@sphereon/ssi-sdk-ext.kms-local 0.28.1-feature.jose.vcdm.52 → 0.28.1-feature.oyd.cmsm.improv.20

package/dist/{index.d.cts → SphereonKeyManagementSystem.d.ts}

@@ -1,10 +1,7 @@
-import { X509Opts } from '@sphereon/ssi-sdk-ext.key-utils';
-import { MinimalImportableKey, ManagedKeyInfo, TKeyType, IKey, KeyMetadata } from '@veramo/core';
+import { IKey, ManagedKeyInfo, MinimalImportableKey, TKeyType } from '@veramo/core';
 import { AbstractPrivateKeyStore } from '@veramo/key-manager';
 import { KeyManagementSystem } from '@veramo/kms-local';
-export * from '@veramo/kms-local';
-
-declare class SphereonKeyManagementSystem extends KeyManagementSystem {
+export declare class SphereonKeyManagementSystem extends KeyManagementSystem {
     private readonly privateKeyStore;
     constructor(keyStore: AbstractPrivateKeyStore);
     importKey(args: Omit<MinimalImportableKey, 'kms'> & {
@@ -33,20 +30,4 @@ declare class SphereonKeyManagementSystem extends KeyManagementSystem {
     private verifyRSA;
     listKeys(): Promise<Array<ManagedKeyInfo>>;
 }
-
-interface ManagedKeyInfoArgs {
-    alias?: string;
-    type: TKeyType;
-    privateKeyHex: string;
-    publicKeyHex?: string;
-    meta?: ManageKeyInfoMeta | undefined | null;
-}
-interface ManageKeyInfoMeta extends KeyMetadata {
-    x509?: X509Opts;
-    [x: string]: any;
-}
-declare enum KeyType {
-    Bls12381G2 = "Bls12381G2"
-}
-
-export { KeyType, type ManageKeyInfoMeta, type ManagedKeyInfoArgs, SphereonKeyManagementSystem };
+//# sourceMappingURL=SphereonKeyManagementSystem.d.ts.map

package/dist/SphereonKeyManagementSystem.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SphereonKeyManagementSystem.d.ts","sourceRoot":"","sources":["../src/SphereonKeyManagementSystem.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,oBAAoB,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAA;AACnF,OAAO,EAAE,uBAAuB,EAAqB,MAAM,qBAAqB,CAAA;AAChF,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAA;AAiBvD,qBAAa,2BAA4B,SAAQ,mBAAmB;IAClE,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAyB;gBAE7C,QAAQ,EAAE,uBAAuB;IAKvC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,oBAAoB,EAAE,KAAK,CAAC,GAAG;QAAE,aAAa,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,cAAc,CAAC;IAkCxG,SAAS,CAAC,EAAE,IAAI,EAAE,EAAE;QAAE,IAAI,EAAE,QAAQ,CAAA;KAAE,GAAG,OAAO,CAAC,cAAc,CAAC;IAuChE,IAAI,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE;QAAE,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,UAAU,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IAsCvH,MAAM,CAAC,EACX,YAAY,EACZ,IAAI,EACJ,SAAS,EACT,IAAI,EACJ,SAAS,GACV,EAAE;QACD,YAAY,EAAE,MAAM,CAAA;QACpB,IAAI,EAAE,QAAQ,CAAA;QACd,SAAS,CAAC,EAAE,MAAM,CAAA;QAClB,IAAI,EAAE,UAAU,CAAA;QAChB,SAAS,EAAE,MAAM,CAAA;KAClB,GAAG,OAAO,CAAC,OAAO,CAAC;IAOpB,OAAO,CAAC,wBAAwB;IAuGhC;;OAEG;YACW,OAAO;YAOP,SAAS;IAMV,QAAQ,IAAI,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;CAGxD"}

package/dist/SphereonKeyManagementSystem.js

@@ -0,0 +1,290 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SphereonKeyManagementSystem = void 0;
+const ssi_sdk_ext_key_utils_1 = require("@sphereon/ssi-sdk-ext.key-utils");
+const kms_local_1 = require("@veramo/kms-local");
+const debug_1 = __importDefault(require("debug"));
+const elliptic_1 = __importDefault(require("elliptic"));
+const u8a = __importStar(require("uint8arrays"));
+const index_1 = require("./index");
+const ssi_sdk_ext_x509_utils_1 = require("@sphereon/ssi-sdk-ext.x509-utils");
+const debug = (0, debug_1.default)('sphereon:kms:local');
+class SphereonKeyManagementSystem extends kms_local_1.KeyManagementSystem {
+    constructor(keyStore) {
+        super(keyStore);
+        this.privateKeyStore = keyStore;
+    }
+    importKey(args) {
+        const _super = Object.create(null, {
+            importKey: { get: () => super.importKey }
+        });
+        return __awaiter(this, void 0, void 0, function* () {
+            switch (args.type) {
+                case index_1.KeyType.Bls12381G2.toString():
+                    if (!args.privateKeyHex || !args.publicKeyHex) {
+                        throw new Error('invalid_argument: type, publicKeyHex and privateKeyHex are required to import a key');
+                    }
+                    const managedKey = this.asSphereonManagedKeyInfo(Object.assign(Object.assign({}, args), { alias: args.kid, privateKeyHex: args.privateKeyHex, publicKeyHex: args.publicKeyHex, type: args.type }));
+                    yield this.privateKeyStore.import(Object.assign({ alias: managedKey.kid }, args));
+                    debug('imported key', managedKey.type, managedKey.publicKeyHex);
+                    return managedKey;
+                case 'Secp256k1':
+                case 'Secp256r1':
+                // @ts-ignore
+                case 'RSA': {
+                    if (!args.privateKeyHex && !args.privateKeyPEM) {
+                        throw new Error('invalid_argument: type and privateKeyHex (or privateKeyPEM for RSA) are required to import a key');
+                    }
+                    const managedKey = this.asSphereonManagedKeyInfo(Object.assign({ alias: args.kid }, args));
+                    yield this.privateKeyStore.import(Object.assign({ alias: managedKey.kid }, args));
+                    debug('imported key', managedKey.type, managedKey.publicKeyHex);
+                    return managedKey;
+                }
+                default:
+                    return yield _super.importKey.call(this, args);
+            }
+        });
+    }
+    createKey(_a) {
+        const _super = Object.create(null, {
+            createKey: { get: () => super.createKey }
+        });
+        return __awaiter(this, arguments, void 0, function* ({ type }) {
+            let key;
+            switch (type) {
+                case index_1.KeyType.Bls12381G2: {
+                    throw Error('BLS support not available because upstream is not really providing Windows and React-Native support; giving too much headache. We soon will move to @digitalbazaar/bbs-signatures');
+                    /*// @ts-ignore
+                    const bbs = await import('@digitalbazaar/bbs-signatures')
+                    const keyPairBls12381G2 = await bbs.generateKeyPair({
+                      ciphersuite: 'BLS12-381-SHA-256'
+                    })
+                    key = await this.importKey({
+                      type,
+                      privateKeyHex: Buffer.from(keyPairBls12381G2.secretKey).toString('hex'),
+                      publicKeyHex: Buffer.from(keyPairBls12381G2.publicKey).toString('hex'),
+                    })
+                    break*/
+                }
+                // @ts-ignore
+                case 'RSA': {
+                    const privateKeyHex = yield (0, ssi_sdk_ext_key_utils_1.generatePrivateKeyHex)(type);
+                    key = yield this.importKey({
+                        type,
+                        privateKeyHex,
+                    });
+                    break;
+                }
+                default:
+                    key = yield _super.createKey.call(this, { type });
+            }
+            debug('Created key', type, key.publicKeyHex);
+            return key;
+        });
+    }
+    sign(_a) {
+        const _super = Object.create(null, {
+            sign: { get: () => super.sign }
+        });
+        return __awaiter(this, arguments, void 0, function* ({ keyRef, algorithm, data }) {
+            let privateKey;
+            try {
+                privateKey = yield this.privateKeyStore.get({ alias: keyRef.kid });
+            }
+            catch (e) {
+                throw new Error(`key_not_found: No key entry found for kid=${keyRef.kid}`);
+            }
+            if (privateKey.type === index_1.KeyType.Bls12381G2) {
+                throw Error('BLS support not available because upstream is not really providing Windows and React-Native support; giving too much headache. We soon will move to @digitalbazaar/bbs-signatures');
+                /*// @ts-ignore
+                const bbs = await import('@digitalbazaar/bbs-signatures')
+                if (!data || Array.isArray(data)) {
+                  throw new Error('Data must be defined and cannot be an array')
+                }
+                const keyPair = {
+                  keyPair: {
+                    secretKey: Uint8Array.from(Buffer.from(privateKey.privateKeyHex, 'hex')),
+                    publicKey: Uint8Array.from(Buffer.from(keyRef.kid, 'hex')),
+                  },
+                  messages: [data],
+                }
+                const signature = await bbs.sign({secretKey: privateKey, publicKey, header, messages});
+                return signature*/
+            }
+            else if (
+            // @ts-ignore
+            privateKey.type === 'RSA' &&
+                (typeof algorithm === 'undefined' || algorithm === 'RS256' || algorithm === 'RS512' || algorithm === 'PS256' || algorithm === 'PS512')) {
+                return yield this.signRSA(privateKey, data, algorithm !== null && algorithm !== void 0 ? algorithm : 'PS256');
+            }
+            else {
+                return yield _super.sign.call(this, { keyRef, algorithm, data });
+            }
+            throw Error(`not_supported: Cannot sign using key of type ${privateKey.type}`);
+        });
+    }
+    verify(_a) {
+        return __awaiter(this, arguments, void 0, function* ({ publicKeyHex, type, algorithm, data, signature, }) {
+            if (type === 'RSA') {
+                return yield this.verifyRSA(publicKeyHex, data, algorithm !== null && algorithm !== void 0 ? algorithm : 'PS256', signature);
+            }
+            throw Error(`KMS verify is not implemented yet for ${type}`);
+        });
+    }
+    asSphereonManagedKeyInfo(args) {
+        var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l;
+        let key;
+        switch (args.type) {
+            case index_1.KeyType.Bls12381G2:
+                key = {
+                    type: args.type,
+                    kid: (_a = args.alias) !== null && _a !== void 0 ? _a : args.publicKeyHex,
+                    publicKeyHex: args.publicKeyHex,
+                    meta: {
+                        algorithms: ['BLS'],
+                    },
+                };
+                break;
+            case 'Secp256k1': {
+                const privateBytes = u8a.fromString(args.privateKeyHex.toLowerCase(), 'base16');
+                const secp256k1 = new elliptic_1.default.ec('secp256k1');
+                const keyPair = secp256k1.keyFromPrivate(privateBytes, 'hex');
+                const publicKeyHex = keyPair.getPublic(true, 'hex');
+                key = {
+                    type: args.type,
+                    kid: (_b = args.alias) !== null && _b !== void 0 ? _b : publicKeyHex,
+                    publicKeyHex,
+                    meta: {
+                        jwkThumbprint: (0, ssi_sdk_ext_key_utils_1.calculateJwkThumbprint)({ jwk: (0, ssi_sdk_ext_key_utils_1.toJwk)(publicKeyHex, 'Secp256k1') }),
+                        algorithms: ['ES256K', 'ES256K-R', 'eth_signTransaction', 'eth_signTypedData', 'eth_signMessage', 'eth_rawSign'],
+                    },
+                };
+                break;
+            }
+            case 'Secp256r1': {
+                const privateBytes = u8a.fromString(args.privateKeyHex.toLowerCase(), 'base16');
+                const secp256r1 = new elliptic_1.default.ec('p256');
+                const keyPair = secp256r1.keyFromPrivate(privateBytes, 'hex');
+                const publicKeyHex = keyPair.getPublic(true, 'hex');
+                key = {
+                    type: args.type,
+                    kid: (_c = args.alias) !== null && _c !== void 0 ? _c : publicKeyHex,
+                    publicKeyHex,
+                    meta: {
+                        jwkThumbprint: (0, ssi_sdk_ext_key_utils_1.calculateJwkThumbprint)({ jwk: (0, ssi_sdk_ext_key_utils_1.toJwk)(publicKeyHex, 'Secp256r1') }),
+                        algorithms: ['ES256'],
+                    },
+                };
+                break;
+            }
+            // @ts-ignore
+            case 'RSA': {
+                const x509 = (_d = args.meta) === null || _d === void 0 ? void 0 : _d.x509;
+                const privateKeyPEM = (_e = x509 === null || x509 === void 0 ? void 0 : x509.privateKeyPEM) !== null && _e !== void 0 ? _e : (args.privateKeyHex.includes('---') ? args.privateKeyHex : (0, ssi_sdk_ext_x509_utils_1.hexToPEM)(args.privateKeyHex, 'private')); // In case we have x509 opts, the private key hex really was a PEM already (yuck)
+                const publicKeyJwk = (0, ssi_sdk_ext_x509_utils_1.PEMToJwk)(privateKeyPEM, 'public');
+                const publicKeyPEM = (0, ssi_sdk_ext_x509_utils_1.jwkToPEM)(publicKeyJwk, 'public');
+                const publicKeyHex = (0, ssi_sdk_ext_x509_utils_1.PEMToHex)(publicKeyPEM);
+                const meta = {};
+                if (x509) {
+                    meta.x509 = {
+                        cn: (_g = (_f = x509.cn) !== null && _f !== void 0 ? _f : args.alias) !== null && _g !== void 0 ? _g : publicKeyHex,
+                    };
+                    let certChain = (_h = x509.certificateChainPEM) !== null && _h !== void 0 ? _h : '';
+                    if (x509.certificatePEM) {
+                        if (!certChain.includes(x509.certificatePEM)) {
+                            certChain = `${x509.certificatePEM}\n${certChain}`;
+                        }
+                    }
+                    if (certChain.length > 0) {
+                        meta.x509.certificateChainPEM = certChain;
+                        const x5c = (0, ssi_sdk_ext_x509_utils_1.pemCertChainTox5c)(certChain);
+                        if (!x509.certificateChainURL) {
+                            // Do not put the chain in the JWK when the chain is hosted. We do put it in the x509 metadata
+                            // @ts-ignore
+                            publicKeyJwk.x5c = x5c;
+                        }
+                        meta.x509.x5c = x5c;
+                    }
+                    if (x509.certificateChainURL) {
+                        // @ts-ignore
+                        publicKeyJwk.x5u = x509.certificateChainURL;
+                        meta.x509.x5u = x509.certificateChainURL;
+                    }
+                }
+                key = {
+                    type: args.type,
+                    kid: (_l = (_j = args.alias) !== null && _j !== void 0 ? _j : (_k = meta === null || meta === void 0 ? void 0 : meta.x509) === null || _k === void 0 ? void 0 : _k.cn) !== null && _l !== void 0 ? _l : publicKeyHex,
+                    publicKeyHex,
+                    meta: Object.assign(Object.assign({}, meta), { 
+                        // todo: could als be DSA etc
+                        algorithms: ['RS256', 'RS512', 'PS256', 'PS512'], publicKeyJwk,
+                        publicKeyPEM }),
+                };
+                break;
+            }
+            default:
+                throw Error('not_supported: Key type not supported: ' + args.type);
+        }
+        return key;
+    }
+    /**
+     * @returns a base64url encoded signature for the `RS256` alg
+     */
+    signRSA(privateKey, data, signingAlgorithm) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const { hashAlgorithm, scheme } = (0, ssi_sdk_ext_x509_utils_1.signAlgorithmToSchemeAndHashAlg)(signingAlgorithm);
+            const signer = new ssi_sdk_ext_x509_utils_1.RSASigner((0, ssi_sdk_ext_x509_utils_1.PEMToJwk)((0, ssi_sdk_ext_x509_utils_1.hexToPEM)(privateKey.privateKeyHex, 'private'), 'private'), { hashAlgorithm, scheme });
+            const signature = yield signer.sign(data);
+            return signature;
+        });
+    }
+    verifyRSA(publicKeyHex, data, signingAlgorithm, signature) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const { hashAlgorithm, scheme } = (0, ssi_sdk_ext_x509_utils_1.signAlgorithmToSchemeAndHashAlg)(signingAlgorithm);
+            const signer = new ssi_sdk_ext_x509_utils_1.RSASigner((0, ssi_sdk_ext_x509_utils_1.PEMToJwk)((0, ssi_sdk_ext_x509_utils_1.hexToPEM)(publicKeyHex, 'public'), 'public'), { hashAlgorithm, scheme });
+            return yield signer.verify(data, signature);
+        });
+    }
+    listKeys() {
+        return __awaiter(this, void 0, void 0, function* () {
+            return (yield this.privateKeyStore.list({})).map((privateKey) => this.asSphereonManagedKeyInfo(privateKey));
+        });
+    }
+}
+exports.SphereonKeyManagementSystem = SphereonKeyManagementSystem;
+//# sourceMappingURL=SphereonKeyManagementSystem.js.map

