@sebastienrousseau/crypto-kms 0.0.7

package/dist/providers/azure.d.ts

@@ -0,0 +1,29 @@
+import type { KmsProvider, KmsKeyMetadata, KmsEncryptResult, KmsDecryptResult, KmsSignResult } from "../types";
+export interface AzureKmsOptions {
+    vaultUrl: string;
+}
+export declare class AzureKmsProvider implements KmsProvider {
+    readonly name = "azure";
+    private readonly _vaultUrl;
+    constructor(options: AzureKmsOptions);
+    get vaultUrl(): string;
+    listKeys(_filters?: {
+        usage?: string;
+        enabled?: boolean;
+    }): Promise<KmsKeyMetadata[]>;
+    getKey(_keyId: string): Promise<KmsKeyMetadata>;
+    createKey(_algorithm: string, _usage: "encrypt" | "sign" | "wrap", _metadata?: Record<string, string>): Promise<KmsKeyMetadata>;
+    enableKey(_keyId: string): Promise<void>;
+    disableKey(_keyId: string): Promise<void>;
+    scheduleKeyDeletion(_keyId: string, _pendingWindowDays?: number): Promise<void>;
+    encrypt(_keyId: string, _plaintext: Uint8Array, _context?: Record<string, string>): Promise<KmsEncryptResult>;
+    decrypt(_keyId: string, _ciphertext: string, _context?: Record<string, string>): Promise<KmsDecryptResult>;
+    sign(_keyId: string, _data: Uint8Array, _algorithm?: string): Promise<KmsSignResult>;
+    verify(_keyId: string, _data: Uint8Array, _signature: string, _algorithm?: string): Promise<boolean>;
+    rotateKey(_keyId: string): Promise<KmsKeyMetadata>;
+    generateDataKey(_keyId: string, _keySpec?: string): Promise<{
+        plaintext: Uint8Array;
+        ciphertext: string;
+    }>;
+}
+//# sourceMappingURL=azure.d.ts.map

package/dist/providers/azure.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"azure.d.ts","sourceRoot":"","sources":["../../src/providers/azure.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EACV,WAAW,EACX,cAAc,EACd,gBAAgB,EAChB,gBAAgB,EAChB,aAAa,EACd,MAAM,UAAU,CAAC;AAalB,MAAM,WAAW,eAAe;IAE9B,QAAQ,EAAE,MAAM,CAAC;CAClB;AAgBD,qBAAa,gBAAiB,YAAW,WAAW;IAElD,QAAQ,CAAC,IAAI,WAAW;IAExB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;gBAGvB,OAAO,EAAE,eAAe;IAKpC,IAAI,QAAQ,IAAI,MAAM,CAErB;IAGD,QAAQ,CAAC,QAAQ,CAAC,EAAE;QAClB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,OAAO,CAAC,EAAE,OAAO,CAAC;KACnB,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;IAU7B,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IAU/C,SAAS,CACP,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,SAAS,GAAG,MAAM,GAAG,MAAM,EACnC,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GACjC,OAAO,CAAC,cAAc,CAAC;IAU1B,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAUxC,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAUzC,mBAAmB,CACjB,MAAM,EAAE,MAAM,EACd,kBAAkB,CAAC,EAAE,MAAM,GAC1B,OAAO,CAAC,IAAI,CAAC;IAUhB,OAAO,CACL,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,UAAU,EACtB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAChC,OAAO,CAAC,gBAAgB,CAAC;IAU5B,OAAO,CACL,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,EACnB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAChC,OAAO,CAAC,gBAAgB,CAAC;IAU5B,IAAI,CACF,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,UAAU,EACjB,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,aAAa,CAAC;IAUzB,MAAM,CACJ,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,UAAU,EACjB,UAAU,EAAE,MAAM,EAClB,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,OAAO,CAAC;IAUnB,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IAUlD,eAAe,CACb,MAAM,EAAE,MAAM,EACd,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC;QAET,SAAS,EAAE,UAAU,CAAC;QAEtB,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC;CAQH"}

