@solana/keychain-vault 0.0.0 → 0.2.1

package/README.md

@@ -0,0 +1,145 @@
+# @solana/keychain-vault
+
+HashiCorp Vault-based signer for Solana transactions using Vault's transit engine.
+
+## Installation
+
+```bash
+npm install @solana/keychain-vault
+```
+
+## Prerequisites
+
+1. A HashiCorp Vault instance with the transit engine enabled
+2. An ED25519 key created in the transit engine
+3. A Vault token with sign permissions for the key
+
+### Creating a Transit Key in Vault
+
+```bash
+# Enable the transit engine
+vault secrets enable transit
+
+# Create an ED25519 key
+vault write transit/keys/my-solana-key type=ed25519
+
+# Export the public key to get your Solana address
+vault read -field=keys transit/export/signing-key/my-solana-key/1
+```
+
+## Usage
+
+### Basic Setup
+
+```typescript
+import { VaultSigner } from '@solana/keychain-vault';
+
+const signer = new VaultSigner({
+    vaultAddr: 'https://vault.example.com',
+    vaultToken: 'hvs.your-vault-token',
+    keyName: 'my-solana-key',
+    publicKey: 'your-solana-public-key-base58', // Must match the Vault key
+});
+
+// Check if the signer is available
+const isAvailable = await signer.isAvailable();
+console.log('Vault signer available:', isAvailable);
+```
+
+### Signing Transactions
+
+```typescript
+import { pipe } from '@solana/functional';
+import { createTransaction } from '@solana/transactions';
+import { signTransaction } from '@solana/signers';
+
+// Create your transaction
+const transaction = pipe(
+    createTransaction({ version: 0 }),
+    // ... add instructions
+);
+
+// Sign the transaction
+const signedTransaction = await signTransaction([signer], transaction);
+```
+
+### Signing Messages
+
+```typescript
+import { signMessage } from '@solana/signers';
+
+const message = new TextEncoder().encode('Hello, Solana!');
+const signature = await signMessage([signer], message);
+```
+
+### With Rate Limiting
+
+If you're signing multiple transactions/messages concurrently and want to avoid rate limits:
+
+```typescript
+const signer = new VaultSigner({
+    vaultAddr: 'https://vault.example.com',
+    vaultToken: 'hvs.your-vault-token',
+    keyName: 'my-solana-key',
+    publicKey: 'your-solana-public-key',
+    requestDelayMs: 100, // 100ms delay between concurrent requests
+});
+```
+
+## Configuration
+
+### VaultSignerConfig
+
+| Field | Type | Required | Description |
+|-------|------|----------|-------------|
+| `vaultAddr` | `string` | Yes | Vault server address (e.g., https://vault.example.com) |
+| `vaultToken` | `string` | Yes | Vault authentication token |
+| `keyName` | `string` | Yes | Name of the transit key in Vault |
+| `publicKey` | `string` | Yes | Solana public key (base58) corresponding to the Vault key |
+| `requestDelayMs` | `number` | No | Delay in ms between concurrent signing requests (default: 0) |
+
+## Vault Permissions
+
+The Vault token must have the following permissions on the transit key:
+
+```hcl
+path "transit/sign/my-solana-key" {
+  capabilities = ["update"]
+}
+
+path "transit/keys/my-solana-key" {
+  capabilities = ["read"]
+}
+```
+
+## Error Handling
+
+The signer will throw errors with specific codes from `@solana/keychain-core`:
+
+- `CONFIG_ERROR` - Invalid configuration
+- `HTTP_ERROR` - Network request failed
+- `REMOTE_API_ERROR` - Vault API returned an error
+- `PARSING_ERROR` - Failed to parse Vault response
+
+```typescript
+import { SignerErrorCode } from '@solana/keychain-core';
+
+try {
+    await signer.signMessages([message]);
+} catch (error) {
+    if (error.code === SignerErrorCode.REMOTE_API_ERROR) {
+        console.error('Vault API error:', error.message);
+    }
+}
+```
+
+## Security Considerations
+
+1. **Token Security**: Never hardcode Vault tokens. Use environment variables or secure secret management.
+2. **TLS**: Always use HTTPS when connecting to Vault.
+3. **Token Rotation**: Implement token rotation and use short-lived tokens when possible.
+4. **Audit Logging**: Enable Vault audit logging to track signing operations.
+
+## License
+
+MIT

package/dist/__tests__/setup.d.ts

@@ -0,0 +1,4 @@
+import { SignerTestConfig, TestScenario } from '@solana/keychain-test-utils';
+import { VaultSigner } from '../vault-signer';
+export declare function getConfig(scenarios: TestScenario[]): Promise<SignerTestConfig<VaultSigner>>;
+//# sourceMappingURL=setup.d.ts.map

package/dist/__tests__/setup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup.d.ts","sourceRoot":"","sources":["../../src/__tests__/setup.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC7E,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAmB9C,wBAAsB,SAAS,CAAC,SAAS,EAAE,YAAY,EAAE,GAAG,OAAO,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC,CAKjG"}

