@sebastienrousseau/crypto-kms 0.0.8 → 0.0.24

package/dist/providers/aws.d.ts

@@ -32,5 +32,13 @@ export declare class AwsKmsProvider implements KmsProvider {
         plaintext: Uint8Array;
         ciphertext: string;
     }>;
+    wrapKey(keyId: string, unwrappedKey: Uint8Array, context?: Record<string, string>): Promise<{
+        wrappedKey: string;
+        keyId: string;
+    }>;
+    unwrapKey(keyId: string, wrappedKey: string, context?: Record<string, string>): Promise<{
+        unwrappedKey: Uint8Array;
+        keyId: string;
+    }>;
 }
 //# sourceMappingURL=aws.d.ts.map

package/dist/providers/aws.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"aws.d.ts","sourceRoot":"","sources":["../../src/providers/aws.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EACV,WAAW,EACX,cAAc,EACd,gBAAgB,EAChB,gBAAgB,EAChB,aAAa,EACd,MAAM,UAAU,CAAC;AAkBlB,MAAM,WAAW,aAAa;IAE5B,MAAM,EAAE,MAAM,CAAC;IAEf,WAAW,CAAC,EAAE;QAEZ,WAAW,EAAE,MAAM,CAAC;QAEpB,eAAe,EAAE,MAAM,CAAC;QAExB,YAAY,CAAC,EAAE,MAAM,CAAC;KACvB,CAAC;IAEF,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAqBD,qBAAa,cAAe,YAAW,WAAW;IAEhD,QAAQ,CAAC,IAAI,SAAS;IAEtB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAgB;IAExC,OAAO,CAAC,MAAM,CAAsB;gBAGxB,OAAO,EAAE,aAAa;YAMpB,SAAS;IAqBjB,QAAQ,CAAC,QAAQ,CAAC,EAAE;QACxB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,OAAO,CAAC,EAAE,OAAO,CAAC;KACnB,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;IAevB,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IAgB9C,SAAS,CACb,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,SAAS,GAAG,MAAM,GAAG,MAAM,EAClC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAChC,OAAO,CAAC,cAAc,CAAC;IA+BpB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAOvC,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAOxC,mBAAmB,CACvB,KAAK,EAAE,MAAM,EACb,iBAAiB,SAAK,GACrB,OAAO,CAAC,IAAI,CAAC;IAYV,OAAO,CACX,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,UAAU,EACrB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC/B,OAAO,CAAC,gBAAgB,CAAC;IAqBtB,OAAO,CACX,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC/B,OAAO,CAAC,gBAAgB,CAAC;IAiBtB,IAAI,CACR,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,UAAU,EAChB,SAAS,SAAuB,GAC/B,OAAO,CAAC,aAAa,CAAC;IAmBnB,MAAM,CACV,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,UAAU,EAChB,SAAS,EAAE,MAAM,EACjB,SAAS,SAAuB,GAC/B,OAAO,CAAC,OAAO,CAAC;IAgBb,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IAQjD,eAAe,CACnB,KAAK,EAAE,MAAM,EACb,OAAO,SAAY,GAClB,OAAO,CAAC;QAET,SAAS,EAAE,UAAU,CAAC;QAEtB,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC;CAcH"}
+{"version":3,"file":"aws.d.ts","sourceRoot":"","sources":["../../src/providers/aws.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EACV,WAAW,EACX,cAAc,EACd,gBAAgB,EAChB,gBAAgB,EAChB,aAAa,EACd,MAAM,UAAU,CAAC;AAuBlB,MAAM,WAAW,aAAa;IAE5B,MAAM,EAAE,MAAM,CAAC;IAEf,WAAW,CAAC,EAAE;QAEZ,WAAW,EAAE,MAAM,CAAC;QAEpB,eAAe,EAAE,MAAM,CAAC;QAExB,YAAY,CAAC,EAAE,MAAM,CAAC;KACvB,CAAC;IAEF,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAqBD,qBAAa,cAAe,YAAW,WAAW;IAEhD,QAAQ,CAAC,IAAI,SAAS;IAEtB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAgB;IAExC,OAAO,CAAC,MAAM,CAAsB;gBAGxB,OAAO,EAAE,aAAa;YAMpB,SAAS;IAqBjB,QAAQ,CAAC,QAAQ,CAAC,EAAE;QACxB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,OAAO,CAAC,EAAE,OAAO,CAAC;KACnB,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;IAevB,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IAiB9C,SAAS,CACb,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,SAAS,GAAG,MAAM,GAAG,MAAM,EAClC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAChC,OAAO,CAAC,cAAc,CAAC;IA+BpB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAOvC,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAOxC,mBAAmB,CACvB,KAAK,EAAE,MAAM,EACb,iBAAiB,SAAK,GACrB,OAAO,CAAC,IAAI,CAAC;IAYV,OAAO,CACX,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,UAAU,EACrB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC/B,OAAO,CAAC,gBAAgB,CAAC;IAqBtB,OAAO,CACX,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC/B,OAAO,CAAC,gBAAgB,CAAC;IAiBtB,IAAI,CACR,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,UAAU,EAChB,SAAS,SAAuB,GAC/B,OAAO,CAAC,aAAa,CAAC;IAmBnB,MAAM,CACV,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,UAAU,EAChB,SAAS,EAAE,MAAM,EACjB,SAAS,SAAuB,GAC/B,OAAO,CAAC,OAAO,CAAC;IAgBb,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IAQjD,eAAe,CACnB,KAAK,EAAE,MAAM,EACb,OAAO,SAAY,GAClB,OAAO,CAAC;QAET,SAAS,EAAE,UAAU,CAAC;QAEtB,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC;IAgBI,OAAO,CACX,KAAK,EAAE,MAAM,EACb,YAAY,EAAE,UAAU,EACxB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC/B,OAAO,CAAC;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAM3C,SAAS,CACb,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC/B,OAAO,CAAC;QAAE,YAAY,EAAE,UAAU,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CAIxD"}

package/dist/providers/aws.js

@@ -80,13 +80,13 @@ class AwsKmsProvider {
         const client = await this.getClient();
         const { DescribeKeyCommand } = await Promise.resolve().then(() => __importStar(require("@aws-sdk/client-kms")));
         const result = await client.send(new DescribeKeyCommand({ KeyId: keyId }));
-        const meta = result.KeyMetadata;
+        const meta = result.KeyMetadata ?? {};
         return {
-            keyId: meta?.KeyId ?? keyId,
-            algorithm: meta?.KeySpec ?? "unknown",
-            usage: meta?.KeyUsage === "SIGN_VERIFY" ? "sign" : "encrypt",
-            createdAt: meta?.CreationDate?.toISOString() ?? new Date().toISOString(),
-            enabled: meta?.Enabled ?? true,
+            keyId: meta.KeyId ?? keyId,
+            algorithm: meta.KeySpec ?? "unknown",
+            usage: meta.KeyUsage === "SIGN_VERIFY" ? "sign" : "encrypt",
+            createdAt: meta.CreationDate?.toISOString() ?? new Date().toISOString(),
+            enabled: meta.Enabled ?? true,
             provider: "aws",
         };
     }
@@ -209,6 +209,14 @@ class AwsKmsProvider {
             ciphertext: Buffer.from(result.CiphertextBlob).toString("base64"),
         };
     }
+    async wrapKey(keyId, unwrappedKey, context) {
+        const enc = await this.encrypt(keyId, unwrappedKey, context);
+        return { wrappedKey: enc.ciphertext, keyId: enc.keyId };
+    }
+    async unwrapKey(keyId, wrappedKey, context) {
+        const dec = await this.decrypt(keyId, wrappedKey, context);
+        return { unwrappedKey: dec.plaintext, keyId: dec.keyId };
+    }
 }
 exports.AwsKmsProvider = AwsKmsProvider;
 //# sourceMappingURL=aws.js.map