package/dist/providers/azure.js

@@ -0,0 +1,52 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AzureKmsProvider = void 0;
+const errors_1 = require("../errors");
+class AzureKmsProvider {
+    name = "azure";
+    _vaultUrl;
+    constructor(options) {
+        this._vaultUrl = options.vaultUrl;
+    }
+    get vaultUrl() {
+        return this._vaultUrl;
+    }
+    listKeys(_filters) {
+        return Promise.reject(new errors_1.KmsError("NOT_IMPLEMENTED", "Not implemented: install @azure/keyvault-keys"));
+    }
+    getKey(_keyId) {
+        return Promise.reject(new errors_1.KmsError("NOT_IMPLEMENTED", "Not implemented: install @azure/keyvault-keys"));
+    }
+    createKey(_algorithm, _usage, _metadata) {
+        return Promise.reject(new errors_1.KmsError("NOT_IMPLEMENTED", "Not implemented: install @azure/keyvault-keys"));
+    }
+    enableKey(_keyId) {
+        return Promise.reject(new errors_1.KmsError("NOT_IMPLEMENTED", "Not implemented: install @azure/keyvault-keys"));
+    }
+    disableKey(_keyId) {
+        return Promise.reject(new errors_1.KmsError("NOT_IMPLEMENTED", "Not implemented: install @azure/keyvault-keys"));
+    }
+    scheduleKeyDeletion(_keyId, _pendingWindowDays) {
+        return Promise.reject(new errors_1.KmsError("NOT_IMPLEMENTED", "Not implemented: install @azure/keyvault-keys"));
+    }
+    encrypt(_keyId, _plaintext, _context) {
+        return Promise.reject(new errors_1.KmsError("NOT_IMPLEMENTED", "Not implemented: install @azure/keyvault-keys"));
+    }
+    decrypt(_keyId, _ciphertext, _context) {
+        return Promise.reject(new errors_1.KmsError("NOT_IMPLEMENTED", "Not implemented: install @azure/keyvault-keys"));
+    }
+    sign(_keyId, _data, _algorithm) {
+        return Promise.reject(new errors_1.KmsError("NOT_IMPLEMENTED", "Not implemented: install @azure/keyvault-keys"));
+    }
+    verify(_keyId, _data, _signature, _algorithm) {
+        return Promise.reject(new errors_1.KmsError("NOT_IMPLEMENTED", "Not implemented: install @azure/keyvault-keys"));
+    }
+    rotateKey(_keyId) {
+        return Promise.reject(new errors_1.KmsError("NOT_IMPLEMENTED", "Not implemented: install @azure/keyvault-keys"));
+    }
+    generateDataKey(_keyId, _keySpec) {
+        return Promise.reject(new errors_1.KmsError("NOT_IMPLEMENTED", "Not implemented: install @azure/keyvault-keys"));
+    }
+}
+exports.AzureKmsProvider = AzureKmsProvider;
+//# sourceMappingURL=azure.js.map

package/dist/providers/gcp.d.ts

@@ -0,0 +1,31 @@
+import type { KmsProvider, KmsKeyMetadata, KmsEncryptResult, KmsDecryptResult, KmsSignResult } from "../types";
+export interface GcpKmsOptions {
+    projectId: string;
+    locationId: string;
+    keyRingId: string;
+}
+export declare class GcpKmsProvider implements KmsProvider {
+    readonly name = "gcp";
+    private readonly options;
+    constructor(options: GcpKmsOptions);
+    private getParent;
+    listKeys(_filters?: {
+        usage?: string;
+        enabled?: boolean;
+    }): Promise<KmsKeyMetadata[]>;
+    getKey(_keyId: string): Promise<KmsKeyMetadata>;
+    createKey(_algorithm: string, _usage: "encrypt" | "sign" | "wrap", _metadata?: Record<string, string>): Promise<KmsKeyMetadata>;
+    enableKey(_keyId: string): Promise<void>;
+    disableKey(_keyId: string): Promise<void>;
+    scheduleKeyDeletion(_keyId: string, _pendingWindowDays?: number): Promise<void>;
+    encrypt(_keyId: string, _plaintext: Uint8Array, _context?: Record<string, string>): Promise<KmsEncryptResult>;
+    decrypt(_keyId: string, _ciphertext: string, _context?: Record<string, string>): Promise<KmsDecryptResult>;
+    sign(_keyId: string, _data: Uint8Array, _algorithm?: string): Promise<KmsSignResult>;
+    verify(_keyId: string, _data: Uint8Array, _signature: string, _algorithm?: string): Promise<boolean>;
+    rotateKey(_keyId: string): Promise<KmsKeyMetadata>;
+    generateDataKey(_keyId: string, _keySpec?: string): Promise<{
+        plaintext: Uint8Array;
+        ciphertext: string;
+    }>;
+}
+//# sourceMappingURL=gcp.d.ts.map

package/dist/providers/gcp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gcp.d.ts","sourceRoot":"","sources":["../../src/providers/gcp.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EACV,WAAW,EACX,cAAc,EACd,gBAAgB,EAChB,gBAAgB,EAChB,aAAa,EACd,MAAM,UAAU,CAAC;AAelB,MAAM,WAAW,aAAa;IAE5B,SAAS,EAAE,MAAM,CAAC;IAElB,UAAU,EAAE,MAAM,CAAC;IAEnB,SAAS,EAAE,MAAM,CAAC;CACnB;AAkBD,qBAAa,cAAe,YAAW,WAAW;IAEhD,QAAQ,CAAC,IAAI,SAAS;IAEtB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAgB;gBAG5B,OAAO,EAAE,aAAa;IAKlC,OAAO,CAAC,SAAS;IAKjB,QAAQ,CAAC,QAAQ,CAAC,EAAE;QAClB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,OAAO,CAAC,EAAE,OAAO,CAAC;KACnB,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;IAW7B,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IAU/C,SAAS,CACP,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,SAAS,GAAG,MAAM,GAAG,MAAM,EACnC,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GACjC,OAAO,CAAC,cAAc,CAAC;IAU1B,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAUxC,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAUzC,mBAAmB,CACjB,MAAM,EAAE,MAAM,EACd,kBAAkB,CAAC,EAAE,MAAM,GAC1B,OAAO,CAAC,IAAI,CAAC;IAUhB,OAAO,CACL,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,UAAU,EACtB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAChC,OAAO,CAAC,gBAAgB,CAAC;IAU5B,OAAO,CACL,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,EACnB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAChC,OAAO,CAAC,gBAAgB,CAAC;IAU5B,IAAI,CACF,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,UAAU,EACjB,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,aAAa,CAAC;IAUzB,MAAM,CACJ,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,UAAU,EACjB,UAAU,EAAE,MAAM,EAClB,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,OAAO,CAAC;IAUnB,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IAUlD,eAAe,CACb,MAAM,EAAE,MAAM,EACd,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC;QAET,SAAS,EAAE,UAAU,CAAC;QAEtB,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC;CAQH"}