package/dist/SphereonKeyManagementSystem.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SphereonKeyManagementSystem.js","sourceRoot":"","sources":["../src/SphereonKeyManagementSystem.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2EAAgH;AAIhH,iDAAuD;AACvD,kDAAyB;AACzB,wDAA+B;AAC/B,iDAAkC;AAClC,mCAAqD;AACrD,6EAQyC;AAEzC,MAAM,KAAK,GAAG,IAAA,eAAK,EAAC,oBAAoB,CAAC,CAAA;AAEzC,MAAa,2BAA4B,SAAQ,+BAAmB;IAGlE,YAAY,QAAiC;QAC3C,KAAK,CAAC,QAAQ,CAAC,CAAA;QACf,IAAI,CAAC,eAAe,GAAG,QAAQ,CAAA;IACjC,CAAC;IAEK,SAAS,CAAC,IAAoE;;;;;YAClF,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;gBAClB,KAAK,eAAO,CAAC,UAAU,CAAC,QAAQ,EAAE;oBAChC,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;wBAC9C,MAAM,IAAI,KAAK,CAAC,qFAAqF,CAAC,CAAA;oBACxG,CAAC;oBACD,MAAM,UAAU,GAAG,IAAI,CAAC,wBAAwB,iCAC3C,IAAI,KACP,KAAK,EAAE,IAAI,CAAC,GAAG,EACf,aAAa,EAAE,IAAI,CAAC,aAAa,EACjC,YAAY,EAAE,IAAI,CAAC,YAAY,EAC/B,IAAI,EAAE,IAAI,CAAC,IAAI,IACf,CAAA;oBACF,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,iBAAG,KAAK,EAAE,UAAU,CAAC,GAAG,IAAK,IAAI,EAAG,CAAA;oBACrE,KAAK,CAAC,cAAc,EAAE,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,YAAY,CAAC,CAAA;oBAC/D,OAAO,UAAU,CAAA;gBAEnB,KAAK,WAAW,CAAC;gBACjB,KAAK,WAAW,CAAC;gBACjB,aAAa;gBACb,KAAK,KAAK,CAAC,CAAC,CAAC;oBACX,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;wBAC/C,MAAM,IAAI,KAAK,CAAC,kGAAkG,CAAC,CAAA;oBACrH,CAAC;oBACD,MAAM,UAAU,GAAG,IAAI,CAAC,wBAAwB,iBAAG,KAAK,EAAE,IAAI,CAAC,GAAG,IAAK,IAAI,EAAG,CAAA;oBAC9E,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,iBAAG,KAAK,EAAE,UAAU,CAAC,GAAG,IAAK,IAAI,EAAG,CAAA;oBACrE,KAAK,CAAC,cAAc,EAAE,UAAU,CAAC,IAAI,EAAE,UAAU,CAAC,YAAY,CAAC,CAAA;oBAC/D,OAAO,UAAU,CAAA;gBACnB,CAAC;gBACD;oBACE,OAAO,MAAM,OAAM,SAAS,YAAC,IAAI,CAAC,CAAA;YACtC,CAAC;QACH,CAAC;KAAA;IAEK,SAAS;;;;6DAAC,EAAE,IAAI,EAAsB;YAC1C,IAAI,GAAmB,CAAA;YAEvB,QAAQ,IAAI,EAAE,CAAC;gBACb,KAAK,eAAO,CAAC,UAAU,CAAC,CAAC,CAAC;oBACxB,MAAM,KAAK,CACT,mLAAmL,CACpL,CAAA;oBACD;;;;;;;;;;2BAUO;gBACT,CAAC;gBAED,aAAa;gBACb,KAAK,KAAK,CAAC,CAAC,CAAC;oBACX,MAAM,aAAa,GAAG,MAAM,IAAA,6CAAqB,EAAC,IAAI,CAAC,CAAA;oBACvD,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC;wBACzB,IAAI;wBACJ,aAAa;qBACd,CAAC,CAAA;oBACF,MAAK;gBACP,CAAC;gBACD;oBACE,GAAG,GAAG,MAAM,OAAM,SAAS,YAAC,EAAE,IAAI,EAAE,CAAC,CAAA;YACzC,CAAC;YAED,KAAK,CAAC,aAAa,EAAE,IAAI,EAAE,GAAG,CAAC,YAAY,CAAC,CAAA;YAE5C,OAAO,GAAG,CAAA;QACZ,CAAC;KAAA;IAEK,IAAI;;;;6DAAC,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAuE;YACzG,IAAI,UAA6B,CAAA;YACjC,IAAI,CAAC;gBACH,UAAU,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAA;YACpE,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,MAAM,IAAI,KAAK,CAAC,6CAA6C,MAAM,CAAC,GAAG,EAAE,CAAC,CAAA;YAC5E,CAAC;YAED,IAAI,UAAU,CAAC,IAAI,KAAK,eAAO,CAAC,UAAU,EAAE,CAAC;gBAC3C,MAAM,KAAK,CACT,mLAAmL,CACpL,CAAA;gBACD;;;;;;;;;;;;;kCAakB;YACpB,CAAC;iBAAM;YACL,aAAa;YACb,UAAU,CAAC,IAAI,KAAK,KAAK;gBACzB,CAAC,OAAO,SAAS,KAAK,WAAW,IAAI,SAAS,KAAK,OAAO,IAAI,SAAS,KAAK,OAAO,IAAI,SAAS,KAAK,OAAO,IAAI,SAAS,KAAK,OAAO,CAAC,EACtI,CAAC;gBACD,OAAO,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,EAAE,SAAS,aAAT,SAAS,cAAT,SAAS,GAAI,OAAO,CAAC,CAAA;YACnE,CAAC;iBAAM,CAAC;gBACN,OAAO,MAAM,OAAM,IAAI,YAAC,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;YACtD,CAAC;YACD,MAAM,KAAK,CAAC,gDAAgD,UAAU,CAAC,IAAI,EAAE,CAAC,CAAA;QAChF,CAAC;KAAA;IAEK,MAAM;6DAAC,EACX,YAAY,EACZ,IAAI,EACJ,SAAS,EACT,IAAI,EACJ,SAAS,GAOV;YACC,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;gBACnB,OAAO,MAAM,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,IAAI,EAAE,SAAS,aAAT,SAAS,cAAT,SAAS,GAAI,OAAO,EAAE,SAAS,CAAC,CAAA;YAClF,CAAC;YACD,MAAM,KAAK,CAAC,yCAAyC,IAAI,EAAE,CAAC,CAAA;QAC9D,CAAC;KAAA;IAEO,wBAAwB,CAAC,IAAwB;;QACvD,IAAI,GAA4B,CAAA;QAChC,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;YAClB,KAAK,eAAO,CAAC,UAAU;gBACrB,GAAG,GAAG;oBACJ,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,GAAG,EAAE,MAAA,IAAI,CAAC,KAAK,mCAAI,IAAI,CAAC,YAAY;oBACpC,YAAY,EAAE,IAAI,CAAC,YAAY;oBAC/B,IAAI,EAAE;wBACJ,UAAU,EAAE,CAAC,KAAK,CAAC;qBACpB;iBACF,CAAA;gBACD,MAAK;YACP,KAAK,WAAW,CAAC,CAAC,CAAC;gBACjB,MAAM,YAAY,GAAG,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,EAAE,QAAQ,CAAC,CAAA;gBAC/E,MAAM,SAAS,GAAG,IAAI,kBAAQ,CAAC,EAAE,CAAC,WAAW,CAAC,CAAA;gBAC9C,MAAM,OAAO,GAAG,SAAS,CAAC,cAAc,CAAC,YAAY,EAAE,KAAK,CAAC,CAAA;gBAC7D,MAAM,YAAY,GAAG,OAAO,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;gBACnD,GAAG,GAAG;oBACJ,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,GAAG,EAAE,MAAA,IAAI,CAAC,KAAK,mCAAI,YAAY;oBAC/B,YAAY;oBACZ,IAAI,EAAE;wBACJ,aAAa,EAAE,IAAA,8CAAsB,EAAC,EAAE,GAAG,EAAE,IAAA,6BAAK,EAAC,YAAY,EAAE,WAAW,CAAC,EAAE,CAAC;wBAChF,UAAU,EAAE,CAAC,QAAQ,EAAE,UAAU,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,aAAa,CAAC;qBACjH;iBACF,CAAA;gBACD,MAAK;YACP,CAAC;YACD,KAAK,WAAW,CAAC,CAAC,CAAC;gBACjB,MAAM,YAAY,GAAG,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,EAAE,QAAQ,CAAC,CAAA;gBAC/E,MAAM,SAAS,GAAG,IAAI,kBAAQ,CAAC,EAAE,CAAC,MAAM,CAAC,CAAA;gBACzC,MAAM,OAAO,GAAG,SAAS,CAAC,cAAc,CAAC,YAAY,EAAE,KAAK,CAAC,CAAA;gBAC7D,MAAM,YAAY,GAAG,OAAO,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;gBACnD,GAAG,GAAG;oBACJ,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,GAAG,EAAE,MAAA,IAAI,CAAC,KAAK,mCAAI,YAAY;oBAC/B,YAAY;oBACZ,IAAI,EAAE;wBACJ,aAAa,EAAE,IAAA,8CAAsB,EAAC,EAAE,GAAG,EAAE,IAAA,6BAAK,EAAC,YAAY,EAAE,WAAW,CAAC,EAAE,CAAC;wBAChF,UAAU,EAAE,CAAC,OAAO,CAAC;qBACtB;iBACF,CAAA;gBACD,MAAK;YACP,CAAC;YACD,aAAa;YACb,KAAK,KAAK,CAAC,CAAC,CAAC;gBACX,MAAM,IAAI,GAAG,MAAA,IAAI,CAAC,IAAI,0CAAE,IAAgB,CAAA;gBACxC,MAAM,aAAa,GACjB,MAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,aAAa,mCAAI,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAA,iCAAQ,EAAC,IAAI,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC,CAAA,CAAC,iFAAiF;gBAC9M,MAAM,YAAY,GAAG,IAAA,iCAAQ,EAAC,aAAa,EAAE,QAAQ,CAAC,CAAA;gBACtD,MAAM,YAAY,GAAG,IAAA,iCAAQ,EAAC,YAAY,EAAE,QAAQ,CAAC,CAAA;gBACrD,MAAM,YAAY,GAAG,IAAA,iCAAQ,EAAC,YAAY,CAAC,CAAA;gBAE3C,MAAM,IAAI,GAAG,EAAS,CAAA;gBACtB,IAAI,IAAI,EAAE,CAAC;oBACT,IAAI,CAAC,IAAI,GAAG;wBACV,EAAE,EAAE,MAAA,MAAA,IAAI,CAAC,EAAE,mCAAI,IAAI,CAAC,KAAK,mCAAI,YAAY;qBAC1C,CAAA;oBACD,IAAI,SAAS,GAAW,MAAA,IAAI,CAAC,mBAAmB,mCAAI,EAAE,CAAA;oBACtD,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;wBACxB,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;4BAC7C,SAAS,GAAG,GAAG,IAAI,CAAC,cAAc,KAAK,SAAS,EAAE,CAAA;wBACpD,CAAC;oBACH,CAAC;oBACD,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBACzB,IAAI,CAAC,IAAI,CAAC,mBAAmB,GAAG,SAAS,CAAA;wBACzC,MAAM,GAAG,GAAG,IAAA,0CAAiB,EAAC,SAAS,CAAC,CAAA;wBACxC,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,CAAC;4BAC9B,8FAA8F;4BAC9F,aAAa;4BACb,YAAY,CAAC,GAAG,GAAG,GAAG,CAAA;wBACxB,CAAC;wBACD,IAAI,CAAC,IAAI,CAAC,GAAG,GAAG,GAAG,CAAA;oBACrB,CAAC;oBACD,IAAI,IAAI,CAAC,mBAAmB,EAAE,CAAC;wBAC7B,aAAa;wBACb,YAAY,CAAC,GAAG,GAAG,IAAI,CAAC,mBAAmB,CAAA;wBAC3C,IAAI,CAAC,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,mBAAmB,CAAA;oBAC1C,CAAC;gBACH,CAAC;gBAED,GAAG,GAAG;oBACJ,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,GAAG,EAAE,MAAA,MAAA,IAAI,CAAC,KAAK,mCAAI,MAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,IAAI,0CAAE,EAAE,mCAAI,YAAY;oBACjD,YAAY;oBACZ,IAAI,kCACC,IAAI;wBACP,6BAA6B;wBAC7B,UAAU,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,EAChD,YAAY;wBACZ,YAAY,GACb;iBACF,CAAA;gBACD,MAAK;YACP,CAAC;YAED;gBACE,MAAM,KAAK,CAAC,yCAAyC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAA;QACtE,CAAC;QACD,OAAO,GAAqB,CAAA;IAC9B,CAAC;IAED;;OAEG;IACW,OAAO,CAAC,UAA6B,EAAE,IAAgB,EAAE,gBAAwB;;YAC7F,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,IAAA,wDAA+B,EAAC,gBAAgB,CAAC,CAAA;YACnF,MAAM,MAAM,GAAG,IAAI,kCAAS,CAAC,IAAA,iCAAQ,EAAC,IAAA,iCAAQ,EAAC,UAAU,CAAC,aAAa,EAAE,SAAS,CAAC,EAAE,SAAS,CAAC,EAAE,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,CAAA;YAC3H,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YACzC,OAAO,SAAmB,CAAA;QAC5B,CAAC;KAAA;IAEa,SAAS,CAAC,YAAoB,EAAE,IAAgB,EAAE,gBAAwB,EAAE,SAAiB;;YACzG,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,IAAA,wDAA+B,EAAC,gBAAgB,CAAC,CAAA;YACnF,MAAM,MAAM,GAAG,IAAI,kCAAS,CAAC,IAAA,iCAAQ,EAAC,IAAA,iCAAQ,EAAC,YAAY,EAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC,EAAE,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,CAAA;YAC7G,OAAO,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,CAAA;QAC7C,CAAC;KAAA;IAEY,QAAQ;;YACnB,OAAO,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,UAA6B,EAAE,EAAE,CAAC,IAAI,CAAC,wBAAwB,CAAC,UAAU,CAAC,CAAC,CAAA;QAChI,CAAC;KAAA;CACF;AApQD,kEAoQC"}