package/dist/__tests__/setup.js

@@ -0,0 +1,23 @@
+import { VaultSigner } from '../vault-signer';
+const SIGNER_TYPE = 'vault';
+const REQUIRED_ENV_VARS = ['VAULT_ADDR', 'VAULT_TOKEN', 'VAULT_KEY_NAME', 'VAULT_SIGNER_PUBKEY'];
+async function createVaultSigner() {
+    return new VaultSigner({
+        vaultAddr: process.env.VAULT_ADDR,
+        vaultToken: process.env.VAULT_TOKEN,
+        keyName: process.env.VAULT_KEY_NAME,
+        publicKey: process.env.VAULT_SIGNER_PUBKEY,
+    });
+}
+const CONFIG = {
+    signerType: SIGNER_TYPE,
+    requiredEnvVars: REQUIRED_ENV_VARS,
+    createSigner: createVaultSigner,
+};
+export async function getConfig(scenarios) {
+    return {
+        ...CONFIG,
+        testScenarios: scenarios,
+    };
+}
+//# sourceMappingURL=setup.js.map

package/dist/__tests__/setup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup.js","sourceRoot":"","sources":["../../src/__tests__/setup.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAE9C,MAAM,WAAW,GAAG,OAAO,CAAC;AAC5B,MAAM,iBAAiB,GAAG,CAAC,YAAY,EAAE,aAAa,EAAE,gBAAgB,EAAE,qBAAqB,CAAC,CAAC;AAEjG,KAAK,UAAU,iBAAiB;IAC5B,OAAO,IAAI,WAAW,CAAC;QACnB,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,UAAW;QAClC,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,WAAY;QACpC,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,cAAe;QACpC,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,mBAAoB;KAC9C,CAAC,CAAC;AACP,CAAC;AACD,MAAM,MAAM,GAAkC;IAC1C,UAAU,EAAE,WAAW;IACvB,eAAe,EAAE,iBAAiB;IAClC,YAAY,EAAE,iBAAiB;CAClC,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,SAAyB;IACrD,OAAO;QACH,GAAG,MAAM;QACT,aAAa,EAAE,SAAS;KAC3B,CAAC;AACN,CAAC"}

package/dist/__tests__/vault-signer.integration.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=vault-signer.integration.test.d.ts.map

package/dist/__tests__/vault-signer.integration.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault-signer.integration.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/vault-signer.integration.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/vault-signer.integration.test.js

@@ -0,0 +1,17 @@
+import { describe, it } from 'vitest';
+import { runSignerIntegrationTest } from '@solana/keychain-test-utils';
+import { getConfig } from './setup';
+import { config } from 'dotenv';
+config();
+describe('VaultSigner Integration', () => {
+    it.skipIf(!process.env.VAULT_ADDR)('signs transactions with real API', async () => {
+        await runSignerIntegrationTest(await getConfig(['signTransaction']));
+    });
+    it.skipIf(!process.env.VAULT_ADDR)('signs messages with real API', async () => {
+        await runSignerIntegrationTest(await getConfig(['signMessage']));
+    });
+    it.skipIf(!process.env.VAULT_ADDR)('simulates transactions with real API', async () => {
+        await runSignerIntegrationTest(await getConfig(['simulateTransaction']));
+    });
+});
+//# sourceMappingURL=vault-signer.integration.test.js.map

package/dist/__tests__/vault-signer.integration.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault-signer.integration.test.js","sourceRoot":"","sources":["../../src/__tests__/vault-signer.integration.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACtC,OAAO,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AACvE,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAChC,MAAM,EAAE,CAAC;AAET,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE;IACrC,EAAE,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,kCAAkC,EAAE,KAAK,IAAI,EAAE;QAC9E,MAAM,wBAAwB,CAAC,MAAM,SAAS,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC;IACzE,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,8BAA8B,EAAE,KAAK,IAAI,EAAE;QAC1E,MAAM,wBAAwB,CAAC,MAAM,SAAS,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;IACH,EAAE,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,sCAAsC,EAAE,KAAK,IAAI,EAAE;QAClF,MAAM,wBAAwB,CAAC,MAAM,SAAS,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;IAC7E,CAAC,CAAC,CAAC;AACP,CAAC,CAAC,CAAC"}

package/dist/__tests__/vault-signer.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=vault-signer.test.d.ts.map

package/dist/__tests__/vault-signer.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault-signer.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/vault-signer.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/vault-signer.test.js

