@sebastienrousseau/crypto-kms 0.0.7

package/dist/providers/vault.js

@@ -0,0 +1,63 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.VaultKmsProvider = void 0;
+const errors_1 = require("../errors");
+class VaultKmsProvider {
+    name = "vault";
+    _address;
+    _token;
+    _mount;
+    constructor(options) {
+        this._address = options.address;
+        this._token = options.token;
+        this._mount = options.mountPath ?? "transit";
+    }
+    buildUrl(path) {
+        const base = this._address.replace(/\/+$/, "");
+        return `${base}/v1/${this._mount}/${path}`;
+    }
+    buildHeaders() {
+        return {
+            "X-Vault-Token": this._token,
+            "Content-Type": "application/json",
+        };
+    }
+    listKeys(_filters) {
+        return Promise.reject(new errors_1.KmsError("NOT_IMPLEMENTED", "Not implemented: configure HashiCorp Vault connection"));
+    }
+    getKey(_keyId) {
+        return Promise.reject(new errors_1.KmsError("NOT_IMPLEMENTED", "Not implemented: configure HashiCorp Vault connection"));
+    }
+    createKey(_algorithm, _usage, _metadata) {
+        return Promise.reject(new errors_1.KmsError("NOT_IMPLEMENTED", "Not implemented: configure HashiCorp Vault connection"));
+    }
+    enableKey(_keyId) {
+        return Promise.reject(new errors_1.KmsError("NOT_IMPLEMENTED", "Not implemented: configure HashiCorp Vault connection"));
+    }
+    disableKey(_keyId) {
+        return Promise.reject(new errors_1.KmsError("NOT_IMPLEMENTED", "Not implemented: configure HashiCorp Vault connection"));
+    }
+    scheduleKeyDeletion(_keyId, _pendingWindowDays) {
+        return Promise.reject(new errors_1.KmsError("NOT_IMPLEMENTED", "Not implemented: configure HashiCorp Vault connection"));
+    }
+    encrypt(_keyId, _plaintext, _context) {
+        return Promise.reject(new errors_1.KmsError("NOT_IMPLEMENTED", "Not implemented: configure HashiCorp Vault connection"));
+    }
+    decrypt(_keyId, _ciphertext, _context) {
+        return Promise.reject(new errors_1.KmsError("NOT_IMPLEMENTED", "Not implemented: configure HashiCorp Vault connection"));
+    }
+    sign(_keyId, _data, _algorithm) {
+        return Promise.reject(new errors_1.KmsError("NOT_IMPLEMENTED", "Not implemented: configure HashiCorp Vault connection"));
+    }
+    verify(_keyId, _data, _signature, _algorithm) {
+        return Promise.reject(new errors_1.KmsError("NOT_IMPLEMENTED", "Not implemented: configure HashiCorp Vault connection"));
+    }
+    rotateKey(_keyId) {
+        return Promise.reject(new errors_1.KmsError("NOT_IMPLEMENTED", "Not implemented: configure HashiCorp Vault connection"));
+    }
+    generateDataKey(_keyId, _keySpec) {
+        return Promise.reject(new errors_1.KmsError("NOT_IMPLEMENTED", "Not implemented: configure HashiCorp Vault connection"));
+    }
+}
+exports.VaultKmsProvider = VaultKmsProvider;
+//# sourceMappingURL=vault.js.map