package/dist/providers/gcp.d.ts

@@ -3,29 +3,42 @@ export interface GcpKmsOptions {
     projectId: string;
     locationId: string;
     keyRingId: string;
+    token?: string;
+    endpoint?: string;
 }
 export declare class GcpKmsProvider implements KmsProvider {
     readonly name = "gcp";
     private readonly options;
     constructor(options: GcpKmsOptions);
     private getParent;
-    listKeys(_filters?: {
+    private getKeyName;
+    private buildUrl;
+    private request;
+    listKeys(filters?: {
         usage?: string;
         enabled?: boolean;
     }): Promise<KmsKeyMetadata[]>;
-    getKey(_keyId: string): Promise<KmsKeyMetadata>;
-    createKey(_algorithm: string, _usage: "encrypt" | "sign" | "wrap", _metadata?: Record<string, string>): Promise<KmsKeyMetadata>;
-    enableKey(_keyId: string): Promise<void>;
-    disableKey(_keyId: string): Promise<void>;
-    scheduleKeyDeletion(_keyId: string, _pendingWindowDays?: number): Promise<void>;
-    encrypt(_keyId: string, _plaintext: Uint8Array, _context?: Record<string, string>): Promise<KmsEncryptResult>;
-    decrypt(_keyId: string, _ciphertext: string, _context?: Record<string, string>): Promise<KmsDecryptResult>;
-    sign(_keyId: string, _data: Uint8Array, _algorithm?: string): Promise<KmsSignResult>;
-    verify(_keyId: string, _data: Uint8Array, _signature: string, _algorithm?: string): Promise<boolean>;
-    rotateKey(_keyId: string): Promise<KmsKeyMetadata>;
-    generateDataKey(_keyId: string, _keySpec?: string): Promise<{
+    getKey(keyId: string): Promise<KmsKeyMetadata>;
+    createKey(algorithm: string, usage: "encrypt" | "sign" | "wrap", metadata?: Record<string, string>): Promise<KmsKeyMetadata>;
+    enableKey(keyId: string): Promise<void>;
+    disableKey(keyId: string): Promise<void>;
+    scheduleKeyDeletion(keyId: string, _pendingWindowDays?: number): Promise<void>;
+    encrypt(keyId: string, plaintext: Uint8Array, context?: Record<string, string>): Promise<KmsEncryptResult>;
+    decrypt(keyId: string, ciphertext: string, context?: Record<string, string>): Promise<KmsDecryptResult>;
+    sign(keyId: string, data: Uint8Array, algorithm?: string): Promise<KmsSignResult>;
+    verify(keyId: string, data: Uint8Array, signature: string, _algorithm?: string): Promise<boolean>;
+    rotateKey(keyId: string): Promise<KmsKeyMetadata>;
+    generateDataKey(keyId: string, keySpec?: string): Promise<{
         plaintext: Uint8Array;
         ciphertext: string;
     }>;
+    wrapKey(keyId: string, unwrappedKey: Uint8Array, context?: Record<string, string>): Promise<{
+        wrappedKey: string;
+        keyId: string;
+    }>;
+    unwrapKey(keyId: string, wrappedKey: string, context?: Record<string, string>): Promise<{
+        unwrappedKey: Uint8Array;
+        keyId: string;
+    }>;
 }
 //# sourceMappingURL=gcp.d.ts.map

package/dist/providers/gcp.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"gcp.d.ts","sourceRoot":"","sources":["../../src/providers/gcp.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EACV,WAAW,EACX,cAAc,EACd,gBAAgB,EAChB,gBAAgB,EAChB,aAAa,EACd,MAAM,UAAU,CAAC;AAelB,MAAM,WAAW,aAAa;IAE5B,SAAS,EAAE,MAAM,CAAC;IAElB,UAAU,EAAE,MAAM,CAAC;IAEnB,SAAS,EAAE,MAAM,CAAC;CACnB;AAkBD,qBAAa,cAAe,YAAW,WAAW;IAEhD,QAAQ,CAAC,IAAI,SAAS;IAEtB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAgB;gBAG5B,OAAO,EAAE,aAAa;IAKlC,OAAO,CAAC,SAAS;IAKjB,QAAQ,CAAC,QAAQ,CAAC,EAAE;QAClB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,OAAO,CAAC,EAAE,OAAO,CAAC;KACnB,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;IAW7B,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IAU/C,SAAS,CACP,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,SAAS,GAAG,MAAM,GAAG,MAAM,EACnC,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GACjC,OAAO,CAAC,cAAc,CAAC;IAU1B,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAUxC,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAUzC,mBAAmB,CACjB,MAAM,EAAE,MAAM,EACd,kBAAkB,CAAC,EAAE,MAAM,GAC1B,OAAO,CAAC,IAAI,CAAC;IAUhB,OAAO,CACL,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,UAAU,EACtB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAChC,OAAO,CAAC,gBAAgB,CAAC;IAU5B,OAAO,CACL,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,EACnB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAChC,OAAO,CAAC,gBAAgB,CAAC;IAU5B,IAAI,CACF,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,UAAU,EACjB,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,aAAa,CAAC;IAUzB,MAAM,CACJ,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,UAAU,EACjB,UAAU,EAAE,MAAM,EAClB,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,OAAO,CAAC;IAUnB,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IAUlD,eAAe,CACb,MAAM,EAAE,MAAM,EACd,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC;QAET,SAAS,EAAE,UAAU,CAAC;QAEtB,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC;CAQH"}
+{"version":3,"file":"gcp.d.ts","sourceRoot":"","sources":["../../src/providers/gcp.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EACV,WAAW,EACX,cAAc,EACd,gBAAgB,EAChB,gBAAgB,EAChB,aAAa,EACd,MAAM,UAAU,CAAC;AAgBlB,MAAM,WAAW,aAAa;IAE5B,SAAS,EAAE,MAAM,CAAC;IAElB,UAAU,EAAE,MAAM,CAAC;IAEnB,SAAS,EAAE,MAAM,CAAC;IAElB,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAoGD,qBAAa,cAAe,YAAW,WAAW;IAEhD,QAAQ,CAAC,IAAI,SAAS;IAEtB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAgB;gBAG5B,OAAO,EAAE,aAAa;IAKlC,OAAO,CAAC,SAAS;IAKjB,OAAO,CAAC,UAAU;IAMlB,OAAO,CAAC,QAAQ;YAWF,OAAO;IAoCf,QAAQ,CAAC,OAAO,CAAC,EAAE;QACvB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,OAAO,CAAC,EAAE,OAAO,CAAC;KACnB,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;IAcvB,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IAO9C,SAAS,CACb,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,SAAS,GAAG,MAAM,GAAG,MAAM,EAClC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAChC,OAAO,CAAC,cAAc,CAAC;IAgBpB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAMvC,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAMxC,mBAAmB,CACvB,KAAK,EAAE,MAAM,EACb,kBAAkB,CAAC,EAAE,MAAM,GAC1B,OAAO,CAAC,IAAI,CAAC;IAMV,OAAO,CACX,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,UAAU,EACrB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC/B,OAAO,CAAC,gBAAgB,CAAC;IAwBtB,OAAO,CACX,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC/B,OAAO,CAAC,gBAAgB,CAAC;IAoBtB,IAAI,CACR,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,UAAU,EAChB,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,aAAa,CAAC;IAcnB,MAAM,CACV,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,UAAU,EAChB,SAAS,EAAE,MAAM,EACjB,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,OAAO,CAAC;IAeb,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IAOjD,eAAe,CACnB,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC;QACT,SAAS,EAAE,UAAU,CAAC;QACtB,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC;IAYI,OAAO,CACX,KAAK,EAAE,MAAM,EACb,YAAY,EAAE,UAAU,EACxB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC/B,OAAO,CAAC;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAM3C,SAAS,CACb,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC/B,OAAO,CAAC;QAAE,YAAY,EAAE,UAAU,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CAIxD"}