package/dist/index.d.ts

@@ -1,52 +1,19 @@
 import { X509Opts } from '@sphereon/ssi-sdk-ext.key-utils';
-import { MinimalImportableKey, ManagedKeyInfo, TKeyType, IKey, KeyMetadata } from '@veramo/core';
-import { AbstractPrivateKeyStore } from '@veramo/key-manager';
-import { KeyManagementSystem } from '@veramo/kms-local';
+import { KeyMetadata, TKeyType } from '@veramo/core';
+export { SphereonKeyManagementSystem } from './SphereonKeyManagementSystem';
 export * from '@veramo/kms-local';
-
-declare class SphereonKeyManagementSystem extends KeyManagementSystem {
-    private readonly privateKeyStore;
-    constructor(keyStore: AbstractPrivateKeyStore);
-    importKey(args: Omit<MinimalImportableKey, 'kms'> & {
-        privateKeyPEM?: string;
-    }): Promise<ManagedKeyInfo>;
-    createKey({ type }: {
-        type: TKeyType;
-    }): Promise<ManagedKeyInfo>;
-    sign({ keyRef, algorithm, data }: {
-        keyRef: Pick<IKey, 'kid'>;
-        algorithm?: string;
-        data: Uint8Array;
-    }): Promise<string>;
-    verify({ publicKeyHex, type, algorithm, data, signature, }: {
-        publicKeyHex: string;
-        type: TKeyType;
-        algorithm?: string;
-        data: Uint8Array;
-        signature: string;
-    }): Promise<boolean>;
-    private asSphereonManagedKeyInfo;
-    /**
-     * @returns a base64url encoded signature for the `RS256` alg
-     */
-    private signRSA;
-    private verifyRSA;
-    listKeys(): Promise<Array<ManagedKeyInfo>>;
-}
-
-interface ManagedKeyInfoArgs {
+export interface ManagedKeyInfoArgs {
     alias?: string;
     type: TKeyType;
     privateKeyHex: string;
     publicKeyHex?: string;
     meta?: ManageKeyInfoMeta | undefined | null;
 }
-interface ManageKeyInfoMeta extends KeyMetadata {
+export interface ManageKeyInfoMeta extends KeyMetadata {
     x509?: X509Opts;
     [x: string]: any;
 }
-declare enum KeyType {
+export declare enum KeyType {
     Bls12381G2 = "Bls12381G2"
 }
-
-export { KeyType, type ManageKeyInfoMeta, type ManagedKeyInfoArgs, SphereonKeyManagementSystem };
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,iCAAiC,CAAA;AAC1D,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAA;AAEpD,OAAO,EAAE,2BAA2B,EAAE,MAAM,+BAA+B,CAAA;AAE3E,cAAc,mBAAmB,CAAA;AAEjC,MAAM,WAAW,kBAAkB;IACjC,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,QAAQ,CAAA;IACd,aAAa,EAAE,MAAM,CAAA;IACrB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,IAAI,CAAC,EAAE,iBAAiB,GAAG,SAAS,GAAG,IAAI,CAAA;CAC5C;AAED,MAAM,WAAW,iBAAkB,SAAQ,WAAW;IACpD,IAAI,CAAC,EAAE,QAAQ,CAAA;IACf,CAAC,CAAC,EAAE,MAAM,GAAG,GAAG,CAAA;CACjB;AACD,oBAAY,OAAO;IACjB,UAAU,eAAe;CAC1B"}