package/dist/providers/versioned-key.d.ts

@@ -0,0 +1,26 @@
+export interface KeyVersion {
+    readonly version: number;
+    readonly createdAt: string;
+    material: Uint8Array | undefined;
+    readonly publicKey: Uint8Array | undefined;
+}
+export interface VersionedKey {
+    readonly usage: "encrypt" | "sign" | "wrap";
+    readonly versions: KeyVersion[];
+}
+export declare function createVersionedKey(usage: VersionedKey["usage"]): VersionedKey;
+export declare function currentVersion(key: VersionedKey): KeyVersion;
+export declare function rotateVersionedKey(key: VersionedKey): KeyVersion;
+export declare function destroyVersion(key: VersionedKey, version: number, keyId: string): void;
+export declare function canonicalContext(context?: Record<string, string>): Buffer;
+export declare function sealCurrent(key: VersionedKey, plaintext: Uint8Array, context?: Record<string, string>): {
+    ciphertext: string;
+    version: number;
+};
+export declare function openVersioned(key: VersionedKey, keyId: string, ciphertext: string, context?: Record<string, string>): {
+    plaintext: Uint8Array;
+    version: number;
+};
+export declare function signCurrent(key: VersionedKey, data: Uint8Array): Uint8Array;
+export declare function verifyAnyVersion(key: VersionedKey, data: Uint8Array, signature: Uint8Array): boolean;
+//# sourceMappingURL=versioned-key.d.ts.map

package/dist/providers/versioned-key.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"versioned-key.d.ts","sourceRoot":"","sources":["../../src/providers/versioned-key.ts"],"names":[],"mappings":"AA4CA,MAAM,WAAW,UAAU;IAEzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAEzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAE3B,QAAQ,EAAE,UAAU,GAAG,SAAS,CAAC;IAEjC,QAAQ,CAAC,SAAS,EAAE,UAAU,GAAG,SAAS,CAAC;CAC5C;AAGD,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,KAAK,EAAE,SAAS,GAAG,MAAM,GAAG,MAAM,CAAC;IAC5C,QAAQ,CAAC,QAAQ,EAAE,UAAU,EAAE,CAAC;CACjC;AAuBD,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,YAAY,CAAC,OAAO,CAAC,GAAG,YAAY,CAE7E;AAGD,wBAAgB,cAAc,CAAC,GAAG,EAAE,YAAY,GAAG,UAAU,CAE5D;AAGD,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,YAAY,GAAG,UAAU,CAIhE;AA8BD,wBAAgB,cAAc,CAC5B,GAAG,EAAE,YAAY,EACjB,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,GACZ,IAAI,CAUN;AASD,wBAAgB,gBAAgB,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,CAazE;AAWD,wBAAgB,WAAW,CACzB,GAAG,EAAE,YAAY,EACjB,SAAS,EAAE,UAAU,EACrB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC/B;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAUzC;AAyBD,wBAAgB,aAAa,CAC3B,GAAG,EAAE,YAAY,EACjB,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC/B;IAAE,SAAS,EAAE,UAAU,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAa5C;AAYD,wBAAgB,WAAW,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,UAAU,GAAG,UAAU,CAO3E;AAMD,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,YAAY,EACjB,IAAI,EAAE,UAAU,EAChB,SAAS,EAAE,UAAU,GACpB,OAAO,CAQT"}