package/dist/providers/gcp.js

@@ -2,6 +2,57 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.GcpKmsProvider = void 0;
 const errors_1 = require("../errors");
+function parseGcpResponse(text) {
+    if (!text)
+        return {};
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return {};
+    }
+}
+function handleGcpError(res, json, keyId) {
+    const errMsg = json.error?.message ?? `HTTP ${res.status}`;
+    if (res.status === 404 || /not found/i.test(errMsg)) {
+        throw new errors_1.KmsError("NOT_FOUND", errMsg, keyId);
+    }
+    if (res.status === 400 && /decryption|ciphertext/i.test(errMsg)) {
+        throw new errors_1.KmsError("DECRYPTION_FAILED", errMsg, keyId);
+    }
+    if (/disabled|destroy/i.test(errMsg)) {
+        throw new errors_1.KmsError("DISABLED", errMsg, keyId);
+    }
+    throw new errors_1.KmsError("INVALID_ARGUMENT", `GCP KMS error: ${errMsg}`, keyId);
+}
+function mapGcpAlgorithm(algorithm, usage) {
+    const upper = algorithm.toUpperCase();
+    if (usage === "sign") {
+        if (upper.includes("EC") || upper.includes("P256")) {
+            return "EC_SIGN_P256_SHA256";
+        }
+        return "RSA_SIGN_PSS_2048_SHA256";
+    }
+    return "GOOGLE_SYMMETRIC_ENCRYPTION";
+}
+function extractGcpKeyId(fullName) {
+    if (!fullName)
+        return "";
+    const idx = fullName.lastIndexOf("/");
+    return idx >= 0 ? fullName.slice(idx + 1) : fullName;
+}
+function mapGcpKey(raw, fallbackId) {
+    const keyId = extractGcpKeyId(raw.name) || fallbackId;
+    const isSign = raw.purpose === "ASYMMETRIC_SIGN";
+    return {
+        keyId,
+        algorithm: raw.primary?.algorithm ?? "GOOGLE_SYMMETRIC_ENCRYPTION",
+        usage: isSign ? "sign" : "encrypt",
+        createdAt: raw.createTime ?? new Date().toISOString(),
+        enabled: raw.primary?.state !== "DISABLED" && raw.primary?.state !== "DESTROYED",
+        provider: "gcp",
+    };
+}
 class GcpKmsProvider {
     name = "gcp";
     options;
@@ -11,42 +62,173 @@ class GcpKmsProvider {
     getParent() {
         return `projects/${this.options.projectId}/locations/${this.options.locationId}/keyRings/${this.options.keyRingId}`;
     }
-    listKeys(_filters) {
-        void this.getParent();
-        return Promise.reject(new errors_1.KmsError("NOT_IMPLEMENTED", "Not implemented: install @google-cloud/kms"));
+    getKeyName(keyId) {
+        if (keyId.startsWith("projects/"))
+            return keyId;
+        return `${this.getParent()}/cryptoKeys/${keyId}`;
+    }
+    buildUrl(path) {
+        if (!/^[a-zA-Z0-9_\-/:.?=&]+$/.test(path) || path.includes("..")) {
+            throw new errors_1.KmsError("INVALID_ARGUMENT", "Invalid GCP KMS path", path);
+        }
+        const endpoint = this.options.endpoint ?? "https://cloudkms.googleapis.com/v1";
+        const base = `${endpoint.replace(/\/+$/, "")}/`;
+        return new URL(path, base).href;
+    }
+    async request(path, method = "GET", body) {
+        const url = this.buildUrl(path);
+        const headers = {
+            "Content-Type": "application/json",
+        };
+        if (this.options.token) {
+            headers["Authorization"] = `Bearer ${this.options.token}`;
+        }
+        const reqInit = {
+            method,
+            headers,
+            ...(body ? { body: JSON.stringify(body) } : {}),
+        };
+        let res;
+        try {
+            res = await fetch(url, reqInit);
+        }
+        catch (err) {
+            throw new errors_1.KmsError("INVALID_ARGUMENT", `GCP KMS network error: ${err.message}`, path);
+        }
+        const text = await res.text();
+        const json = parseGcpResponse(text);
+        if (!res.ok) {
+            handleGcpError(res, json, path);
+        }
+        return (json.data ?? json);
+    }
+    async listKeys(filters) {
+        const path = `${this.getParent()}/cryptoKeys`;
+        const res = await this.request(path);
+        let keys = (res.cryptoKeys ?? []).map((k) => mapGcpKey(k, ""));
+        if (filters?.usage) {
+            keys = keys.filter((k) => k.usage === filters.usage);
+        }
+        if (filters?.enabled !== undefined) {
+            keys = keys.filter((k) => k.enabled === filters.enabled);
+        }
+        return keys;
+    }
+    async getKey(keyId) {
+        const path = this.getKeyName(keyId);
+        const res = await this.request(path);
+        return mapGcpKey(res, keyId);
+    }
+    async createKey(algorithm, usage, metadata) {
+        const keyId = `key-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+        const path = `${this.getParent()}/cryptoKeys?cryptoKeyId=${keyId}`;
+        const purpose = usage === "sign" ? "ASYMMETRIC_SIGN" : "ENCRYPT_DECRYPT";
+        const body = {
+            purpose,
+            versionTemplate: {
+                algorithm: mapGcpAlgorithm(algorithm, usage),
+            },
+            ...(metadata ? { labels: metadata } : {}),
+        };
+        const res = await this.request(path, "POST", body);
+        return mapGcpKey(res, keyId);
     }
-    getKey(_keyId) {
-        return Promise.reject(new errors_1.KmsError("NOT_IMPLEMENTED", "Not implemented: install @google-cloud/kms"));
+    async enableKey(keyId) {
+        const path = `${this.getKeyName(keyId)}/cryptoKeyVersions/1?updateMask=state`;
+        await this.request(path, "PATCH", { state: "ENABLED" });
     }
-    createKey(_algorithm, _usage, _metadata) {
-        return Promise.reject(new errors_1.KmsError("NOT_IMPLEMENTED", "Not implemented: install @google-cloud/kms"));
+    async disableKey(keyId) {
+        const path = `${this.getKeyName(keyId)}/cryptoKeyVersions/1?updateMask=state`;
+        await this.request(path, "PATCH", { state: "DISABLED" });
     }
-    enableKey(_keyId) {
-        return Promise.reject(new errors_1.KmsError("NOT_IMPLEMENTED", "Not implemented: install @google-cloud/kms"));
+    async scheduleKeyDeletion(keyId, _pendingWindowDays) {
+        const path = `${this.getKeyName(keyId)}/cryptoKeyVersions/1:destroy`;
+        await this.request(path, "POST", {});
     }
-    disableKey(_keyId) {
-        return Promise.reject(new errors_1.KmsError("NOT_IMPLEMENTED", "Not implemented: install @google-cloud/kms"));
+    async encrypt(keyId, plaintext, context) {
+        const path = `${this.getKeyName(keyId)}:encrypt`;
+        const body = {
+            plaintext: Buffer.from(plaintext).toString("base64"),
+            ...(context
+                ? {
+                    additionalAuthenticatedData: Buffer.from(JSON.stringify(context)).toString("base64"),
+                }
+                : {}),
+        };
+        const res = await this.request(path, "POST", body);
+        const out = {
+            ciphertext: res.ciphertext,
+            keyId,
+        };
+        if (context) {
+            out.context = context;
+        }
+        return out;
     }
-    scheduleKeyDeletion(_keyId, _pendingWindowDays) {
-        return Promise.reject(new errors_1.KmsError("NOT_IMPLEMENTED", "Not implemented: install @google-cloud/kms"));
+    async decrypt(keyId, ciphertext, context) {
+        const path = `${this.getKeyName(keyId)}:decrypt`;
+        const body = {
+            ciphertext,
+            ...(context
+                ? {
+                    additionalAuthenticatedData: Buffer.from(JSON.stringify(context)).toString("base64"),
+                }
+                : {}),
+        };
+        const res = await this.request(path, "POST", body);
+        return {
+            plaintext: new Uint8Array(Buffer.from(res.plaintext, "base64")),
+            keyId,
+        };
     }
-    encrypt(_keyId, _plaintext, _context) {
-        return Promise.reject(new errors_1.KmsError("NOT_IMPLEMENTED", "Not implemented: install @google-cloud/kms"));
+    async sign(keyId, data, algorithm) {
+        const path = `${this.getKeyName(keyId)}/cryptoKeyVersions/1:asymmetricSign`;
+        const body = {
+            data: Buffer.from(data).toString("base64"),
+        };
+        const res = await this.request(path, "POST", body);
+        return {
+            signature: res.signature,
+            keyId,
+            algorithm: algorithm ?? "RSA_SIGN_PSS_2048_SHA256",
+        };
     }
-    decrypt(_keyId, _ciphertext, _context) {
-        return Promise.reject(new errors_1.KmsError("NOT_IMPLEMENTED", "Not implemented: install @google-cloud/kms"));
+    async verify(keyId, data, signature, _algorithm) {
+        try {
+            const path = `${this.getKeyName(keyId)}/cryptoKeyVersions/1:macVerify`;
+            const body = {
+                data: Buffer.from(data).toString("base64"),
+                mac: signature,
+            };
+            const res = await this.request(path, "POST", body);
+            return Boolean(res.success);
+        }
+        catch {
+            return false;
+        }
     }
-    sign(_keyId, _data, _algorithm) {
-        return Promise.reject(new errors_1.KmsError("NOT_IMPLEMENTED", "Not implemented: install @google-cloud/kms"));
+    async rotateKey(keyId) {
+        const path = `${this.getKeyName(keyId)}/cryptoKeyVersions`;
+        await this.request(path, "POST", {});
+        return this.getKey(keyId);
     }
-    verify(_keyId, _data, _signature, _algorithm) {
-        return Promise.reject(new errors_1.KmsError("NOT_IMPLEMENTED", "Not implemented: install @google-cloud/kms"));
+    async generateDataKey(keyId, keySpec) {
+        const len = keySpec === "AES_128" ? 16 : 32;
+        const plaintext = new Uint8Array(len);
+        crypto.getRandomValues(plaintext);
+        const enc = await this.encrypt(keyId, plaintext);
+        return {
+            plaintext,
+            ciphertext: enc.ciphertext,
+        };
     }
-    rotateKey(_keyId) {
-        return Promise.reject(new errors_1.KmsError("NOT_IMPLEMENTED", "Not implemented: install @google-cloud/kms"));
+    async wrapKey(keyId, unwrappedKey, context) {
+        const enc = await this.encrypt(keyId, unwrappedKey, context);
+        return { wrappedKey: enc.ciphertext, keyId };
     }
-    generateDataKey(_keyId, _keySpec) {
-        return Promise.reject(new errors_1.KmsError("NOT_IMPLEMENTED", "Not implemented: install @google-cloud/kms"));
+    async unwrapKey(keyId, wrappedKey, context) {
+        const dec = await this.decrypt(keyId, wrappedKey, context);
+        return { unwrappedKey: dec.plaintext, keyId };
     }
 }
 exports.GcpKmsProvider = GcpKmsProvider;