package/dist/providers/gcp.js

@@ -0,0 +1,53 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GcpKmsProvider = void 0;
+const errors_1 = require("../errors");
+class GcpKmsProvider {
+    name = "gcp";
+    options;
+    constructor(options) {
+        this.options = options;
+    }
+    getParent() {
+        return `projects/${this.options.projectId}/locations/${this.options.locationId}/keyRings/${this.options.keyRingId}`;
+    }
+    listKeys(_filters) {
+        void this.getParent();
+        return Promise.reject(new errors_1.KmsError("NOT_IMPLEMENTED", "Not implemented: install @google-cloud/kms"));
+    }
+    getKey(_keyId) {
+        return Promise.reject(new errors_1.KmsError("NOT_IMPLEMENTED", "Not implemented: install @google-cloud/kms"));
+    }
+    createKey(_algorithm, _usage, _metadata) {
+        return Promise.reject(new errors_1.KmsError("NOT_IMPLEMENTED", "Not implemented: install @google-cloud/kms"));
+    }
+    enableKey(_keyId) {
+        return Promise.reject(new errors_1.KmsError("NOT_IMPLEMENTED", "Not implemented: install @google-cloud/kms"));
+    }
+    disableKey(_keyId) {
+        return Promise.reject(new errors_1.KmsError("NOT_IMPLEMENTED", "Not implemented: install @google-cloud/kms"));
+    }
+    scheduleKeyDeletion(_keyId, _pendingWindowDays) {
+        return Promise.reject(new errors_1.KmsError("NOT_IMPLEMENTED", "Not implemented: install @google-cloud/kms"));
+    }
+    encrypt(_keyId, _plaintext, _context) {
+        return Promise.reject(new errors_1.KmsError("NOT_IMPLEMENTED", "Not implemented: install @google-cloud/kms"));
+    }
+    decrypt(_keyId, _ciphertext, _context) {
+        return Promise.reject(new errors_1.KmsError("NOT_IMPLEMENTED", "Not implemented: install @google-cloud/kms"));
+    }
+    sign(_keyId, _data, _algorithm) {
+        return Promise.reject(new errors_1.KmsError("NOT_IMPLEMENTED", "Not implemented: install @google-cloud/kms"));
+    }
+    verify(_keyId, _data, _signature, _algorithm) {
+        return Promise.reject(new errors_1.KmsError("NOT_IMPLEMENTED", "Not implemented: install @google-cloud/kms"));
+    }
+    rotateKey(_keyId) {
+        return Promise.reject(new errors_1.KmsError("NOT_IMPLEMENTED", "Not implemented: install @google-cloud/kms"));
+    }
+    generateDataKey(_keyId, _keySpec) {
+        return Promise.reject(new errors_1.KmsError("NOT_IMPLEMENTED", "Not implemented: install @google-cloud/kms"));
+    }
+}
+exports.GcpKmsProvider = GcpKmsProvider;
+//# sourceMappingURL=gcp.js.map

package/dist/providers/local.d.ts

@@ -0,0 +1,30 @@
+import type { KmsProvider, KmsKeyMetadata, KmsEncryptResult, KmsDecryptResult, KmsSignResult } from "../types";
+export declare class LocalKmsProvider implements KmsProvider {
+    readonly name = "local";
+    private readonly store;
+    private record;
+    private enabledRecord;
+    private cipherRecord;
+    private snapshot;
+    listKeys(filters?: {
+        usage?: string;
+        enabled?: boolean;
+    }): Promise<KmsKeyMetadata[]>;
+    getKey(keyId: string): Promise<KmsKeyMetadata>;
+    createKey(algorithm: string, usage: "encrypt" | "sign" | "wrap", _metadata?: Record<string, string>): Promise<KmsKeyMetadata>;
+    enableKey(keyId: string): Promise<void>;
+    disableKey(keyId: string): Promise<void>;
+    scheduleKeyDeletion(keyId: string, pendingWindowDays?: number): Promise<void>;
+    encrypt(keyId: string, plaintext: Uint8Array, context?: Record<string, string>): Promise<KmsEncryptResult>;
+    decrypt(keyId: string, ciphertext: string, context?: Record<string, string>): Promise<KmsDecryptResult>;
+    private signingRecord;
+    sign(keyId: string, data: Uint8Array, _algorithm?: string): Promise<KmsSignResult>;
+    verify(keyId: string, data: Uint8Array, signature: string, _algorithm?: string): Promise<boolean>;
+    rotateKey(keyId: string): Promise<KmsKeyMetadata>;
+    destroyKeyVersion(keyId: string, version: number): Promise<void>;
+    generateDataKey(keyId: string, _keySpec?: string): Promise<{
+        plaintext: Uint8Array;
+        ciphertext: string;
+    }>;
+}
+//# sourceMappingURL=local.d.ts.map