@@ -0,0 +1,282 @@
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import { VaultSigner } from '../vault-signer.js';
+// Mock fetch globally
+global.fetch = vi.fn();
+describe('VaultSigner', () => {
+    const mockConfig = {
+        keyName: 'test-key',
+        publicKey: '11111111111111111111111111111111',
+        vaultAddr: 'https://vault.example.com',
+        vaultToken: 'test-token',
+    };
+    beforeEach(() => {
+        vi.clearAllMocks();
+    });
+    describe('constructor', () => {
+        it('should create a signer with valid configuration', () => {
+            const signer = new VaultSigner(mockConfig);
+            expect(signer.address).toBe(mockConfig.publicKey);
+        });
+        it('should throw error for missing vaultAddr', () => {
+            expect(() => {
+                new VaultSigner({
+                    ...mockConfig,
+                    vaultAddr: '',
+                });
+            }).toThrow('Missing required configuration fields');
+        });
+        it('should throw error for missing vaultToken', () => {
+            expect(() => {
+                new VaultSigner({
+                    ...mockConfig,
+                    vaultToken: '',
+                });
+            }).toThrow('Missing required configuration fields');
+        });
+        it('should throw error for missing keyName', () => {
+            expect(() => {
+                new VaultSigner({
+                    ...mockConfig,
+                    keyName: '',
+                });
+            }).toThrow('Missing required configuration fields');
+        });
+        it('should throw error for invalid public key', () => {
+            expect(() => {
+                new VaultSigner({
+                    ...mockConfig,
+                    publicKey: 'invalid-key',
+                });
+            }).toThrow('Invalid Solana public key format');
+        });
+        it('should remove trailing slash from vaultAddr', () => {
+            const signer = new VaultSigner({
+                ...mockConfig,
+                vaultAddr: 'https://vault.example.com/',
+            });
+            expect(signer['vaultAddr']).toBe('https://vault.example.com');
+        });
+        it('should validate requestDelayMs', () => {
+            expect(() => {
+                new VaultSigner({
+                    ...mockConfig,
+                    requestDelayMs: -1,
+                });
+            }).toThrow('requestDelayMs must not be negative');
+        });
+        it('should warn for high requestDelayMs', () => {
+            const warnSpy = vi.spyOn(console, 'warn').mockImplementation(() => { });
+            new VaultSigner({
+                ...mockConfig,
+                requestDelayMs: 3001,
+            });
+            expect(warnSpy).toHaveBeenCalledWith(expect.stringContaining('requestDelayMs is greater than 3000ms'));
+            warnSpy.mockRestore();
+        });
+    });
+    describe('isAvailable', () => {
+        it('should return true when Vault key is accessible and supports signing', async () => {
+            const mockResponse = {
+                data: {
+                    supports_signing: true,
+                    type: 'ed25519',
+                },
+            };
+            vi.mocked(fetch).mockResolvedValueOnce(new Response(JSON.stringify(mockResponse), {
+                status: 200,
+            }));
+            const signer = new VaultSigner(mockConfig);
+            const result = await signer.isAvailable();
+            expect(result).toBe(true);
+            expect(fetch).toHaveBeenCalledWith('https://vault.example.com/v1/transit/keys/test-key', expect.objectContaining({
+                headers: {
+                    'X-Vault-Token': 'test-token',
+                },
+                method: 'GET',
+            }));
+        });
+        it('should return false when Vault key does not support signing', async () => {
+            const mockResponse = {
+                data: {
+                    supports_signing: false,
+                    type: 'aes256-gcm96',
+                },
+            };
+            vi.mocked(fetch).mockResolvedValueOnce(new Response(JSON.stringify(mockResponse), {
+                status: 200,
+            }));
+            const signer = new VaultSigner(mockConfig);
+            const result = await signer.isAvailable();
+            expect(result).toBe(false);
+        });
+        it('should return false when Vault key is not ed25519', async () => {
+            const mockResponse = {
+                data: {
+                    supports_signing: true,
+                    type: 'rsa-2048',
+                },
+            };
+            vi.mocked(fetch).mockResolvedValueOnce(new Response(JSON.stringify(mockResponse), {
+                status: 200,
+            }));
+            const signer = new VaultSigner(mockConfig);
+            const result = await signer.isAvailable();
+            expect(result).toBe(false);
+        });
+        it('should return false when Vault returns error', async () => {
+            vi.mocked(fetch).mockResolvedValueOnce(new Response('{"errors":["permission denied"]}', {
+                status: 403,
+            }));
+            const signer = new VaultSigner(mockConfig);
+            const result = await signer.isAvailable();
+            expect(result).toBe(false);
+        });
+        it('should return false when network request fails', async () => {
+            vi.mocked(fetch).mockRejectedValueOnce(new Error('Network error'));
+            const signer = new VaultSigner(mockConfig);
+            const result = await signer.isAvailable();
+            expect(result).toBe(false);
+        });
+    });
+    describe('signMessages', () => {
+        it('should sign a message successfully', async () => {
+            const mockSignature = 'vault:v1:' + 'a'.repeat(86); // Base64 encoded signature
+            const mockResponse = {
+                data: {
+                    signature: mockSignature,
+                },
+            };
