@sphereon/ssi-sdk-ext.key-manager 0.24.1-unstable.10 → 0.24.1-unstable.112

package/dist/agent/SphereonKeyManager.d.ts

@@ -1,6 +1,6 @@
-import { KeyManager as VeramoKeyManager, AbstractKeyManagementSystem, AbstractKeyStore } from '@veramo/key-manager';
-import { ManagedKeyInfo } from '@veramo/core';
-import { ISphereonKeyManager, ISphereonKeyManagerSignArgs, ISphereonKeyManagerVerifyArgs } from '../types/ISphereonKeyManager';
+import { IKey, ManagedKeyInfo } from '@veramo/core';
+import { AbstractKeyManagementSystem, AbstractKeyStore, KeyManager as VeramoKeyManager } from '@veramo/key-manager';
+import { IKeyManagerGetArgs, ISphereonKeyManager, ISphereonKeyManagerCreateArgs, ISphereonKeyManagerHandleExpirationsArgs, ISphereonKeyManagerSignArgs, ISphereonKeyManagerVerifyArgs } from '../types/ISphereonKeyManager';
 export declare const sphereonKeyManagerMethods: Array<string>;
 export declare class SphereonKeyManager extends VeramoKeyManager {
     private localStore;
@@ -10,9 +10,12 @@ export declare class SphereonKeyManager extends VeramoKeyManager {
         store: AbstractKeyStore;
         kms: Record<string, AbstractKeyManagementSystem>;
     });
-    private getAvailableKms;
+    keyManagerCreate(args: ISphereonKeyManagerCreateArgs): Promise<ManagedKeyInfo>;
     keyManagerSign(args: ISphereonKeyManagerSignArgs): Promise<string>;
     keyManagerVerify(args: ISphereonKeyManagerVerifyArgs): Promise<boolean>;
     keyManagerListKeys(): Promise<ManagedKeyInfo[]>;
+    keyManagerHandleExpirations(args: ISphereonKeyManagerHandleExpirationsArgs): Promise<Array<ManagedKeyInfo>>;
+    private getKmsByName;
+    keyManagerGet({ kid }: IKeyManagerGetArgs): Promise<IKey>;
 }
 //# sourceMappingURL=SphereonKeyManager.d.ts.map

package/dist/agent/SphereonKeyManager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SphereonKeyManager.d.ts","sourceRoot":"","sources":["../../src/agent/SphereonKeyManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,IAAI,gBAAgB,EAAE,2BAA2B,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AAEnH,OAAO,EAAQ,cAAc,EAAY,MAAM,cAAc,CAAA;AAE7D,OAAO,EAAE,mBAAmB,EAAE,2BAA2B,EAAE,6BAA6B,EAAE,MAAM,8BAA8B,CAAA;AAE9H,eAAO,MAAM,yBAAyB,EAAE,KAAK,CAAC,MAAM,CAMnD,CAAA;AAED,qBAAa,kBAAmB,SAAQ,gBAAgB;IACtD,OAAO,CAAC,UAAU,CAAkB;IACpC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA6C;IAC5E,QAAQ,CAAC,YAAY,EAAE,mBAAmB,CAAA;gBAE9B,OAAO,EAAE;QAAE,KAAK,EAAE,gBAAgB,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,2BAA2B,CAAC,CAAA;KAAE;IAUlG,OAAO,CAAC,eAAe;IASjB,cAAc,CAAC,IAAI,EAAE,2BAA2B,GAAG,OAAO,CAAC,MAAM,CAAC;IAUlE,gBAAgB,CAAC,IAAI,EAAE,6BAA6B,GAAG,OAAO,CAAC,OAAO,CAAC;IASvE,kBAAkB,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;CAGtD"}
+{"version":3,"file":"SphereonKeyManager.d.ts","sourceRoot":"","sources":["../../src/agent/SphereonKeyManager.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAe,cAAc,EAAE,MAAM,cAAc,CAAA;AAChE,OAAO,EAAE,2BAA2B,EAAE,gBAAgB,EAAE,UAAU,IAAI,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AACnH,OAAO,EAEL,kBAAkB,EAClB,mBAAmB,EACnB,6BAA6B,EAC7B,wCAAwC,EACxC,2BAA2B,EAC3B,6BAA6B,EAC9B,MAAM,8BAA8B,CAAA;AAIrC,eAAO,MAAM,yBAAyB,EAAE,KAAK,CAAC,MAAM,CAQnD,CAAA;AAED,qBAAa,kBAAmB,SAAQ,gBAAgB;IAEtD,OAAO,CAAC,UAAU,CAAkB;IACpC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA6C;IAC5E,QAAQ,CAAC,YAAY,EAAE,mBAAmB,CAAA;gBAE9B,OAAO,EAAE;QAAE,KAAK,EAAE,gBAAgB,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,2BAA2B,CAAC,CAAA;KAAE;IAUnF,gBAAgB,CAAC,IAAI,EAAE,6BAA6B,GAAG,OAAO,CAAC,cAAc,CAAC;IAyBvF,cAAc,CAAC,IAAI,EAAE,2BAA2B,GAAG,OAAO,CAAC,MAAM,CAAC;IAUlE,gBAAgB,CAAC,IAAI,EAAE,6BAA6B,GAAG,OAAO,CAAC,OAAO,CAAC;IAevE,kBAAkB,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;IAI/C,2BAA2B,CAAC,IAAI,EAAE,wCAAwC,GAAG,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAiBjH,OAAO,CAAC,YAAY;IASd,aAAa,CAAC,EAAE,GAAG,EAAE,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;CAmBhE"}