package/dist/providers/local.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"local.d.ts","sourceRoot":"","sources":["../../src/providers/local.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EACV,WAAW,EACX,cAAc,EACd,gBAAgB,EAChB,gBAAgB,EAChB,aAAa,EACd,MAAM,UAAU,CAAC;AAqDlB,qBAAa,gBAAiB,YAAW,WAAW;IAElD,QAAQ,CAAC,IAAI,WAAW;IAExB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAqC;IAG3D,OAAO,CAAC,MAAM;IASd,OAAO,CAAC,aAAa;IASrB,OAAO,CAAC,YAAY;IAapB,OAAO,CAAC,QAAQ;IAQV,QAAQ,CAAC,OAAO,CAAC,EAAE;QACvB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,OAAO,CAAC,EAAE,OAAO,CAAC;KACnB,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;IAevB,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IAK9C,SAAS,CACb,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,SAAS,GAAG,MAAM,GAAG,MAAM,EAClC,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GACjC,OAAO,CAAC,cAAc,CAAC;IAqBpB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKvC,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKxC,mBAAmB,CACvB,KAAK,EAAE,MAAM,EACb,iBAAiB,SAAK,GACrB,OAAO,CAAC,IAAI,CAAC;IAUV,OAAO,CACX,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,UAAU,EACrB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC/B,OAAO,CAAC,gBAAgB,CAAC;IAetB,OAAO,CACX,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC/B,OAAO,CAAC,gBAAgB,CAAC;IAO5B,OAAO,CAAC,aAAa;IAYf,IAAI,CACR,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,UAAU,EAChB,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,aAAa,CAAC;IAanB,MAAM,CACV,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,UAAU,EAChB,SAAS,EAAE,MAAM,EACjB,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,OAAO,CAAC;IASb,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IAajD,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKhE,eAAe,CACnB,KAAK,EAAE,MAAM,EACb,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC;QAET,SAAS,EAAE,UAAU,CAAC;QAEtB,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC;CAQH"}