+            vi.mocked(fetch).mockResolvedValueOnce(new Response(JSON.stringify(mockResponse), {
+                status: 200,
+            }));
+            const signer = new VaultSigner(mockConfig);
+            const message = {
+                content: new Uint8Array([1, 2, 3, 4]),
+                signatures: {},
+            };
+            const [result] = await signer.signMessages([message]);
+            expect(result).toHaveProperty(mockConfig.publicKey);
+            expect(fetch).toHaveBeenCalledWith('https://vault.example.com/v1/transit/sign/test-key', expect.objectContaining({
+                body: expect.stringContaining('"input"'),
+                headers: {
+                    'Content-Type': 'application/json',
+                    'X-Vault-Token': 'test-token',
+                },
+                method: 'POST',
+            }));
+        });
+        it('should handle Vault API errors', async () => {
+            const mockErrorResponse = {
+                errors: ['key not found'],
+            };
+            vi.mocked(fetch).mockResolvedValueOnce(new Response(JSON.stringify(mockErrorResponse), {
+                status: 404,
+            }));
+            const signer = new VaultSigner(mockConfig);
+            const message = {
+                content: new Uint8Array([1, 2, 3, 4]),
+                signatures: {},
+            };
+            await expect(signer.signMessages([message])).rejects.toThrow('Vault API error: key not found');
+        });
+        it('should handle network errors', async () => {
+            vi.mocked(fetch).mockRejectedValueOnce(new Error('Network failure'));
+            const signer = new VaultSigner(mockConfig);
+            const message = {
+                content: new Uint8Array([1, 2, 3, 4]),
+                signatures: {},
+            };
+            await expect(signer.signMessages([message])).rejects.toThrow('Vault network request failed');
+        });
+        it('should handle missing signature in response', async () => {
+            const mockResponse = {
+                data: {},
+            };
+            vi.mocked(fetch).mockResolvedValueOnce(new Response(JSON.stringify(mockResponse), {
+                status: 200,
+            }));
+            const signer = new VaultSigner(mockConfig);
+            const message = {
+                content: new Uint8Array([1, 2, 3, 4]),
+                signatures: {},
+            };
+            await expect(signer.signMessages([message])).rejects.toThrow('Missing signature in Vault response');
+        });
+        it('should handle signature without vault prefix', async () => {
+            const mockSignature = 'a'.repeat(86); // Base64 encoded signature without prefix
+            const mockResponse = {
+                data: {
+                    signature: mockSignature,
+                },
+            };
+            vi.mocked(fetch).mockResolvedValueOnce(new Response(JSON.stringify(mockResponse), {
+                status: 200,
+            }));
+            const signer = new VaultSigner(mockConfig);
+            const message = {
+                content: new Uint8Array([1, 2, 3, 4]),
+                signatures: {},
+            };
+            const [result] = await signer.signMessages([message]);
+            expect(result).toHaveProperty(mockConfig.publicKey);
+        });
+        it('should apply request delay for multiple messages', async () => {
+            const mockSignature = 'vault:v1:' + 'a'.repeat(86);
+            const mockResponse = {
+                data: {
+                    signature: mockSignature,
+                },
+            };
+            vi.mocked(fetch).mockImplementation(() => Promise.resolve(new Response(JSON.stringify(mockResponse), {
+                status: 200,
+            })));
+            const delaySpy = vi.spyOn(global, 'setTimeout');
+            const signer = new VaultSigner({
+                ...mockConfig,
+                requestDelayMs: 100,
+            });
+            const messages = [
+                { content: new Uint8Array([1, 2, 3, 4]), signatures: {} },
+                { content: new Uint8Array([5, 6, 7, 8]), signatures: {} },
+                { content: new Uint8Array([9, 10, 11, 12]), signatures: {} },
+            ];
+            await signer.signMessages(messages);
+            // First message should not have delay, subsequent ones should
+            expect(delaySpy).toHaveBeenCalledTimes(2);
+            expect(delaySpy).toHaveBeenNthCalledWith(1, expect.any(Function), 100);
+            expect(delaySpy).toHaveBeenNthCalledWith(2, expect.any(Function), 200);
+            delaySpy.mockRestore();
+        });
+    });
+    describe('signTransactions', () => {
+        it('should sign a transaction successfully', async () => {
+            const mockSignature = 'vault:v1:' + 'a'.repeat(86);
+            const mockResponse = {
+                data: {
+                    signature: mockSignature,
+                },
+            };
+            vi.mocked(fetch).mockResolvedValueOnce(new Response(JSON.stringify(mockResponse), {
+                status: 200,
+            }));
+            const signer = new VaultSigner(mockConfig);
+            // Create a mock transaction - this is simplified
+            const mockTransaction = {
+                '"__transactionSize:@solana/kit"': 100,
+                lifetimeConstraint: { blockhash: 'test', lastValidBlockHeight: 100n },
+                messageBytes: new Uint8Array([1, 2, 3, 4]),
+                signatures: {},
+            };
+            const [result] = await signer.signTransactions([mockTransaction]);
+            expect(result).toHaveProperty(mockConfig.publicKey);
+            expect(fetch).toHaveBeenCalledWith('https://vault.example.com/v1/transit/sign/test-key', expect.objectContaining({
+                headers: {
+                    'Content-Type': 'application/json',
+                    'X-Vault-Token': 'test-token',
+                },
+                method: 'POST',
+            }));
+        });
+    });
+});
+//# sourceMappingURL=vault-signer.test.js.map