package/dist/providers/local.d.ts

@@ -26,5 +26,13 @@ export declare class LocalKmsProvider implements KmsProvider {
         plaintext: Uint8Array;
         ciphertext: string;
     }>;
+    wrapKey(keyId: string, unwrappedKey: Uint8Array, context?: Record<string, string>): Promise<{
+        wrappedKey: string;
+        keyId: string;
+    }>;
+    unwrapKey(keyId: string, wrappedKey: string, context?: Record<string, string>): Promise<{
+        unwrappedKey: Uint8Array;
+        keyId: string;
+    }>;
 }
 //# sourceMappingURL=local.d.ts.map

package/dist/providers/local.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"local.d.ts","sourceRoot":"","sources":["../../src/providers/local.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EACV,WAAW,EACX,cAAc,EACd,gBAAgB,EAChB,gBAAgB,EAChB,aAAa,EACd,MAAM,UAAU,CAAC;AAqDlB,qBAAa,gBAAiB,YAAW,WAAW;IAElD,QAAQ,CAAC,IAAI,WAAW;IAExB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAqC;IAG3D,OAAO,CAAC,MAAM;IASd,OAAO,CAAC,aAAa;IASrB,OAAO,CAAC,YAAY;IAapB,OAAO,CAAC,QAAQ;IAQV,QAAQ,CAAC,OAAO,CAAC,EAAE;QACvB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,OAAO,CAAC,EAAE,OAAO,CAAC;KACnB,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;IAevB,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IAK9C,SAAS,CACb,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,SAAS,GAAG,MAAM,GAAG,MAAM,EAClC,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GACjC,OAAO,CAAC,cAAc,CAAC;IAqBpB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKvC,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKxC,mBAAmB,CACvB,KAAK,EAAE,MAAM,EACb,iBAAiB,SAAK,GACrB,OAAO,CAAC,IAAI,CAAC;IAUV,OAAO,CACX,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,UAAU,EACrB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC/B,OAAO,CAAC,gBAAgB,CAAC;IAetB,OAAO,CACX,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC/B,OAAO,CAAC,gBAAgB,CAAC;IAO5B,OAAO,CAAC,aAAa;IAYf,IAAI,CACR,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,UAAU,EAChB,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,aAAa,CAAC;IAanB,MAAM,CACV,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,UAAU,EAChB,SAAS,EAAE,MAAM,EACjB,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,OAAO,CAAC;IASb,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IAajD,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKhE,eAAe,CACnB,KAAK,EAAE,MAAM,EACb,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC;QAET,SAAS,EAAE,UAAU,CAAC;QAEtB,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC;CAQH"}
+{"version":3,"file":"local.d.ts","sourceRoot":"","sources":["../../src/providers/local.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,EACV,WAAW,EACX,cAAc,EACd,gBAAgB,EAChB,gBAAgB,EAChB,aAAa,EACd,MAAM,UAAU,CAAC;AAqDlB,qBAAa,gBAAiB,YAAW,WAAW;IAElD,QAAQ,CAAC,IAAI,WAAW;IAExB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAqC;IAG3D,OAAO,CAAC,MAAM;IASd,OAAO,CAAC,aAAa;IASrB,OAAO,CAAC,YAAY;IAapB,OAAO,CAAC,QAAQ;IAQV,QAAQ,CAAC,OAAO,CAAC,EAAE;QACvB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,OAAO,CAAC,EAAE,OAAO,CAAC;KACnB,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;IAevB,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IAK9C,SAAS,CACb,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,SAAS,GAAG,MAAM,GAAG,MAAM,EAClC,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GACjC,OAAO,CAAC,cAAc,CAAC;IAqBpB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKvC,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKxC,mBAAmB,CACvB,KAAK,EAAE,MAAM,EACb,iBAAiB,SAAK,GACrB,OAAO,CAAC,IAAI,CAAC;IAUV,OAAO,CACX,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,UAAU,EACrB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC/B,OAAO,CAAC,gBAAgB,CAAC;IAetB,OAAO,CACX,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC/B,OAAO,CAAC,gBAAgB,CAAC;IAO5B,OAAO,CAAC,aAAa;IAYf,IAAI,CACR,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,UAAU,EAChB,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,aAAa,CAAC;IAanB,MAAM,CACV,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,UAAU,EAChB,SAAS,EAAE,MAAM,EACjB,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,OAAO,CAAC;IASb,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IAajD,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKhE,eAAe,CACnB,KAAK,EAAE,MAAM,EACb,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC;QAET,SAAS,EAAE,UAAU,CAAC;QAEtB,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC;IAUI,OAAO,CACX,KAAK,EAAE,MAAM,EACb,YAAY,EAAE,UAAU,EACxB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC/B,OAAO,CAAC;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAM3C,SAAS,CACb,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC/B,OAAO,CAAC;QAAE,YAAY,EAAE,UAAU,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CAIxD"}