package/dist/providers/versioned-key.js

@@ -0,0 +1,141 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createVersionedKey = createVersionedKey;
+exports.currentVersion = currentVersion;
+exports.rotateVersionedKey = rotateVersionedKey;
+exports.destroyVersion = destroyVersion;
+exports.canonicalContext = canonicalContext;
+exports.sealCurrent = sealCurrent;
+exports.openVersioned = openVersioned;
+exports.signCurrent = signCurrent;
+exports.verifyAnyVersion = verifyAnyVersion;
+const node_crypto_1 = require("node:crypto");
+const crypto_lib_1 = require("@sebastienrousseau/crypto-lib");
+const errors_1 = require("../errors");
+const FORMAT_V1 = 0x01;
+const HEADER_LEN = 5;
+const IV_LEN = 12;
+const TAG_LEN = 16;
+const ED25519_SIG_LEN = 64;
+function newVersion(usage, version) {
+    const createdAt = new Date().toISOString();
+    if (usage === "sign") {
+        const kp = (0, crypto_lib_1.generateEd25519KeyPair)();
+        return {
+            version,
+            createdAt,
+            material: (0, crypto_lib_1.hexToBytes)(kp.privateKey),
+            publicKey: (0, crypto_lib_1.hexToBytes)(kp.publicKey),
+        };
+    }
+    return {
+        version,
+        createdAt,
+        material: (0, node_crypto_1.randomBytes)(32),
+        publicKey: undefined,
+    };
+}
+function createVersionedKey(usage) {
+    return { usage, versions: [newVersion(usage, 1)] };
+}
+function currentVersion(key) {
+    return key.versions[key.versions.length - 1];
+}
+function rotateVersionedKey(key) {
+    const next = newVersion(key.usage, key.versions.length + 1);
+    key.versions.push(next);
+    return next;
+}
+function materialOf(key, version, keyId) {
+    const entry = key.versions[version - 1];
+    if (!entry) {
+        throw new errors_1.KmsError("NOT_FOUND", `Key version ${version} not found for key ${keyId}`, keyId);
+    }
+    if (!entry.material) {
+        throw new errors_1.KmsError("VERSION_DESTROYED", `Key version ${version} of key ${keyId} has been destroyed`, keyId);
+    }
+    return entry.material;
+}
+function destroyVersion(key, version, keyId) {
+    materialOf(key, version, keyId);
+    if (version === currentVersion(key).version) {
+        throw new errors_1.KmsError("INVALID_ARGUMENT", `Cannot destroy the current version (${version}) of key ${keyId}; rotate first`, keyId);
+    }
+    key.versions[version - 1].material = undefined;
+}
+function canonicalContext(context) {
+    const entries = Object.entries(context ?? {});
+    if (entries.length === 0)
+        return Buffer.alloc(0);
+    for (const [k, v] of entries) {
+        if (typeof v !== "string") {
+            throw new errors_1.KmsError("INVALID_ARGUMENT", `Encryption context value for '${k}' must be a string`);
+        }
+    }
+    entries.sort(([a], [b]) => (a < b ? -1 : 1));
+    return Buffer.from(JSON.stringify(entries), "utf8");
+}
+function header(version) {
+    const h = Buffer.alloc(HEADER_LEN);
+    h[0] = FORMAT_V1;
+    h.writeUInt32BE(version, 1);
+    return h;
+}
+function sealCurrent(key, plaintext, context) {
+    const aadContext = canonicalContext(context);
+    const { version, material } = currentVersion(key);
+    const head = header(version);
+    const iv = (0, node_crypto_1.randomBytes)(IV_LEN);
+    const cipher = (0, node_crypto_1.createCipheriv)("aes-256-gcm", material, iv);
+    cipher.setAAD(Buffer.concat([head, aadContext]));
+    const body = Buffer.concat([cipher.update(plaintext), cipher.final()]);
+    const packed = Buffer.concat([head, iv, cipher.getAuthTag(), body]);
+    return { ciphertext: packed.toString("base64"), version };
+}
+function parseEnvelope(ciphertext, keyId) {
+    const data = Buffer.from(ciphertext, "base64");
+    if (data.length < HEADER_LEN + IV_LEN + TAG_LEN) {
+        throw new errors_1.KmsError("INVALID_CIPHERTEXT", "Ciphertext too short", keyId);
+    }
+    if (data[0] !== FORMAT_V1) {
+        throw new errors_1.KmsError("INVALID_CIPHERTEXT", "Unsupported ciphertext format", keyId);
+    }
+    return {
+        head: data.subarray(0, HEADER_LEN),
+        version: data.readUInt32BE(1),
+        iv: data.subarray(HEADER_LEN, HEADER_LEN + IV_LEN),
+        tag: data.subarray(HEADER_LEN + IV_LEN, HEADER_LEN + IV_LEN + TAG_LEN),
+        body: data.subarray(HEADER_LEN + IV_LEN + TAG_LEN),
+    };
+}
+function openVersioned(key, keyId, ciphertext, context) {
+    const aadContext = canonicalContext(context);
+    const env = parseEnvelope(ciphertext, keyId);
+    const material = materialOf(key, env.version, keyId);
+    const decipher = (0, node_crypto_1.createDecipheriv)("aes-256-gcm", material, env.iv);
+    decipher.setAuthTag(env.tag);
+    decipher.setAAD(Buffer.concat([env.head, aadContext]));
+    try {
+        const out = Buffer.concat([decipher.update(env.body), decipher.final()]);
+        return { plaintext: new Uint8Array(out), version: env.version };
+    }
+    catch {
+        throw new errors_1.KmsError("DECRYPTION_FAILED", "Decryption failed", keyId);
+    }
+}
+function signedMessage(data) {
+    return data;
+}
+function signCurrent(key, data) {
+    const { material } = currentVersion(key);
+    const { signature } = (0, crypto_lib_1.ed25519Sign)(material, signedMessage(data));
+    return (0, crypto_lib_1.hexToBytes)(signature);
+}
+function verifyAnyVersion(key, data, signature) {
+    if (signature.length !== ED25519_SIG_LEN)
+        return false;
+    return key.versions.some((v) => v.material !== undefined &&
+        (0, crypto_lib_1.ed25519Verify)(v.publicKey, signedMessage(data), signature)
+            .valid);
+}
+//# sourceMappingURL=versioned-key.js.map