package/dist/providers/local.js

@@ -0,0 +1,139 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LocalKmsProvider = void 0;
+const node_crypto_1 = require("node:crypto");
+const crypto_lib_1 = require("@sebastienrousseau/crypto-lib");
+const errors_1 = require("../errors");
+const versioned_key_1 = require("./versioned-key");
+function generateId() {
+    return `local-${(0, crypto_lib_1.bytesToHex)((0, node_crypto_1.randomBytes)(16))}`;
+}
+class LocalKmsProvider {
+    name = "local";
+    store = new Map();
+    record(keyId) {
+        const record = this.store.get(keyId);
+        if (!record) {
+            throw new errors_1.KmsError("NOT_FOUND", `Key not found: ${keyId}`, keyId);
+        }
+        return record;
+    }
+    enabledRecord(keyId) {
+        const record = this.record(keyId);
+        if (!record.metadata.enabled) {
+            throw new errors_1.KmsError("DISABLED", `Key is disabled: ${keyId}`, keyId);
+        }
+        return record;
+    }
+    cipherRecord(keyId, purpose) {
+        const record = this.enabledRecord(keyId);
+        if (record.metadata.usage === "sign") {
+            throw new errors_1.KmsError("INVALID_USAGE", `Key ${keyId} is a signing key, ${purpose}`, keyId);
+        }
+        return record;
+    }
+    snapshot(record) {
+        return {
+            ...record.metadata,
+            currentVersion: (0, versioned_key_1.currentVersion)(record.key).version,
+        };
+    }
+    async listKeys(filters) {
+        const keys = Array.from(this.store.values())
+            .filter((r) => !r.pendingDeletion)
+            .map((r) => this.snapshot(r));
+        if (!filters)
+            return keys;
+        return keys.filter((k) => (filters.usage === undefined || k.usage === filters.usage) &&
+            (filters.enabled === undefined || k.enabled === filters.enabled));
+    }
+    async getKey(keyId) {
+        return this.snapshot(this.record(keyId));
+    }
+    async createKey(algorithm, usage, _metadata) {
+        const keyId = generateId();
+        const metadata = {
+            keyId,
+            algorithm,
+            usage,
+            createdAt: new Date().toISOString(),
+            enabled: true,
+            provider: "local",
+        };
+        const record = {
+            metadata,
+            key: (0, versioned_key_1.createVersionedKey)(usage),
+            pendingDeletion: undefined,
+            deletionDate: undefined,
+        };
+        this.store.set(keyId, record);
+        return this.snapshot(record);
+    }
+    async enableKey(keyId) {
+        this.record(keyId).metadata.enabled = true;
+    }
+    async disableKey(keyId) {
+        this.record(keyId).metadata.enabled = false;
+    }
+    async scheduleKeyDeletion(keyId, pendingWindowDays = 30) {
+        const record = this.record(keyId);
+        record.pendingDeletion = true;
+        record.metadata.enabled = false;
+        const deletionDate = new Date();
+        deletionDate.setDate(deletionDate.getDate() + pendingWindowDays);
+        record.deletionDate = deletionDate.toISOString();
+    }
+    async encrypt(keyId, plaintext, context) {
+        const record = this.cipherRecord(keyId, "not an encryption key");
+        const sealed = (0, versioned_key_1.sealCurrent)(record.key, plaintext, context);
+        const result = {
+            ciphertext: sealed.ciphertext,
+            keyId,
+            keyVersion: sealed.version,
+        };
+        if (context) {
+            result.context = context;
+        }
+        return result;
+    }
+    async decrypt(keyId, ciphertext, context) {
+        const record = this.cipherRecord(keyId, "not an encryption key");
+        const opened = (0, versioned_key_1.openVersioned)(record.key, keyId, ciphertext, context);
+        return { plaintext: opened.plaintext, keyId, keyVersion: opened.version };
+    }
+    signingRecord(keyId, record) {
+        if (record.metadata.usage !== "sign") {
+            throw new errors_1.KmsError("INVALID_USAGE", `Key ${keyId} is not a signing key`, keyId);
+        }
+        return record.key;
+    }
+    async sign(keyId, data, _algorithm) {
+        const key = this.signingRecord(keyId, this.enabledRecord(keyId));
+        return {
+            signature: (0, crypto_lib_1.bytesToBase64)((0, versioned_key_1.signCurrent)(key, data)),
+            keyId,
+            algorithm: "ed25519",
+        };
+    }
+    async verify(keyId, data, signature, _algorithm) {
+        const key = this.signingRecord(keyId, this.record(keyId));
+        return (0, versioned_key_1.verifyAnyVersion)(key, data, (0, crypto_lib_1.base64ToBytes)(signature));
+    }
+    async rotateKey(keyId) {
+        const record = this.record(keyId);
+        const next = (0, versioned_key_1.rotateVersionedKey)(record.key);
+        record.metadata.createdAt = next.createdAt;
+        return this.snapshot(record);
+    }
+    async destroyKeyVersion(keyId, version) {
+        (0, versioned_key_1.destroyVersion)(this.record(keyId).key, version, keyId);
+    }
+    async generateDataKey(keyId, _keySpec) {
+        this.cipherRecord(keyId, "cannot generate data key");
+        const dek = new Uint8Array((0, node_crypto_1.randomBytes)(32));
+        const wrapped = await this.encrypt(keyId, dek);
+        return { plaintext: dek, ciphertext: wrapped.ciphertext };
+    }
+}
+exports.LocalKmsProvider = LocalKmsProvider;
+//# sourceMappingURL=local.js.map

package/dist/providers/pkcs11.d.ts

@@ -0,0 +1,53 @@
+import type { KmsProvider, KmsKeyMetadata, KmsEncryptResult, KmsDecryptResult, KmsSignResult } from "../types";
+export interface Pkcs11HsmOptions {
+    modulePath?: string;
+    slotIndex?: number;
+    tokenLabel?: string;
+    pin?: string;
+    hsmModel?: "thales-luna" | "aws-cloudhsm" | "utimaco" | "yubihsm2" | "generic";
+    simulate?: boolean;
+}
+export interface HsmSessionInfo {
+    model: string;
+    slotIndex: number;
+    tokenLabel: string;
+    fipsLevel: string;
+    simulated: boolean;
+    authenticated: boolean;
+    sessionState: "CKS_RO_USER_FUNCTIONS" | "CKS_RW_USER_FUNCTIONS";
+}
+export declare class Pkcs11HsmProvider implements KmsProvider {
+    readonly name = "pkcs11";
+    readonly hsmModel: string;
+    readonly slotIndex: number;
+    readonly tokenLabel: string;
+    private readonly store;
+    private handleCounter;
+    private isAuthenticated;
+    constructor(options?: Pkcs11HsmOptions);
+    getHsmSessionInfo(): HsmSessionInfo;
+    private record;
+    private enabledRecord;
+    private requireUsage;
+    private snapshot;
+    listKeys(filters?: {
+        usage?: string;
+        enabled?: boolean;
+    }): Promise<KmsKeyMetadata[]>;
+    getKey(keyId: string): Promise<KmsKeyMetadata>;
+    createKey(algorithm: string, usage: "encrypt" | "sign" | "wrap", _metadata?: Record<string, string>): Promise<KmsKeyMetadata>;
+    enableKey(keyId: string): Promise<void>;
+    disableKey(keyId: string): Promise<void>;
+    scheduleKeyDeletion(keyId: string, pendingWindowDays?: number): Promise<void>;
+    encrypt(keyId: string, plaintext: Uint8Array, context?: Record<string, string>): Promise<KmsEncryptResult>;
+    decrypt(keyId: string, ciphertext: string, context?: Record<string, string>): Promise<KmsDecryptResult>;
+    sign(keyId: string, data: Uint8Array, algorithm?: string): Promise<KmsSignResult>;
+    verify(keyId: string, data: Uint8Array, signature: string, _algorithm?: string): Promise<boolean>;
+    rotateKey(keyId: string): Promise<KmsKeyMetadata>;
+    destroyKeyVersion(keyId: string, version: number): Promise<void>;
+    generateDataKey(keyId: string, _keySpec?: string): Promise<{
+        plaintext: Uint8Array;
+        ciphertext: string;
+    }>;
+}
+//# sourceMappingURL=pkcs11.d.ts.map