package/dist/agent/SphereonKeyManager.js

@@ -1,4 +1,27 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
 var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
     function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
     return new (P || (P = Promise))(function (resolve, reject) {
@@ -10,14 +33,18 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.SphereonKeyManager = exports.sphereonKeyManagerMethods = void 0;
+const ssi_sdk_ext_key_utils_1 = require("@sphereon/ssi-sdk-ext.key-utils");
 const key_manager_1 = require("@veramo/key-manager");
-const ssi_sdk_ext_kms_local_1 = require("@sphereon/ssi-sdk-ext.kms-local");
+const ISphereonKeyManager_1 = require("../types/ISphereonKeyManager");
+const u8a = __importStar(require("uint8arrays"));
 exports.sphereonKeyManagerMethods = [
     'keyManagerCreate',
+    'keyManagerGet',
     'keyManagerImport',
     'keyManagerSign',
     'keyManagerVerify',
     'keyManagerListKeys',
+    'keyManagerHandleExpirations',
 ];
 class SphereonKeyManager extends key_manager_1.KeyManager {
     constructor(options) {
@@ -29,12 +56,26 @@ class SphereonKeyManager extends key_manager_1.KeyManager {
         methods.keyManagerListKeys = this.keyManagerListKeys.bind(this);
         this.localMethods = methods;
     }
-    getAvailableKms(name) {
-        const kms = this.availableKMSes[name];
-        if (!kms) {
-            throw Error(`invalid_argument: This agent has no registered KeyManagementSystem with name='${name}'`);
-        }
-        return kms;
+    keyManagerCreate(args) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a, _b, _c, _d;
+            const kms = this.getKmsByName(args.kms);
+            const meta = Object.assign(Object.assign({}, args.meta), (args.opts && { opts: args.opts }));
+            if ((0, ISphereonKeyManager_1.hasKeyOptions)(meta) && ((_a = meta.opts) === null || _a === void 0 ? void 0 : _a.ephemeral) && !((_b = meta.opts.expiration) === null || _b === void 0 ? void 0 : _b.removalDate)) {
+                // Make sure we set a delete date on an ephemeral key
+                meta.opts = Object.assign(Object.assign({}, meta.opts), { expiration: Object.assign(Object.assign({}, (_c = meta.opts) === null || _c === void 0 ? void 0 : _c.expiration), { removalDate: new Date(Date.now() + 5 * 60 * 1000) }) });
+            }
+            const partialKey = yield kms.createKey({ type: args.type, meta });
+            const key = Object.assign(Object.assign({}, partialKey), { kms: args.kms });
+            key.meta = Object.assign(Object.assign({}, meta), key.meta);
+            key.meta.jwkThumbprint = (_d = key.meta.jwkThumbprint) !== null && _d !== void 0 ? _d : (0, ssi_sdk_ext_key_utils_1.calculateJwkThumbprintForKey)({ key });
+            yield this.localStore.import(key);
+            if (key.privateKeyHex) {
+                // Make sure to not export the private key
+                delete key.privateKeyHex;
+            }
+            return key;
+        });
     }
     //FIXME extend the IKeyManagerSignArgs.data to be a string or array of strings
     keyManagerSign(args) {
@@ -43,27 +84,83 @@ class SphereonKeyManager extends key_manager_1.KeyManager {
         });
         return __awaiter(this, void 0, void 0, function* () {
             const keyInfo = (yield this.localStore.get({ kid: args.keyRef }));
-            const kms = this.getAvailableKms(keyInfo.kms);
-            if (keyInfo.type === ssi_sdk_ext_kms_local_1.KeyType.Bls12381G2) {
+            const kms = this.getKmsByName(keyInfo.kms);
+            if (keyInfo.type === 'Bls12381G2') {
                 return yield kms.sign({ keyRef: keyInfo, data: Uint8Array.from(Buffer.from(args.data)) });
             }
-            // @ts-ignore
+            // @ts-ignore // we can pass in uint8arrays as well, which the super also can handle but does not expose in its types
             return yield _super.keyManagerSign.call(this, args);
         });
     }
     keyManagerVerify(args) {
         return __awaiter(this, void 0, void 0, function* () {
-            const kms = this.getAvailableKms(args.kms);
-            if (('verify' in kms && typeof kms.verify === 'function') || kms instanceof ssi_sdk_ext_kms_local_1.SphereonKeyManagementSystem) {
-                // @ts-ignore
-                return yield kms.verify(args);
+            if (args.kms) {
+                const kms = this.getKmsByName(args.kms);
+                if (kms && 'verify' in kms && typeof kms.verify === 'function') {
+                    // @ts-ignore
+                    return yield kms.verify(args);
+                }
             }
-            throw Error(`KMS ${kms} does not support verification`);
+            return yield (0, ssi_sdk_ext_key_utils_1.verifySignatureWithSubtle)({
+                key: (0, ssi_sdk_ext_key_utils_1.toJwk)(args.publicKeyHex, args.type),
+                data: args.data,
+                signature: u8a.fromString(args.signature, 'utf-8'),
+            });
         });
     }
     keyManagerListKeys() {
         return __awaiter(this, void 0, void 0, function* () {
-            return this.localStore.list({}); // FIXME there are no args it seems
+            return this.localStore.list({});
+        });
+    }
+    keyManagerHandleExpirations(args) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const keys = yield this.keyManagerListKeys();
+            const expiredKeys = keys
+                .filter((key) => (0, ISphereonKeyManager_1.hasKeyOptions)(key.meta))
+                .filter((key) => {
+                var _a, _b;
+                if ((0, ISphereonKeyManager_1.hasKeyOptions)(key.meta) && ((_b = (_a = key.meta) === null || _a === void 0 ? void 0 : _a.opts) === null || _b === void 0 ? void 0 : _b.expiration)) {
+                    const expiration = key.meta.opts.expiration;
+                    return !(expiration.expiryDate && expiration.expiryDate.getMilliseconds() > Date.now());
+                }
+                return false;
+            });
+            if (args.skipRemovals !== true) {
+                yield Promise.all(expiredKeys.map((key) => this.keyManagerDelete({ kid: key.kid })));
+            }
+            return keys;
+        });
+    }
+    getKmsByName(name) {
+        const kms = this.availableKMSes[name];
+        if (!kms) {
+            throw Error(`invalid_argument: This agent has no registered KeyManagementSystem with name='${name}'`);
+        }
+        return kms;
+    }
+    //todo https://sphereon.atlassian.net/browse/SDK-28 improve the logic for keyManagerGet in sphereon-key-manager
+    keyManagerGet(_a) {
+        return __awaiter(this, arguments, void 0, function* ({ kid }) {
+            try {
+                const key = yield this.localStore.get({ kid });
+                return key;
+            }
+            catch (e) {
+                const keys = yield this.keyManagerListKeys();
+                const foundKey = keys.find((key) => {
+                    var _a, _b;
+                    return key.publicKeyHex === kid ||
+                        ((_a = key.meta) === null || _a === void 0 ? void 0 : _a.jwkThumbprint) === kid ||
+                        (((_b = key.meta) === null || _b === void 0 ? void 0 : _b.jwkThumbprint) == null && (0, ssi_sdk_ext_key_utils_1.calculateJwkThumbprintForKey)({ key }) === kid);
+                });
+                if (foundKey) {
+                    return foundKey;
+                }
+                else {
+                    throw new Error(`Key with kid ${kid} not found`);
+                }
+            }
         });
     }
 }