package/dist/providers/local.js

@@ -134,6 +134,14 @@ class LocalKmsProvider {
         const wrapped = await this.encrypt(keyId, dek);
         return { plaintext: dek, ciphertext: wrapped.ciphertext };
     }
+    async wrapKey(keyId, unwrappedKey, context) {
+        const enc = await this.encrypt(keyId, unwrappedKey, context);
+        return { wrappedKey: enc.ciphertext, keyId: enc.keyId };
+    }
+    async unwrapKey(keyId, wrappedKey, context) {
+        const dec = await this.decrypt(keyId, wrappedKey, context);
+        return { unwrappedKey: dec.plaintext, keyId: dec.keyId };
+    }
 }
 exports.LocalKmsProvider = LocalKmsProvider;
 //# sourceMappingURL=local.js.map

package/dist/providers/vault.d.ts

@@ -3,32 +3,45 @@ export interface VaultKmsOptions {
     address: string;
     token: string;
     mountPath?: string;
+    namespace?: string;
 }
 export declare class VaultKmsProvider implements KmsProvider {
     readonly name = "vault";
     private readonly _address;
     private readonly _token;
     private readonly _mount;
+    private readonly _namespace?;
     constructor(options: VaultKmsOptions);
     buildUrl(path: string): string;
     buildHeaders(): Record<string, string>;
-    listKeys(_filters?: {
+    private request;
+    private mapMetadata;
+    listKeys(filters?: {
         usage?: string;
         enabled?: boolean;
     }): Promise<KmsKeyMetadata[]>;
-    getKey(_keyId: string): Promise<KmsKeyMetadata>;
-    createKey(_algorithm: string, _usage: "encrypt" | "sign" | "wrap", _metadata?: Record<string, string>): Promise<KmsKeyMetadata>;
-    enableKey(_keyId: string): Promise<void>;
-    disableKey(_keyId: string): Promise<void>;
-    scheduleKeyDeletion(_keyId: string, _pendingWindowDays?: number): Promise<void>;
-    encrypt(_keyId: string, _plaintext: Uint8Array, _context?: Record<string, string>): Promise<KmsEncryptResult>;
-    decrypt(_keyId: string, _ciphertext: string, _context?: Record<string, string>): Promise<KmsDecryptResult>;
-    sign(_keyId: string, _data: Uint8Array, _algorithm?: string): Promise<KmsSignResult>;
-    verify(_keyId: string, _data: Uint8Array, _signature: string, _algorithm?: string): Promise<boolean>;
-    rotateKey(_keyId: string): Promise<KmsKeyMetadata>;
-    generateDataKey(_keyId: string, _keySpec?: string): Promise<{
+    getKey(keyId: string): Promise<KmsKeyMetadata>;
+    private resolveVaultType;
+    createKey(algorithm: string, usage: "encrypt" | "sign" | "wrap", metadata?: Record<string, string>): Promise<KmsKeyMetadata>;
+    enableKey(keyId: string): Promise<void>;
+    disableKey(keyId: string): Promise<void>;
+    scheduleKeyDeletion(keyId: string, _pendingWindowDays?: number): Promise<void>;
+    encrypt(keyId: string, plaintext: Uint8Array, context?: Record<string, string>): Promise<KmsEncryptResult>;
+    decrypt(keyId: string, ciphertext: string, context?: Record<string, string>): Promise<KmsDecryptResult>;
+    sign(keyId: string, data: Uint8Array, algorithm?: string): Promise<KmsSignResult>;
+    verify(keyId: string, data: Uint8Array, signature: string, algorithm?: string): Promise<boolean>;
+    rotateKey(keyId: string): Promise<KmsKeyMetadata>;
+    generateDataKey(keyId: string, keySpec?: string): Promise<{
         plaintext: Uint8Array;
         ciphertext: string;
     }>;
+    wrapKey(keyId: string, unwrappedKey: Uint8Array, context?: Record<string, string>): Promise<{
+        wrappedKey: string;
+        keyId: string;
+    }>;
+    unwrapKey(keyId: string, wrappedKey: string, context?: Record<string, string>): Promise<{
+        unwrappedKey: Uint8Array;
+        keyId: string;
+    }>;
 }
 //# sourceMappingURL=vault.d.ts.map