package/dist/providers/pkcs11.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pkcs11.d.ts","sourceRoot":"","sources":["../../src/providers/pkcs11.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EACV,WAAW,EACX,cAAc,EACd,gBAAgB,EAChB,gBAAgB,EAChB,aAAa,EACd,MAAM,UAAU,CAAC;AAelB,MAAM,WAAW,gBAAgB;IAE/B,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB,UAAU,CAAC,EAAE,MAAM,CAAC;IAKpB,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb,QAAQ,CAAC,EACP,aAAa,GAAG,cAAc,GAAG,SAAS,GAAG,UAAU,GAAG,SAAS,CAAC;IAKtE,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAGD,MAAM,WAAW,cAAc;IAE7B,KAAK,EAAE,MAAM,CAAC;IAEd,SAAS,EAAE,MAAM,CAAC;IAElB,UAAU,EAAE,MAAM,CAAC;IAEnB,SAAS,EAAE,MAAM,CAAC;IAElB,SAAS,EAAE,OAAO,CAAC;IAEnB,aAAa,EAAE,OAAO,CAAC;IAEvB,YAAY,EAAE,uBAAuB,GAAG,uBAAuB,CAAC;CACjE;AAmCD,qBAAa,iBAAkB,YAAW,WAAW;IAEnD,QAAQ,CAAC,IAAI,YAAY;IAEzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAE1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAE3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAE5B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAmC;IACzD,OAAO,CAAC,aAAa,CAAQ;IAC7B,OAAO,CAAC,eAAe,CAAS;gBAEpB,OAAO,GAAE,gBAAqB;IAe1C,iBAAiB,IAAI,cAAc;IAanC,OAAO,CAAC,MAAM;IASd,OAAO,CAAC,aAAa;IAYrB,OAAO,CAAC,YAAY;IAkBpB,OAAO,CAAC,QAAQ;IAQV,QAAQ,CAAC,OAAO,CAAC,EAAE;QACvB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,OAAO,CAAC,EAAE,OAAO,CAAC;KACnB,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;IAevB,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IAK9C,SAAS,CACb,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,SAAS,GAAG,MAAM,GAAG,MAAM,EAClC,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GACjC,OAAO,CAAC,cAAc,CAAC;IAmBpB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKvC,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKxC,mBAAmB,CACvB,KAAK,EAAE,MAAM,EACb,iBAAiB,SAAI,GACpB,OAAO,CAAC,IAAI,CAAC;IAUV,OAAO,CACX,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,UAAU,EACrB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC/B,OAAO,CAAC,gBAAgB,CAAC;IAgBtB,OAAO,CACX,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC/B,OAAO,CAAC,gBAAgB,CAAC;IAQtB,IAAI,CACR,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,UAAU,EAChB,SAAS,SAAY,GACpB,OAAO,CAAC,aAAa,CAAC;IAcnB,MAAM,CACV,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,UAAU,EAChB,SAAS,EAAE,MAAM,EACjB,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,OAAO,CAAC;IASb,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IAajD,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKhE,eAAe,CACnB,KAAK,EAAE,MAAM,EACb,QAAQ,SAAY,GACnB,OAAO,CAAC;QAAE,SAAS,EAAE,UAAU,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC;CAQ1D"}

