;
+        }
+        return out;
+    }
+    async decrypt(keyId, ciphertext, context) {
+        const client = await this.getClient();
+        const { DecryptCommand } = await Promise.resolve().then(() => __importStar(require("@aws-sdk/client-kms")));
+        const result = await client.send(new DecryptCommand({
+            KeyId: keyId,
+            CiphertextBlob: Buffer.from(ciphertext, "base64"),
+            ...(context ? { EncryptionContext: context } : {}),
+        }));
+        return {
+            plaintext: new Uint8Array(result.Plaintext),
+            keyId: result.KeyId ?? keyId,
+        };
+    }
+    async sign(keyId, data, algorithm = "RSASSA_PSS_SHA_256") {
+        const client = await this.getClient();
+        const { SignCommand } = await Promise.resolve().then(() => __importStar(require("@aws-sdk/client-kms")));
+        const result = await client.send(new SignCommand({
+            KeyId: keyId,
+            Message: data,
+            MessageType: "RAW",
+            SigningAlgorithm: algorithm,
+        }));
+        return {
+            signature: Buffer.from(result.Signature).toString("base64"),
+            keyId: result.KeyId ?? keyId,
+            algorithm: result.SigningAlgorithm ?? algorithm,
+        };
+    }
+    async verify(keyId, data, signature, algorithm = "RSASSA_PSS_SHA_256") {
+        const client = await this.getClient();
+        const { VerifyCommand } = await Promise.resolve().then(() => __importStar(require("@aws-sdk/client-kms")));
+        const result = await client.send(new VerifyCommand({
+            KeyId: keyId,
+            Message: data,
+            MessageType: "RAW",
+            Signature: Buffer.from(signature, "base64"),
+            SigningAlgorithm: algorithm,
+        }));
+        return result.SignatureValid ?? false;
+    }
+    async rotateKey(keyId) {
+        const client = await this.getClient();
+        const { EnableKeyRotationCommand } = await Promise.resolve().then(() => __importStar(require("@aws-sdk/client-kms")));
+        await client.send(new EnableKeyRotationCommand({ KeyId: keyId }));
+        return this.getKey(keyId);
+    }
+    async generateDataKey(keyId, keySpec = "AES_256") {
+        const client = await this.getClient();
+        const { GenerateDataKeyCommand } = await Promise.resolve().then(() => __importStar(require("@aws-sdk/client-kms")));
+        const result = await client.send(new GenerateDataKeyCommand({
+            KeyId: keyId,
+            KeySpec: keySpec,
+        }));
+        return {
+            plaintext: new Uint8Array(result.Plaintext),
+            ciphertext: Buffer.from(result.CiphertextBlob).toString("base64"),
+        };
+    }
+}
+exports.AwsKmsProvider = AwsKmsProvider;
+//# sourceMappingURL=aws.js.map