package/dist/__tests__/vault-signer.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault-signer.test.js","sourceRoot":"","sources":["../../src/__tests__/vault-signer.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAE9D,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEjD,sBAAsB;AACtB,MAAM,CAAC,KAAK,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;AAEvB,QAAQ,CAAC,aAAa,EAAE,GAAG,EAAE;IACzB,MAAM,UAAU,GAAG;QACf,OAAO,EAAE,UAAU;QACnB,SAAS,EAAE,kCAAkC;QAC7C,SAAS,EAAE,2BAA2B;QACtC,UAAU,EAAE,YAAY;KAC3B,CAAC;IAEF,UAAU,CAAC,GAAG,EAAE;QACZ,EAAE,CAAC,aAAa,EAAE,CAAC;IACvB,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,aAAa,EAAE,GAAG,EAAE;QACzB,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;YACvD,MAAM,MAAM,GAAG,IAAI,WAAW,CAAC,UAAU,CAAC,CAAC;YAC3C,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACtD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;YAChD,MAAM,CAAC,GAAG,EAAE;gBACR,IAAI,WAAW,CAAC;oBACZ,GAAG,UAAU;oBACb,SAAS,EAAE,EAAE;iBAChB,CAAC,CAAC;YACP,CAAC,CAAC,CAAC,OAAO,CAAC,uCAAuC,CAAC,CAAC;QACxD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;YACjD,MAAM,CAAC,GAAG,EAAE;gBACR,IAAI,WAAW,CAAC;oBACZ,GAAG,UAAU;oBACb,UAAU,EAAE,EAAE;iBACjB,CAAC,CAAC;YACP,CAAC,CAAC,CAAC,OAAO,CAAC,uCAAuC,CAAC,CAAC;QACxD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;YAC9C,MAAM,CAAC,GAAG,EAAE;gBACR,IAAI,WAAW,CAAC;oBACZ,GAAG,UAAU;oBACb,OAAO,EAAE,EAAE;iBACd,CAAC,CAAC;YACP,CAAC,CAAC,CAAC,OAAO,CAAC,uCAAuC,CAAC,CAAC;QACxD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;YACjD,MAAM,CAAC,GAAG,EAAE;gBACR,IAAI,WAAW,CAAC;oBACZ,GAAG,UAAU;oBACb,SAAS,EAAE,aAAa;iBAC3B,CAAC,CAAC;YACP,CAAC,CAAC,CAAC,OAAO,CAAC,kCAAkC,CAAC,CAAC;QACnD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;YACnD,MAAM,MAAM,GAAG,IAAI,WAAW,CAAC;gBAC3B,GAAG,UAAU;gBACb,SAAS,EAAE,4BAA4B;aAC1C,CAAC,CAAC;YACH,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;QAClE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;YACtC,MAAM,CAAC,GAAG,EAAE;gBACR,IAAI,WAAW,CAAC;oBACZ,GAAG,UAAU;oBACb,cAAc,EAAE,CAAC,CAAC;iBACrB,CAAC,CAAC;YACP,CAAC,CAAC,CAAC,OAAO,CAAC,qCAAqC,CAAC,CAAC;QACtD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;YAC3C,MAAM,OAAO,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACvE,IAAI,WAAW,CAAC;gBACZ,GAAG,UAAU;gBACb,cAAc,EAAE,IAAI;aACvB,CAAC,CAAC;YACH,MAAM,CAAC,OAAO,CAAC,CAAC,oBAAoB,CAAC,MAAM,CAAC,gBAAgB,CAAC,uCAAuC,CAAC,CAAC,CAAC;YACvG,OAAO,CAAC,WAAW,EAAE,CAAC;QAC1B,CAAC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,aAAa,EAAE,GAAG,EAAE;QACzB,EAAE,CAAC,sEAAsE,EAAE,KAAK,IAAI,EAAE;YAClF,MAAM,YAAY,GAAG;gBACjB,IAAI,EAAE;oBACF,gBAAgB,EAAE,IAAI;oBACtB,IAAI,EAAE,SAAS;iBAClB;aACJ,CAAC;YAEF,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,qBAAqB,CAClC,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,EAAE;gBACvC,MAAM,EAAE,GAAG;aACd,CAAC,CACL,CAAC;YAEF,MAAM,MAAM,GAAG,IAAI,WAAW,CAAC,UAAU,CAAC,CAAC;YAC3C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,WAAW,EAAE,CAAC;YAE1C,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC1B,MAAM,CAAC,KAAK,CAAC,CAAC,oBAAoB,CAC9B,oDAAoD,EACpD,MAAM,CAAC,gBAAgB,CAAC;gBACpB,OAAO,EAAE;oBACL,eAAe,EAAE,YAAY;iBAChC;gBACD,MAAM,EAAE,KAAK;aAChB,CAAC,CACL,CAAC;QACN,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,6DAA6D,EAAE,KAAK,IAAI,EAAE;YACzE,MAAM,YAAY,GAAG;gBACjB,IAAI,EAAE;oBACF,gBAAgB,EAAE,KAAK;oBACvB,IAAI,EAAE,cAAc;iBACvB;aACJ,CAAC;YAEF,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,qBAAqB,CAClC,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,EAAE;gBACvC,MAAM,EAAE,GAAG;aACd,CAAC,CACL,CAAC;YAEF,MAAM,MAAM,GAAG,IAAI,WAAW,CAAC,UAAU,CAAC,CAAC;YAC3C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,WAAW,EAAE,CAAC;YAE1C,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/B,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;YAC/D,MAAM,YAAY,GAAG;gBACjB,IAAI,