package/dist/providers/pkcs11.js

@@ -0,0 +1,165 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Pkcs11HsmProvider = void 0;
+const node_crypto_1 = require("node:crypto");
+const crypto_lib_1 = require("@sebastienrousseau/crypto-lib");
+const errors_1 = require("../errors");
+const versioned_key_1 = require("./versioned-key");
+function generateHsmKeyId(model) {
+    return `pkcs11-${model}-${(0, crypto_lib_1.bytesToHex)((0, node_crypto_1.randomBytes)(12))}`;
+}
+class Pkcs11HsmProvider {
+    name = "pkcs11";
+    hsmModel;
+    slotIndex;
+    tokenLabel;
+    store = new Map();
+    handleCounter = 1000;
+    isAuthenticated = false;
+    constructor(options = {}) {
+        if (options.simulate !== true) {
+            throw new Error("Pkcs11HsmProvider: no real PKCS#11 backend is implemented. " +
+                "Pass { simulate: true } to use the in-memory software simulation " +
+                "(tests and CI only; it provides no hardware key isolation).");
+        }
+        this.hsmModel = options.hsmModel ?? "generic";
+        this.slotIndex = options.slotIndex ?? 0;
+        this.tokenLabel = options.tokenLabel ?? "HSM-DEFAULT-TOKEN";
+        this.isAuthenticated = Boolean(options.pin);
+    }
+    getHsmSessionInfo() {
+        return {
+            model: this.hsmModel,
+            slotIndex: this.slotIndex,
+            tokenLabel: this.tokenLabel,
+            fipsLevel: "none (software simulation)",
+            simulated: true,
+            authenticated: this.isAuthenticated,
+            sessionState: "CKS_RW_USER_FUNCTIONS",
+        };
+    }
+    record(keyId) {
+        const record = this.store.get(keyId);
+        if (!record) {
+            throw new errors_1.KmsError("NOT_FOUND", `HSM key not found: ${keyId}`, keyId);
+        }
+        return record;
+    }
+    enabledRecord(keyId) {
+        const record = this.record(keyId);
+        if (!record.metadata.enabled) {
+            throw new errors_1.KmsError("DISABLED", `HSM key is disabled: ${keyId}`, keyId);
+        }
+        return record;
+    }
+    requireUsage(keyId, record, expected) {
+        const usage = record.metadata.usage;
+        const ok = expected === "sign" ? usage === "sign" : usage !== "sign";
+        if (!ok) {
+            throw new errors_1.KmsError("INVALID_USAGE", `HSM key usage is '${usage}', expected '${expected}'`, keyId);
+        }
+        return record.key;
+    }
+    snapshot(record) {
+        return {
+            ...record.metadata,
+            currentVersion: (0, versioned_key_1.currentVersion)(record.key).version,
+        };
+    }
+    async listKeys(filters) {
+        const keys = Array.from(this.store.values())
+            .filter((r) => !r.pendingDeletion)
+            .map((r) => this.snapshot(r));
+        if (!filters)
+            return keys;
+        return keys.filter((k) => (filters.usage === undefined || k.usage === filters.usage) &&
+            (filters.enabled === undefined || k.enabled === filters.enabled));
+    }
+    async getKey(keyId) {
+        return this.snapshot(this.record(keyId));
+    }
+    async createKey(algorithm, usage, _metadata) {
+        const keyId = generateHsmKeyId(this.hsmModel);
+        const record = {
+            metadata: {
+                keyId,
+                algorithm,
+                usage,
+                createdAt: new Date().toISOString(),
+                enabled: true,
+                provider: "pkcs11",
+            },
+            key: (0, versioned_key_1.createVersionedKey)(usage),
+            hsmHandle: ++this.handleCounter,
+        };
+        this.store.set(keyId, record);
+        return this.snapshot(record);
+    }
+    async enableKey(keyId) {
+        this.record(keyId).metadata.enabled = true;
+    }
+    async disableKey(keyId) {
+        this.record(keyId).metadata.enabled = false;
+    }
+    async scheduleKeyDeletion(keyId, pendingWindowDays = 7) {
+        const record = this.record(keyId);
+        record.pendingDeletion = true;
+        const date = new Date();
+        date.setDate(date.getDate() + pendingWindowDays);
+        record.deletionDate = date.toISOString();
+        record.metadata.enabled = false;
+    }
+    async encrypt(keyId, plaintext, context) {
+        const record = this.enabledRecord(keyId);
+        const key = this.requireUsage(keyId, record, "encrypt");
+        const sealed = (0, versioned_key_1.sealCurrent)(key, plaintext, context);
+        const result = {
+            ciphertext: sealed.ciphertext,
+            keyId,
+            keyVersion: sealed.version,
+        };
+        if (context !== undefined) {
+            result.context = context;
+        }
+        return result;
+    }
+    async decrypt(keyId, ciphertext, context) {
+        const record = this.enabledRecord(keyId);
+        const key = this.requireUsage(keyId, record, "encrypt");
+        const opened = (0, versioned_key_1.openVersioned)(key, keyId, ciphertext, context);
+        return { plaintext: opened.plaintext, keyId, keyVersion: opened.version };
+    }
+    async sign(keyId, data, algorithm = "Ed25519") {
+        const record = this.enabledRecord(keyId);
+        const key = this.requireUsage(keyId, record, "sign");
+        return {
+            signature: (0, crypto_lib_1.bytesToBase64)((0, versioned_key_1.signCurrent)(key, data)),
+            keyId,
+            algorithm,
+        };
+    }
+    async verify(keyId, data, signature, _algorithm) {
+        const key = this.requireUsage(keyId, this.record(keyId), "sign");
+        return (0, versioned_key_1.verifyAnyVersion)(key, data, (0, crypto_lib_1.base64ToBytes)(signature));
+    }
+    async rotateKey(keyId) {
+        const record = this.record(keyId);
+        const next = (0, versioned_key_1.rotateVersionedKey)(record.key);
+        record.hsmHandle = ++this.handleCounter;
+        record.metadata.createdAt = next.createdAt;
+        return this.snapshot(record);
+    }
+    async destroyKeyVersion(keyId, version) {
+        (0, versioned_key_1.destroyVersion)(this.record(keyId).key, version, keyId);
+    }
+    async generateDataKey(keyId, _keySpec = "AES_256") {
+        const plaintext = new Uint8Array((0, node_crypto_1.randomBytes)(32));
+        const enc = await this.encrypt(keyId, plaintext);
+        return {
+            plaintext,
+            ciphertext: enc.ciphertext,
+        };
+    }
+}
+exports.Pkcs11HsmProvider = Pkcs11HsmProvider;
+//# sourceMappingURL=pkcs11.js.map