package/dist/agent/SphereonKeyManager.js.map

@@ -1 +1 @@
-{"version":3,"file":"SphereonKeyManager.js","sourceRoot":"","sources":["../../src/agent/SphereonKeyManager.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,qDAAmH;AAGnH,2EAAsF;AAGzE,QAAA,yBAAyB,GAAkB;IACtD,kBAAkB;IAClB,kBAAkB;IAClB,gBAAgB;IAChB,kBAAkB;IAClB,oBAAoB;CACrB,CAAA;AAED,MAAa,kBAAmB,SAAQ,wBAAgB;IAKtD,YAAY,OAAsF;QAChG,KAAK,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAA;QACjD,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,KAAK,CAAA;QAC/B,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,GAAG,CAAA;QACjC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAA;QAC5B,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC3D,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC/D,IAAI,CAAC,YAAY,GAAkC,OAAQ,CAAA;IAC7D,CAAC;IAEO,eAAe,CAAC,IAAY;QAClC,MAAM,GAAG,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAA;QACrC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,KAAK,CAAC,iFAAiF,IAAI,GAAG,CAAC,CAAA;QACvG,CAAC;QACD,OAAO,GAAG,CAAA;IACZ,CAAC;IAED,8EAA8E;IACxE,cAAc,CAAC,IAAiC;;;;;YACpD,MAAM,OAAO,GAAS,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAS,CAAA;YAC/E,MAAM,GAAG,GAAG,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;YAC7C,IAAI,OAAO,CAAC,IAAI,KAAe,+BAAO,CAAC,UAAU,EAAE,CAAC;gBAClD,OAAO,MAAM,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAA;YAC3F,CAAC;YACD,aAAa;YACb,OAAO,MAAM,OAAM,cAAc,YAAC,IAAI,CAAC,CAAA;QACzC,CAAC;KAAA;IAEK,gBAAgB,CAAC,IAAmC;;YACxD,MAAM,GAAG,GAAG,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YAC1C,IAAI,CAAC,QAAQ,IAAI,GAAG,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,UAAU,CAAC,IAAI,GAAG,YAAY,mDAA2B,EAAE,CAAC;gBACxG,aAAa;gBACb,OAAO,MAAM,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;YAC/B,CAAC;YACD,MAAM,KAAK,CAAC,OAAO,GAAG,gCAAgC,CAAC,CAAA;QACzD,CAAC;KAAA;IAEK,kBAAkB;;YACtB,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA,CAAC,mCAAmC;QACrE,CAAC;KAAA;CACF;AA9CD,gDA8CC"}
+{"version":3,"file":"SphereonKeyManager.js","sourceRoot":"","sources":["../../src/agent/SphereonKeyManager.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2EAAgH;AAEhH,qDAAmH;AACnH,sEAQqC;AAErC,iDAAkC;AAErB,QAAA,yBAAyB,GAAkB;IACtD,kBAAkB;IAClB,eAAe;IACf,kBAAkB;IAClB,gBAAgB;IAChB,kBAAkB;IAClB,oBAAoB;IACpB,6BAA6B;CAC9B,CAAA;AAED,MAAa,kBAAmB,SAAQ,wBAAgB;IAMtD,YAAY,OAAsF;QAChG,KAAK,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAA;QACjD,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,KAAK,CAAA;QAC/B,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,GAAG,CAAA;QACjC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAA;QAC5B,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC3D,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC/D,IAAI,CAAC,YAAY,GAAkC,OAAQ,CAAA;IAC7D,CAAC;IAEc,gBAAgB,CAAC,IAAmC;;;YACjE,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YACvC,MAAM,IAAI,mCAAqB,IAAI,CAAC,IAAI,GAAK,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAE,CAAA;YACjF,IAAI,IAAA,mCAAa,EAAC,IAAI,CAAC,KAAI,MAAA,IAAI,CAAC,IAAI,0CAAE,SAAS,CAAA,IAAI,CAAC,CAAA,MAAA,IAAI,CAAC,IAAI,CAAC,UAAU,0CAAE,WAAW,CAAA,EAAE,CAAC;gBACtF,qDAAqD;gBACrD,IAAI,CAAC,IAAI,mCACJ,IAAI,CAAC,IAAI,KACZ,UAAU,kCAAO,MAAA,IAAI,CAAC,IAAI,0CAAE,UAAU,KAAE,WAAW,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,MAC1F,CAAA;YACH,CAAC;YACD,MAAM,UAAU,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;YACjE,MAAM,GAAG,mCAAc,UAAU,KAAE,GAAG,EAAE,IAAI,CAAC,GAAG,GAAE,CAAA;YAClD,GAAG,CAAC,IAAI,mCAAQ,IAAI,GAAK,GAAG,CAAC,IAAI,CAAE,CAAA;YACnC,GAAG,CAAC,IAAI,CAAC,aAAa,GAAG,MAAA,GAAG,CAAC,IAAI,CAAC,aAAa,mCAAI,IAAA,oDAA4B,EAAC,EAAE,GAAG,EAAE,CAAC,CAAA;YAExF,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;YACjC,IAAI,GAAG,CAAC,aAAa,EAAE,CAAC;gBACtB,0CAA0C;gBAC1C,OAAO,GAAG,CAAC,aAAa,CAAA;YAC1B,CAAC;YACD,OAAO,GAAG,CAAA;QACZ,CAAC;KAAA;IAED,8EAA8E;IAExE,cAAc,CAAC,IAAiC;;;;;YACpD,MAAM,OAAO,GAAS,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAS,CAAA;YAC/E,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;YAC1C,IAAI,OAAO,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBAClC,OAAO,MAAM,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAA;YAC3F,CAAC;YACD,qHAAqH;YACrH,OAAO,MAAM,OAAM,cAAc,YAAC,IAAI,CAAC,CAAA;QACzC,CAAC;KAAA;IAEK,gBAAgB,CAAC,IAAmC;;YACxD,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;gBACb,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;gBACvC,IAAI,GAAG,IAAI,QAAQ,IAAI,GAAG,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;oBAC/D,aAAa;oBACb,OAAO,MAAM,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;gBAC/B,CAAC;YACH,CAAC;YACD,OAAO,MAAM,IAAA,iDAAyB,EAAC;gBACrC,GAAG,EAAE,IAAA,6BAAK,EAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,IAAI,CAAC;gBACxC,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,SAAS,EAAE,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC;aACnD,CAAC,CAAA;QACJ,CAAC;KAAA;IAEK,kBAAkB;;YACtB,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QACjC,CAAC;KAAA;IAEK,2BAA2B,CAAC,IAA8C;;YAC9E,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,kBAAkB,EAAE,CAAA;YAC5C,MAAM,WAAW,GAAG,IAAI;iBACrB,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAA,mCAAa,EAAC,GAAG,CAAC,IAAI,CAAC,CAAC;iBACxC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE;;gBACd,IAAI,IAAA,mCAAa,EAAC,GAAG,CAAC,IAAI,CAAC,KAAI,MAAA,MAAA,GAAG,CAAC,IAAI,0CAAE,IAAI,0CAAE,UAAU,CAAA,EAAE,CAAC;oBAC1D,MAAM,UAAU,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAA;oBAC3C,OAAO,CAAC,CAAC,UAAU,CAAC,UAAU,IAAI,UAAU,CAAC,UAAU,CAAC,eAAe,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAA;gBACzF,CAAC;gBACD,OAAO,KAAK,CAAA;YACd,CAAC,CAAC,CAAA;YACJ,IAAI,IAAI,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;gBAC/B,MAAM,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAA;YACtF,CAAC;YACD,OAAO,IAAI,CAAA;QACb,CAAC;KAAA;IAEO,YAAY,CAAC,IAAY;QAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAA;QACrC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,KAAK,CAAC,iFAAiF,IAAI,GAAG,CAAC,CAAA;QACvG,CAAC;QACD,OAAO,GAAG,CAAA;IACZ,CAAC;IAED,+GAA+G;IACzG,aAAa;6DAAC,EAAE,GAAG,EAAsB;YAC7C,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,CAAC,CAAA;gBAC9C,OAAO,GAAG,CAAA;YACZ,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,MAAM,IAAI,GAAqB,MAAM,IAAI,CAAC,kBAAkB,EAAE,CAAA;gBAC9D,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CACxB,CAAC,GAAG,EAAE,EAAE;;oBACN,OAAA,GAAG,CAAC,YAAY,KAAK,GAAG;wBACxB,CAAA,MAAA,GAAG,CAAC,IAAI,0CAAE,aAAa,MAAK,GAAG;wBAC/B,CAAC,CAAA,MAAA,GAAG,CAAC,IAAI,0CAAE,aAAa,KAAI,IAAI,IAAI,IAAA,oDAA4B,EAAC,EAAE,GAAG,EAAE,CAAC,KAAK,GAAG,CAAC,CAAA;iBAAA,CACrF,CAAA;gBACD,IAAI,QAAQ,EAAE,CAAC;oBACb,OAAO,QAAgB,CAAA;gBACzB,CAAC;qBAAM,CAAC;oBACN,MAAM,IAAI,KAAK,CAAC,gBAAgB,GAAG,YAAY,CAAC,CAAA;gBAClD,CAAC;YACH,CAAC;QACH,CAAC;KAAA;CACF;AAnHD,gDAmHC"}

package/dist/ssi-sdk-ext.key-manager.d.ts

@@ -1,5 +1,6 @@
 import { AbstractKeyManagementSystem } from '@veramo/key-manager';
 import { AbstractKeyStore } from '@veramo/key-manager';
+import { IKey } from '@veramo/core';
 import { IKeyManager } from '@veramo/core';
 import { IKeyManagerSignArgs } from '@veramo/core';
 import { IPluginMethodMap } from '@veramo/core';
@@ -9,24 +10,9 @@ import { ManagedKeyInfo } from '@veramo/core';
 import { MinimalImportableKey } from '@veramo/core';
 import { TKeyType } from '@veramo/core';
 