EAAE;oBACF,gBAAgB,EAAE,IAAI;oBACtB,IAAI,EAAE,UAAU;iBACnB;aACJ,CAAC;YAEF,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,qBAAqB,CAClC,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,EAAE;gBACvC,MAAM,EAAE,GAAG;aACd,CAAC,CACL,CAAC;YAEF,MAAM,MAAM,GAAG,IAAI,WAAW,CAAC,UAAU,CAAC,CAAC;YAC3C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,WAAW,EAAE,CAAC;YAE1C,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/B,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;YAC1D,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,qBAAqB,CAClC,IAAI,QAAQ,CAAC,kCAAkC,EAAE;gBAC7C,MAAM,EAAE,GAAG;aACd,CAAC,CACL,CAAC;YAEF,MAAM,MAAM,GAAG,IAAI,WAAW,CAAC,UAAU,CAAC,CAAC;YAC3C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,WAAW,EAAE,CAAC;YAE1C,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/B,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;YAC5D,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,qBAAqB,CAAC,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC;YAEnE,MAAM,MAAM,GAAG,IAAI,WAAW,CAAC,UAAU,CAAC,CAAC;YAC3C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,WAAW,EAAE,CAAC;YAE1C,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/B,CAAC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;QAC1B,EAAE,CAAC,oCAAoC,EAAE,KAAK,IAAI,EAAE;YAChD,MAAM,aAAa,GAAG,WAAW,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,2BAA2B;YAC/E,MAAM,YAAY,GAAG;gBACjB,IAAI,EAAE;oBACF,SAAS,EAAE,aAAa;iBAC3B;aACJ,CAAC;YAEF,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,qBAAqB,CAClC,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,EAAE;gBACvC,MAAM,EAAE,GAAG;aACd,CAAC,CACL,CAAC;YAEF,MAAM,MAAM,GAAG,IAAI,WAAW,CAAC,UAAU,CAAC,CAAC;YAC3C,MAAM,OAAO,GAAG;gBACZ,OAAO,EAAE,IAAI,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;gBACrC,UAAU,EAAE,EAAE;aACjB,CAAC;YAEF,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;YAEtD,MAAM,CAAC,MAAM,CAAC,CAAC,cAAc,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;YACpD,MAAM,CAAC,KAAK,CAAC,CAAC,oBAAoB,CAC9B,oDAAoD,EACpD,MAAM,CAAC,gBAAgB,CAAC;gBACpB,IAAI,EAAE,MAAM,CAAC,gBAAgB,CAAC,SAAS,CAAC;gBACxC,OAAO,EAAE;oBACL,cAAc,EAAE,kBAAkB;oBAClC,eAAe,EAAE,YAAY;iBAChC;gBACD,MAAM,EAAE,MAAM;aACjB,CAAC,CACL,CAAC;QACN,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,gCAAgC,EAAE,KAAK,IAAI,EAAE;YAC5C,MAAM,iBAAiB,GAAG;gBACtB,MAAM,EAAE,CAAC,eAAe,CAAC;aAC5B,CAAC;YAEF,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,qBAAqB,CAClC,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC,EAAE;gBAC5C,MAAM,EAAE,GAAG;aACd,CAAC,CACL,CAAC;YAEF,MAAM,MAAM,GAAG,IAAI,WAAW,CAAC,UAAU,CAAC,CAAC;YAC3C,MAAM,OAAO,GAAG;gBACZ,OAAO,EAAE,IAAI,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;gBACrC,UAAU,EAAE,EAAE;aACjB,CAAC;YAEF,MAAM,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,gCAAgC,CAAC,CAAC;QACnG,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,8BAA8B,EAAE,KAAK,IAAI,EAAE;YAC1C,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,qBAAqB,CAAC,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC;YAErE,MAAM,MAAM,GAAG,IAAI,WAAW,CAAC,UAAU,CAAC,CAAC;YAC3C,MAAM,OAAO,GAAG;gBACZ,OAAO,EAAE,IAAI,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;gBACrC,UAAU,EAAE,EAAE;aACjB,CAAC;YAEF,MAAM,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,8BAA8B,CAAC,CAAC;QACjG,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,6CAA6C,EAAE,KAAK,IAAI,EAAE;YACzD,MAAM,YAAY,GAAG;gBACjB,IAAI,EAAE,EAAE;aACX,CAAC;YAEF,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,qBAAqB,CAClC,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,EAAE;gBACvC,MAAM,EAAE,GAAG;aACd,CAAC,CACL,CAAC;YAEF,MAAM,MAAM,GAAG,IAAI,WAAW,CAAC,UAAU,CAAC,CAAC;YAC3C,MAAM,OAAO,GAAG;gBACZ,OAAO,EAAE,IAAI,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;gBACrC,UAAU,EAAE,EAAE;aACjB,CAAC;YAEF,MAAM,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