package/dist/index.js

@@ -1,270 +1,25 @@
-var __defProp = Object.defineProperty;
-var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
-
-// src/SphereonKeyManagementSystem.ts
-import { calculateJwkThumbprint, generatePrivateKeyHex, toJwk } from "@sphereon/ssi-sdk-ext.key-utils";
-import { KeyManagementSystem } from "@veramo/kms-local";
-import Debug from "debug";
-import elliptic from "elliptic";
-import * as u8a from "uint8arrays";
-import { hexToPEM, jwkToPEM, pemCertChainTox5c, PEMToHex, PEMToJwk, RSASigner, signAlgorithmToSchemeAndHashAlg } from "@sphereon/ssi-sdk-ext.x509-utils";
-var { fromString } = u8a;
-var debug = Debug("sphereon:kms:local");
-var SphereonKeyManagementSystem = class extends KeyManagementSystem {
-  static {
-    __name(this, "SphereonKeyManagementSystem");
-  }
-  privateKeyStore;
-  constructor(keyStore) {
-    super(keyStore);
-    this.privateKeyStore = keyStore;
-  }
-  async importKey(args) {
-    switch (args.type) {
-      case KeyType.Bls12381G2.toString():
-        if (!args.privateKeyHex || !args.publicKeyHex) {
-          throw new Error("invalid_argument: type, publicKeyHex and privateKeyHex are required to import a key");
-        }
-        const managedKey = this.asSphereonManagedKeyInfo({
-          ...args,
-          alias: args.kid,
-          privateKeyHex: args.privateKeyHex,
-          publicKeyHex: args.publicKeyHex,
-          type: args.type
-        });
-        await this.privateKeyStore.import({
-          alias: managedKey.kid,
-          ...args
-        });
-        debug("imported key", managedKey.type, managedKey.publicKeyHex);
-        return managedKey;
-      case "Secp256k1":
-      case "Secp256r1":
-      // @ts-ignore
-      case "RSA": {
-        if (!args.privateKeyHex && !args.privateKeyPEM) {
-          throw new Error("invalid_argument: type and privateKeyHex (or privateKeyPEM for RSA) are required to import a key");
-        }
-        const managedKey2 = this.asSphereonManagedKeyInfo({
-          alias: args.kid,
-          ...args
-        });
-        await this.privateKeyStore.import({
-          alias: managedKey2.kid,
-          ...args
-        });
-        debug("imported key", managedKey2.type, managedKey2.publicKeyHex);
-        return managedKey2;
-      }
-      default:
-        return await super.importKey(args);
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
     }
-  }
-  async createKey({ type }) {
-    let key;
-    switch (type) {
-      case KeyType.Bls12381G2: {
-        throw Error("BLS support not available because upstream is not really providing Windows and React-Native support; giving too much headache. We soon will move to @digitalbazaar/bbs-signatures");
-      }
-      // @ts-ignore
-      case "RSA": {
-        const privateKeyHex = await generatePrivateKeyHex(type);
-        key = await this.importKey({
-          type,
-          privateKeyHex
-        });
-        break;
-      }
-      default:
-        key = await super.createKey({
-          type
-        });
-    }
-    debug("Created key", type, key.publicKeyHex);
-    return key;
-  }
-  async sign({ keyRef, algorithm, data }) {
-    let privateKey;
-    try {
-      privateKey = await this.privateKeyStore.get({
-        alias: keyRef.kid
-      });
-    } catch (e) {
-      throw new Error(`key_not_found: No key entry found for kid=${keyRef.kid}`);
-    }
-    if (privateKey.type === KeyType.Bls12381G2) {
-      throw Error("BLS support not available because upstream is not really providing Windows and React-Native support; giving too much headache. We soon will move to @digitalbazaar/bbs-signatures");
-    } else if (
-      // @ts-ignore
-      privateKey.type === "RSA"
-    ) {
-      if (typeof algorithm === "undefined" || algorithm === "RS256" || algorithm === "RS512" || algorithm === "PS256" || algorithm === "PS512") {
-        return await this.signRSA(privateKey, data, algorithm ?? "PS256");
-      }
-      return Promise.reject(new Error(`not_supported: Cannot sign using key of type RSA and alg: ${algorithm}. Only RS and PS algorithms are supported.`));
-    } else {
-      return await super.sign({
-        keyRef,
-        algorithm,
-        data
-      });
-    }
-  }
-  async verify({ publicKeyHex, type, algorithm, data, signature }) {
-    if (type === "RSA") {
-      return await this.verifyRSA(publicKeyHex, data, algorithm ?? "PS256", signature);
-    }
-    throw Error(`KMS verify is not implemented yet for ${type}`);
-  }
-  asSphereonManagedKeyInfo(args) {
-    let key;
-    switch (args.type) {
-      case KeyType.Bls12381G2:
-        key = {
-          type: args.type,
-          kid: args.alias ?? args.publicKeyHex,
-          publicKeyHex: args.publicKeyHex,
-          meta: {
-            algorithms: [
-              "BLS"
-            ]
-          }
-        };
-        break;
-      case "Secp256k1": {
-        const privateBytes = fromString(args.privateKeyHex.toLowerCase(), "base16");
-        const secp256k1 = new elliptic.ec("secp256k1");
-        const keyPair = secp256k1.keyFromPrivate(privateBytes, "hex");
-        const publicKeyHex = keyPair.getPublic(true, "hex");
-        key = {
-          type: args.type,
-          kid: args.alias ?? publicKeyHex,
-          publicKeyHex,
-          meta: {
-            jwkThumbprint: calculateJwkThumbprint({
-              jwk: toJwk(publicKeyHex, "Secp256k1")
-            }),
-            algorithms: [
-              "ES256K",
-              "ES256K-R",
-              "eth_signTransaction",
-              "eth_signTypedData",
-              "eth_signMessage",
-              "eth_rawSign"
-            ]
-          }
-        };
-        break;
-      }
-      case "Secp256r1": {
-        const privateBytes = fromString(args.privateKeyHex.toLowerCase(), "base16");
-        const secp256r1 = new elliptic.ec("p256");
-        const keyPair = secp256r1.keyFromPrivate(privateBytes, "hex");
-        const publicKeyHex = keyPair.getPublic(true, "hex");
-        key = {
-          type: args.type,
-          kid: args.alias ?? publicKeyHex,
-          publicKeyHex,
-          meta: {
-            jwkThumbprint: calculateJwkThumbprint({
-              jwk: toJwk(publicKeyHex, "Secp256r1")
-            }),
-            algorithms: [
-              "ES256"
-            ]
-          }
-        };
-        break;
-      }
-      // @ts-ignore
-      case "RSA": {
-        const x509 = args.meta?.x509;
-        const privateKeyPEM = x509?.privateKeyPEM ?? (args.privateKeyHex.includes("---") ? args.privateKeyHex : hexToPEM(args.privateKeyHex, "private"));
-        const publicKeyJwk = PEMToJwk(privateKeyPEM, "public");
-        const publicKeyPEM = jwkToPEM(publicKeyJwk, "public");
-        const publicKeyHex = PEMToHex(publicKeyPEM);
-        const meta = {};
-        if (x509) {
-          meta.x509 = {
-            cn: x509.cn ?? args.alias ?? publicKeyHex
-          };
-          let certChain = x509.certificateChainPEM ?? "";
-          if (x509.certificatePEM) {
-            if (!certChain.includes(x509.certificatePEM)) {
-              certChain = `${x509.certificatePEM}
-${certChain}`;
-            }
-          }
-          if (certChain.length > 0) {
-            meta.x509.certificateChainPEM = certChain;
-            const x5c = pemCertChainTox5c(certChain);
-            if (!x509.certificateChainURL) {
-              publicKeyJwk.x5c = x5c;
-            }
-            meta.x509.x5c = x5c;
-          }
-          if (x509.certificateChainURL) {
-            publicKeyJwk.x5u = x509.certificateChainURL;
-            meta.x509.x5u = x509.certificateChainURL;
-          }
-        }
-        key = {
-          type: args.type,
-          kid: args.alias ?? meta?.x509?.cn ?? publicKeyHex,
-          publicKeyHex,
-          meta: {
-            ...meta,
-            // todo: could als be EcDSA etc
-            algorithms: [
-              "PS256",
-              "PS512",
-              "RS256",
-              "RS512"
-            ],
-            publicKeyJwk,
-            publicKeyPEM
-          }
-        };
-        break;
-      }
-      default:
-        throw Error("not_supported: Key type not supported: " + args.type);
-    }
-    return key;
-  }
-  /**
-  * @returns a base64url encoded signature for the `RS256` alg
-  */
-  async signRSA(privateKey, data, signingAlgorithm) {
-    const { hashAlgorithm, scheme } = signAlgorithmToSchemeAndHashAlg(signingAlgorithm);
-    const signer = new RSASigner(PEMToJwk(hexToPEM(privateKey.privateKeyHex, "private"), "private"), {
-      hashAlgorithm,
-      scheme
-    });
-    const signature = await signer.sign(data);
-    return signature;
-  }
-  async verifyRSA(publicKeyHex, data, signingAlgorithm, signature) {
-    const { hashAlgorithm, scheme } = signAlgorithmToSchemeAndHashAlg(signingAlgorithm);
-    const signer = new RSASigner(PEMToJwk(hexToPEM(publicKeyHex, "public"), "public"), {
-      hashAlgorithm,
-      scheme
-    });
-    return await signer.verify(data, signature);
-  }
-  async listKeys() {
-    return (await this.privateKeyStore.list({})).map((privateKey) => this.asSphereonManagedKeyInfo(privateKey));
-  }
-};
-
-// src/index.ts
-export * from "@veramo/kms-local";