-/**
- * Input arguments for {@link ISphereonKeyManager.keyManagerCreate | keyManagerCreate}
- * @public
- */
-export declare interface IKeyManagerCreateArgs {
-    /**
-     * Key type
-     */
-    type: TKeyType;
-    /**
-     * Key Management System
-     */
-    kms: string;
-    /**
-     * Optional. Key meta data
-     */
-    meta?: KeyMetadata;
-}
+export declare function hasKeyOptions(object: any): object is {
+    opts?: IkeyOptions;
+};
 
 /**
  * Input arguments for {@link ISphereonKeyManager.keyManagerDelete | keyManagerDelete}
@@ -50,8 +36,24 @@ export declare interface IKeyManagerGetArgs {
     kid: string;
 }
 
+export declare interface IkeyOptions {
+    /**
+     * Is this a temporary key?
+     */
+    ephemeral?: boolean;
+    /**
+     * Expiration and remove the key
+     */
+    expiration?: {
+        expiryDate?: Date;
+        removalDate?: Date;
+    };
+}
+
+export declare const isDefined: <T extends unknown>(object: T | undefined) => object is T;
+
 export declare interface ISphereonKeyManager extends IKeyManager, IPluginMethodMap {
-    keyManagerCreate(args: IKeyManagerCreateArgs): Promise<PartialKey>;
+    keyManagerCreate(args: ISphereonKeyManagerCreateArgs): Promise<PartialKey>;
     keyManagerImport(key: MinimalImportableKey): Promise<PartialKey>;
     keyManagerSign(args: ISphereonKeyManagerSignArgs): Promise<string>;
     /**
@@ -62,6 +64,38 @@ export declare interface ISphereonKeyManager extends IKeyManager, IPluginMethodM
      */
     keyManagerVerify(args: ISphereonKeyManagerVerifyArgs): Promise<boolean>;
     keyManagerListKeys(): Promise<Array<ManagedKeyInfo>>;
+    /**
+     * Set keys to expired and remove keys eligible for deletion.
+     * @param args
+     */
+    keyManagerHandleExpirations(args: ISphereonKeyManagerHandleExpirationsArgs): Promise<Array<ManagedKeyInfo>>;
+}
+
+/**
+ * Input arguments for {@link ISphereonKeyManager.keyManagerCreate | keyManagerCreate}
+ * @public
+ */
+export declare interface ISphereonKeyManagerCreateArgs {
+    /**
+     * Key type
+     */
+    type: TKeyType;
+    /**
+     * Key Management System
+     */
+    kms: string;
+    /**
+     * Key options
+     */
+    opts?: IkeyOptions;
+    /**
+     * Optional. Key meta data
+     */
+    meta?: KeyMetadata;
+}
+
+export declare interface ISphereonKeyManagerHandleExpirationsArgs {
+    skipRemovals?: boolean;
 }
 
 /**
@@ -76,7 +110,7 @@ export declare interface ISphereonKeyManagerSignArgs extends IKeyManagerSignArgs
 }
 
 export declare interface ISphereonKeyManagerVerifyArgs {
-    kms: string;
+    kms?: string;
     publicKeyHex: string;
     type: TKeyType;
     algorithm?: string;
@@ -98,10 +132,13 @@ export declare class SphereonKeyManager extends KeyManager {
         store: AbstractKeyStore;
         kms: Record<string, AbstractKeyManagementSystem>;
     });
-    private getAvailableKms;
+    keyManagerCreate(args: ISphereonKeyManagerCreateArgs): Promise<ManagedKeyInfo>;
     keyManagerSign(args: ISphereonKeyManagerSignArgs): Promise<string>;
     keyManagerVerify(args: ISphereonKeyManagerVerifyArgs): Promise<boolean>;
     keyManagerListKeys(): Promise<ManagedKeyInfo[]>;
+    keyManagerHandleExpirations(args: ISphereonKeyManagerHandleExpirationsArgs): Promise<Array<ManagedKeyInfo>>;
+    private getKmsByName;
+    keyManagerGet({ kid }: IKeyManagerGetArgs): Promise<IKey>;
 }
 
 export declare const sphereonKeyManagerMethods: Array<string>;

package/dist/tsdoc-metadata.json

@@ -5,7 +5,7 @@
   "toolPackages": [
     {
       "packageName": "@microsoft/api-extractor",
-      "packageVersion": "7.47.3"
+      "packageVersion": "7.47.5"
     }
   ]
 }

package/dist/types/ISphereonKeyManager.d.ts

@@ -4,7 +4,7 @@ export type PartialKey = ManagedKeyInfo & {
     privateKeyHex: string;
 };
 export interface ISphereonKeyManager extends IKeyManager, IPluginMethodMap {
-    keyManagerCreate(args: IKeyManagerCreateArgs): Promise<PartialKey>;
+    keyManagerCreate(args: ISphereonKeyManagerCreateArgs): Promise<PartialKey>;
     keyManagerImport(key: MinimalImportableKey): Promise<PartialKey>;
     keyManagerSign(args: ISphereonKeyManagerSignArgs): Promise<string>;
     /**
@@ -15,12 +15,30 @@ export interface ISphereonKeyManager extends IKeyManager, IPluginMethodMap {
      */
     keyManagerVerify(args: ISphereonKeyManagerVerifyArgs): Promise<boolean>;
     keyManagerListKeys(): Promise<Array<ManagedKeyInfo>>;
+    /**
+     * Set keys to expired and remove keys eligible for deletion.
+     * @param args
+     */
+    keyManagerHandleExpirations(args: ISphereonKeyManagerHandleExpirationsArgs): Promise<Array<ManagedKeyInfo>>;
+}
+export interface IkeyOptions {
+    /**
+     * Is this a temporary key?
+     */
+    ephemeral?: boolean;
+    /**
+     * Expiration and remove the key
+     */
+    expiration?: {
+        expiryDate?: Date;
+        removalDate?: Date;
+    };
 }
 /**
  * Input arguments for {@link ISphereonKeyManager.keyManagerCreate | keyManagerCreate}
  * @public
  */
-export interface IKeyManagerCreateArgs {
+export interface ISphereonKeyManagerCreateArgs {
     /**
      * Key type
      */
@@ -29,11 +47,18 @@ export interface IKeyManagerCreateArgs {
      * Key Management System
      */
     kms: string;
+    /**
+     * Key options
+     */
+    opts?: IkeyOptions;
     /**
      * Optional. Key meta data
      */
     meta?: KeyMetadata;
 }
+export declare function hasKeyOptions(object: any): object is {
+    opts?: IkeyOptions;
+};
 /**
  * Input arguments for {@link ISphereonKeyManager.keyManagerGet | keyManagerGet}
  * @public
@@ -64,12 +89,16 @@ export interface ISphereonKeyManagerSignArgs extends IKeyManagerSignArgs {
      */
     data: string | Uint8Array;
 }
+export interface ISphereonKeyManagerHandleExpirationsArgs {
+    skipRemovals?: boolean;
+}
 export interface ISphereonKeyManagerVerifyArgs {
-    kms: string;
+    kms?: string;
     publicKeyHex: string;
     type: TKeyType;
     algorithm?: string;
     data: Uint8Array;
     signature: string;
 }
+export declare const isDefined: <T extends unknown>(object: T | undefined) => object is T;
 //# sourceMappingURL=ISphereonKeyManager.d.ts.map

