@sphereon/ssi-sdk-ext.kms-local 0.28.1-feature.esm.cjs.11 → 0.28.1-feature.esm.cjs.14

package/dist/index.cjs

@@ -1,20 +1,56 @@
-"use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _interopRequireWildcard(obj) { if (obj && obj.__esModule) { return obj; } else { var newObj = {}; if (obj != null) { for (var key in obj) { if (Object.prototype.hasOwnProperty.call(obj, key)) { newObj[key] = obj[key]; } } } newObj.default = obj; return newObj; } } function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; } function _createStarExport(obj) { Object.keys(obj) .filter((key) => key !== "default" && key !== "__esModule") .forEach((key) => { if (exports.hasOwnProperty(key)) { return; } Object.defineProperty(exports, key, {enumerable: true, configurable: true, get: () => obj[key]}); }); } function _nullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return rhsFn(); } } function _optionalChain(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = fn(value); } else if (op === 'call' || op === 'optionalCall') { value = fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; }var __defProp = Object.defineProperty;
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __reExport = (target, mod, secondTarget) => (__copyProps(target, mod, "default"), secondTarget && __copyProps(secondTarget, mod, "default"));
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  KeyType: () => KeyType,
+  SphereonKeyManagementSystem: () => SphereonKeyManagementSystem
+});
+module.exports = __toCommonJS(index_exports);
 
 // src/SphereonKeyManagementSystem.ts
-var _ssisdkextkeyutils = require('@sphereon/ssi-sdk-ext.key-utils');
-var _kmslocal = require('@veramo/kms-local'); _createStarExport(_kmslocal);
-var _debug = require('debug'); var _debug2 = _interopRequireDefault(_debug);
-var _elliptic = require('elliptic'); var _elliptic2 = _interopRequireDefault(_elliptic);
-var _uint8arrays = require('uint8arrays'); var u8a = _interopRequireWildcard(_uint8arrays);
-var _ssisdkextx509utils = require('@sphereon/ssi-sdk-ext.x509-utils');
+var import_ssi_sdk_ext = require("@sphereon/ssi-sdk-ext.key-utils");
+var import_kms_local = require("@veramo/kms-local");
+var import_debug = __toESM(require("debug"), 1);
+var import_elliptic = __toESM(require("elliptic"), 1);
+var u8a = __toESM(require("uint8arrays"), 1);
+var import_ssi_sdk_ext2 = require("@sphereon/ssi-sdk-ext.x509-utils");
 var { fromString } = u8a;
-var debug = _debug2.default.call(void 0, "sphereon:kms:local");
-var SphereonKeyManagementSystem = class extends _kmslocal.KeyManagementSystem {
+var debug = (0, import_debug.default)("sphereon:kms:local");
+var SphereonKeyManagementSystem = class extends import_kms_local.KeyManagementSystem {
   static {
     __name(this, "SphereonKeyManagementSystem");
   }
-  
+  privateKeyStore;
   constructor(keyStore) {
     super(keyStore);
     this.privateKeyStore = keyStore;
@@ -68,7 +104,7 @@ var SphereonKeyManagementSystem = class extends _kmslocal.KeyManagementSystem {
       }
       // @ts-ignore
       case "RSA": {
-        const privateKeyHex = await _ssisdkextkeyutils.generatePrivateKeyHex.call(void 0, type);
+        const privateKeyHex = await (0, import_ssi_sdk_ext.generatePrivateKeyHex)(type);
         key = await this.importKey({
           type,
           privateKeyHex
@@ -98,7 +134,7 @@ var SphereonKeyManagementSystem = class extends _kmslocal.KeyManagementSystem {
       // @ts-ignore
       privateKey.type === "RSA" && (typeof algorithm === "undefined" || algorithm === "RS256" || algorithm === "RS512" || algorithm === "PS256" || algorithm === "PS512")
     ) {
-      return await this.signRSA(privateKey, data, _nullishCoalesce(algorithm, () => ( "PS256")));
+      return await this.signRSA(privateKey, data, algorithm ?? "PS256");
     } else {
       return await super.sign({
         keyRef,
@@ -110,7 +146,7 @@ var SphereonKeyManagementSystem = class extends _kmslocal.KeyManagementSystem {
   }
   async verify({ publicKeyHex, type, algorithm, data, signature }) {
     if (type === "RSA") {
-      return await this.verifyRSA(publicKeyHex, data, _nullishCoalesce(algorithm, () => ( "PS256")), signature);
+      return await this.verifyRSA(publicKeyHex, data, algorithm ?? "PS256", signature);
     }
     throw Error(`KMS verify is not implemented yet for ${type}`);
   }
@@ -120,7 +156,7 @@ var SphereonKeyManagementSystem = class extends _kmslocal.KeyManagementSystem {
       case KeyType.Bls12381G2:
         key = {
           type: args.type,
-          kid: _nullishCoalesce(args.alias, () => ( args.publicKeyHex)),
+          kid: args.alias ?? args.publicKeyHex,
           publicKeyHex: args.publicKeyHex,
           meta: {
             algorithms: [
@@ -131,16 +167,16 @@ var SphereonKeyManagementSystem = class extends _kmslocal.KeyManagementSystem {
         break;
       case "Secp256k1": {
         const privateBytes = fromString(args.privateKeyHex.toLowerCase(), "base16");
-        const secp256k1 = new _elliptic2.default.ec("secp256k1");
+        const secp256k1 = new import_elliptic.default.ec("secp256k1");
         const keyPair = secp256k1.keyFromPrivate(privateBytes, "hex");
         const publicKeyHex = keyPair.getPublic(true, "hex");
         key = {
           type: args.type,
-          kid: _nullishCoalesce(args.alias, () => ( publicKeyHex)),
+          kid: args.alias ?? publicKeyHex,
           publicKeyHex,
           meta: {
-            jwkThumbprint: _ssisdkextkeyutils.calculateJwkThumbprint.call(void 0, {
-              jwk: _ssisdkextkeyutils.toJwk.call(void 0, publicKeyHex, "Secp256k1")
+            jwkThumbprint: (0, import_ssi_sdk_ext.calculateJwkThumbprint)({
+              jwk: (0, import_ssi_sdk_ext.toJwk)(publicKeyHex, "Secp256k1")
             }),
             algorithms: [
               "ES256K",
@@ -156,16 +192,16 @@ var SphereonKeyManagementSystem = class extends _kmslocal.KeyManagementSystem {