-var KeyType = /* @__PURE__ */ function(KeyType2) {
-  KeyType2["Bls12381G2"] = "Bls12381G2";
-  return KeyType2;
-}({});
-export {
-  KeyType,
-  SphereonKeyManagementSystem
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.KeyType = exports.SphereonKeyManagementSystem = void 0;
+var SphereonKeyManagementSystem_1 = require("./SphereonKeyManagementSystem");
+Object.defineProperty(exports, "SphereonKeyManagementSystem", { enumerable: true, get: function () { return SphereonKeyManagementSystem_1.SphereonKeyManagementSystem; } });
+__exportStar(require("@veramo/kms-local"), exports);
+var KeyType;
+(function (KeyType) {
+    KeyType["Bls12381G2"] = "Bls12381G2";
+})(KeyType || (exports.KeyType = KeyType = {}));
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/SphereonKeyManagementSystem.ts","../src/index.ts"],"sourcesContent":["import { calculateJwkThumbprint, generatePrivateKeyHex, toJwk, type X509Opts } from '@sphereon/ssi-sdk-ext.key-utils'\n\nimport type { IKey, ManagedKeyInfo, MinimalImportableKey, TKeyType } from '@veramo/core'\nimport { AbstractPrivateKeyStore, type ManagedPrivateKey } from '@veramo/key-manager'\nimport { KeyManagementSystem } from '@veramo/kms-local'\nimport Debug from 'debug'\nimport elliptic from 'elliptic'\n// @ts-ignore\nimport * as u8a from 'uint8arrays'\nconst { fromString } = u8a\nimport { KeyType, type ManagedKeyInfoArgs } from './index'\nimport {\n  hexToPEM,\n  jwkToPEM,\n  pemCertChainTox5c,\n  PEMToHex,\n  PEMToJwk,\n  RSASigner,\n  signAlgorithmToSchemeAndHashAlg,\n} from '@sphereon/ssi-sdk-ext.x509-utils'\n\nconst debug = Debug('sphereon:kms:local')\n\nexport class SphereonKeyManagementSystem extends KeyManagementSystem {\n  private readonly privateKeyStore: AbstractPrivateKeyStore\n\n  constructor(keyStore: AbstractPrivateKeyStore) {\n    super(keyStore)\n    this.privateKeyStore = keyStore\n  }\n\n  async importKey(args: Omit<MinimalImportableKey, 'kms'> & { privateKeyPEM?: string }): Promise<ManagedKeyInfo> {\n    switch (args.type) {\n      case KeyType.Bls12381G2.toString():\n        if (!args.privateKeyHex || !args.publicKeyHex) {\n          throw new Error('invalid_argument: type, publicKeyHex and privateKeyHex are required to import a key')\n        }\n        const managedKey = this.asSphereonManagedKeyInfo({\n          ...args,\n          alias: args.kid,\n          privateKeyHex: args.privateKeyHex,\n          publicKeyHex: args.publicKeyHex,\n          type: args.type,\n        })\n        await this.privateKeyStore.import({ alias: managedKey.kid, ...args })\n        debug('imported key', managedKey.type, managedKey.publicKeyHex)\n        return managedKey\n\n      case 'Secp256k1':\n      case 'Secp256r1':\n      // @ts-ignore\n      case 'RSA': {\n        if (!args.privateKeyHex && !args.privateKeyPEM) {\n          throw new Error('invalid_argument: type and privateKeyHex (or privateKeyPEM for RSA) are required to import a key')\n        }\n        const managedKey = this.asSphereonManagedKeyInfo({ alias: args.kid, ...args })\n        await this.privateKeyStore.import({ alias: managedKey.kid, ...args })\n        debug('imported key', managedKey.type, managedKey.publicKeyHex)\n        return managedKey\n      }\n      default:\n        return await super.importKey(args)\n    }\n  }\n\n  async createKey({ type }: { type: TKeyType }): Promise<ManagedKeyInfo> {\n    let key: ManagedKeyInfo\n\n    switch (type) {\n      case KeyType.Bls12381G2: {\n        throw Error(\n          'BLS support not available because upstream is not really providing Windows and React-Native support; giving too much headache. We soon will move to @digitalbazaar/bbs-signatures'\n        )\n        /*// @ts-ignore\n        const bbs = await import('@digitalbazaar/bbs-signatures')\n        const keyPairBls12381G2 = await bbs.generateKeyPair({\n          ciphersuite: 'BLS12-381-SHA-256'\n        })\n        key = await this.importKey({\n          type,\n          privateKeyHex: Buffer.from(keyPairBls12381G2.secretKey).toString('hex'),\n          publicKeyHex: Buffer.from(keyPairBls12381G2.publicKey).toString('hex'),\n        })\n        break*/\n      }\n\n      // @ts-ignore\n      case 'RSA': {\n        const privateKeyHex = await generatePrivateKeyHex(type)\n        key = await this.importKey({\n          type,\n          privateKeyHex,\n        })\n        break\n      }\n      default:\n        key = await super.createKey({ type })\n    }\n\n    debug('Created key', type, key.publicKeyHex)\n\n    return key\n  }\n\n  async sign({ keyRef, algorithm, data }: { keyRef: Pick<IKey, 'kid'>; algorithm?: string; data: Uint8Array }): Promise<string> {\n    let privateKey: ManagedPrivateKey\n    try {\n      privateKey = await this.privateKeyStore.get({ alias: keyRef.kid })\n    } catch (e) {\n      throw new Error(`key_not_found: No key entry found for kid=${keyRef.kid}`)\n    }\n\n    if (privateKey.type === KeyType.Bls12381G2) {\n      throw Error(\n        'BLS support not available because upstream is not really providing Windows and React-Native support; giving too much headache. We soon will move to @digitalbazaar/bbs-signatures'\n      )\n      /*// @ts-ignore\n      const bbs = await import('@digitalbazaar/bbs-signatures')\n      if (!data || Array.isArray(data)) {\n        throw new Error('Data must be defined and cannot be an array')\n      }\n      const keyPair = {\n        keyPair: {\n          secretKey: Uint8Array.from(Buffer.from(privateKey.privateKeyHex, 'hex')),\n          publicKey: Uint8Array.from(Buffer.from(keyRef.kid, 'hex')),\n        },\n        messages: [data],\n      }\n      const signature = await bbs.sign({secretKey: privateKey, publicKey, header, messages});\n      return signature*/\n    } else if (\n      // @ts-ignore\n      privateKey.type === 'RSA'\n    ) {\n      if (typeof algorithm === 'undefined' || algorithm === 'RS256' || algorithm === 'RS512' || algorithm === 'PS256' || algorithm === 'PS512') {\n        return await this.signRSA(privateKey, data, algorithm ?? 'PS256')\n      }\n      return Promise.reject(\n        new Error(`not_supported: Cannot sign using key of type RSA and alg: ${algorithm}. Only RS and PS algorithms are supported.`)\n      )\n    } else {\n      return await super.sign({ keyRef, algorithm, data })\n    }\n  }\n\n  async verify({\n    publicKeyHex,\n    type,\n    algorithm,\n    data,\n    signature,\n  }: {\n    publicKeyHex: string\n    type: TKeyType\n    algorithm?: string\n    data: Uint8Array\n    signature: string\n  }): Promise<boolean> {\n    if (type === 'RSA') {\n      return await this.verifyRSA(publicKeyHex, data, algorithm ?? 'PS256', signature)\n    }\n    throw Error(`KMS verify is not implemented yet for ${type}`)\n  }\n\n  private asSphereonManagedKeyInfo(args: ManagedKeyInfoArgs): ManagedKeyInfo {\n    let key: Partial<ManagedKeyInfo>\n    switch (args.type) {\n      case KeyType.Bls12381G2:\n        key = {\n          type: args.type,\n          kid: args.alias ?? args.publicKeyHex,\n          publicKeyHex: args.publicKeyHex,\n          meta: {\n            algorithms: ['BLS'],\n          },\n        }\n        break\n      case 'Secp256k1': {\n        const privateBytes = fromString(args.privateKeyHex.toLowerCase(), 'base16')\n        const secp256k1 = new elliptic.ec('secp256k1')\n        const keyPair = secp256k1.keyFromPrivate(privateBytes, 'hex')\n        const publicKeyHex = keyPair.getPublic(true, 'hex')\n        key = {\n          type: args.type,\n          kid: args.alias ?? publicKeyHex,\n          publicKeyHex,\n          meta: {\n            jwkThumbprint: calculateJwkThumbprint({ jwk: toJwk(publicKeyHex, 'Secp256k1') }),\n            algorithms: ['ES256K', 'ES256K-R', 'eth_signTransaction', 'eth_signTypedData', 'eth_signMessage', 'eth_rawSign'],\n          },\n        }\n        break\n      }\n      case 'Secp256r1': {\n        const privateBytes = fromString(args.privateKeyHex.toLowerCase(), 'base16')\n        const secp256r1 = new elliptic.ec('p256')\n        const keyPair = secp256r1.keyFromPrivate(privateBytes, 'hex')\n        const publicKeyHex = keyPair.getPublic(true, 'hex')\n        key = {\n          type: args.type,\n          kid: args.alias ?? publicKeyHex,\n          publicKeyHex,\n          meta: {\n            jwkThumbprint: calculateJwkThumbprint({ jwk: toJwk(publicKeyHex, 'Secp256r1') }),\n            algorithms: ['ES256'],\n          },\n        }\n        break\n      }\n      // @ts-ignore\n      case 'RSA': {\n        const x509 = args.meta?.x509 as X509Opts\n        const privateKeyPEM =\n          x509?.privateKeyPEM ?? (args.privateKeyHex.includes('---') ? args.privateKeyHex : hexToPEM(args.privateKeyHex, 'private')) // In case we have x509 opts, the private key hex really was a PEM already (yuck)\n        const publicKeyJwk = PEMToJwk(privateKeyPEM, 'public')\n        const publicKeyPEM = jwkToPEM(publicKeyJwk, 'public')\n        const publicKeyHex = PEMToHex(publicKeyPEM)\n\n        const meta = {} as any\n        if (x509) {\n          meta.x509 = {\n            cn: x509.cn ?? args.alias ?? publicKeyHex,\n          }\n          let certChain: string = x509.certificateChainPEM ?? ''\n          if (x509.certificatePEM) {\n            if (!certChain.includes(x509.certificatePEM)) {\n              certChain = `${x509.certificatePEM}\\n${certChain}`\n            }\n          }\n          if (certChain.length > 0) {\n            meta.x509.certificateChainPEM = certChain\n            const x5c = pemCertChainTox5c(certChain)\n            if (!x509.certificateChainURL) {\n              // Do not put the chain in the JWK when the chain is hosted. We do put it in the x509 metadata\n              // @ts-ignore\n              publicKeyJwk.x5c = x5c\n            }\n            meta.x509.x5c = x5c\n          }\n          if (x509.certificateChainURL) {\n            // @ts-ignore\n            publicKeyJwk.x5u = x509.certificateChainURL\n            meta.x509.x5u = x509.certificateChainURL\n          }\n        }\n\n        key = {\n          type: args.type,\n          kid: args.alias ?? meta?.x509?.cn ?? publicKeyHex,\n          publicKeyHex,\n          meta: {\n            ...meta,\n            // todo: could als be EcDSA etc\n            algorithms: ['PS256', 'PS512', 'RS256', 'RS512'],\n            publicKeyJwk,\n            publicKeyPEM,\n          },\n        }\n        break\n      }\n\n      default:\n        throw Error('not_supported: Key type not supported: ' + args.type)\n    }\n    return key as ManagedKeyInfo\n  }\n\n  /**\n   * @returns a base64url encoded signature for the `RS256` alg\n   */\n  private async signRSA(privateKey: ManagedPrivateKey, data: Uint8Array, signingAlgorithm: string): Promise<string> {\n    const { hashAlgorithm, scheme } = signAlgorithmToSchemeAndHashAlg(signingAlgorithm)\n    const signer = new RSASigner(PEMToJwk(hexToPEM(privateKey.privateKeyHex, 'private'), 'private'), { hashAlgorithm, scheme })\n    const signature = await signer.sign(data)\n    return signature as string\n  }\n\n  private async verifyRSA(publicKeyHex: string, data: Uint8Array, signingAlgorithm: string, signature: string) {\n    const { hashAlgorithm, scheme } = signAlgorithmToSchemeAndHashAlg(signingAlgorithm)\n    const signer = new RSASigner(PEMToJwk(hexToPEM(publicKeyHex, 'public'), 'public'), { hashAlgorithm, scheme })\n    return await signer.verify(data, signature)\n  }\n\n  public async listKeys(): Promise<Array<ManagedKeyInfo>> {\n    return (await this.privateKeyStore.list({})).map((privateKey: ManagedPrivateKey) => this.asSphereonManagedKeyInfo(privateKey))\n  }\n}\n","import type { X509Opts } from '@sphereon/ssi-sdk-ext.key-utils'\nimport type { KeyMetadata, TKeyType } from '@veramo/core'\n\nexport { SphereonKeyManagementSystem } from './SphereonKeyManagementSystem'\n\nexport * from '@veramo/kms-local'\n\nexport interface ManagedKeyInfoArgs {\n  alias?: string\n  type: TKeyType\n  privateKeyHex: string\n  publicKeyHex?: string\n  meta?: ManageKeyInfoMeta | undefined | null\n}\n\nexport interface ManageKeyInfoMeta extends KeyMetadata {\n  x509?: X509Opts\n  [x: string]: any\n}\nexport enum KeyType {\n  Bls12381G2 = 'Bls12381G2',\n}\n"],"mappings":";;;;AAAA,SAASA,wBAAwBC,uBAAuBC,aAA4B;AAIpF,SAASC,2BAA2B;AACpC,OAAOC,WAAW;AAClB,OAAOC,cAAc;AAErB,YAAYC,SAAS;AAGrB,SACEC,UACAC,UACAC,mBACAC,UACAC,UACAC,WACAC,uCACK;AAVP,IAAM,EAAEC,WAAU,IAAKC;AAYvB,IAAMC,QAAQC,MAAM,oBAAA;AAEb,IAAMC,8BAAN,cAA0CC,oBAAAA;EAvBjD,OAuBiDA;;;EAC9BC;EAEjBC,YAAYC,UAAmC;AAC7C,UAAMA,QAAAA;AACN,SAAKF,kBAAkBE;EACzB;EAEA,MAAMC,UAAUC,MAA+F;AAC7G,YAAQA,KAAKC,MAAI;MACf,KAAKC,QAAQC,WAAWC,SAAQ;AAC9B,YAAI,CAACJ,KAAKK,iBAAiB,CAACL,KAAKM,cAAc;AAC7C,gBAAM,IAAIC,MAAM,qFAAA;QAClB;AACA,cAAMC,aAAa,KAAKC,yBAAyB;UAC/C,GAAGT;UACHU,OAAOV,KAAKW;UACZN,eAAeL,KAAKK;UACpBC,cAAcN,KAAKM;UACnBL,MAAMD,KAAKC;QACb,CAAA;AACA,cAAM,KAAKL,gBAAgBgB,OAAO;UAAEF,OAAOF,WAAWG;UAAK,GAAGX;QAAK,CAAA;AACnER,cAAM,gBAAgBgB,WAAWP,MAAMO,WAAWF,YAAY;AAC9D,eAAOE;MAET,KAAK;MACL,KAAK;;MAEL,KAAK,OAAO;AACV,YAAI,CAACR,KAAKK,iBAAiB,CAACL,KAAKa,eAAe;AAC9C,gBAAM,IAAIN,MAAM,kGAAA;QAClB;AACA,cAAMC,cAAa,KAAKC,yBAAyB;UAAEC,OAAOV,KAAKW;UAAK,GAAGX;QAAK,CAAA;AAC5E,cAAM,KAAKJ,gBAAgBgB,OAAO;UAAEF,OAAOF,YAAWG;UAAK,GAAGX;QAAK,CAAA;AACnER,cAAM,gBAAgBgB,YAAWP,MAAMO,YAAWF,YAAY;AAC9D,eAAOE;MACT;MACA;AACE,eAAO,MAAM,MAAMT,UAAUC,IAAAA;IACjC;EACF;EAEA,MAAMc,UAAU,EAAEb,KAAI,GAAiD;AACrE,QAAIc;AAEJ,YAAQd,MAAAA;MACN,KAAKC,QAAQC,YAAY;AACvB,cAAMI,MACJ,mLAAA;MAaJ;;MAGA,KAAK,OAAO;AACV,cAAMF,gBAAgB,MAAMW,sBAAsBf,IAAAA;AAClDc,cAAM,MAAM,KAAKhB,UAAU;UACzBE;UACAI;QACF,CAAA;AACA;MACF;MACA;AACEU,cAAM,MAAM,MAAMD,UAAU;UAAEb;QAAK,CAAA;IACvC;AAEAT,UAAM,eAAeS,MAAMc,IAAIT,YAAY;AAE3C,WAAOS;EACT;EAEA,MAAME,KAAK,EAAEC,QAAQC,WAAWC,KAAI,GAA0F;AAC5H,QAAIC;AACJ,QAAI;AACFA,mBAAa,MAAM,KAAKzB,gBAAgB0B,IAAI;QAAEZ,OAAOQ,OAAOP;MAAI,CAAA;IAClE,SAASY,GAAG;AACV,YAAM,IAAIhB,MAAM,6CAA6CW,OAAOP,GAAG,EAAE;IAC3E;AAEA,QAAIU,WAAWpB,SAASC,QAAQC,YAAY;AAC1C,YAAMI,MACJ,mLAAA;IAgBJ;;MAEEc,WAAWpB,SAAS;MACpB;AACA,UAAI,OAAOkB,cAAc,eAAeA,cAAc,WAAWA,cAAc,WAAWA,cAAc,WAAWA,cAAc,SAAS;AACxI,eAAO,MAAM,KAAKK,QAAQH,YAAYD,MAAMD,aAAa,OAAA;MAC3D;AACA,aAAOM,QAAQC,OACb,IAAInB,MAAM,6DAA6DY,SAAAA,4CAAqD,CAAA;IAEhI,OAAO;AACL,aAAO,MAAM,MAAMF,KAAK;QAAEC;QAAQC;QAAWC;MAAK,CAAA;IACpD;EACF;EAEA,MAAMO,OAAO,EACXrB,cACAL,MACAkB,WACAC,MACAQ,UAAS,GAOU;AACnB,QAAI3B,SAAS,OAAO;AAClB,aAAO,MAAM,KAAK4B,UAAUvB,cAAcc,MAAMD,aAAa,SAASS,SAAAA;IACxE;AACA,UAAMrB,MAAM,yCAAyCN,IAAAA,EAAM;EAC7D;EAEQQ,yBAAyBT,MAA0C;AACzE,QAAIe;AACJ,YAAQf,KAAKC,MAAI;MACf,KAAKC,QAAQC;AACXY,cAAM;UACJd,MAAMD,KAAKC;UACXU,KAAKX,KAAKU,SAASV,KAAKM;UACxBA,cAAcN,KAAKM;UACnBwB,MAAM;YACJC,YAAY;cAAC;;UACf;QACF;AACA;MACF,KAAK,aAAa;AAChB,cAAMC,eAAe1C,WAAWU,KAAKK,cAAc4B,YAAW,GAAI,QAAA;AAClE,cAAMC,YAAY,IAAIC,SAASC,GAAG,WAAA;AAClC,cAAMC,UAAUH,UAAUI,eAAeN,cAAc,KAAA;AACvD,cAAM1B,eAAe+B,QAAQE,UAAU,MAAM,KAAA;AAC7CxB,cAAM;UACJd,MAAMD,KAAKC;UACXU,KAAKX,KAAKU,SAASJ;UACnBA;UACAwB,MAAM;YACJU,eAAeC,uBAAuB;cAAEC,KAAKC,MAAMrC,cAAc,WAAA;YAAa,CAAA;YAC9EyB,YAAY;cAAC;cAAU;cAAY;cAAuB;cAAqB;cAAmB;;UACpG;QACF;AACA;MACF;MACA,KAAK,aAAa;AAChB,cAAMC,eAAe1C,WAAWU,KAAKK,cAAc4B,YAAW,GAAI,QAAA;AAClE,cAAMW,YAAY,IAAIT,SAASC,GAAG,MAAA;AAClC,cAAMC,UAAUO,UAAUN,eAAeN,cAAc,KAAA;AACvD,cAAM1B,eAAe+B,QAAQE,UAAU,MAAM,KAAA;AAC7CxB,cAAM;UACJd,MAAMD,KAAKC;UACXU,KAAKX,KAAKU,SAASJ;UACnBA;UACAwB,MAAM;YACJU,eAAeC,uBAAuB;cAAEC,KAAKC,MAAMrC,cAAc,WAAA;YAAa,CAAA;YAC9EyB,YAAY;cAAC;;UACf;QACF;AACA;MACF;;MAEA,KAAK,OAAO;AACV,cAAMc,OAAO7C,KAAK8B,MAAMe;AACxB,cAAMhC,gBACJgC,MAAMhC,kBAAkBb,KAAKK,cAAcyC,SAAS,KAAA,IAAS9C,KAAKK,gBAAgB0C,SAAS/C,KAAKK,eAAe,SAAA;AACjH,cAAM2C,eAAeC,SAASpC,eAAe,QAAA;AAC7C,cAAMqC,eAAeC,SAASH,cAAc,QAAA;AAC5C,cAAM1C,eAAe8C,SAASF,YAAAA;AAE9B,cAAMpB,OAAO,CAAC;AACd,YAAIe,MAAM;AACRf,eAAKe,OAAO;YACVQ,IAAIR,KAAKQ,MAAMrD,KAAKU,SAASJ;UAC/B;AACA,cAAIgD,YAAoBT,KAAKU,uBAAuB;AACpD,cAAIV,KAAKW,gBAAgB;AACvB,gBAAI,CAACF,UAAUR,SAASD,KAAKW,cAAc,GAAG;AAC5CF,0BAAY,GAAGT,KAAKW,cAAc;EAAKF,SAAAA;YACzC;UACF;AACA,cAAIA,UAAUG,SAAS,GAAG;AACxB3B,iBAAKe,KAAKU,sBAAsBD;AAChC,kBAAMI,MAAMC,kBAAkBL,SAAAA;AAC9B,gBAAI,CAACT,KAAKe,qBAAqB;AAG7BZ,2BAAaU,MAAMA;YACrB;AACA5B,iBAAKe,KAAKa,MAAMA;UAClB;AACA,cAAIb,KAAKe,qBAAqB;AAE5BZ,yBAAaa,MAAMhB,KAAKe;AACxB9B,iBAAKe,KAAKgB,MAAMhB,KAAKe;UACvB;QACF;AAEA7C,cAAM;UACJd,MAAMD,KAAKC;UACXU,KAAKX,KAAKU,SAASoB,MAAMe,MAAMQ,MAAM/C;UACrCA;UACAwB,MAAM;YACJ,GAAGA;;YAEHC,YAAY;cAAC;cAAS;cAAS;cAAS;;YACxCiB;YACAE;UACF;QACF;AACA;MACF;MAEA;AACE,cAAM3C,MAAM,4CAA4CP,KAAKC,IAAI;IACrE;AACA,WAAOc;EACT;;;;EAKA,MAAcS,QAAQH,YAA+BD,MAAkB0C,kBAA2C;AAChH,UAAM,EAAEC,eAAeC,OAAM,IAAKC,gCAAgCH,gBAAAA;AAClE,UAAMI,SAAS,IAAIC,UAAUlB,SAASF,SAAS1B,WAAWhB,eAAe,SAAA,GAAY,SAAA,GAAY;MAAE0D;MAAeC;IAAO,CAAA;AACzH,UAAMpC,YAAY,MAAMsC,OAAOjD,KAAKG,IAAAA;AACpC,WAAOQ;EACT;EAEA,MAAcC,UAAUvB,cAAsBc,MAAkB0C,kBAA0BlC,WAAmB;AAC3G,UAAM,EAAEmC,eAAeC,OAAM,IAAKC,gCAAgCH,gBAAAA;AAClE,UAAMI,SAAS,IAAIC,UAAUlB,SAASF,SAASzC,cAAc,QAAA,GAAW,QAAA,GAAW;MAAEyD;MAAeC;IAAO,CAAA;AAC3G,WAAO,MAAME,OAAOvC,OAAOP,MAAMQ,SAAAA;EACnC;EAEA,MAAawC,WAA2C;AACtD,YAAQ,MAAM,KAAKxE,gBAAgByE,KAAK,CAAC,CAAA,GAAIC,IAAI,CAACjD,eAAkC,KAAKZ,yBAAyBY,UAAAA,CAAAA;EACpH;AACF;;;ACzRA,cAAc;AAcP,IAAKkD,UAAAA,yBAAAA,UAAAA;;SAAAA;;","names":["calculateJwkThumbprint","generatePrivateKeyHex","toJwk","KeyManagementSystem","Debug","elliptic","u8a","hexToPEM","jwkToPEM","pemCertChainTox5c","PEMToHex","PEMToJwk","RSASigner","signAlgorithmToSchemeAndHashAlg","fromString","u8a","debug","Debug","SphereonKeyManagementSystem","KeyManagementSystem","privateKeyStore","constructor","keyStore","importKey","args","type","KeyType","Bls12381G2","toString","privateKeyHex","publicKeyHex","Error","managedKey","asSphereonManagedKeyInfo","alias","kid","import","privateKeyPEM","createKey","key","generatePrivateKeyHex","sign","keyRef","algorithm","data","privateKey","get","e","signRSA","Promise","reject","verify","signature","verifyRSA","meta","algorithms","privateBytes","toLowerCase","secp256k1","elliptic","ec","keyPair","keyFromPrivate","getPublic","jwkThumbprint","calculateJwkThumbprint","jwk","toJwk","secp256r1","x509","includes","hexToPEM","publicKeyJwk","PEMToJwk","publicKeyPEM","jwkToPEM","PEMToHex","cn","certChain","certificateChainPEM","certificatePEM","length","x5c","pemCertChainTox5c","certificateChainURL","x5u","signingAlgorithm","hashAlgorithm","scheme","signAlgorithmToSchemeAndHashAlg","signer","RSASigner","listKeys","list","map","KeyType"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAGA,6EAA2E;AAAlE,0IAAA,2BAA2B,OAAA;AAEpC,oDAAiC;AAcjC,IAAY,OAEX;AAFD,WAAY,OAAO;IACjB,oCAAyB,CAAA;AAC3B,CAAC,EAFW,OAAO,uBAAP,OAAO,QAElB"}