package/dist/types/ISphereonKeyManager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ISphereonKeyManager.d.ts","sourceRoot":"","sources":["../../src/types/ISphereonKeyManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,oBAAoB,EAAE,QAAQ,EAAE,mBAAmB,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAC9H,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAE7C,MAAM,MAAM,UAAU,GAAG,cAAc,GAAG;IAAE,aAAa,EAAE,MAAM,CAAA;CAAE,CAAA;AAEnE,MAAM,WAAW,mBAAoB,SAAQ,WAAW,EAAE,gBAAgB;IACxE,gBAAgB,CAAC,IAAI,EAAE,qBAAqB,GAAG,OAAO,CAAC,UAAU,CAAC,CAAA;IAElE,gBAAgB,CAAC,GAAG,EAAE,oBAAoB,GAAG,OAAO,CAAC,UAAU,CAAC,CAAA;IAEhE,cAAc,CAAC,IAAI,EAAE,2BAA2B,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IAElE;;;;;OAKG;IACH,gBAAgB,CAAC,IAAI,EAAE,6BAA6B,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAEvE,kBAAkB,IAAI,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAA;CACrD;AAED;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC;;OAEG;IACH,IAAI,EAAE,QAAQ,CAAA;IAEd;;OAEG;IACH,GAAG,EAAE,MAAM,CAAA;IAEX;;OAEG;IACH,IAAI,CAAC,EAAE,WAAW,CAAA;CACnB;AAED;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC;;OAEG;IACH,GAAG,EAAE,MAAM,CAAA;CACZ;AAED;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC;;OAEG;IACH,GAAG,EAAE,MAAM,CAAA;CACZ;AAED;;;GAGG;AAEH,MAAM,WAAW,2BAA4B,SAAQ,mBAAmB;IACtE;;OAEG;IACH,IAAI,EAAE,MAAM,GAAG,UAAU,CAAA;CAC1B;AAED,MAAM,WAAW,6BAA6B;IAC5C,GAAG,EAAE,MAAM,CAAA;IACX,YAAY,EAAE,MAAM,CAAA;IACpB,IAAI,EAAE,QAAQ,CAAA;IACd,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,IAAI,EAAE,UAAU,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;CAClB"}
+{"version":3,"file":"ISphereonKeyManager.d.ts","sourceRoot":"","sources":["../../src/types/ISphereonKeyManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,oBAAoB,EAAE,QAAQ,EAAE,mBAAmB,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAC9H,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAE7C,MAAM,MAAM,UAAU,GAAG,cAAc,GAAG;IAAE,aAAa,EAAE,MAAM,CAAA;CAAE,CAAA;AAEnE,MAAM,WAAW,mBAAoB,SAAQ,WAAW,EAAE,gBAAgB;IACxE,gBAAgB,CAAC,IAAI,EAAE,6BAA6B,GAAG,OAAO,CAAC,UAAU,CAAC,CAAA;IAE1E,gBAAgB,CAAC,GAAG,EAAE,oBAAoB,GAAG,OAAO,CAAC,UAAU,CAAC,CAAA;IAEhE,cAAc,CAAC,IAAI,EAAE,2BAA2B,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IAElE;;;;;OAKG;IACH,gBAAgB,CAAC,IAAI,EAAE,6BAA6B,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAEvE,kBAAkB,IAAI,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAA;IAEpD;;;OAGG;IACH,2BAA2B,CAAC,IAAI,EAAE,wCAAwC,GAAG,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAA;CAC5G;AAED,MAAM,WAAW,WAAW;IAC1B;;OAEG;IACH,SAAS,CAAC,EAAE,OAAO,CAAA;IAEnB;;OAEG;IACH,UAAU,CAAC,EAAE;QACX,UAAU,CAAC,EAAE,IAAI,CAAA;QACjB,WAAW,CAAC,EAAE,IAAI,CAAA;KACnB,CAAA;CACF;AAED;;;GAGG;AACH,MAAM,WAAW,6BAA6B;IAC5C;;OAEG;IACH,IAAI,EAAE,QAAQ,CAAA;IAEd;;OAEG;IACH,GAAG,EAAE,MAAM,CAAA;IAEX;;OAEG;IACH,IAAI,CAAC,EAAE,WAAW,CAAA;IAElB;;OAEG;IACH,IAAI,CAAC,EAAE,WAAW,CAAA;CACnB;AAED,wBAAgB,aAAa,CAAC,MAAM,EAAE,GAAG,GAAG,MAAM,IAAI;IAAE,IAAI,CAAC,EAAE,WAAW,CAAA;CAAE,CAE3E;AAED;;;GAGG;AACH,MAAM,WAAW,kBAAkB;IACjC;;OAEG;IACH,GAAG,EAAE,MAAM,CAAA;CACZ;AAED;;;GAGG;AACH,MAAM,WAAW,qBAAqB;IACpC;;OAEG;IACH,GAAG,EAAE,MAAM,CAAA;CACZ;AAED;;;GAGG;AAEH,MAAM,WAAW,2BAA4B,SAAQ,mBAAmB;IACtE;;OAEG;IACH,IAAI,EAAE,MAAM,GAAG,UAAU,CAAA;CAC1B;AAED,MAAM,WAAW,wCAAwC;IACvD,YAAY,CAAC,EAAE,OAAO,CAAA;CACvB;AAED,MAAM,WAAW,6BAA6B;IAC5C,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,YAAY,EAAE,MAAM,CAAA;IACpB,IAAI,EAAE,QAAQ,CAAA;IACd,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,IAAI,EAAE,UAAU,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,eAAO,MAAM,SAAS,8BAA+B,CAAC,GAAG,SAAS,gBAAsC,CAAA"}

package/dist/types/ISphereonKeyManager.js

@@ -1,3 +1,10 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.isDefined = exports.hasKeyOptions = void 0;
+function hasKeyOptions(object) {
+    return object && 'opts' in object && ('ephemeral' in object.opts || 'expiration' in object.opts);
+}
+exports.hasKeyOptions = hasKeyOptions;
+const isDefined = (object) => object !== undefined;
+exports.isDefined = isDefined;
 //# sourceMappingURL=ISphereonKeyManager.js.map