       }
       case "Secp256r1": {
         const privateBytes = fromString(args.privateKeyHex.toLowerCase(), "base16");
-        const secp256r1 = new _elliptic2.default.ec("p256");
+        const secp256r1 = new import_elliptic.default.ec("p256");
         const keyPair = secp256r1.keyFromPrivate(privateBytes, "hex");
         const publicKeyHex = keyPair.getPublic(true, "hex");
         key = {
           type: args.type,
-          kid: _nullishCoalesce(args.alias, () => ( publicKeyHex)),
+          kid: args.alias ?? publicKeyHex,
           publicKeyHex,
           meta: {
-            jwkThumbprint: _ssisdkextkeyutils.calculateJwkThumbprint.call(void 0, {
-              jwk: _ssisdkextkeyutils.toJwk.call(void 0, publicKeyHex, "Secp256r1")
+            jwkThumbprint: (0, import_ssi_sdk_ext.calculateJwkThumbprint)({
+              jwk: (0, import_ssi_sdk_ext.toJwk)(publicKeyHex, "Secp256r1")
             }),
             algorithms: [
               "ES256"
@@ -176,17 +212,17 @@ var SphereonKeyManagementSystem = class extends _kmslocal.KeyManagementSystem {
       }
       // @ts-ignore
       case "RSA": {
-        const x509 = _optionalChain([args, 'access', _ => _.meta, 'optionalAccess', _2 => _2.x509]);
-        const privateKeyPEM = _nullishCoalesce(_optionalChain([x509, 'optionalAccess', _3 => _3.privateKeyPEM]), () => ( (args.privateKeyHex.includes("---") ? args.privateKeyHex : _ssisdkextx509utils.hexToPEM.call(void 0, args.privateKeyHex, "private"))));
-        const publicKeyJwk = _ssisdkextx509utils.PEMToJwk.call(void 0, privateKeyPEM, "public");
-        const publicKeyPEM = _ssisdkextx509utils.jwkToPEM.call(void 0, publicKeyJwk, "public");
-        const publicKeyHex = _ssisdkextx509utils.PEMToHex.call(void 0, publicKeyPEM);
+        const x509 = args.meta?.x509;
+        const privateKeyPEM = x509?.privateKeyPEM ?? (args.privateKeyHex.includes("---") ? args.privateKeyHex : (0, import_ssi_sdk_ext2.hexToPEM)(args.privateKeyHex, "private"));
+        const publicKeyJwk = (0, import_ssi_sdk_ext2.PEMToJwk)(privateKeyPEM, "public");
+        const publicKeyPEM = (0, import_ssi_sdk_ext2.jwkToPEM)(publicKeyJwk, "public");
+        const publicKeyHex = (0, import_ssi_sdk_ext2.PEMToHex)(publicKeyPEM);
         const meta = {};
         if (x509) {
           meta.x509 = {
-            cn: _nullishCoalesce(_nullishCoalesce(x509.cn, () => ( args.alias)), () => ( publicKeyHex))
+            cn: x509.cn ?? args.alias ?? publicKeyHex
           };
-          let certChain = _nullishCoalesce(x509.certificateChainPEM, () => ( ""));
+          let certChain = x509.certificateChainPEM ?? "";
           if (x509.certificatePEM) {
             if (!certChain.includes(x509.certificatePEM)) {
               certChain = `${x509.certificatePEM}
@@ -195,7 +231,7 @@ ${certChain}`;
           }
           if (certChain.length > 0) {
             meta.x509.certificateChainPEM = certChain;
-            const x5c = _ssisdkextx509utils.pemCertChainTox5c.call(void 0, certChain);
+            const x5c = (0, import_ssi_sdk_ext2.pemCertChainTox5c)(certChain);
             if (!x509.certificateChainURL) {
               publicKeyJwk.x5c = x5c;
             }
@@ -208,7 +244,7 @@ ${certChain}`;
         }
         key = {
           type: args.type,
-          kid: _nullishCoalesce(_nullishCoalesce(args.alias, () => ( _optionalChain([meta, 'optionalAccess', _4 => _4.x509, 'optionalAccess', _5 => _5.cn]))), () => ( publicKeyHex)),
+          kid: args.alias ?? meta?.x509?.cn ?? publicKeyHex,
           publicKeyHex,
           meta: {
             ...meta,
@@ -234,8 +270,8 @@ ${certChain}`;
   * @returns a base64url encoded signature for the `RS256` alg
   */
   async signRSA(privateKey, data, signingAlgorithm) {
-    const { hashAlgorithm, scheme } = _ssisdkextx509utils.signAlgorithmToSchemeAndHashAlg.call(void 0, signingAlgorithm);
-    const signer = new (0, _ssisdkextx509utils.RSASigner)(_ssisdkextx509utils.PEMToJwk.call(void 0, _ssisdkextx509utils.hexToPEM.call(void 0, privateKey.privateKeyHex, "private"), "private"), {
+    const { hashAlgorithm, scheme } = (0, import_ssi_sdk_ext2.signAlgorithmToSchemeAndHashAlg)(signingAlgorithm);
+    const signer = new import_ssi_sdk_ext2.RSASigner((0, import_ssi_sdk_ext2.PEMToJwk)((0, import_ssi_sdk_ext2.hexToPEM)(privateKey.privateKeyHex, "private"), "private"), {
       hashAlgorithm,
       scheme
     });
@@ -243,8 +279,8 @@ ${certChain}`;
     return signature;
   }
   async verifyRSA(publicKeyHex, data, signingAlgorithm, signature) {
-    const { hashAlgorithm, scheme } = _ssisdkextx509utils.signAlgorithmToSchemeAndHashAlg.call(void 0, signingAlgorithm);
-    const signer = new (0, _ssisdkextx509utils.RSASigner)(_ssisdkextx509utils.PEMToJwk.call(void 0, _ssisdkextx509utils.hexToPEM.call(void 0, publicKeyHex, "public"), "public"), {
+    const { hashAlgorithm, scheme } = (0, import_ssi_sdk_ext2.signAlgorithmToSchemeAndHashAlg)(signingAlgorithm);
+    const signer = new import_ssi_sdk_ext2.RSASigner((0, import_ssi_sdk_ext2.PEMToJwk)((0, import_ssi_sdk_ext2.hexToPEM)(publicKeyHex, "public"), "public"), {
       hashAlgorithm,
       scheme
     });
@@ -256,13 +292,9 @@ ${certChain}`;
 };
 
 // src/index.ts
-
+__reExport(index_exports, require("@veramo/kms-local"), module.exports);
 var KeyType = /* @__PURE__ */ function(KeyType2) {
   KeyType2["Bls12381G2"] = "Bls12381G2";
   return KeyType2;
 }({});
-
-
-
-exports.KeyType = KeyType; exports.SphereonKeyManagementSystem = SphereonKeyManagementSystem;