package/dist/ssi-sdk-ext.kms-local.d.ts

@@ -7,9 +7,10 @@ import { MinimalImportableKey } from '@veramo/core';
 import { TKeyType } from '@veramo/core';
 import { X509Opts } from '@sphereon/ssi-sdk-ext.key-utils';
 
-export declare enum KeyType {
+declare enum KeyType_2 {
     Bls12381G2 = "Bls12381G2"
 }
+export { KeyType_2 as KeyType }
 
 export declare interface ManagedKeyInfoArgs {
     alias?: string;

package/package.json

@@ -1,48 +1,34 @@
 {
   "name": "@sphereon/ssi-sdk-ext.kms-local",
   "description": "Sphereon Local Key Management System with support for BLS/BBS+, RSA keys",
-  "version": "0.28.1-feature.jose.vcdm.52+751e224",
-  "source": "./src/index.ts",
-  "type": "module",
-  "main": "./dist/index.cjs",
-  "module": "./dist/index.js",
-  "types": "./dist/index.d.ts",
-  "exports": {
-    "react-native": "./dist/index.js",
-    "import": {
-      "types": "./dist/index.d.ts",
-      "import": "./dist/index.js"
-    },
-    "require": {
-      "types": "./dist/index.d.cts",
-      "require": "./dist/index.cjs"
-    }
-  },
+  "version": "0.28.1-feature.oyd.cmsm.improv.20+7c3cf5a",
+  "source": "src/index.ts",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
   "scripts": {
-    "build": "tsup --config ../../tsup.config.ts --tsconfig ../../tsconfig.tsup.json && sphereon dev generate-plugin-schema",
+    "build": "tsc --build",
     "generate-plugin-schema": "sphereon dev generate-plugin-schema"
   },
   "dependencies": {
-    "@sphereon/ssi-sdk-ext.did-utils": "0.28.1-feature.jose.vcdm.52+751e224",
-    "@sphereon/ssi-sdk-ext.key-utils": "0.28.1-feature.jose.vcdm.52+751e224",
-    "@sphereon/ssi-sdk-ext.x509-utils": "0.28.1-feature.jose.vcdm.52+751e224",
+    "@sphereon/ssi-sdk-ext.did-utils": "0.28.1-feature.oyd.cmsm.improv.20+7c3cf5a",
+    "@sphereon/ssi-sdk-ext.key-utils": "0.28.1-feature.oyd.cmsm.improv.20+7c3cf5a",
+    "@sphereon/ssi-sdk-ext.x509-utils": "0.28.1-feature.oyd.cmsm.improv.20+7c3cf5a",
     "@trust/keyto": "2.0.0-alpha1",
     "@veramo/core": "4.2.0",
     "@veramo/key-manager": "4.2.0",
     "@veramo/kms-local": "4.2.0",
-    "debug": "^4.4.0",
     "elliptic": "^6.5.4",
     "uint8arrays": "3.1.1"
   },
   "devDependencies": {
     "@sphereon/jsencrypt": "3.3.2-unstable.0",
-    "@sphereon/ssi-sdk.dev": "0.33.1-feature.jose.vcdm.65",
+    "@sphereon/ssi-sdk.dev": "0.30.2-feature.SDK.41.oidf.support.286",
     "@types/elliptic": "6.4.14",
     "@veramo/cli": "4.2.0"
   },
   "files": [
-    "dist",
-    "src",
+    "dist/**/*",
+    "src/**/*",
     "plugin.schema.json",
     "README.md",
     "LICENSE"
@@ -58,5 +44,5 @@
     "kms",
     "Veramo"
   ],
-  "gitHead": "751e224f245c6ba757827ea4e50ad3c46afbea94"
+  "gitHead": "7c3cf5a3b32ef8a31744757aab14c21338880f79"
 }

package/src/SphereonKeyManagementSystem.ts

@@ -1,14 +1,12 @@
-import { calculateJwkThumbprint, generatePrivateKeyHex, toJwk, type X509Opts } from '@sphereon/ssi-sdk-ext.key-utils'
+import { calculateJwkThumbprint, generatePrivateKeyHex, toJwk, X509Opts } from '@sphereon/ssi-sdk-ext.key-utils'
 
-import type { IKey, ManagedKeyInfo, MinimalImportableKey, TKeyType } from '@veramo/core'
-import { AbstractPrivateKeyStore, type ManagedPrivateKey } from '@veramo/key-manager'
+import { IKey, ManagedKeyInfo, MinimalImportableKey, TKeyType } from '@veramo/core'
+import { AbstractPrivateKeyStore, ManagedPrivateKey } from '@veramo/key-manager'
 import { KeyManagementSystem } from '@veramo/kms-local'
 import Debug from 'debug'
 import elliptic from 'elliptic'
-// @ts-ignore
 import * as u8a from 'uint8arrays'
-const { fromString } = u8a
-import { KeyType, type ManagedKeyInfoArgs } from './index'
+import { KeyType, ManagedKeyInfoArgs } from './index'
 import {
   hexToPEM,
   jwkToPEM,
@@ -130,17 +128,14 @@ export class SphereonKeyManagementSystem extends KeyManagementSystem {
       return signature*/
     } else if (
       // @ts-ignore
-      privateKey.type === 'RSA'
+      privateKey.type === 'RSA' &&
+      (typeof algorithm === 'undefined' || algorithm === 'RS256' || algorithm === 'RS512' || algorithm === 'PS256' || algorithm === 'PS512')
     ) {
-      if (typeof algorithm === 'undefined' || algorithm === 'RS256' || algorithm === 'RS512' || algorithm === 'PS256' || algorithm === 'PS512') {
-        return await this.signRSA(privateKey, data, algorithm ?? 'PS256')
-      }
-      return Promise.reject(
-        new Error(`not_supported: Cannot sign using key of type RSA and alg: ${algorithm}. Only RS and PS algorithms are supported.`)
-      )
+      return await this.signRSA(privateKey, data, algorithm ?? 'PS256')
     } else {
       return await super.sign({ keyRef, algorithm, data })
     }
+    throw Error(`not_supported: Cannot sign using key of type ${privateKey.type}`)
   }
 
   async verify({
@@ -176,7 +171,7 @@ export class SphereonKeyManagementSystem extends KeyManagementSystem {
         }
         break
       case 'Secp256k1': {
-        const privateBytes = fromString(args.privateKeyHex.toLowerCase(), 'base16')
+        const privateBytes = u8a.fromString(args.privateKeyHex.toLowerCase(), 'base16')
         const secp256k1 = new elliptic.ec('secp256k1')
         const keyPair = secp256k1.keyFromPrivate(privateBytes, 'hex')
         const publicKeyHex = keyPair.getPublic(true, 'hex')
@@ -192,7 +187,7 @@ export class SphereonKeyManagementSystem extends KeyManagementSystem {
         break
       }
       case 'Secp256r1': {
-        const privateBytes = fromString(args.privateKeyHex.toLowerCase(), 'base16')
+        const privateBytes = u8a.fromString(args.privateKeyHex.toLowerCase(), 'base16')
         const secp256r1 = new elliptic.ec('p256')
         const keyPair = secp256r1.keyFromPrivate(privateBytes, 'hex')
         const publicKeyHex = keyPair.getPublic(true, 'hex')
@@ -250,8 +245,8 @@ export class SphereonKeyManagementSystem extends KeyManagementSystem {
           publicKeyHex,
           meta: {
             ...meta,
-            // todo: could als be EcDSA etc
-            algorithms: ['PS256', 'PS512', 'RS256', 'RS512'],
+            // todo: could als be DSA etc
+            algorithms: ['RS256', 'RS512', 'PS256', 'PS512'],
             publicKeyJwk,
             publicKeyPEM,
           },

package/src/__tests__/key-management-system.test.ts

@@ -1,7 +1,6 @@
-import { ManagedKeyInfo } from '@veramo/core'
-import { MemoryPrivateKeyStore } from '@veramo/key-manager'
-import { describe, expect, it } from 'vitest'
 import { SphereonKeyManagementSystem } from '../SphereonKeyManagementSystem'
+import { MemoryPrivateKeyStore } from '@veramo/key-manager'
+import { ManagedKeyInfo } from '@veramo/core'
 