package/dist/providers/vault.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"vault.d.ts","sourceRoot":"","sources":["../../src/providers/vault.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EACV,WAAW,EACX,cAAc,EACd,gBAAgB,EAChB,gBAAgB,EAChB,aAAa,EACd,MAAM,UAAU,CAAC;AAelB,MAAM,WAAW,eAAe;IAE9B,OAAO,EAAE,MAAM,CAAC;IAEhB,KAAK,EAAE,MAAM,CAAC;IAEd,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAkBD,qBAAa,gBAAiB,YAAW,WAAW;IAElD,QAAQ,CAAC,IAAI,WAAW;IAExB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAElC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAEhC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;gBAGpB,OAAO,EAAE,eAAe;IAOpC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM;IAM9B,YAAY,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAQtC,QAAQ,CAAC,QAAQ,CAAC,EAAE;QAClB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,OAAO,CAAC,EAAE,OAAO,CAAC;KACnB,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;IAU7B,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IAU/C,SAAS,CACP,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,SAAS,GAAG,MAAM,GAAG,MAAM,EACnC,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GACjC,OAAO,CAAC,cAAc,CAAC;IAU1B,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAUxC,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAUzC,mBAAmB,CACjB,MAAM,EAAE,MAAM,EACd,kBAAkB,CAAC,EAAE,MAAM,GAC1B,OAAO,CAAC,IAAI,CAAC;IAUhB,OAAO,CACL,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,UAAU,EACtB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAChC,OAAO,CAAC,gBAAgB,CAAC;IAU5B,OAAO,CACL,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,EACnB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAChC,OAAO,CAAC,gBAAgB,CAAC;IAU5B,IAAI,CACF,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,UAAU,EACjB,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,aAAa,CAAC;IAUzB,MAAM,CACJ,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,UAAU,EACjB,UAAU,EAAE,MAAM,EAClB,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,OAAO,CAAC;IAUnB,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IAUlD,eAAe,CACb,MAAM,EAAE,MAAM,EACd,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC;QAET,SAAS,EAAE,UAAU,CAAC;QAEtB,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC;CAQH"}
+{"version":3,"file":"vault.d.ts","sourceRoot":"","sources":["../../src/providers/vault.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EACV,WAAW,EACX,cAAc,EACd,gBAAgB,EAChB,gBAAgB,EAChB,aAAa,EACd,MAAM,UAAU,CAAC;AAelB,MAAM,WAAW,eAAe;IAE9B,OAAO,EAAE,MAAM,CAAC;IAEhB,KAAK,EAAE,MAAM,CAAC;IAEd,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AA8DD,qBAAa,gBAAiB,YAAW,WAAW;IAElD,QAAQ,CAAC,IAAI,WAAW;IAExB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAElC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAEhC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAEhC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAqB;gBAGrC,OAAO,EAAE,eAAe;IAQpC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM;IAe9B,YAAY,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;YAYxB,OAAO;IAwCrB,OAAO,CAAC,WAAW;IAqBb,QAAQ,CAAC,OAAO,CAAC,EAAE;QACvB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,OAAO,CAAC,EAAE,OAAO,CAAC;KACnB,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;IAmBvB,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IAWpD,OAAO,CAAC,gBAAgB;IAYlB,SAAS,CACb,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,SAAS,GAAG,MAAM,GAAG,MAAM,EAClC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAChC,OAAO,CAAC,cAAc,CAAC;IAUpB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAUvC,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAYxC,mBAAmB,CACvB,KAAK,EAAE,MAAM,EACb,kBAAkB,CAAC,EAAE,MAAM,GAC1B,OAAO,CAAC,IAAI,CAAC;IAWV,OAAO,CACX,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,UAAU,EACrB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC/B,OAAO,CAAC,gBAAgB,CAAC;IAuBtB,OAAO,CACX,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC/B,OAAO,CAAC,gBAAgB,CAAC;IAoBtB,IAAI,CACR,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,UAAU,EAChB,SAAS,SAAa,GACrB,OAAO,CAAC,aAAa,CAAC;IAgBnB,MAAM,CACV,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,UAAU,EAChB,SAAS,EAAE,MAAM,EACjB,SAAS,SAAa,GACrB,OAAO,CAAC,OAAO,CAAC;IAgBb,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IAMjD,eAAe,CACnB,KAAK,EAAE,MAAM,EACb,OAAO,SAAY,GAClB,OAAO,CAAC;QACT,SAAS,EAAE,UAAU,CAAC;QACtB,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC;IAeI,OAAO,CACX,KAAK,EAAE,MAAM,EACb,YAAY,EAAE,UAAU,EACxB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC/B,OAAO,CAAC;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAM3C,SAAS,CACb,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC/B,OAAO,CAAC;QAAE,YAAY,EAAE,UAAU,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CAIxD"}