 //# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["/home/runner/work/SSI-SDK-crypto-extensions/SSI-SDK-crypto-extensions/packages/kms-local/dist/index.cjs","../src/SphereonKeyManagementSystem.ts","../src/index.ts"],"names":["fromString","u8a","debug","Debug","SphereonKeyManagementSystem","KeyManagementSystem","privateKeyStore","constructor","keyStore","importKey","args","type","KeyType","Bls12381G2","toString","privateKeyHex","publicKeyHex","Error","managedKey","asSphereonManagedKeyInfo","alias","kid","import","privateKeyPEM","createKey","key","generatePrivateKeyHex","sign","keyRef","algorithm","data","privateKey","get","e","signature","x509","includes","publicKeyPEM","certChain","x5c","certificateChainURL","meta","publicKeyJwk","signingAlgorithm","hashAlgorithm","scheme"],"mappings":"AAAA,+zCAAI,UAAU,EAAE,MAAM,CAAC,cAAc;AACrC,IAAI,OAAO,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,CAAC,CAAC;AACxF;AACA;ACHA,oEAA+E;AAI/E,2EAAoC;AACpC,4EAAkB;AAClB,wFAAqB;AAErB,2FAAqB;AAGrB,sEAQO;AAVP,IAAM,EAAEA,WAAU,EAAA,EAAKC,GAAAA;AAYvB,IAAMC,MAAAA,EAAQC,6BAAAA,oBAAM,CAAA;AAEb,IAAMC,4BAAAA,EAAN,MAAA,QAA0CC,8BAAAA;ADVjD,ECbA,OAuBiDA;ADTjD,IAAI,MAAM,CAAC,IAAI,EAAE,6BAA6B,CAAC;AAC/C,EAAE;AACF,ECQmBC;ADPnB,ECSEC,WAAAA,CAAYC,QAAAA,EAAmC;AAC7C,IAAA,KAAA,CAAMA,QAAAA,CAAAA;AACN,IAAA,IAAA,CAAKF,gBAAAA,EAAkBE,QAAAA;ADR3B,ECSE;ADRF,ECUE,MAAMC,SAAAA,CAAUC,IAAAA,EAA+F;AAC7G,IAAA,OAAA,CAAQA,IAAAA,CAAKC,IAAAA,EAAI;ADTrB,MCUM,KAAKC,OAAAA,CAAQC,UAAAA,CAAWC,QAAAA,CAAQ,CAAA;AAC9B,QAAA,GAAA,CAAI,CAACJ,IAAAA,CAAKK,cAAAA,GAAiB,CAACL,IAAAA,CAAKM,YAAAA,EAAc;AAC7C,UAAA,MAAM,IAAIC,KAAAA,CAAM,qFAAA,CAAA;ADT1B,QCUQ;AACA,QAAA,MAAMC,WAAAA,EAAa,IAAA,CAAKC,wBAAAA,CAAyB;ADTzD,UCUU,GAAGT,IAAAA;ADTb,UCUUU,KAAAA,EAAOV,IAAAA,CAAKW,GAAAA;ADTtB,UCUUN,aAAAA,EAAeL,IAAAA,CAAKK,aAAAA;ADT9B,UCUUC,YAAAA,EAAcN,IAAAA,CAAKM,YAAAA;ADT7B,UCUUL,IAAAA,EAAMD,IAAAA,CAAKC;ADTrB,QCUQ,CAAA,CAAA;AACA,QAAA,MAAM,IAAA,CAAKL,eAAAA,CAAgBgB,MAAAA,CAAO;ADT1C,UCS4CF,KAAAA,EAAOF,UAAAA,CAAWG,GAAAA;ADR9D,UCQmE,GAAGX;ADPtE,QCO2E,CAAA,CAAA;AACnER,QAAAA,KAAAA,CAAM,cAAA,EAAgBgB,UAAAA,CAAWP,IAAAA,EAAMO,UAAAA,CAAWF,YAAY,CAAA;AAC9D,QAAA,OAAOE,UAAAA;ADNf,MCQM,KAAK,WAAA;ADPX,MCQM,KAAK,WAAA;ADPX;AACA,MCQM,KAAK,KAAA,EAAO;AACV,QAAA,GAAA,CAAI,CAACR,IAAAA,CAAKK,cAAAA,GAAiB,CAACL,IAAAA,CAAKa,aAAAA,EAAe;AAC9C,UAAA,MAAM,IAAIN,KAAAA,CAAM,kGAAA,CAAA;ADP1B,QCQQ;AACA,QAAA,MAAMC,YAAAA,EAAa,IAAA,CAAKC,wBAAAA,CAAyB;ADPzD,UCO2DC,KAAAA,EAAOV,IAAAA,CAAKW,GAAAA;ADNvE,UCM4E,GAAGX;ADL/E,QCKoF,CAAA,CAAA;AAC5E,QAAA,MAAM,IAAA,CAAKJ,eAAAA,CAAgBgB,MAAAA,CAAO;ADJ1C,UCI4CF,KAAAA,EAAOF,WAAAA,CAAWG,GAAAA;ADH9D,UCGmE,GAAGX;ADFtE,QCE2E,CAAA,CAAA;AACnER,QAAAA,KAAAA,CAAM,cAAA,EAAgBgB,WAAAA,CAAWP,IAAAA,EAAMO,WAAAA,CAAWF,YAAY,CAAA;AAC9D,QAAA,OAAOE,WAAAA;ADDf,MCEM;ADDN,MCEM,OAAA;AACE,QAAA,OAAO,MAAM,KAAA,CAAMT,SAAAA,CAAUC,IAAAA,CAAAA;ADDrC,ICEI;ADDJ,ECEE;ADDF,ECGE,MAAMc,SAAAA,CAAU,EAAEb,KAAI,CAAA,EAAiD;AACrE,IAAA,IAAIc,GAAAA;AAEJ,IAAA,OAAA,CAAQd,IAAAA,EAAAA;ADHZ,MCIM,KAAKC,OAAAA,CAAQC,UAAAA,EAAY;AACvB,QAAA,MAAMI,KAAAA,CACJ,mLAAA,CAAA;ADJV,MCiBM;ADhBN;AACA,MCkBM,KAAK,KAAA,EAAO;AACV,QAAA,MAAMF,cAAAA,EAAgB,MAAMW,sDAAAA,IAAsBf,CAAAA;AAClDc,QAAAA,IAAAA,EAAM,MAAM,IAAA,CAAKhB,SAAAA,CAAU;ADjBnC,UCkBUE,IAAAA;ADjBV,UCkBUI;ADjBV,QCkBQ,CAAA,CAAA;AACA,QAAA,KAAA;ADjBR,MCkBM;ADjBN,MCkBM,OAAA;AACEU,QAAAA,IAAAA,EAAM,MAAM,KAAA,CAAMD,SAAAA,CAAU;ADjBpC,UCiBsCb;ADhBtC,QCgB2C,CAAA,CAAA;ADf3C,ICgBI;AAEAT,IAAAA,KAAAA,CAAM,aAAA,EAAeS,IAAAA,EAAMc,GAAAA,CAAIT,YAAY,CAAA;AAE3C,IAAA,OAAOS,GAAAA;ADjBX,ECkBE;ADjBF,ECmBE,MAAME,IAAAA,CAAK,EAAEC,MAAAA,EAAQC,SAAAA,EAAWC,KAAI,CAAA,EAA0F;AAC5H,IAAA,IAAIC,UAAAA;AACJ,IAAA,IAAI;AACFA,MAAAA,WAAAA,EAAa,MAAM,IAAA,CAAKzB,eAAAA,CAAgB0B,GAAAA,CAAI;ADlBlD,QCkBoDZ,KAAAA,EAAOQ,MAAAA,CAAOP;ADjBlE,MCiBsE,CAAA,CAAA;ADhBtE,ICiBI,EAAA,MAAA,CAASY,CAAAA,EAAG;AACV,MAAA,MAAM,IAAIhB,KAAAA,CAAM,CAAA,0CAAA,EAA6CW,MAAAA,CAAOP,GAAG,CAAA,CAAA;AACzE,IAAA;AAE4C,IAAA;AAExC,MAAA;AAgBJ,IAAA;ADjC0E;ACoCnCQ,MAAAA;AACrC,IAAA;AACyD,MAAA;AACpD,IAAA;AACmB,MAAA;AAAED,QAAAA;AAAQC,QAAAA;AAAWC,QAAAA;AAAK,MAAA;AACpD,IAAA;AACuEnB,IAAAA;AACzE,EAAA;AAcqB,EAAA;AACC,IAAA;AACoDuB,MAAAA;AACxE,IAAA;AAC2D,IAAA;AAC7D,EAAA;AAE2E,EAAA;AACrET,IAAAA;AACa,IAAA;AACFZ,MAAAA;AACL,QAAA;AACOF,UAAAA;AACaK,UAAAA;AACLA,UAAAA;AACb,UAAA;AACQ,YAAA;AAAC,cAAA;AD3CqD,YAAA;AC4CpE,UAAA;AACF,QAAA;AACA,QAAA;AACgB,MAAA;AACkD,QAAA;AAChC,QAAA;AACqB,QAAA;AACV,QAAA;AACvC,QAAA;AACOL,UAAAA;AACQK,UAAAA;AACnBA,UAAAA;AACM,UAAA;AACkC,YAAA;AAA2B,cAAA;AAAa,YAAA;AAClE,YAAA;AAAC,cAAA;AAAU,cAAA;AAAY,cAAA;AAAuB,cAAA;AAAqB,cAAA;AAAmB,cAAA;ADlChC,YAAA;ACmCpE,UAAA;AACF,QAAA;AACA,QAAA;AACF,MAAA;AACkB,MAAA;AACkD,QAAA;AAChC,QAAA;AACqB,QAAA;AACV,QAAA;AACvC,QAAA;AACOL,UAAAA;AACQK,UAAAA;AACnBA,UAAAA;AACM,UAAA;AACkC,YAAA;AAA2B,cAAA;AAAa,YAAA;AAClE,YAAA;AAAC,cAAA;AD9BqD,YAAA;AC+BpE,UAAA;AACF,QAAA;AACA,QAAA;AACF,MAAA;AD7BwE;AC+B5D,MAAA;AACcmB,QAAAA;AAEqBC,QAAAA;AACA,QAAA;AACD,QAAA;AACdC,QAAAA;AAEhB,QAAA;AACJ,QAAA;AACI,UAAA;AACmBrB,YAAAA;AAC/B,UAAA;AACoD,UAAA;AAC3B,UAAA;AACuB,YAAA;AACV,cAAA;AAAKsB;AACzC,YAAA;AACF,UAAA;AAC0B,UAAA;AACQA,YAAAA;AACFA,YAAAA;AACC,YAAA;AAGVC,cAAAA;AACrB,YAAA;AACgBA,YAAAA;AAClB,UAAA;AAC8B,UAAA;AAEJC,YAAAA;AACHA,YAAAA;AACvB,UAAA;AACF,QAAA;AAEM,QAAA;AACO7B,UAAAA;AAC0BK,UAAAA;AACrCA,UAAAA;AACM,UAAA;AACDyB,YAAAA;ADlC+D;ACoCtD,YAAA;AAAC,cAAA;AAAS,cAAA;AAAS,cAAA;AAAS,cAAA;AD9B0B,YAAA;AC+BlEC,YAAAA;AACAL,YAAAA;AACF,UAAA;AACF,QAAA;AACA,QAAA;AACF,MAAA;AAEA,MAAA;AACmE,QAAA;AACrE,IAAA;AACOZ,IAAAA;AACT,EAAA;AD9B4E;AACA;AACA;ACiCsC,EAAA;AAC9CkB,IAAAA;AACO,IAAA;AAA0BC,MAAAA;AAAeC,MAAAA;AAAO,IAAA;AACrFf,IAAAA;AAC7BI,IAAAA;AACT,EAAA;AAE6G,EAAA;AACzCS,IAAAA;AACM,IAAA;AAAaC,MAAAA;AAAeC,MAAAA;AAAO,IAAA;AAC1EX,IAAAA;AACnC,EAAA;AAEwD,EAAA;AACmCf,IAAAA;AAC3F,EAAA;AACF;AD3B8E;AACA;AE5PhE;AAcFP;AFiPkE,EAAA;AEjPlEA,EAAAA;AFmPkE;AACA;AACA;AACA;AACA","file":"/home/runner/work/SSI-SDK-crypto-extensions/SSI-SDK-crypto-extensions/packages/kms-local/dist/index.cjs","sourcesContent":[null,"import { calculateJwkThumbprint, generatePrivateKeyHex, toJwk, X509Opts } from '@sphereon/ssi-sdk-ext.key-utils'\n\nimport { IKey, ManagedKeyInfo, MinimalImportableKey, TKeyType } from '@veramo/core'\nimport { AbstractPrivateKeyStore, ManagedPrivateKey } from '@veramo/key-manager'\nimport { KeyManagementSystem } from '@veramo/kms-local'\nimport Debug from 'debug'\nimport elliptic from 'elliptic'\n// @ts-ignore\nimport * as u8a from 'uint8arrays'\nconst { fromString } = u8a\nimport { KeyType, ManagedKeyInfoArgs } from './index'\nimport {\n  hexToPEM,\n  jwkToPEM,\n  pemCertChainTox5c,\n  PEMToHex,\n  PEMToJwk,\n  RSASigner,\n  signAlgorithmToSchemeAndHashAlg,\n} from '@sphereon/ssi-sdk-ext.x509-utils'\n\nconst debug = Debug('sphereon:kms:local')\n\nexport class SphereonKeyManagementSystem extends KeyManagementSystem {\n  private readonly privateKeyStore: AbstractPrivateKeyStore\n\n  constructor(keyStore: AbstractPrivateKeyStore) {\n    super(keyStore)\n    this.privateKeyStore = keyStore\n  }\n\n  async importKey(args: Omit<MinimalImportableKey, 'kms'> & { privateKeyPEM?: string }): Promise<ManagedKeyInfo> {\n    switch (args.type) {\n      case KeyType.Bls12381G2.toString():\n        if (!args.privateKeyHex || !args.publicKeyHex) {\n          throw new Error('invalid_argument: type, publicKeyHex and privateKeyHex are required to import a key')\n        }\n        const managedKey = this.asSphereonManagedKeyInfo({\n          ...args,\n          alias: args.kid,\n          privateKeyHex: args.privateKeyHex,\n          publicKeyHex: args.publicKeyHex,\n          type: args.type,\n        })\n        await this.privateKeyStore.import({ alias: managedKey.kid, ...args })\n        debug('imported key', managedKey.type, managedKey.publicKeyHex)\n        return managedKey\n\n      case 'Secp256k1':\n      case 'Secp256r1':\n      // @ts-ignore\n      case 'RSA': {\n        if (!args.privateKeyHex && !args.privateKeyPEM) {\n          throw new Error('invalid_argument: type and privateKeyHex (or privateKeyPEM for RSA) are required to import a key')\n        }\n        const managedKey = this.asSphereonManagedKeyInfo({ alias: args.kid, ...args })\n        await this.privateKeyStore.import({ alias: managedKey.kid, ...args })\n        debug('imported key', managedKey.type, managedKey.publicKeyHex)\n        return managedKey\n      }\n      default:\n        return await super.importKey(args)\n    }\n  }\n\n  async createKey({ type }: { type: TKeyType }): Promise<ManagedKeyInfo> {\n    let key: ManagedKeyInfo\n\n    switch (type) {\n      case KeyType.Bls12381G2: {\n        throw Error(\n          'BLS support not available because upstream is not really providing Windows and React-Native support; giving too much headache. We soon will move to @digitalbazaar/bbs-signatures'\n        )\n        /*// @ts-ignore\n        const bbs = await import('@digitalbazaar/bbs-signatures')\n        const keyPairBls12381G2 = await bbs.generateKeyPair({\n          ciphersuite: 'BLS12-381-SHA-256'\n        })\n        key = await this.importKey({\n          type,\n          privateKeyHex: Buffer.from(keyPairBls12381G2.secretKey).toString('hex'),\n          publicKeyHex: Buffer.from(keyPairBls12381G2.publicKey).toString('hex'),\n        })\n        break*/\n      }\n\n      // @ts-ignore\n      case 'RSA': {\n        const privateKeyHex = await generatePrivateKeyHex(type)\n        key = await this.importKey({\n          type,\n          privateKeyHex,\n        })\n        break\n      }\n      default:\n        key = await super.createKey({ type })\n    }\n\n    debug('Created key', type, key.publicKeyHex)\n\n    return key\n  }\n\n  async sign({ keyRef, algorithm, data }: { keyRef: Pick<IKey, 'kid'>; algorithm?: string; data: Uint8Array }): Promise<string> {\n    let privateKey: ManagedPrivateKey\n    try {\n      privateKey = await this.privateKeyStore.get({ alias: keyRef.kid })\n    } catch (e) {\n      throw new Error(`key_not_found: No key entry found for kid=${keyRef.kid}`)\n    }\n\n    if (privateKey.type === KeyType.Bls12381G2) {\n      throw Error(\n        'BLS support not available because upstream is not really providing Windows and React-Native support; giving too much headache. We soon will move to @digitalbazaar/bbs-signatures'\n      )\n      /*// @ts-ignore\n      const bbs = await import('@digitalbazaar/bbs-signatures')\n      if (!data || Array.isArray(data)) {\n        throw new Error('Data must be defined and cannot be an array')\n      }\n      const keyPair = {\n        keyPair: {\n          secretKey: Uint8Array.from(Buffer.from(privateKey.privateKeyHex, 'hex')),\n          publicKey: Uint8Array.from(Buffer.from(keyRef.kid, 'hex')),\n        },\n        messages: [data],\n      }\n      const signature = await bbs.sign({secretKey: privateKey, publicKey, header, messages});\n      return signature*/\n    } else if (\n      // @ts-ignore\n      privateKey.type === 'RSA' &&\n      (typeof algorithm === 'undefined' || algorithm === 'RS256' || algorithm === 'RS512' || algorithm === 'PS256' || algorithm === 'PS512')\n    ) {\n      return await this.signRSA(privateKey, data, algorithm ?? 'PS256')\n    } else {\n      return await super.sign({ keyRef, algorithm, data })\n    }\n    throw Error(`not_supported: Cannot sign using key of type ${privateKey.type}`)\n  }\n\n  async verify({\n    publicKeyHex,\n    type,\n    algorithm,\n    data,\n    signature,\n  }: {\n    publicKeyHex: string\n    type: TKeyType\n    algorithm?: string\n    data: Uint8Array\n    signature: string\n  }): Promise<boolean> {\n    if (type === 'RSA') {\n      return await this.verifyRSA(publicKeyHex, data, algorithm ?? 