package/dist/providers/vault.d.ts

@@ -0,0 +1,34 @@
+import type { KmsProvider, KmsKeyMetadata, KmsEncryptResult, KmsDecryptResult, KmsSignResult } from "../types";
+export interface VaultKmsOptions {
+    address: string;
+    token: string;
+    mountPath?: string;
+}
+export declare class VaultKmsProvider implements KmsProvider {
+    readonly name = "vault";
+    private readonly _address;
+    private readonly _token;
+    private readonly _mount;
+    constructor(options: VaultKmsOptions);
+    buildUrl(path: string): string;
+    buildHeaders(): Record<string, string>;
+    listKeys(_filters?: {
+        usage?: string;
+        enabled?: boolean;
+    }): Promise<KmsKeyMetadata[]>;
+    getKey(_keyId: string): Promise<KmsKeyMetadata>;
+    createKey(_algorithm: string, _usage: "encrypt" | "sign" | "wrap", _metadata?: Record<string, string>): Promise<KmsKeyMetadata>;
+    enableKey(_keyId: string): Promise<void>;
+    disableKey(_keyId: string): Promise<void>;
+    scheduleKeyDeletion(_keyId: string, _pendingWindowDays?: number): Promise<void>;
+    encrypt(_keyId: string, _plaintext: Uint8Array, _context?: Record<string, string>): Promise<KmsEncryptResult>;
+    decrypt(_keyId: string, _ciphertext: string, _context?: Record<string, string>): Promise<KmsDecryptResult>;
+    sign(_keyId: string, _data: Uint8Array, _algorithm?: string): Promise<KmsSignResult>;
+    verify(_keyId: string, _data: Uint8Array, _signature: string, _algorithm?: string): Promise<boolean>;
+    rotateKey(_keyId: string): Promise<KmsKeyMetadata>;
+    generateDataKey(_keyId: string, _keySpec?: string): Promise<{
+        plaintext: Uint8Array;
+        ciphertext: string;
+    }>;
+}
+//# sourceMappingURL=vault.d.ts.map

package/dist/providers/vault.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault.d.ts","sourceRoot":"","sources":["../../src/providers/vault.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EACV,WAAW,EACX,cAAc,EACd,gBAAgB,EAChB,gBAAgB,EAChB,aAAa,EACd,MAAM,UAAU,CAAC;AAelB,MAAM,WAAW,eAAe;IAE9B,OAAO,EAAE,MAAM,CAAC;IAEhB,KAAK,EAAE,MAAM,CAAC;IAEd,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAkBD,qBAAa,gBAAiB,YAAW,WAAW;IAElD,QAAQ,CAAC,IAAI,WAAW;IAExB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAElC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAEhC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;gBAGpB,OAAO,EAAE,eAAe;IAOpC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM;IAM9B,YAAY,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAQtC,QAAQ,CAAC,QAAQ,CAAC,EAAE;QAClB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,OAAO,CAAC,EAAE,OAAO,CAAC;KACnB,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;IAU7B,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IAU/C,SAAS,CACP,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,SAAS,GAAG,MAAM,GAAG,MAAM,EACnC,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GACjC,OAAO,CAAC,cAAc,CAAC;IAU1B,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAUxC,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAUzC,mBAAmB,CACjB,MAAM,EAAE,MAAM,EACd,kBAAkB,CAAC,EAAE,MAAM,GAC1B,OAAO,CAAC,IAAI,CAAC;IAUhB,OAAO,CACL,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,UAAU,EACtB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAChC,OAAO,CAAC,gBAAgB,CAAC;IAU5B,OAAO,CACL,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,EACnB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAChC,OAAO,CAAC,gBAAgB,CAAC;IAU5B,IAAI,CACF,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,UAAU,EACjB,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,aAAa,CAAC;IAUzB,MAAM,CACJ,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,UAAU,EACjB,UAAU,EAAE,MAAM,EAClB,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,OAAO,CAAC;IAUnB,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IAUlD,eAAe,CACb,MAAM,EAAE,MAAM,EACd,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC;QAET,SAAS,EAAE,UAAU,CAAC;QAEtB,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC;CAQH"}