,qCAAqC,CAAC,CAAC;QACxG,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;YAC1D,MAAM,aAAa,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,0CAA0C;YAChF,MAAM,YAAY,GAAG;gBACjB,IAAI,EAAE;oBACF,SAAS,EAAE,aAAa;iBAC3B;aACJ,CAAC;YAEF,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,qBAAqB,CAClC,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,EAAE;gBACvC,MAAM,EAAE,GAAG;aACd,CAAC,CACL,CAAC;YAEF,MAAM,MAAM,GAAG,IAAI,WAAW,CAAC,UAAU,CAAC,CAAC;YAC3C,MAAM,OAAO,GAAG;gBACZ,OAAO,EAAE,IAAI,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;gBACrC,UAAU,EAAE,EAAE;aACjB,CAAC;YAEF,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;YACtD,MAAM,CAAC,MAAM,CAAC,CAAC,cAAc,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACxD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,kDAAkD,EAAE,KAAK,IAAI,EAAE;YAC9D,MAAM,aAAa,GAAG,WAAW,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACnD,MAAM,YAAY,GAAG;gBACjB,IAAI,EAAE;oBACF,SAAS,EAAE,aAAa;iBAC3B;aACJ,CAAC;YAEF,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,kBAAkB,CAAC,GAAG,EAAE,CACrC,OAAO,CAAC,OAAO,CACX,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,EAAE;gBACvC,MAAM,EAAE,GAAG;aACd,CAAC,CACL,CACJ,CAAC;YAEF,MAAM,QAAQ,GAAG,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;YAChD,MAAM,MAAM,GAAG,IAAI,WAAW,CAAC;gBAC3B,GAAG,UAAU;gBACb,cAAc,EAAE,GAAG;aACtB,CAAC,CAAC;YAEH,MAAM,QAAQ,GAAG;gBACb,EAAE,OAAO,EAAE,IAAI,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE;gBACzD,EAAE,OAAO,EAAE,IAAI,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE;gBACzD,EAAE,OAAO,EAAE,IAAI,UAAU,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE;aAC/D,CAAC;YAEF,MAAM,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;YAEpC,8DAA8D;YAC9D,MAAM,CAAC,QAAQ,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;YAC1C,MAAM,CAAC,QAAQ,CAAC,CAAC,uBAAuB,CAAC,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAC;YACvE,MAAM,CAAC,QAAQ,CAAC,CAAC,uBAAuB,CAAC,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,CAAC;YAEvE,QAAQ,CAAC,WAAW,EAAE,CAAC;QAC3B,CAAC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;QAC9B,EAAE,CAAC,wCAAwC,EAAE,KAAK,IAAI,EAAE;YACpD,MAAM,aAAa,GAAG,WAAW,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACnD,MAAM,YAAY,GAAG;gBACjB,IAAI,EAAE;oBACF,SAAS,EAAE,aAAa;iBAC3B;aACJ,CAAC;YAEF,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,qBAAqB,CAClC,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,EAAE;gBACvC,MAAM,EAAE,GAAG;aACd,CAAC,CACL,CAAC;YAEF,MAAM,MAAM,GAAG,IAAI,WAAW,CAAC,UAAU,CAAC,CAAC;YAE3C,iDAAiD;YACjD,MAAM,eAAe,GAAG;gBACpB,iCAAiC,EAAE,GAAG;gBACtC,kBAAkB,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,oBAAoB,EAAE,IAAI,EAAE;gBACrE,YAAY,EAAE,IAAI,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;gBAC1C,UAAU,EAAE,EAAE;aACV,CAAC;YAET,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC;YAElE,MAAM,CAAC,MAAM,CAAC,CAAC,cAAc,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;YACpD,MAAM,CAAC,KAAK,CAAC,CAAC,oBAAoB,CAC9B,oDAAoD,EACpD,MAAM,CAAC,gBAAgB,CAAC;gBACpB,OAAO,EAAE;oBACL,cAAc,EAAE,kBAAkB;oBAClC,eAAe,EAAE,YAAY;iBAChC;gBACD,MAAM,EAAE,MAAM;aACjB,CAAC,CACL,CAAC;QACN,CAAC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;AACP,CAAC,CAAC,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,4 @@
+export { VaultSigner } from './vault-signer.js';
+export type { VaultSignerConfig } from './vault-signer.js';
+export type { VaultErrorResponse, VaultKeyReadRequest, VaultKeyReadResponse, VaultPayloadBase64, VaultSignatureBase64, VaultSignRequest, VaultSignResponse, } from './types.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,YAAY,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAC3D,YAAY,EACR,kBAAkB,EAClB,mBAAmB,EACnB,oBAAoB,EACpB,kBAAkB,EAClB,oBAAoB,EACpB,gBAAgB,EAChB,iBAAiB,GACpB,MAAM,YAAY,CAAC"}