package/dist/providers/vault.js

@@ -2,61 +2,230 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.VaultKmsProvider = void 0;
 const errors_1 = require("../errors");
+function parseVaultResponse(text) {
+    if (!text)
+        return {};
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return {};
+    }
+}
+function handleVaultError(res, json, keyId) {
+    const errMsg = json.errors?.join(", ") ?? `HTTP ${res.status}`;
+    if (res.status === 400 &&
+        /ciphertext.*invalid|decryption failed/i.test(errMsg)) {
+        throw new errors_1.KmsError("DECRYPTION_FAILED", errMsg, keyId);
+    }
+    if (/disabled/i.test(errMsg)) {
+        throw new errors_1.KmsError("DISABLED", errMsg, keyId);
+    }
+    throw new errors_1.KmsError("INVALID_ARGUMENT", `Vault error: ${errMsg}`, keyId);
+}
 class VaultKmsProvider {
     name = "vault";
     _address;
     _token;
     _mount;
+    _namespace;
     constructor(options) {
         this._address = options.address;
         this._token = options.token;
         this._mount = options.mountPath ?? "transit";
+        this._namespace = options.namespace;
     }
     buildUrl(path) {
-        const base = this._address.replace(/\/+$/, "");
-        return `${base}/v1/${this._mount}/${path}`;
+        if (!/^[a-zA-Z0-9_\-/:.?=&]+$/.test(path) || path.includes("..")) {
+            throw new errors_1.KmsError("INVALID_ARGUMENT", "Invalid Vault path", path);
+        }
+        const address = this._address.startsWith("http://") ||
+            this._address.startsWith("https://")
+            ? this._address
+            : `http://${this._address}`;
+        const cleanMount = encodeURIComponent(this._mount);
+        const base = `${address.replace(/\/+$/, "")}/v1/${cleanMount}/`;
+        return new URL(path, base).href;
     }
     buildHeaders() {
-        return {
+        const headers = {
             "X-Vault-Token": this._token,
             "Content-Type": "application/json",
         };
+        if (this._namespace) {
+            headers["X-Vault-Namespace"] = this._namespace;
+        }
+        return headers;
     }
-    listKeys(_filters) {
-        return Promise.reject(new errors_1.KmsError("NOT_IMPLEMENTED", "Not implemented: configure HashiCorp Vault connection"));
+    async request(path, method = "GET", body, keyId) {
+        const url = this.buildUrl(path);
+        const reqInit = {
+            method,
+            headers: this.buildHeaders(),
+        };
+        if (body !== undefined) {
+            reqInit.body = JSON.stringify(body);
+        }
+        let res;
+        try {
+            res = await fetch(url, reqInit);
+        }
+        catch (err) {
+            throw new errors_1.KmsError("INVALID_ARGUMENT", `Vault request failed: ${err.message}`, keyId);
+        }
+        if (res.status === 404) {
+            throw new errors_1.KmsError("NOT_FOUND", `Vault path not found: ${path}`, keyId);
+        }
+        const text = await res.text();
+        const json = parseVaultResponse(text);
+        if (!res.ok) {
+            handleVaultError(res, json, keyId);
+        }
+        return (json.data ?? json);
     }
-    getKey(_keyId) {
-        return Promise.reject(new errors_1.KmsError("NOT_IMPLEMENTED", "Not implemented: configure HashiCorp Vault connection"));
+    mapMetadata(keyId, details) {
+        const usage = details.supports_signing ? "sign" : "encrypt";
+        const minEnc = details.min_encryption_version ?? 0;
+        const latest = details.latest_version ?? 1;
+        const enabled = minEnc <= latest;
+        const meta = {
+            keyId,
+            algorithm: details.type ?? "aes256-gcm96",
+            usage,
+            createdAt: new Date().toISOString(),
+            enabled,
+            provider: "vault",
+        };
+        if (details.latest_version !== undefined) {
+            meta.currentVersion = details.latest_version;
+        }
+        return meta;
     }
-    createKey(_algorithm, _usage, _metadata) {
-        return Promise.reject(new errors_1.KmsError("NOT_IMPLEMENTED", "Not implemented: configure HashiCorp Vault connection"));
+    async listKeys(filters) {
+        const res = await this.request("keys?list=true");
+        const keyNames = res.keys ?? [];
+        const list = [];
+        for (const name of keyNames) {
+            try {
+                const meta = await this.getKey(name);
+                if (filters?.usage && meta.usage !== filters.usage)
+                    continue;
+                if (filters?.enabled !== undefined && meta.enabled !== filters.enabled)
+                    continue;
+                list.push(meta);
+            }
+            catch {
+            }
+        }
+        return list;
     }
-    enableKey(_keyId) {
-        return Promise.reject(new errors_1.KmsError("NOT_IMPLEMENTED", "Not implemented: configure HashiCorp Vault connection"));
+    async getKey(keyId) {
+        const details = await this.request(`keys/${keyId}`, "GET", undefined, keyId);
+        return this.mapMetadata(keyId, details);
     }
-    disableKey(_keyId) {
-        return Promise.reject(new errors_1.KmsError("NOT_IMPLEMENTED", "Not implemented: configure HashiCorp Vault connection"));
+    resolveVaultType(algorithm, usage) {
+        const lower = algorithm.toLowerCase();
+        if (lower.includes("p256") || lower.includes("ecdsa"))
+            return "ecdsa-p256";
+        if (lower.includes("rsa-4096"))
+            return "rsa-4096";
+        if (lower.includes("rsa"))
+            return "rsa-2048";
+        if (lower.includes("chacha"))
+            return "chacha20-poly1305";
+        if (lower.includes("ed25519"))
+            return "ed25519";
+        if (usage === "sign")
+            return "ed25519";
+        return "aes256-gcm96";
     }
-    scheduleKeyDeletion(_keyId, _pendingWindowDays) {
-        return Promise.reject(new errors_1.KmsError("NOT_IMPLEMENTED", "Not implemented: configure HashiCorp Vault connection"));
+    async createKey(algorithm, usage, metadata) {
+        const keyId = metadata?.["keyId"] ??
+            `vault-${Date.now()}-${Math.floor(Math.random() * 1e6)}`;
+        const vaultType = this.resolveVaultType(algorithm, usage);
+        await this.request(`keys/${keyId}`, "POST", { type: vaultType }, keyId);
+        return this.getKey(keyId);
     }
-    encrypt(_keyId, _plaintext, _context) {
-        return Promise.reject(new errors_1.KmsError("NOT_IMPLEMENTED", "Not implemented: configure HashiCorp Vault connection"));
+    async enableKey(keyId) {
+        await this.request(`keys/${keyId}/config`, "POST", { min_encryption_version: 0 }, keyId);
     }
-    decrypt(_keyId, _ciphertext, _context) {
-        return Promise.reject(new errors_1.KmsError("NOT_IMPLEMENTED", "Not implemented: configure HashiCorp Vault connection"));
+    async disableKey(keyId) {
+        const meta = await this.getKey(keyId);
+        const disableVersion = (meta.currentVersion ?? 1) + 1;
+        await this.request(`keys/${keyId}/config`, "POST", { min_encryption_version: disableVersion }, keyId);
     }
-    sign(_keyId, _data, _algorithm) {
-        return Promise.reject(new errors_1.KmsError("NOT_IMPLEMENTED", "Not implemented: configure HashiCorp Vault connection"));
+    async scheduleKeyDeletion(keyId, _pendingWindowDays) {
+        await this.request(`keys/${keyId}/config`, "POST", { deletion_allowed: true }, keyId);
+        await this.request(`keys/${keyId}`, "DELETE", undefined, keyId);
+    }
+    async encrypt(keyId, plaintext, context) {
+        const b64Plaintext = Buffer.from(plaintext).toString("base64");
+        const b64Context = context
+            ? Buffer.from(JSON.stringify(context)).toString("base64")
+            : undefined;
+        const body = { plaintext: b64Plaintext };
+        if (b64Context)
+            body.context = b64Context;
+        const res = await this.request(`encrypt/${keyId}`, "POST", body, keyId);
+        const out = {
+            ciphertext: res.ciphertext,
+            keyId,
+        };
+        if (context)
+            out.context = context;
+        return out;
     }
-    verify(_keyId, _data, _signature, _algorithm) {
-        return Promise.reject(new errors_1.KmsError("NOT_IMPLEMENTED", "Not implemented: configure HashiCorp Vault connection"));
+    async decrypt(keyId, ciphertext, context) {
+        const b64Context = context
+            ? Buffer.from(JSON.stringify(context)).toString("base64")
+            : undefined;
+        const body = { ciphertext };
+        if (b64Context)
+            body.context = b64Context;
+        const res = await this.request(`decrypt/${keyId}`, "POST", body, keyId);
+        return {
+            plaintext: new Uint8Array(Buffer.from(res.plaintext, "base64")),
+            keyId,
+        };
+    }
+    async sign(keyId, data, algorithm = "sha2-256") {
+        const input = Buffer.from(data).toString("base64");
+        const res = await this.request(`sign/${keyId}`, "POST", { input, signature_algorithm: algorithm }, keyId);
+        return {
+            signature: res.signature,
+            keyId,
+            algorithm,
+        };
+    }
+    async verify(keyId, data, signature, algorithm = "sha2-256") {
+        const input = Buffer.from(data).toString("base64");
+        try {
+            const res = await this.request(`verify/${keyId}`, "POST", { input, signature, signature_algorithm: algorithm }, keyId);
+            return Boolean(res.valid);
+        }
+        catch {
+            return false;
+        }
+    }
+    async rotateKey(keyId) {
+        await this.request(`keys/${keyId}/rotate`, "POST", undefined, keyId);
+        return this.getKey(keyId);
+    }
+    async generateDataKey(keyId, keySpec = "AES_256") {
+        const bits = keySpec.includes("128") ? 128 : 256;
+        const res = await this.request(`datakey/plaintext/${keyId}`, "POST", { bits }, keyId);
+        return {
+            plaintext: new Uint8Array(Buffer.from(res.plaintext, "base64")),
+            ciphertext: res.ciphertext,
+        };
     }
-    rotateKey(_keyId) {
-        return Promise.reject(new errors_1.KmsError("NOT_IMPLEMENTED", "Not implemented: configure HashiCorp Vault connection"));
+    async wrapKey(keyId, unwrappedKey, context) {
+        const enc = await this.encrypt(keyId, unwrappedKey, context);
+        return { wrappedKey: enc.ciphertext, keyId: enc.keyId };
     }
-    generateDataKey(_keyId, _keySpec) {
-        return Promise.reject(new errors_1.KmsError("NOT_IMPLEMENTED", "Not implemented: configure HashiCorp Vault connection"));
+    async unwrapKey(keyId, wrappedKey, context) {
+        const dec = await this.decrypt(keyId, wrappedKey, context);
+        return { unwrappedKey: dec.plaintext, keyId: dec.keyId };
     }
 }
 exports.VaultKmsProvider = VaultKmsProvider;