package/dist/types/ISphereonKeyManager.js.map

@@ -1 +1 @@
-{"version":3,"file":"ISphereonKeyManager.js","sourceRoot":"","sources":["../../src/types/ISphereonKeyManager.ts"],"names":[],"mappings":""}
+{"version":3,"file":"ISphereonKeyManager.js","sourceRoot":"","sources":["../../src/types/ISphereonKeyManager.ts"],"names":[],"mappings":";;;AAsEA,SAAgB,aAAa,CAAC,MAAW;IACvC,OAAO,MAAQ,IAAI,MAAM,IAAI,MAAM,IAAI,CAAC,WAAW,IAAI,MAAM,CAAC,IAAI,IAAI,YAAY,IAAI,MAAM,CAAC,IAAI,CAAC,CAAA;AACpG,CAAC;AAFD,sCAEC;AAiDM,MAAM,SAAS,GAAG,CAAoB,MAAqB,EAAe,EAAE,CAAC,MAAM,KAAK,SAAS,CAAA;AAA3F,QAAA,SAAS,aAAkF"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@sphereon/ssi-sdk-ext.key-manager",
   "description": "Sphereon Key Manager plugin with BLS support",
-  "version": "0.24.1-unstable.10+61bd444",
+  "version": "0.24.1-unstable.112+bb5e9a0",
   "source": "src/index.ts",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -15,14 +15,15 @@
     "generate-plugin-schema": "sphereon dev generate-plugin-schema"
   },
   "dependencies": {
-    "@sphereon/ssi-sdk-ext.kms-local": "0.24.1-unstable.10+61bd444",
     "@veramo/core": "4.2.0",
-    "@veramo/key-manager": "4.2.0"
+    "@veramo/key-manager": "4.2.0",
+    "uint8arrays": "^3.1.1"
   },
   "devDependencies": {
     "@mattrglobal/bbs-signatures": "^1.3.1",
-    "@sphereon/ssi-sdk-ext.key-utils": "0.24.1-unstable.10+61bd444",
-    "@sphereon/ssi-sdk.dev": "0.28.0"
+    "@sphereon/ssi-sdk-ext.key-utils": "0.24.1-unstable.112+bb5e9a0",
+    "@sphereon/ssi-sdk-ext.kms-local": "0.24.1-unstable.112+bb5e9a0",
+    "@sphereon/ssi-sdk.dev": "0.29.1-unstable.161"
   },
   "resolutions": {
     "jsonld": "npm:@digitalcredentials/jsonld@^5.2.1",
@@ -38,7 +39,7 @@
   "publishConfig": {
     "access": "public"
   },
-  "repository": "git@github.com:Sphereon-Opensource/SSI-SDK.git",
+  "repository": "git@github.com:Sphereon-OpenSource/SSI-SDK-crypto-extensions.git",
   "author": "Sphereon <dev@sphereon.com>",
   "license": "Apache-2.0",
   "keywords": [
@@ -46,5 +47,5 @@
     "kms",
     "Veramo"
   ],
-  "gitHead": "61bd4445b8a7e3da5bac0412d4359d9bf66df50c"
+  "gitHead": "bb5e9a06dffdec576f98d957d26dc0f4d1e9cca2"
 }

package/plugin.schema.json

@@ -2,7 +2,7 @@
   "ISphereonKeyManager": {
     "components": {
       "schemas": {
-        "IKeyManagerCreateArgs": {
+        "ISphereonKeyManagerCreateArgs": {
           "type": "object",
           "properties": {
             "type": {
@@ -13,6 +13,10 @@
               "type": "string",
               "description": "Key Management System"
             },
+            "opts": {
+              "$ref": "#/components/schemas/IkeyOptions",
+              "description": "Key options"
+            },
             "meta": {
               "$ref": "#/components/schemas/KeyMetadata",
               "description": "Optional. Key meta data"
@@ -37,6 +41,29 @@
           ],
           "description": "Cryptographic key type."
         },
+        "IkeyOptions": {
+          "type": "object",
+          "properties": {
+            "ephemeral": {
+              "type": "boolean",
+              "description": "Is this a temporary key?"
+            },
+            "expiration": {
+              "type": "object",
+              "properties": {
+                "expiryDate": {
+                  "type": "string",
+                  "format": "date-time"
+                },
+                "removalDate": {
+                  "type": "string",
+                  "format": "date-time"
+                }
+              },
+              "description": "Expiration and remove the key"
+            }
+          }
+        },
         "KeyMetadata": {
           "type": "object",
           "properties": {
@@ -91,11 +118,15 @@
             "type"
           ]
         },
-        "MinimalImportableKey": {
-          "$ref": "#/components/schemas/RequireOnly<IKey,(\"privateKeyHex\"|\"type\"|\"kms\")>",
-          "description": "Represents the properties required to import a key."
+        "ISphereonKeyManagerHandleExpirationsArgs": {
+          "type": "object",
+          "properties": {
+            "skipRemovals": {
+              "type": "boolean"
+            }
+          }
         },
-        "RequireOnly<IKey,(\"privateKeyHex\"|\"type\"|\"kms\")>": {
+        "ManagedKeyInfo": {
           "type": "object",
           "properties": {
             "kid": {
@@ -114,10 +145,6 @@
               "type": "string",
               "description": "Public key"
             },
-            "privateKeyHex": {
-              "type": "string",
-              "description": "Optional. Private key"
-            },
             "meta": {
               "anyOf": [
                 {
@@ -130,9 +157,19 @@
               "description": "Optional. Key metadata. This should be used to determine which algorithms are supported."
             }
           },
-          "description": "Represents an object type where a subset of keys are required and everything else is optional."
+          "required": [
+            "kid",
+            "kms",
+            "type",
+            "publicKeyHex"
+          ],
+          "description": "Represents information about a managed key. Private or secret key material is NOT present."
         },
-        "ManagedKeyInfo": {
+        "MinimalImportableKey": {
+          "$ref": "#/components/schemas/RequireOnly<IKey,(\"privateKeyHex\"|\"type\"|\"kms\")>",
+          "description": "Represents the properties required to import a key."
+        },
+        "RequireOnly<IKey,(\"privateKeyHex\"|\"type\"|\"kms\")>": {
           "type": "object",
           "properties": {
             "kid": {
@@ -151,6 +188,10 @@
               "type": "string",
               "description": "Public key"
             },
+            "privateKeyHex": {
+              "type": "string",
+              "description": "Optional. Private key"
+            },
             "meta": {
               "anyOf": [
                 {
@@ -163,13 +204,7 @@
               "description": "Optional. Key metadata. This should be used to determine which algorithms are supported."
             }
           },
-          "required": [
-            "kid",
-            "kms",
-            "type",
-            "publicKeyHex"
-          ],
-          "description": "Represents information about a managed key. Private or secret key material is NOT present."
+          "description": "Represents an object type where a subset of keys are required and everything else is optional."
         },
         "ISphereonKeyManagerSignArgs": {
           "type": "object",
@@ -313,7 +348,6 @@
             }
           },
           "required": [
-            "kms",
             "publicKeyHex",
             "type",
             "data",
@@ -325,12 +359,24 @@
         "keyManagerCreate": {
           "description": "",
           "arguments": {
-            "$ref": "#/components/schemas/IKeyManagerCreateArgs"
+            "$ref": "#/components/schemas/ISphereonKeyManagerCreateArgs"
           },
           "returnType": {
             "$ref": "#/components/schemas/PartialKey"
           }
         },
+        "keyManagerHandleExpirations": {
+          "description": "Set keys to expired and remove keys eligible for deletion.",
+          "arguments": {
+            "$ref": "#/components/schemas/ISphereonKeyManagerHandleExpirationsArgs"
+          },
+          "returnType": {
+            "type": "array",
+            "items": {
+              "$ref": "#/components/schemas/ManagedKeyInfo"
+            }
+          }
+        },
         "keyManagerImport": {
           "description": "",
           "arguments": {