'PS256', signature)\n    }\n    throw Error(`KMS verify is not implemented yet for ${type}`)\n  }\n\n  private asSphereonManagedKeyInfo(args: ManagedKeyInfoArgs): ManagedKeyInfo {\n    let key: Partial<ManagedKeyInfo>\n    switch (args.type) {\n      case KeyType.Bls12381G2:\n        key = {\n          type: args.type,\n          kid: args.alias ?? args.publicKeyHex,\n          publicKeyHex: args.publicKeyHex,\n          meta: {\n            algorithms: ['BLS'],\n          },\n        }\n        break\n      case 'Secp256k1': {\n        const privateBytes = fromString(args.privateKeyHex.toLowerCase(), 'base16')\n        const secp256k1 = new elliptic.ec('secp256k1')\n        const keyPair = secp256k1.keyFromPrivate(privateBytes, 'hex')\n        const publicKeyHex = keyPair.getPublic(true, 'hex')\n        key = {\n          type: args.type,\n          kid: args.alias ?? publicKeyHex,\n          publicKeyHex,\n          meta: {\n            jwkThumbprint: calculateJwkThumbprint({ jwk: toJwk(publicKeyHex, 'Secp256k1') }),\n            algorithms: ['ES256K', 'ES256K-R', 'eth_signTransaction', 'eth_signTypedData', 'eth_signMessage', 'eth_rawSign'],\n          },\n        }\n        break\n      }\n      case 'Secp256r1': {\n        const privateBytes = fromString(args.privateKeyHex.toLowerCase(), 'base16')\n        const secp256r1 = new elliptic.ec('p256')\n        const keyPair = secp256r1.keyFromPrivate(privateBytes, 'hex')\n        const publicKeyHex = keyPair.getPublic(true, 'hex')\n        key = {\n          type: args.type,\n          kid: args.alias ?? publicKeyHex,\n          publicKeyHex,\n          meta: {\n            jwkThumbprint: calculateJwkThumbprint({ jwk: toJwk(publicKeyHex, 'Secp256r1') }),\n            algorithms: ['ES256'],\n          },\n        }\n        break\n      }\n      // @ts-ignore\n      case 'RSA': {\n        const x509 = args.meta?.x509 as X509Opts\n        const privateKeyPEM =\n          x509?.privateKeyPEM ?? (args.privateKeyHex.includes('---') ? args.privateKeyHex : hexToPEM(args.privateKeyHex, 'private')) // In case we have x509 opts, the private key hex really was a PEM already (yuck)\n        const publicKeyJwk = PEMToJwk(privateKeyPEM, 'public')\n        const publicKeyPEM = jwkToPEM(publicKeyJwk, 'public')\n        const publicKeyHex = PEMToHex(publicKeyPEM)\n\n        const meta = {} as any\n        if (x509) {\n          meta.x509 = {\n            cn: x509.cn ?? args.alias ?? publicKeyHex,\n          }\n          let certChain: string = x509.certificateChainPEM ?? ''\n          if (x509.certificatePEM) {\n            if (!certChain.includes(x509.certificatePEM)) {\n              certChain = `${x509.certificatePEM}\\n${certChain}`\n            }\n          }\n          if (certChain.length > 0) {\n            meta.x509.certificateChainPEM = certChain\n            const x5c = pemCertChainTox5c(certChain)\n            if (!x509.certificateChainURL) {\n              // Do not put the chain in the JWK when the chain is hosted. We do put it in the x509 metadata\n              // @ts-ignore\n              publicKeyJwk.x5c = x5c\n            }\n            meta.x509.x5c = x5c\n          }\n          if (x509.certificateChainURL) {\n            // @ts-ignore\n            publicKeyJwk.x5u = x509.certificateChainURL\n            meta.x509.x5u = x509.certificateChainURL\n          }\n        }\n\n        key = {\n          type: args.type,\n          kid: args.alias ?? meta?.x509?.cn ?? publicKeyHex,\n          publicKeyHex,\n          meta: {\n            ...meta,\n            // todo: could als be DSA etc\n            algorithms: ['RS256', 'RS512', 'PS256', 'PS512'],\n            publicKeyJwk,\n            publicKeyPEM,\n          },\n        }\n        break\n      }\n\n      default:\n        throw Error('not_supported: Key type not supported: ' + args.type)\n    }\n    return key as ManagedKeyInfo\n  }\n\n  /**\n   * @returns a base64url encoded signature for the `RS256` alg\n   */\n  private async signRSA(privateKey: ManagedPrivateKey, data: Uint8Array, signingAlgorithm: string): Promise<string> {\n    const { hashAlgorithm, scheme } = signAlgorithmToSchemeAndHashAlg(signingAlgorithm)\n    const signer = new RSASigner(PEMToJwk(hexToPEM(privateKey.privateKeyHex, 'private'), 'private'), { hashAlgorithm, scheme })\n    const signature = await signer.sign(data)\n    return signature as string\n  }\n\n  private async verifyRSA(publicKeyHex: string, data: Uint8Array, signingAlgorithm: string, signature: string) {\n    const { hashAlgorithm, scheme } = signAlgorithmToSchemeAndHashAlg(signingAlgorithm)\n    const signer = new RSASigner(PEMToJwk(hexToPEM(publicKeyHex, 'public'), 'public'), { hashAlgorithm, scheme })\n    return await signer.verify(data, signature)\n  }\n\n  public async listKeys(): Promise<Array<ManagedKeyInfo>> {\n    return (await this.privateKeyStore.list({})).map((privateKey: ManagedPrivateKey) => this.asSphereonManagedKeyInfo(privateKey))\n  }\n}\n","import { X509Opts } from '@sphereon/ssi-sdk-ext.key-utils'\nimport { KeyMetadata, TKeyType } from '@veramo/core'\n\nexport { SphereonKeyManagementSystem } from './SphereonKeyManagementSystem'\n\nexport * from '@veramo/kms-local'\n\nexport interface ManagedKeyInfoArgs {\n  alias?: string\n  type: TKeyType\n  privateKeyHex: string\n  publicKeyHex?: string\n  meta?: ManageKeyInfoMeta | undefined | null\n}\n\nexport interface ManageKeyInfoMeta extends KeyMetadata {\n  x509?: X509Opts\n  [x: string]: any\n}\nexport enum KeyType {\n  Bls12381G2 = 'Bls12381G2',\n}\n"]}
+{"version":3,"sources":["../src/index.ts","../src/SphereonKeyManagementSystem.ts"],"sourcesContent":["import { X509Opts } from '@sphereon/ssi-sdk-ext.key-utils'\nimport { KeyMetadata, TKeyType } from '@veramo/core'\n\nexport { SphereonKeyManagementSystem } from './SphereonKeyManagementSystem'\n\nexport * from '@veramo/kms-local'\n\nexport interface ManagedKeyInfoArgs {\n  alias?: string\n  type: TKeyType\n  privateKeyHex: string\n  publicKeyHex?: string\n  meta?: ManageKeyInfoMeta | undefined | null\n}\n\nexport interface ManageKeyInfoMeta extends KeyMetadata {\n  x509?: X509Opts\n  [x: string]: any\n}\nexport enum KeyType {\n  Bls12381G2 = 'Bls12381G2',\n}\n","import { calculateJwkThumbprint, generatePrivateKeyHex, toJwk, X509Opts } from '@sphereon/ssi-sdk-ext.key-utils'\n\nimport { IKey, ManagedKeyInfo, MinimalImportableKey, TKeyType } from '@veramo/core'\nimport { AbstractPrivateKeyStore, ManagedPrivateKey } from '@veramo/key-manager'\nimport { KeyManagementSystem } from '@veramo/kms-local'\nimport Debug from 'debug'\nimport elliptic from 'elliptic'\n// @ts-ignore\nimport * as u8a from 'uint8arrays'\nconst { fromString } = u8a\nimport { KeyType, ManagedKeyInfoArgs } from './index'\nimport {\n  hexToPEM,\n  jwkToPEM,\n  pemCertChainTox5c,\n  PEMToHex,\n  PEMToJwk,\n  RSASigner,\n  signAlgorithmToSchemeAndHashAlg,\n} from '@sphereon/ssi-sdk-ext.x509-utils'\n\nconst debug = Debug('sphereon:kms:local')\n\nexport class SphereonKeyManagementSystem extends KeyManagementSystem {\n  private readonly privateKeyStore: AbstractPrivateKeyStore\n\n  constructor(keyStore: AbstractPrivateKeyStore) {\n    super(keyStore)\n    this.privateKeyStore = keyStore\n  }\n\n  async importKey(args: Omit<MinimalImportableKey, 'kms'> & { privateKeyPEM?: string }): Promise<ManagedKeyInfo> {\n    switch (args.type) {\n      case KeyType.Bls12381G2.toString():\n        if (!args.privateKeyHex || !args.publicKeyHex) {\n          throw new Error('invalid_argument: type, publicKeyHex and privateKeyHex are required to import a key')\n        }\n        const managedKey = this.asSphereonManagedKeyInfo({\n          ...args,\n          alias: args.kid,\n          privateKeyHex: args.privateKeyHex,\n          publicKeyHex: args.publicKeyHex,\n          type: args.type,\n        })\n        await this.privateKeyStore.import({ alias: managedKey.kid, ...args })\n        debug('imported key', managedKey.type, managedKey.publicKeyHex)\n        return managedKey\n\n      case 'Secp256k1':\n      case 'Secp256r1':\n      // @ts-ignore\n      case 'RSA': {\n        if (!args.privateKeyHex && !args.privateKeyPEM) {\n          throw new Error('invalid_argument: type and privateKeyHex (or privateKeyPEM for RSA) are required to import a key')\n        }\n        const managedKey = this.asSphereonManagedKeyInfo({ alias: args.kid, ...args })\n        await this.privateKeyStore.import({ alias: managedKey.kid, ...args })\n        debug('imported key', managedKey.type, managedKey.publicKeyHex)\n        return managedKey\n      }\n      default:\n        return await super.importKey(args)\n    }\n  }\n\n  async createKey({ type }: { type: TKeyType }): Promise<ManagedKeyInfo> {\n    let key: ManagedKeyInfo\n\n    switch (type) {\n      case KeyType.Bls12381G2: {\n        throw Error(\n          'BLS support not available because upstream is not really providing Windows and React-Native support; giving too much headache. We soon will move to @digitalbazaar/bbs-signatures'\n        )\n        /*// @ts-ignore\n        const bbs = await import('@digitalbazaar/bbs-signatures')\n        const keyPairBls12381G2 = await bbs.generateKeyPair({\n          ciphersuite: 'BLS12-381-SHA-256'\n        })\n        key = await this.importKey({\n          type,\n          privateKeyHex: Buffer.from(keyPairBls12381G2.secretKey).toString('hex'),\n          publicKeyHex: Buffer.from(keyPairBls12381G2.publicKey).toString('hex'),\n        })\n        break*/\n      }\n\n      // @ts-ignore\n      case 'RSA': {\n        const privateKeyHex = await generatePrivateKeyHex(type)\n        key = await this.importKey({\n          type,\n          privateKeyHex,\n        })\n        break\n      }\n      default:\n        key = await super.createKey({ type })\n    }\n\n    debug('Created key', type, key.publicKeyHex)\n\n    return key\n  }\n\n  async sign({ keyRef, algorithm, data }: { keyRef: Pick<IKey, 'kid'>; algorithm?: string; data: Uint8Array }): Promise<string> {\n    let privateKey: ManagedPrivateKey\n    try {\n      privateKey = await this.privateKeyStore.get({ alias: keyRef.kid })\n    } catch (e) {\n      throw new Error(`key_not_found: No key entry found for kid=${keyRef.kid}`)\n    }\n\n    if (privateKey.type === KeyType.Bls12381G2) {\n      throw Error(\n        'BLS support not available because upstream is not really providing Windows and React-Native support; giving too much headache. We soon will move to @digitalbazaar/bbs-signatures'\n      )\n      /*// @ts-ignore\n      const bbs = await import('@digitalbazaar/bbs-signatures')\n      if (!data || Array.isArray(data)) {\n        throw new Error('Data must be defined and cannot be an array')\n      }\n      const keyPair = {\n        keyPair: {\n          secretKey: Uint8Array.from(Buffer.from(privateKey.privateKeyHex, 'hex')),\n          publicKey: Uint8Array.from(Buffer.from(keyRef.kid, 'hex')),\n        },\n        messages: [data],\n      }\n      const signature = await bbs.sign({secretKey: privateKey, publicKey, header, messages});\n      return signature*/\n    } else if (\n      // @ts-ignore\n      privateKey.type === 'RSA' &&\n      (typeof algorithm === 'undefined' || algorithm === 'RS256' || algorithm === 'RS512' || algorithm === 'PS256' || algorithm === 'PS512')\n    ) {\n      return await this.signRSA(privateKey, data, algorithm ?? 'PS256')\n    } else {\n      return await super.sign({ keyRef, algorithm, data })\n    }\n    throw Error(`not_supported: Cannot sign using key of type ${privateKey.type}`)\n  }\n\n  async verify({\n    publicKeyHex,\n    type,\n    algorithm,\n    data,\n    signature,\n  }: {\n    publicKeyHex: string\n    type: TKeyType\n    algorithm?: string\n    data: Uint8Array\n    signature: string\n  }): Promise<boolean> {\n    if (type === 'RSA') {\n      return await this.verifyRSA(publicKeyHex, data, algorithm ?? 