package/dist/types.d.ts

@@ -44,5 +44,13 @@ export interface KmsProvider {
         plaintext: Uint8Array;
         ciphertext: string;
     }>;
+    wrapKey?(keyId: string, unwrappedKey: Uint8Array, context?: Record<string, string>): Promise<{
+        wrappedKey: string;
+        keyId: string;
+    }>;
+    unwrapKey?(keyId: string, wrappedKey: string, context?: Record<string, string>): Promise<{
+        unwrappedKey: Uint8Array;
+        keyId: string;
+    }>;
 }
 //# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAkBA,MAAM,WAAW,cAAc;IAE7B,KAAK,EAAE,MAAM,CAAC;IAEd,SAAS,EAAE,MAAM,CAAC;IAElB,KAAK,EAAE,SAAS,GAAG,MAAM,GAAG,MAAM,CAAC;IAEnC,SAAS,EAAE,MAAM,CAAC;IAElB,OAAO,EAAE,OAAO,CAAC;IAEjB,QAAQ,EAAE,MAAM,CAAC;IAMjB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAcD,MAAM,WAAW,gBAAgB;IAE/B,UAAU,EAAE,MAAM,CAAC;IAEnB,KAAK,EAAE,MAAM,CAAC;IAEd,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAEjC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAaD,MAAM,WAAW,gBAAgB;IAE/B,SAAS,EAAE,UAAU,CAAC;IAEtB,KAAK,EAAE,MAAM,CAAC;IAEd,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAcD,MAAM,WAAW,aAAa;IAE5B,SAAS,EAAE,MAAM,CAAC;IAElB,KAAK,EAAE,MAAM,CAAC;IAEd,SAAS,EAAE,MAAM,CAAC;CACnB;AAiBD,MAAM,WAAW,WAAW;IAE1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAGtB,QAAQ,CAAC,OAAO,CAAC,EAAE;QACjB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,OAAO,CAAC,EAAE,OAAO,CAAC;KACnB,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IAG9B,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAG/C,SAAS,CACP,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,SAAS,GAAG,MAAM,GAAG,MAAM,EAClC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAChC,OAAO,CAAC,cAAc,CAAC,CAAC;IAG3B,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAGxC,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAGzC,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,iBAAiB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAG9E,OAAO,CACL,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,UAAU,EACrB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC/B,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAG7B,OAAO,CACL,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC/B,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAG7B,IAAI,CACF,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,UAAU,EAChB,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,aAAa,CAAC,CAAC;IAG1B,MAAM,CACJ,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,UAAU,EAChB,SAAS,EAAE,MAAM,EACjB,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,OAAO,CAAC,CAAC;IAMpB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAOlD,iBAAiB,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAGlE,eAAe,CACb,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC;QAET,SAAS,EAAE,UAAU,CAAC;QAEtB,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC,CAAC;CACJ"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAkBA,MAAM,WAAW,cAAc;IAE7B,KAAK,EAAE,MAAM,CAAC;IAEd,SAAS,EAAE,MAAM,CAAC;IAElB,KAAK,EAAE,SAAS,GAAG,MAAM,GAAG,MAAM,CAAC;IAEnC,SAAS,EAAE,MAAM,CAAC;IAElB,OAAO,EAAE,OAAO,CAAC;IAEjB,QAAQ,EAAE,MAAM,CAAC;IAMjB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAcD,MAAM,WAAW,gBAAgB;IAE/B,UAAU,EAAE,MAAM,CAAC;IAEnB,KAAK,EAAE,MAAM,CAAC;IAEd,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAEjC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAaD,MAAM,WAAW,gBAAgB;IAE/B,SAAS,EAAE,UAAU,CAAC;IAEtB,KAAK,EAAE,MAAM,CAAC;IAEd,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAcD,MAAM,WAAW,aAAa;IAE5B,SAAS,EAAE,MAAM,CAAC;IAElB,KAAK,EAAE,MAAM,CAAC;IAEd,SAAS,EAAE,MAAM,CAAC;CACnB;AAiBD,MAAM,WAAW,WAAW;IAE1B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAGtB,QAAQ,CAAC,OAAO,CAAC,EAAE;QACjB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,OAAO,CAAC,EAAE,OAAO,CAAC;KACnB,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IAG9B,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAG/C,SAAS,CACP,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,SAAS,GAAG,MAAM,GAAG,MAAM,EAClC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAChC,OAAO,CAAC,cAAc,CAAC,CAAC;IAG3B,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAGxC,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAGzC,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,iBAAiB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAG9E,OAAO,CACL,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,UAAU,EACrB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC/B,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAG7B,OAAO,CACL,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC/B,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAG7B,IAAI,CACF,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,UAAU,EAChB,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,aAAa,CAAC,CAAC;IAG1B,MAAM,CACJ,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,UAAU,EAChB,SAAS,EAAE,MAAM,EACjB,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,OAAO,CAAC,CAAC;IAMpB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAOlD,iBAAiB,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAGlE,eAAe,CACb,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC;QAET,SAAS,EAAE,UAAU,CAAC;QAEtB,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC,CAAC;IAGH,OAAO,CAAC,CACN,KAAK,EAAE,MAAM,EACb,YAAY,EAAE,UAAU,EACxB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC/B,OAAO,CAAC;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAGlD,SAAS,CAAC,CACR,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC/B,OAAO,CAAC;QAAE,YAAY,EAAE,UAAU,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACzD"}

package/package.json

@@ -1,29 +1,31 @@
 {
   "name": "@sebastienrousseau/crypto-kms",
-  "version": "0.0.8",
+  "version": "0.0.24",
   "description": "Enterprise key management adapters for AWS KMS, Google Cloud KMS, Azure Key Vault, and HashiCorp Vault.",
   "author": "Sebastien Rousseau <sebastienrousseau@users.noreply.github.com>",
   "license": "MIT OR Apache-2.0",
   "engines": {
     "node": ">=22.0.0"
   },
+  "type": "commonjs",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
-  "sideEffects": false,
   "exports": {
     ".": {
       "types": "./dist/index.d.ts",
       "require": "./dist/index.js",
-      "import": "./dist/index.js"
-    }
+      "default": "./dist/index.js"
+    },
+    "./package.json": "./package.json"
   },
+  "sideEffects": false,
   "files": [
     "dist/**/*.js",
     "dist/**/*.d.ts",
     "dist/**/*.d.ts.map"
   ],
   "dependencies": {
-    "@sebastienrousseau/crypto-lib": "0.0.8"
+    "@sebastienrousseau/crypto-lib": "0.0.24"
   },
   "peerDependencies": {
     "@aws-sdk/client-kms": "^3.0.0",
@@ -42,12 +44,12 @@
     }
   },
   "devDependencies": {
-    "@types/chai": "^4.3.7",
-    "@types/mocha": "^10.0.2",
+    "@types/chai": "^5.2.3",
+    "@types/mocha": "^10.0.10",
     "@types/node": "^26.6.3",
     "c8": "^12.0.0",
-    "chai": "^4.5.0",
-    "mocha": "^10.8.2",
+    "chai": "^6.3.0",
+    "mocha": "^12.0.3",
     "rimraf": "^6.1.3",
     "ts-node": "^10.9.2",
     "typedoc": "^0.28.20",
@@ -68,8 +70,8 @@
     "clean": "rimraf ./coverage ./dist ./docs",
     "test": "c8 --check-coverage --lines 100 --branches 100 --functions 100 --reporter=lcov --reporter=text mocha --config=.mocharc.cjs",
     "docs": "typedoc",
-    "lint": "eslint --ext .ts src __tests__",
-    "lint:fix": "eslint --cache --fix --ext .ts src __tests__",
+    "lint": "eslint src __tests__",
+    "lint:fix": "eslint --cache --fix src __tests__",
     "format": "prettier --write src/**/*.ts",
     "format:check": "prettier --check \"src/**/*.ts\""
   }