package/src/__tests__/SphereonKeyManager.test.ts

@@ -0,0 +1,72 @@
+import { SphereonKeyManager } from '../agent/SphereonKeyManager'
+import { MemoryKeyStore, MemoryPrivateKeyStore } from '@veramo/key-manager'
+import { SphereonKeyManagementSystem } from '@sphereon/ssi-sdk-ext.kms-local'
+
+describe('@sphereon/ssi-sdk-ext.key-manager key functionalities', () => {
+  const kms = new SphereonKeyManager({
+    store: new MemoryKeyStore(),
+    kms: {
+      local: new SphereonKeyManagementSystem(new MemoryPrivateKeyStore()),
+    },
+  })
+
+  it('should create and fetch a RSA key', async () => {
+    const key = await kms.keyManagerCreate({ type: 'RSA', kms: 'local' })
+    const fetchByKid = await kms.keyManagerGet({ kid: key.kid })
+    expect(fetchByKid.kid).toEqual(key.kid)
+    expect(fetchByKid.publicKeyHex).toEqual(key.publicKeyHex)
+    expect(fetchByKid?.meta?.publicKeyJwk).toBeDefined()
+    expect(fetchByKid?.meta?.publicKeyPEM).toBeDefined()
+    expect(fetchByKid.type).toEqual('RSA')
+    const fetchByPublicKeyHex = await kms.keyManagerGet({ kid: key.publicKeyHex })
+    expect(fetchByPublicKeyHex.kid).toEqual(key.kid)
+    expect(fetchByPublicKeyHex?.meta?.publicKeyJwk).toBeDefined()
+    expect(fetchByPublicKeyHex?.meta?.publicKeyPEM).toBeDefined()
+    const deleteByPublicKeyHex = await kms.keyManagerDelete({ kid: key.publicKeyHex })
+    expect(deleteByPublicKeyHex).toBeTruthy()
+  })
+
+  it('should create and fetch a X25519 key', async () => {
+    const key = await kms.keyManagerCreate({ type: 'X25519', kms: 'local' })
+    const fetchByKid = await kms.keyManagerGet({ kid: key.kid })
+    expect(fetchByKid.type).toEqual('X25519')
+    expect(fetchByKid.kid).toEqual(key.kid)
+    expect(fetchByKid.publicKeyHex).toEqual(key.publicKeyHex)
+  })
+
+  it('should create and fetch a Ed25519 key', async () => {
+    const key = await kms.keyManagerCreate({ type: 'Ed25519', kms: 'local' })
+    const fetchByKid = await kms.keyManagerGet({ kid: key.kid })
+    expect(fetchByKid.type).toEqual('Ed25519')
+    expect(fetchByKid.kid).toEqual(key.kid)
+    expect(fetchByKid.publicKeyHex).toEqual(key.publicKeyHex)
+    const fetchByPublicKeyHex = await kms.keyManagerGet({ kid: key.publicKeyHex })
+    expect(fetchByPublicKeyHex.kid).toEqual(key.kid)
+  })
+
+  it('should create and fetch a Secp256k1 key', async () => {
+    const key = await kms.keyManagerCreate({ type: 'Secp256k1', kms: 'local' })
+    const fetchByKid = await kms.keyManagerGet({ kid: key.kid })
+    expect(fetchByKid.type).toEqual('Secp256k1')
+    expect(fetchByKid.kid).toEqual(key.kid)
+    expect(fetchByKid.publicKeyHex).toEqual(key.publicKeyHex)
+    expect(fetchByKid?.meta?.algorithms).toEqual(['ES256K', 'ES256K-R', 'eth_signTransaction', 'eth_signTypedData', 'eth_signMessage', 'eth_rawSign'])
+    const fetchByPublicKeyHex = await kms.keyManagerGet({ kid: key.publicKeyHex })
+    expect(fetchByPublicKeyHex.kid).toEqual(key.kid)
+    const fetchByThumbprint = await kms.keyManagerGet({ kid: key?.meta?.jwkThumbprint })
+    expect(fetchByThumbprint.kid).toEqual(fetchByThumbprint.kid)
+  })
+
+  it('should create and fetch a Secp256r1 key', async () => {
+    const key = await kms.keyManagerCreate({ type: 'Secp256r1', kms: 'local' })
+    const fetchByKid = await kms.keyManagerGet({ kid: key.kid })
+    expect(fetchByKid.kid).toEqual(key.kid)
+    expect(fetchByKid.type).toEqual('Secp256r1')
+    expect(fetchByKid.publicKeyHex).toEqual(key.publicKeyHex)
+    expect(fetchByKid?.meta?.algorithms).toEqual(['ES256'])
+    const fetchByPublicKeyHex = await kms.keyManagerGet({ kid: key.publicKeyHex })
+    expect(fetchByPublicKeyHex.kid).toEqual(key.kid)
+    const fetchByThumbprint = await kms.keyManagerGet({ kid: key?.meta?.jwkThumbprint })
+    expect(fetchByThumbprint.kid).toEqual(fetchByThumbprint.kid)
+  })
+})

package/src/agent/SphereonKeyManager.ts

@@ -1,18 +1,30 @@
-import { KeyManager as VeramoKeyManager, AbstractKeyManagementSystem, AbstractKeyStore } from '@veramo/key-manager'
+import { calculateJwkThumbprintForKey, toJwk, verifySignatureWithSubtle } from '@sphereon/ssi-sdk-ext.key-utils'
+import { IKey, KeyMetadata, ManagedKeyInfo } from '@veramo/core'
+import { AbstractKeyManagementSystem, AbstractKeyStore, KeyManager as VeramoKeyManager } from '@veramo/key-manager'
+import {
+  hasKeyOptions,
+  IKeyManagerGetArgs,
+  ISphereonKeyManager,
+  ISphereonKeyManagerCreateArgs,
+  ISphereonKeyManagerHandleExpirationsArgs,
+  ISphereonKeyManagerSignArgs,
+  ISphereonKeyManagerVerifyArgs,
+} from '../types/ISphereonKeyManager'
 
-import { IKey, ManagedKeyInfo, TKeyType } from '@veramo/core'
-import { KeyType, SphereonKeyManagementSystem } from '@sphereon/ssi-sdk-ext.kms-local'
-import { ISphereonKeyManager, ISphereonKeyManagerSignArgs, ISphereonKeyManagerVerifyArgs } from '../types/ISphereonKeyManager'
+import * as u8a from 'uint8arrays'
 
 export const sphereonKeyManagerMethods: Array<string> = [
   'keyManagerCreate',
+  'keyManagerGet',
   'keyManagerImport',
   'keyManagerSign',
   'keyManagerVerify',
   'keyManagerListKeys',
+  'keyManagerHandleExpirations',
 ]
 
 export class SphereonKeyManager extends VeramoKeyManager {
+  // local store reference, given the superclass store is private, and we need additional functions/calls
   private localStore: AbstractKeyStore
   private readonly availableKMSes: Record<string, AbstractKeyManagementSystem>
   readonly localMethods: ISphereonKeyManager
@@ -27,35 +39,103 @@ export class SphereonKeyManager extends VeramoKeyManager {
     this.localMethods = <ISphereonKeyManager>(<unknown>methods)
   }
 