package/dist/types.d.ts

@@ -0,0 +1,48 @@
+export interface KmsKeyMetadata {
+    keyId: string;
+    algorithm: string;
+    usage: "encrypt" | "sign" | "wrap";
+    createdAt: string;
+    enabled: boolean;
+    provider: string;
+    currentVersion?: number;
+}
+export interface KmsEncryptResult {
+    ciphertext: string;
+    keyId: string;
+    context?: Record<string, string>;
+    keyVersion?: number;
+}
+export interface KmsDecryptResult {
+    plaintext: Uint8Array;
+    keyId: string;
+    keyVersion?: number;
+}
+export interface KmsSignResult {
+    signature: string;
+    keyId: string;
+    algorithm: string;
+}
+export interface KmsProvider {
+    readonly name: string;
+    listKeys(filters?: {
+        usage?: string;
+        enabled?: boolean;
+    }): Promise<KmsKeyMetadata[]>;
+    getKey(keyId: string): Promise<KmsKeyMetadata>;
+    createKey(algorithm: string, usage: "encrypt" | "sign" | "wrap", metadata?: Record<string, string>): Promise<KmsKeyMetadata>;
+    enableKey(keyId: string): Promise<void>;
+    disableKey(keyId: string): Promise<void>;
+    scheduleKeyDeletion(keyId: string, pendingWindowDays?: number): Promise<void>;
+    encrypt(keyId: string, plaintext: Uint8Array, context?: Record<string, string>): Promise<KmsEncryptResult>;
+    decrypt(keyId: string, ciphertext: string, context?: Record<string, string>): Promise<KmsDecryptResult>;
+    sign(keyId: string, data: Uint8Array, algorithm?: string): Promise<KmsSignResult>;
+    verify(keyId: string, data: Uint8Array, signature: string, algorithm?: string): Promise<boolean>;
+    rotateKey(keyId: string): Promise<KmsKeyMetadata>;
+    destroyKeyVersion?(keyId: string, version: number): Promise<void>;
+    generateDataKey(keyId: string, keySpec?: string): Promise<{
+        plaintext: Uint8Array;
+        ciphertext: string;
+    }>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAkBA,MAAM,WAAW,cAAc;IAE7B,KAAK,EAAE,MAAM,CAAC;IAEd,SAAS,EAAE,MAAM,CAAC;IAElB,KAAK,EAAE,SAAS,GAAG,MAAM,GAAG,MAAM,CAAC;IAEnC,SAAS,EAAE,MAAM,CAAC;IAElB,OAAO,EAAE,OAAO,CAAC;IAEjB,QAAQ,EAAE,MAAM,CAAC;IAMjB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAcD,MAAM,WAAW,gBAAgB;IAE/B,UAAU,EAAE,MAAM,CAAC;IAEnB,KAAK,EAAE,MAAM,CAAC;IAEd,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAEjC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAaD,MAAM,WAAW,gBAAgB;IAE/B,SAAS,EAAE,UAAU,CAAC;IAEtB,KAAK,EAAE,MAAM,CAAC;IAEd,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAcD,MAAM,WAAW,aAAa;IAE5B,SAAS,EAAE,MAAM,CAAC;IAElB,KAAK,EAAE,MAAM,CAAC;IAEd,SAAS,EAAE,MAAM,CAAC;CACnB;AAiBD,MAAM,WAAW,WAAW;IAE1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAGtB,QAAQ,CAAC,OAAO,CAAC,EAAE;QACjB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,OAAO,CAAC,EAAE,OAAO,CAAC;KACnB,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IAG9B,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAG/C,SAAS,CACP,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,SAAS,GAAG,MAAM,GAAG,MAAM,EAClC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAChC,OAAO,CAAC,cAAc,CAAC,CAAC;IAG3B,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAGxC,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAGzC,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,iBAAiB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAG9E,OAAO,CACL,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,UAAU,EACrB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC/B,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAG7B,OAAO,CACL,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC/B,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAG7B,IAAI,CACF,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,UAAU,EAChB,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,aAAa,CAAC,CAAC;IAG1B,MAAM,CACJ,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,UAAU,EAChB,SAAS,EAAE,MAAM,EACjB,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,OAAO,CAAC,CAAC;IAMpB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAOlD,iBAAiB,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAGlE,eAAe,CACb,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC;QAET,SAAS,EAAE,UAAU,CAAC;QAEtB,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC,CAAC;CACJ"}