package/dist/index.js

@@ -0,0 +1,2 @@
+export { VaultSigner } from './vault-signer.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,114 @@
+/**
+ * Base64 encoded signature string from Vault
+ */
+export type VaultSignatureBase64 = string & {
+    readonly __brand: unique symbol;
+};
+/**
+ * Base64 encoded transaction payload for Vault
+ */
+export type VaultPayloadBase64 = string & {
+    readonly __brand: unique symbol;
+};
+/**
+ * Request to sign data using Vault transit engine
+ */
+export interface VaultSignRequest {
+    /**
+     * Hash algorithm to use (optional, defaults to sha2-256)
+     * Not typically needed for ED25519 keys as they handle hashing internally
+     */
+    hash_algorithm?: 'sha2-256' | 'sha2-384' | 'sha2-512';
+    /**
+     * The base64 encoded data to sign
+     */
+    input: VaultPayloadBase64;
+    /**
+     * Whether to hash the input before signing (optional, defaults to false)
+     * Not typically sent as Vault defaults to false
+     */
+    prehashed?: boolean;
+    /**
+     * Signature algorithm (optional)
+     * Not typically sent as the key type determines the algorithm
+     */
+    signature_algorithm?: 'ed25519' | 'rsa-2048' | 'rsa-3072' | 'rsa-4096';
+}
+/**
+ * Response from Vault transit sign endpoint
+ */
+export interface VaultSignResponse {
+    /**
+     * Optional authentication information
+     */
+    auth?: unknown;
+    data: {
+        /**
+         * Optional key version used for signing
+         */
+        key_version?: number;
+        /**
+         * The signature in the format "vault:v1:signature_base64"
+         */
+        signature: string;
+    };
+    /**
+     * Optional warnings from Vault
+     */
+    warnings?: string[];
+}
+/**
+ * Request to read key metadata from Vault transit engine
+ * No request body needed for key metadata read
+ */
+export type VaultKeyReadRequest = Record<string, never>;
+/**
+ * Response from Vault transit key read endpoint
+ */
+export interface VaultKeyReadResponse {
+    data: {
+        /**
+         * Key creation time
+         */
+        creation_time: string;
+        /**
+         * Whether the key is deletable
+         */
+        deletion_allowed: boolean;
+        /**
+         * Whether the key can be exported
+         */
+        exportable: boolean;
+        /**
+         * Current version of the key
+         */
+        latest_version: number;
+        /**
+         * Minimum version for decryption
+         */
+        min_decryption_version?: number;
+        /**
+         * Minimum version for encryption
+         */
+        min_encryption_version?: number;
+        /**
+         * Whether the key can be used for encryption
+         */
+        supports_encryption: boolean;
+        /**
+         * Whether the key can be used for signing
+         */
+        supports_signing: boolean;
+        /**
+         * Key type (e.g., "ed25519", "rsa-2048", etc.)
+         */
+        type: string;
+    };
+}
+/**
+ * Vault error response format
+ */
+export interface VaultErrorResponse {
+    errors: string[];
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,MAAM,MAAM,oBAAoB,GAAG,MAAM,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,OAAO,MAAM,CAAA;CAAE,CAAC;AAEhF;;GAEG;AACH,MAAM,MAAM,kBAAkB,GAAG,MAAM,GAAG;IAAE,QAAQ,CAAC,OAAO,EAAE,OAAO,MAAM,CAAA;CAAE,CAAC;AAE9E;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC7B;;;OAGG;IACH,cAAc,CAAC,EAAE,UAAU,GAAG,UAAU,GAAG,UAAU,CAAC;IAEtD;;OAEG;IACH,KAAK,EAAE,kBAAkB,CAAC;IAE1B;;;OAGG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IAEpB;;;OAGG;IACH,mBAAmB,CAAC,EAAE,SAAS,GAAG,UAAU,GAAG,UAAU,GAAG,UAAU,CAAC;CAC1E;AAED;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAC9B;;OAEG;IACH,IAAI,CAAC,EAAE,OAAO,CAAC;IAEf,IAAI,EAAE;QACF;;WAEG;QACH,WAAW,CAAC,EAAE,MAAM,CAAC;QAErB;;WAEG;QACH,SAAS,EAAE,MAAM,CAAC;KACrB,CAAC;IAEF;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACvB;AAED;;;GAGG;AACH,MAAM,MAAM,mBAAmB,GAAG,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;AAExD;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACjC,IAAI,EAAE;QACF;;WAEG;QACH,aAAa,EAAE,MAAM,CAAC;QAEtB;;WAEG;QACH,gBAAgB,EAAE,OAAO,CAAC;QAE1B;;WAEG;QACH,UAAU,EAAE,OAAO,CAAC;QAEpB;;WAEG;QACH,cAAc,EAAE,MAAM,CAAC;QAEvB;;WAEG;QACH,sBAAsB,CAAC,EAAE,MAAM,CAAC;QAEhC;;WAEG;QACH,sBAAsB,CAAC,EAAE,MAAM,CAAC;QAEhC;;WAEG;QACH,mBAAmB,EAAE,OAAO,CAAC;QAE7B;;WAEG;QACH,gBAAgB,EAAE,OAAO,CAAC;QAE1B;;WAEG;QACH,IAAI,EAAE,MAAM,CAAC;KAChB,CAAC;CACL;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IAC/B,MAAM,EAAE,MAAM,EAAE,CAAC;CACpB"}

package/dist/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":""}