'PS256', signature)\n    }\n    throw Error(`KMS verify is not implemented yet for ${type}`)\n  }\n\n  private asSphereonManagedKeyInfo(args: ManagedKeyInfoArgs): ManagedKeyInfo {\n    let key: Partial<ManagedKeyInfo>\n    switch (args.type) {\n      case KeyType.Bls12381G2:\n        key = {\n          type: args.type,\n          kid: args.alias ?? args.publicKeyHex,\n          publicKeyHex: args.publicKeyHex,\n          meta: {\n            algorithms: ['BLS'],\n          },\n        }\n        break\n      case 'Secp256k1': {\n        const privateBytes = fromString(args.privateKeyHex.toLowerCase(), 'base16')\n        const secp256k1 = new elliptic.ec('secp256k1')\n        const keyPair = secp256k1.keyFromPrivate(privateBytes, 'hex')\n        const publicKeyHex = keyPair.getPublic(true, 'hex')\n        key = {\n          type: args.type,\n          kid: args.alias ?? publicKeyHex,\n          publicKeyHex,\n          meta: {\n            jwkThumbprint: calculateJwkThumbprint({ jwk: toJwk(publicKeyHex, 'Secp256k1') }),\n            algorithms: ['ES256K', 'ES256K-R', 'eth_signTransaction', 'eth_signTypedData', 'eth_signMessage', 'eth_rawSign'],\n          },\n        }\n        break\n      }\n      case 'Secp256r1': {\n        const privateBytes = fromString(args.privateKeyHex.toLowerCase(), 'base16')\n        const secp256r1 = new elliptic.ec('p256')\n        const keyPair = secp256r1.keyFromPrivate(privateBytes, 'hex')\n        const publicKeyHex = keyPair.getPublic(true, 'hex')\n        key = {\n          type: args.type,\n          kid: args.alias ?? publicKeyHex,\n          publicKeyHex,\n          meta: {\n            jwkThumbprint: calculateJwkThumbprint({ jwk: toJwk(publicKeyHex, 'Secp256r1') }),\n            algorithms: ['ES256'],\n          },\n        }\n        break\n      }\n      // @ts-ignore\n      case 'RSA': {\n        const x509 = args.meta?.x509 as X509Opts\n        const privateKeyPEM =\n          x509?.privateKeyPEM ?? (args.privateKeyHex.includes('---') ? args.privateKeyHex : hexToPEM(args.privateKeyHex, 'private')) // In case we have x509 opts, the private key hex really was a PEM already (yuck)\n        const publicKeyJwk = PEMToJwk(privateKeyPEM, 'public')\n        const publicKeyPEM = jwkToPEM(publicKeyJwk, 'public')\n        const publicKeyHex = PEMToHex(publicKeyPEM)\n\n        const meta = {} as any\n        if (x509) {\n          meta.x509 = {\n            cn: x509.cn ?? args.alias ?? publicKeyHex,\n          }\n          let certChain: string = x509.certificateChainPEM ?? ''\n          if (x509.certificatePEM) {\n            if (!certChain.includes(x509.certificatePEM)) {\n              certChain = `${x509.certificatePEM}\\n${certChain}`\n            }\n          }\n          if (certChain.length > 0) {\n            meta.x509.certificateChainPEM = certChain\n            const x5c = pemCertChainTox5c(certChain)\n            if (!x509.certificateChainURL) {\n              // Do not put the chain in the JWK when the chain is hosted. We do put it in the x509 metadata\n              // @ts-ignore\n              publicKeyJwk.x5c = x5c\n            }\n            meta.x509.x5c = x5c\n          }\n          if (x509.certificateChainURL) {\n            // @ts-ignore\n            publicKeyJwk.x5u = x509.certificateChainURL\n            meta.x509.x5u = x509.certificateChainURL\n          }\n        }\n\n        key = {\n          type: args.type,\n          kid: args.alias ?? meta?.x509?.cn ?? publicKeyHex,\n          publicKeyHex,\n          meta: {\n            ...meta,\n            // todo: could als be DSA etc\n            algorithms: ['RS256', 'RS512', 'PS256', 'PS512'],\n            publicKeyJwk,\n            publicKeyPEM,\n          },\n        }\n        break\n      }\n\n      default:\n        throw Error('not_supported: Key type not supported: ' + args.type)\n    }\n    return key as ManagedKeyInfo\n  }\n\n  /**\n   * @returns a base64url encoded signature for the `RS256` alg\n   */\n  private async signRSA(privateKey: ManagedPrivateKey, data: Uint8Array, signingAlgorithm: string): Promise<string> {\n    const { hashAlgorithm, scheme } = signAlgorithmToSchemeAndHashAlg(signingAlgorithm)\n    const signer = new RSASigner(PEMToJwk(hexToPEM(privateKey.privateKeyHex, 'private'), 'private'), { hashAlgorithm, scheme })\n    const signature = await signer.sign(data)\n    return signature as string\n  }\n\n  private async verifyRSA(publicKeyHex: string, data: Uint8Array, signingAlgorithm: string, signature: string) {\n    const { hashAlgorithm, scheme } = signAlgorithmToSchemeAndHashAlg(signingAlgorithm)\n    const signer = new RSASigner(PEMToJwk(hexToPEM(publicKeyHex, 'public'), 'public'), { hashAlgorithm, scheme })\n    return await signer.verify(data, signature)\n  }\n\n  public async listKeys(): Promise<Array<ManagedKeyInfo>> {\n    return (await this.privateKeyStore.list({})).map((privateKey: ManagedPrivateKey) => this.asSphereonManagedKeyInfo(privateKey))\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAGA;;;;;;;;ACHA,yBAA+E;AAI/E,uBAAoC;AACpC,mBAAkB;AAClB,sBAAqB;AAErB,UAAqB;AAGrB,IAAAA,sBAQO;AAVP,IAAM,EAAEC,WAAU,IAAKC;AAYvB,IAAMC,YAAQC,aAAAA,SAAM,oBAAA;AAEb,IAAMC,8BAAN,cAA0CC,qCAAAA;EAvBjD,OAuBiDA;;;EAC9BC;EAEjBC,YAAYC,UAAmC;AAC7C,UAAMA,QAAAA;AACN,SAAKF,kBAAkBE;EACzB;EAEA,MAAMC,UAAUC,MAA+F;AAC7G,YAAQA,KAAKC,MAAI;MACf,KAAKC,QAAQC,WAAWC,SAAQ;AAC9B,YAAI,CAACJ,KAAKK,iBAAiB,CAACL,KAAKM,cAAc;AAC7C,gBAAM,IAAIC,MAAM,qFAAA;QAClB;AACA,cAAMC,aAAa,KAAKC,yBAAyB;UAC/C,GAAGT;UACHU,OAAOV,KAAKW;UACZN,eAAeL,KAAKK;UACpBC,cAAcN,KAAKM;UACnBL,MAAMD,KAAKC;QACb,CAAA;AACA,cAAM,KAAKL,gBAAgBgB,OAAO;UAAEF,OAAOF,WAAWG;UAAK,GAAGX;QAAK,CAAA;AACnER,cAAM,gBAAgBgB,WAAWP,MAAMO,WAAWF,YAAY;AAC9D,eAAOE;MAET,KAAK;MACL,KAAK;;MAEL,KAAK,OAAO;AACV,YAAI,CAACR,KAAKK,iBAAiB,CAACL,KAAKa,eAAe;AAC9C,gBAAM,IAAIN,MAAM,kGAAA;QAClB;AACA,cAAMC,cAAa,KAAKC,yBAAyB;UAAEC,OAAOV,KAAKW;UAAK,GAAGX;QAAK,CAAA;AAC5E,cAAM,KAAKJ,gBAAgBgB,OAAO;UAAEF,OAAOF,YAAWG;UAAK,GAAGX;QAAK,CAAA;AACnER,cAAM,gBAAgBgB,YAAWP,MAAMO,YAAWF,YAAY;AAC9D,eAAOE;MACT;MACA;AACE,eAAO,MAAM,MAAMT,UAAUC,IAAAA;IACjC;EACF;EAEA,MAAMc,UAAU,EAAEb,KAAI,GAAiD;AACrE,QAAIc;AAEJ,YAAQd,MAAAA;MACN,KAAKC,QAAQC,YAAY;AACvB,cAAMI,MACJ,mLAAA;MAaJ;;MAGA,KAAK,OAAO;AACV,cAAMF,gBAAgB,UAAMW,0CAAsBf,IAAAA;AAClDc,cAAM,MAAM,KAAKhB,UAAU;UACzBE;UACAI;QACF,CAAA;AACA;MACF;MACA;AACEU,cAAM,MAAM,MAAMD,UAAU;UAAEb;QAAK,CAAA;IACvC;AAEAT,UAAM,eAAeS,MAAMc,IAAIT,YAAY;AAE3C,WAAOS;EACT;EAEA,MAAME,KAAK,EAAEC,QAAQC,WAAWC,KAAI,GAA0F;AAC5H,QAAIC;AACJ,QAAI;AACFA,mBAAa,MAAM,KAAKzB,gBAAgB0B,IAAI;QAAEZ,OAAOQ,OAAOP;MAAI,CAAA;IAClE,SAASY,GAAG;AACV,YAAM,IAAIhB,MAAM,6CAA6CW,OAAOP,GAAG,EAAE;IAC3E;AAEA,QAAIU,WAAWpB,SAASC,QAAQC,YAAY;AAC1C,YAAMI,MACJ,mLAAA;IAgBJ;;MAEEc,WAAWpB,SAAS,UACnB,OAAOkB,cAAc,eAAeA,cAAc,WAAWA,cAAc,WAAWA,cAAc,WAAWA,cAAc;MAC9H;AACA,aAAO,MAAM,KAAKK,QAAQH,YAAYD,MAAMD,aAAa,OAAA;IAC3D,OAAO;AACL,aAAO,MAAM,MAAMF,KAAK;QAAEC;QAAQC;QAAWC;MAAK,CAAA;IACpD;AACA,UAAMb,MAAM,gDAAgDc,WAAWpB,IAAI,EAAE;EAC/E;EAEA,MAAMwB,OAAO,EACXnB,cACAL,MACAkB,WACAC,MACAM,UAAS,GAOU;AACnB,QAAIzB,SAAS,OAAO;AAClB,aAAO,MAAM,KAAK0B,UAAUrB,cAAcc,MAAMD,aAAa,SAASO,SAAAA;IACxE;AACA,UAAMnB,MAAM,yCAAyCN,IAAAA,EAAM;EAC7D;EAEQQ,yBAAyBT,MAA0C;AACzE,QAAIe;AACJ,YAAQf,KAAKC,MAAI;MACf,KAAKC,QAAQC;AACXY,cAAM;UACJd,MAAMD,KAAKC;UACXU,KAAKX,KAAKU,SAASV,KAAKM;UACxBA,cAAcN,KAAKM;UACnBsB,MAAM;YACJC,YAAY;cAAC;;UACf;QACF;AACA;MACF,KAAK,aAAa;AAChB,cAAMC,eAAexC,WAAWU,KAAKK,cAAc0B,YAAW,GAAI,QAAA;AAClE,cAAMC,YAAY,IAAIC,gBAAAA,QAASC,GAAG,WAAA;AAClC,cAAMC,UAAUH,UAAUI,eAAeN,cAAc,KAAA;AACvD,cAAMxB,eAAe6B,QAAQE,UAAU,MAAM,KAAA;AAC7CtB,cAAM;UACJd,MAAMD,KAAKC;UACXU,KAAKX,KAAKU,SAASJ;UACnBA;UACAsB,MAAM;YACJU,mBAAeC,2CAAuB;cAAEC,SAAKC,0BAAMnC,cAAc,WAAA;YAAa,CAAA;YAC9EuB,YAAY;cAAC;cAAU;cAAY;cAAuB;cAAqB;cAAmB;;UACpG;QACF;AACA;MACF;MACA,KAAK,aAAa;AAChB,cAAMC,eAAexC,WAAWU,KAAKK,cAAc0B,YAAW,GAAI,QAAA;AAClE,cAAMW,YAAY,IAAIT,gBAAAA,QAASC,GAAG,MAAA;AAClC,cAAMC,UAAUO,UAAUN,eAAeN,cAAc,KAAA;AACvD,cAAMxB,eAAe6B,QAAQE,UAAU,MAAM,KAAA;AAC7CtB,cAAM;UACJd,MAAMD,KAAKC;UACXU,KAAKX,KAAKU,SAASJ;UACnBA;UACAsB,MAAM;YACJU,mBAAeC,2CAAuB;cAAEC,SAAKC,0BAAMnC,cAAc,WAAA;YAAa,CAAA;YAC9EuB,YAAY;cAAC;;UACf;QACF;AACA;MACF;;MAEA,KAAK,OAAO;AACV,cAAMc,OAAO3C,KAAK4B,MAAMe;AACxB,cAAM9B,gBACJ8B,MAAM9B,kBAAkBb,KAAKK,cAAcuC,SAAS,KAAA,IAAS5C,KAAKK,oBAAgBwC,8BAAS7C,KAAKK,eAAe,SAAA;AACjH,cAAMyC,mBAAeC,8BAASlC,eAAe,QAAA;AAC7C,cAAMmC,mBAAeC,8BAASH,cAAc,QAAA;AAC5C,cAAMxC,mBAAe4C,8BAASF,YAAAA;AAE9B,cAAMpB,OAAO,CAAC;AACd,YAAIe,MAAM;AACRf,eAAKe,OAAO;YACVQ,IAAIR,KAAKQ,MAAMnD,KAAKU,SAASJ;UAC/B;AACA,cAAI8C,YAAoBT,KAAKU,uBAAuB;AACpD,cAAIV,KAAKW,gBAAgB;AACvB,gBAAI,CAACF,UAAUR,SAASD,KAAKW,cAAc,GAAG;AAC5CF,0BAAY,GAAGT,KAAKW,cAAc;EAAKF,SAAAA;YACzC;UACF;AACA,cAAIA,UAAUG,SAAS,GAAG;AACxB3B,iBAAKe,KAAKU,sBAAsBD;AAChC,kBAAMI,UAAMC,uCAAkBL,SAAAA;AAC9B,gBAAI,CAACT,KAAKe,qBAAqB;AAG7BZ,2BAAaU,MAAMA;YACrB;AACA5B,iBAAKe,KAAKa,MAAMA;UAClB;AACA,cAAIb,KAAKe,qBAAqB;AAE5BZ,yBAAaa,MAAMhB,KAAKe;AACxB9B,iBAAKe,KAAKgB,MAAMhB,KAAKe;UACvB;QACF;AAEA3C,cAAM;UACJd,MAAMD,KAAKC;UACXU,KAAKX,KAAKU,SAASkB,MAAMe,MAAMQ,MAAM7C;UACrCA;UACAsB,MAAM;YACJ,GAAGA;;YAEHC,YAAY;cAAC;cAAS;cAAS;cAAS;;YACxCiB;YACAE;UACF;QACF;AACA;MACF;MAEA;AACE,cAAMzC,MAAM,4CAA4CP,KAAKC,IAAI;IACrE;AACA,WAAOc;EACT;;;;EAKA,MAAcS,QAAQH,YAA+BD,MAAkBwC,kBAA2C;AAChH,UAAM,EAAEC,eAAeC,OAAM,QAAKC,qDAAgCH,gBAAAA;AAClE,UAAMI,SAAS,IAAIC,kCAAUlB,kCAASF,8BAASxB,WAAWhB,eAAe,SAAA,GAAY,SAAA,GAAY;MAAEwD;MAAeC;IAAO,CAAA;AACzH,UAAMpC,YAAY,MAAMsC,OAAO/C,KAAKG,IAAAA;AACpC,WAAOM;EACT;EAEA,MAAcC,UAAUrB,cAAsBc,MAAkBwC,kBAA0BlC,WAAmB;AAC3G,UAAM,EAAEmC,eAAeC,OAAM,QAAKC,qDAAgCH,gBAAAA;AAClE,UAAMI,SAAS,IAAIC,kCAAUlB,kCAASF,8BAASvC,cAAc,QAAA,GAAW,QAAA,GAAW;MAAEuD;MAAeC;IAAO,CAAA;AAC3G,WAAO,MAAME,OAAOvC,OAAOL,MAAMM,SAAAA;EACnC;EAEA,MAAawC,WAA2C;AACtD,YAAQ,MAAM,KAAKtE,gBAAgBuE,KAAK,CAAC,CAAA,GAAIC,IAAI,CAAC/C,eAAkC,KAAKZ,yBAAyBY,UAAAA,CAAAA;EACpH;AACF;;;ADtRA,0BAAc,8BAFd;AAgBO,IAAKgD,UAAAA,yBAAAA,UAAAA;;SAAAA;;","names":["import_ssi_sdk_ext","fromString","u8a","debug","Debug","SphereonKeyManagementSystem","KeyManagementSystem","privateKeyStore","constructor","keyStore","importKey","args","type","KeyType","Bls12381G2","toString","privateKeyHex","publicKeyHex","Error","managedKey","asSphereonManagedKeyInfo","alias","kid","import","privateKeyPEM","createKey","key","generatePrivateKeyHex","sign","keyRef","algorithm","data","privateKey","get","e","signRSA","verify","signature","verifyRSA","meta","algorithms","privateBytes","toLowerCase","secp256k1","elliptic","ec","keyPair","keyFromPrivate","getPublic","jwkThumbprint","calculateJwkThumbprint","jwk","toJwk","secp256r1","x509","includes","hexToPEM","publicKeyJwk","PEMToJwk","publicKeyPEM","jwkToPEM","PEMToHex","cn","certChain","certificateChainPEM","certificatePEM","length","x5c","pemCertChainTox5c","certificateChainURL","x5u","signingAlgorithm","hashAlgorithm","scheme","signAlgorithmToSchemeAndHashAlg","signer","RSASigner","listKeys","list","map","KeyType"]}

package/dist/tsdoc-metadata.json

@@ -5,7 +5,7 @@
   "toolPackages": [
     {
       "packageName": "@microsoft/api-extractor",
-      "packageVersion": "7.52.3"
+      "packageVersion": "7.52.4"
     }
   ]
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@sphereon/ssi-sdk-ext.kms-local",
   "description": "Sphereon Local Key Management System with support for BLS/BBS+, RSA keys",
-  "version": "0.28.1-feature.esm.cjs.11+5582cc4",
+  "version": "0.28.1-feature.esm.cjs.14+b36311c",
   "source": "./src/index.ts",
   "type": "module",
   "main": "./dist/index.cjs",
@@ -22,9 +22,9 @@
     "generate-plugin-schema": "sphereon dev generate-plugin-schema"
   },
   "dependencies": {
-    "@sphereon/ssi-sdk-ext.did-utils": "^0.28.1-feature.esm.cjs.11+5582cc4",
-    "@sphereon/ssi-sdk-ext.key-utils": "^0.28.1-feature.esm.cjs.11+5582cc4",
-    "@sphereon/ssi-sdk-ext.x509-utils": "^0.28.1-feature.esm.cjs.11+5582cc4",
+    "@sphereon/ssi-sdk-ext.did-utils": "^0.28.1-feature.esm.cjs.14+b36311c",
+    "@sphereon/ssi-sdk-ext.key-utils": "^0.28.1-feature.esm.cjs.14+b36311c",
+    "@sphereon/ssi-sdk-ext.x509-utils": "^0.28.1-feature.esm.cjs.14+b36311c",
     "@trust/keyto": "2.0.0-alpha1",
     "@veramo/core": "4.2.0",
     "@veramo/key-manager": "4.2.0",
@@ -35,7 +35,7 @@
   },
   "devDependencies": {
     "@sphereon/jsencrypt": "3.3.2-unstable.0",
-    "@sphereon/ssi-sdk.dev": " ^0.33",
+    "@sphereon/ssi-sdk.dev": "0.33.1-feature.vcdm2.tsup.26",
     "@types/elliptic": "6.4.14",
     "@veramo/cli": "4.2.0"
   },
@@ -57,5 +57,5 @@
     "kms",
     "Veramo"
   ],
-  "gitHead": "5582cc49ffc25ef9cef9d3b42ff7aad59ca3a480"
+  "gitHead": "b36311cef728bb778039501d6671890fdbdf9334"
 }