package/dist/types.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=types.js.map

package/package.json

@@ -0,0 +1,71 @@
+{
+  "name": "@sebastienrousseau/crypto-kms",
+  "version": "0.0.7",
+  "description": "Enterprise key management adapters for AWS KMS, Google Cloud KMS, Azure Key Vault, and HashiCorp Vault.",
+  "author": "Sebastien Rousseau <sebastienrousseau@users.noreply.github.com>",
+  "license": "MIT OR Apache-2.0",
+  "engines": {
+    "node": ">=22.0.0"
+  },
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "sideEffects": false,
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "require": "./dist/index.js",
+      "import": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist/**/*.js",
+    "dist/**/*.d.ts",
+    "dist/**/*.d.ts.map"
+  ],
+  "dependencies": {
+    "@sebastienrousseau/crypto-lib": "0.0.7"
+  },
+  "peerDependencies": {
+    "@aws-sdk/client-kms": "^3.0.0",
+    "@azure/keyvault-keys": "^4.0.0",
+    "@google-cloud/kms": "^6.2.0"
+  },
+  "peerDependenciesMeta": {
+    "@aws-sdk/client-kms": {
+      "optional": true
+    },
+    "@google-cloud/kms": {
+      "optional": true
+    },
+    "@azure/keyvault-keys": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "@types/chai": "^4.3.7",
+    "@types/mocha": "^10.0.2",
+    "@types/node": "^26.4.1",
+    "c8": "^12.0.0",
+    "chai": "^4.5.0",
+    "mocha": "^10.8.2",
+    "rimraf": "^6.1.3",
+    "ts-node": "^10.9.2",
+    "typedoc": "^0.28.20",
+    "typescript": "~5.9.3"
+  },
+  "homepage": "https://github.com/sebastienrousseau/crypto-service/tree/main/packages/crypto-kms",
+  "publishConfig": {
+    "access": "public"
+  },
+  "private": false,
+  "scripts": {
+    "build": "tsc --build tsconfig.json",
+    "clean": "rimraf ./coverage ./dist ./docs",
+    "test": "c8 --check-coverage --lines 100 --branches 100 --functions 100 --reporter=lcov --reporter=text mocha --config=.mocharc.cjs",
+    "docs": "typedoc",
+    "lint": "eslint --ext .ts src __tests__",
+    "lint:fix": "eslint --cache --fix --ext .ts src __tests__",
+    "format": "prettier --write src/**/*.ts",
+    "format:check": "prettier --check \"src/**/*.ts\""
+  }
+}