-  private getAvailableKms(name: string): AbstractKeyManagementSystem {
-    const kms = this.availableKMSes[name]
-    if (!kms) {
-      throw Error(`invalid_argument: This agent has no registered KeyManagementSystem with name='${name}'`)
+  override async keyManagerCreate(args: ISphereonKeyManagerCreateArgs): Promise<ManagedKeyInfo> {
+    const kms = this.getKmsByName(args.kms)
+    const meta: KeyMetadata = { ...args.meta, ...(args.opts && { opts: args.opts }) }
+    if (hasKeyOptions(meta) && meta.opts?.ephemeral && !meta.opts.expiration?.removalDate) {
+      // Make sure we set a delete date on an ephemeral key
+      meta.opts = {
+        ...meta.opts,
+        expiration: { ...meta.opts?.expiration, removalDate: new Date(Date.now() + 5 * 60 * 1000) },
+      }
     }
-    return kms
+    const partialKey = await kms.createKey({ type: args.type, meta })
+    const key: IKey = { ...partialKey, kms: args.kms }
+    key.meta = { ...meta, ...key.meta }
+    key.meta.jwkThumbprint = key.meta.jwkThumbprint ?? calculateJwkThumbprintForKey({ key })
+
+    await this.localStore.import(key)
+    if (key.privateKeyHex) {
+      // Make sure to not export the private key
+      delete key.privateKeyHex
+    }
+    return key
   }
 
   //FIXME extend the IKeyManagerSignArgs.data to be a string or array of strings
+
   async keyManagerSign(args: ISphereonKeyManagerSignArgs): Promise<string> {
     const keyInfo: IKey = (await this.localStore.get({ kid: args.keyRef })) as IKey
-    const kms = this.getAvailableKms(keyInfo.kms)
-    if (keyInfo.type === <TKeyType>KeyType.Bls12381G2) {
+    const kms = this.getKmsByName(keyInfo.kms)
+    if (keyInfo.type === 'Bls12381G2') {
       return await kms.sign({ keyRef: keyInfo, data: Uint8Array.from(Buffer.from(args.data)) })
     }
-    // @ts-ignore
+    // @ts-ignore // we can pass in uint8arrays as well, which the super also can handle but does not expose in its types
     return await super.keyManagerSign(args)
   }
 
   async keyManagerVerify(args: ISphereonKeyManagerVerifyArgs): Promise<boolean> {
-    const kms = this.getAvailableKms(args.kms)
-    if (('verify' in kms && typeof kms.verify === 'function') || kms instanceof SphereonKeyManagementSystem) {
-      // @ts-ignore
-      return await kms.verify(args)
+    if (args.kms) {
+      const kms = this.getKmsByName(args.kms)
+      if (kms && 'verify' in kms && typeof kms.verify === 'function') {
+        // @ts-ignore
+        return await kms.verify(args)
+      }
     }
-    throw Error(`KMS ${kms} does not support verification`)
+    return await verifySignatureWithSubtle({
+      key: toJwk(args.publicKeyHex, args.type),
+      data: args.data,
+      signature: u8a.fromString(args.signature, 'utf-8'),
+    })
   }
 
   async keyManagerListKeys(): Promise<ManagedKeyInfo[]> {
-    return this.localStore.list({}) // FIXME there are no args it seems
+    return this.localStore.list({})
+  }
+
+  async keyManagerHandleExpirations(args: ISphereonKeyManagerHandleExpirationsArgs): Promise<Array<ManagedKeyInfo>> {
+    const keys = await this.keyManagerListKeys()
+    const expiredKeys = keys
+      .filter((key) => hasKeyOptions(key.meta))
+      .filter((key) => {
+        if (hasKeyOptions(key.meta) && key.meta?.opts?.expiration) {
+          const expiration = key.meta.opts.expiration
+          return !(expiration.expiryDate && expiration.expiryDate.getMilliseconds() > Date.now())
+        }
+        return false
+      })
+    if (args.skipRemovals !== true) {
+      await Promise.all(expiredKeys.map((key) => this.keyManagerDelete({ kid: key.kid })))
+    }
+    return keys
+  }
+
+  private getKmsByName(name: string): AbstractKeyManagementSystem {
+    const kms = this.availableKMSes[name]
+    if (!kms) {
+      throw Error(`invalid_argument: This agent has no registered KeyManagementSystem with name='${name}'`)
+    }
+    return kms
+  }
+
+  //todo https://sphereon.atlassian.net/browse/SDK-28 improve the logic for keyManagerGet in sphereon-key-manager
+  async keyManagerGet({ kid }: IKeyManagerGetArgs): Promise<IKey> {
+    try {
+      const key = await this.localStore.get({ kid })
+      return key
+    } catch (e) {
+      const keys: ManagedKeyInfo[] = await this.keyManagerListKeys()
+      const foundKey = keys.find(
+        (key) =>
+          key.publicKeyHex === kid ||
+          key.meta?.jwkThumbprint === kid ||
+          (key.meta?.jwkThumbprint == null && calculateJwkThumbprintForKey({ key }) === kid)
+      )
+      if (foundKey) {
+        return foundKey as IKey
+      } else {
+        throw new Error(`Key with kid ${kid} not found`)
+      }
+    }
   }
 }

package/src/types/ISphereonKeyManager.ts

@@ -4,7 +4,7 @@ import { ManagedKeyInfo } from '@veramo/core'
 export type PartialKey = ManagedKeyInfo & { privateKeyHex: string }
 
 export interface ISphereonKeyManager extends IKeyManager, IPluginMethodMap {
-  keyManagerCreate(args: IKeyManagerCreateArgs): Promise<PartialKey>
+  keyManagerCreate(args: ISphereonKeyManagerCreateArgs): Promise<PartialKey>
 
   keyManagerImport(key: MinimalImportableKey): Promise<PartialKey>
 
@@ -19,13 +19,34 @@ export interface ISphereonKeyManager extends IKeyManager, IPluginMethodMap {
   keyManagerVerify(args: ISphereonKeyManagerVerifyArgs): Promise<boolean>
 
   keyManagerListKeys(): Promise<Array<ManagedKeyInfo>>
+
+  /**
+   * Set keys to expired and remove keys eligible for deletion.
+   * @param args
+   */
+  keyManagerHandleExpirations(args: ISphereonKeyManagerHandleExpirationsArgs): Promise<Array<ManagedKeyInfo>>
+}
+
+export interface IkeyOptions {
+  /**
+   * Is this a temporary key?
+   */
+  ephemeral?: boolean
+
+  /**
+   * Expiration and remove the key
+   */
+  expiration?: {
+    expiryDate?: Date
+    removalDate?: Date
+  }
 }
 
 /**
  * Input arguments for {@link ISphereonKeyManager.keyManagerCreate | keyManagerCreate}
  * @public
  */
-export interface IKeyManagerCreateArgs {
+export interface ISphereonKeyManagerCreateArgs {
   /**
    * Key type
    */
@@ -36,12 +57,21 @@ export interface IKeyManagerCreateArgs {
    */
   kms: string
 
+  /**
+   * Key options
+   */
+  opts?: IkeyOptions
+
   /**
    * Optional. Key meta data
    */
   meta?: KeyMetadata
 }
 
+export function hasKeyOptions(object: any): object is { opts?: IkeyOptions } {
+  return object!! && 'opts' in object && ('ephemeral' in object.opts || 'expiration' in object.opts)
+}
+
 /**
  * Input arguments for {@link ISphereonKeyManager.keyManagerGet | keyManagerGet}
  * @public
@@ -76,11 +106,17 @@ export interface ISphereonKeyManagerSignArgs extends IKeyManagerSignArgs {
   data: string | Uint8Array
 }
 
+export interface ISphereonKeyManagerHandleExpirationsArgs {
+  skipRemovals?: boolean
+}
+
 export interface ISphereonKeyManagerVerifyArgs {
-  kms: string
+  kms?: string
   publicKeyHex: string
   type: TKeyType
   algorithm?: string
   data: Uint8Array
   signature: string
 }
+
+export const isDefined = <T extends unknown>(object: T | undefined): object is T => object !== undefined