 describe('Key creation', () => {
   it('should create a RSA key', async () => {

package/src/__tests__/rsa.test.ts

@@ -1,4 +1,8 @@
 import JSEncrypt from '@sphereon/jsencrypt'
+import { PEM_CERT, PEM_CHAIN, PEM_FULL_CHAIN, PEM_PRIV_KEY } from './certs'
+import { SphereonKeyManagementSystem } from '../SphereonKeyManagementSystem'
+import { MemoryPrivateKeyStore } from '@veramo/key-manager'
+import * as u8a from 'uint8arrays'
 import { digestMethodParams, X509Opts } from '@sphereon/ssi-sdk-ext.key-utils'
 import {
   pemCertChainTox5c,
@@ -9,11 +13,6 @@ import {
   toKeyObject,
   x5cToPemCertChain,
 } from '@sphereon/ssi-sdk-ext.x509-utils'
-import { MemoryPrivateKeyStore } from '@veramo/key-manager'
-import * as u8a from 'uint8arrays'
-import { describe, expect, it } from 'vitest'
-import { SphereonKeyManagementSystem } from '../SphereonKeyManagementSystem'
-import { PEM_CERT, PEM_CHAIN, PEM_FULL_CHAIN, PEM_PRIV_KEY } from './certs'
 
 describe('X509 PEMs', () => {
   it('should get public key from private key', () => {
@@ -118,7 +117,7 @@ describe('@veramo/kms-local x509 import', () => {
       '30820122300d06092a864886f70d01010105000382010f003082010a0282010100d5eb1f8708914a91581b7945b2f620963859b5279bcd9db3830cc6ac1cf8e9f26ecf8f6cc1a9d914b099fad9c4c4360008d1be9507f893b6ac32a5d6144314da8c4867526ffd15e41ff2f8fc0b7e0e23cf343de8607af88242b0a55ab2f38c371c12fa105522adcfc0356337374aabb0f2e41f14a56a3c20cacba9d58e14de0c78fdb710494dfa261fe5981e90f7b2e9915eedc6079c59406c02e87db772b689a55d51c370ffcfb9c596a960f40419c129e3bc8f8b1389d92997a68476893a6f64ae19372177271a8a420da9189a956d5a2fb614b07714243aa176d686d077a22225cbc39a71d2c4ba3a0e21c1198118c493bcdcf4a44d8dd7ca1ef264c024530203010001'
     )
     expect(key.kid).toEqual('test')
-    expect(key.meta?.algorithms).toEqual(['PS256', 'PS512', 'RS256', 'RS512'])
+    expect(key.meta?.algorithms).toEqual(['RS256', 'RS512', 'PS256', 'PS512'])
 
     expect(key.meta?.publicKeyPEM).toBeDefined()
     await expect(key.meta?.publicKeyJwk).toMatchObject({

package/src/index.ts

@@ -1,5 +1,5 @@
-import type { X509Opts } from '@sphereon/ssi-sdk-ext.key-utils'
-import type { KeyMetadata, TKeyType } from '@veramo/core'
+import { X509Opts } from '@sphereon/ssi-sdk-ext.key-utils'
+import { KeyMetadata, TKeyType } from '@veramo/core'
 
 export { SphereonKeyManagementSystem } from './SphereonKeyManagementSystem'
 

package/dist/index.cjs

@@ -1,302 +0,0 @@
-"use strict";
-var __create = Object.create;
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __reExport = (target, mod, secondTarget) => (__copyProps(target, mod, "default"), secondTarget && __copyProps(secondTarget, mod, "default"));
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
-  // If the importer is in node compatibility mode or this is not an ESM
-  // file that has been converted to a CommonJS file using a Babel-
-  // compatible transform (i.e. "__esModule" has not been set), then set
-  // "default" to the CommonJS "module.exports" for node compatibility.
-  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
-  mod
-));
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-
-// src/index.ts
-var index_exports = {};
-__export(index_exports, {
-  KeyType: () => KeyType,
-  SphereonKeyManagementSystem: () => SphereonKeyManagementSystem
-});
-module.exports = __toCommonJS(index_exports);
-
-// src/SphereonKeyManagementSystem.ts
-var import_ssi_sdk_ext = require("@sphereon/ssi-sdk-ext.key-utils");
-var import_kms_local = require("@veramo/kms-local");
-var import_debug = __toESM(require("debug"), 1);
-var import_elliptic = __toESM(require("elliptic"), 1);
-var u8a = __toESM(require("uint8arrays"), 1);
-var import_ssi_sdk_ext2 = require("@sphereon/ssi-sdk-ext.x509-utils");
-var { fromString } = u8a;
-var debug = (0, import_debug.default)("sphereon:kms:local");
-var SphereonKeyManagementSystem = class extends import_kms_local.KeyManagementSystem {
-  static {
-    __name(this, "SphereonKeyManagementSystem");
-  }
-  privateKeyStore;
-  constructor(keyStore) {
-    super(keyStore);
-    this.privateKeyStore = keyStore;
-  }
-  async importKey(args) {
-    switch (args.type) {
-      case KeyType.Bls12381G2.toString():
-        if (!args.privateKeyHex || !args.publicKeyHex) {
-          throw new Error("invalid_argument: type, publicKeyHex and privateKeyHex are required to import a key");
-        }
-        const managedKey = this.asSphereonManagedKeyInfo({
-          ...args,
-          alias: args.kid,
-          privateKeyHex: args.privateKeyHex,
-          publicKeyHex: args.publicKeyHex,
-          type: args.type
-        });
-        await this.privateKeyStore.import({
-          alias: managedKey.kid,
-          ...args
-        });
-        debug("imported key", managedKey.type, managedKey.publicKeyHex);
-        return managedKey;
-      case "Secp256k1":
-      case "Secp256r1":
-      // @ts-ignore
-      case "RSA": {
-        if (!args.privateKeyHex && !args.privateKeyPEM) {
-          throw new Error("invalid_argument: type and privateKeyHex (or privateKeyPEM for RSA) are required to import a key");
-        }
-        const managedKey2 = this.asSphereonManagedKeyInfo({
-          alias: args.kid,
-          ...args
-        });
-        await this.privateKeyStore.import({
-          alias: managedKey2.kid,
-          ...args
-        });
-        debug("imported key", managedKey2.type, managedKey2.publicKeyHex);
-        return managedKey2;
-      }
-      default:
-        return await super.importKey(args);
-    }
-  }
-  async createKey({ type }) {
-    let key;
-    switch (type) {
-      case KeyType.Bls12381G2: {
-        throw Error("BLS support not available because upstream is not really providing Windows and React-Native support; giving too much headache. We soon will move to @digitalbazaar/bbs-signatures");
-      }
-      // @ts-ignore
-      case "RSA": {
-        const privateKeyHex = await (0, import_ssi_sdk_ext.generatePrivateKeyHex)(type);
-        key = await this.importKey({
-          type,
-          privateKeyHex
-        });
-        break;
-      }
-      default:
-        key = await super.createKey({
-          type
-        });
-    }
-    debug("Created key", type, key.publicKeyHex);
-    return key;
-  }
-  async sign({ keyRef, algorithm, data }) {
-    let privateKey;
-    try {
-      privateKey = await this.privateKeyStore.get({
-        alias: keyRef.kid
-      });
-    } catch (e) {
-      throw new Error(`key_not_found: No key entry found for kid=${keyRef.kid}`);
-    }
-    if (privateKey.type === KeyType.Bls12381G2) {
-      throw Error("BLS support not available because upstream is not really providing Windows and React-Native support; giving too much headache. We soon will move to @digitalbazaar/bbs-signatures");
-    } else if (
-      // @ts-ignore
-      privateKey.type === "RSA"
-    ) {
-      if (typeof algorithm === "undefined" || algorithm === "RS256" || algorithm === "RS512" || algorithm === "PS256" || algorithm === "PS512") {
-        return await this.signRSA(privateKey, data, algorithm ?? "PS256");
-      }
-      return Promise.reject(new Error(`not_supported: Cannot sign using key of type RSA and alg: ${algorithm}. Only RS and PS algorithms are supported.`));
-    } else {
-      return await super.sign({
-        keyRef,
-        algorithm,
-        data
-      });
-    }
-  }
-  async verify({ publicKeyHex, type, algorithm, data, signature }) {
-    if (type === "RSA") {
-      return await this.verifyRSA(publicKeyHex, data, algorithm ?? "PS256", signature);
-    }
-    throw Error(`KMS verify is not implemented yet for ${type}`);
-  }
-  asSphereonManagedKeyInfo(args) {
-    let key;
-    switch (args.type) {
-      case KeyType.Bls12381G2:
-        key = {
-          type: args.type,
-          kid: args.alias ?? args.publicKeyHex,
-          publicKeyHex: args.publicKeyHex,
-          meta: {
-            algorithms: [
-              "BLS"
-            ]
-          }
-        };
-        break;
-      case "Secp256k1": {
-        const privateBytes = fromString(args.privateKeyHex.toLowerCase(), "base16");
-        const secp256k1 = new import_elliptic.default.ec("secp256k1");
-        const keyPair = secp256k1.keyFromPrivate(privateBytes, "hex");
-        const publicKeyHex = keyPair.getPublic(true, "hex");
-        key = {
-          type: args.type,
-          kid: args.alias ?? publicKeyHex,
-          publicKeyHex,
-          meta: {
-            jwkThumbprint: (0, import_ssi_sdk_ext.calculateJwkThumbprint)({
-              jwk: (0, import_ssi_sdk_ext.toJwk)(publicKeyHex, "Secp256k1")
-            }),
-            algorithms: [
-              "ES256K",
-              "ES256K-R",
-              "eth_signTransaction",
-              "eth_signTypedData",
-              "eth_signMessage",
-              "eth_rawSign"
-            ]
-          }
-        };
-        break;
-      }
-      case "Secp256r1": {
-        const privateBytes = fromString(args.privateKeyHex.toLowerCase(), "base16");
-        const secp256r1 = new import_elliptic.default.ec("p256");
-        const keyPair = secp256r1.keyFromPrivate(privateBytes, "hex");
-        const publicKeyHex = keyPair.getPublic(true, "hex");
-        key = {
-          type: args.type,
-          kid: args.alias ?? publicKeyHex,
-          publicKeyHex,
-          meta: {
-            jwkThumbprint: (0, import_ssi_sdk_ext.calculateJwkThumbprint)({
-              jwk: (0, import_ssi_sdk_ext.toJwk)(publicKeyHex, "Secp256r1")
-            }),
-            algorithms: [
-              "ES256"
-            ]
-          }
-        };
-        break;
-      }
-      // @ts-ignore
-      case "RSA": {
-        const x509 = args.meta?.x509;
-        const privateKeyPEM = x509?.privateKeyPEM ?? (args.privateKeyHex.includes("---") ? args.privateKeyHex : (0, import_ssi_sdk_ext2.hexToPEM)(args.privateKeyHex, "private"));
-        const publicKeyJwk = (0, import_ssi_sdk_ext2.PEMToJwk)(privateKeyPEM, "public");
-        const publicKeyPEM = (0, import_ssi_sdk_ext2.jwkToPEM)(publicKeyJwk, "public");
-        const publicKeyHex = (0, import_ssi_sdk_ext2.PEMToHex)(publicKeyPEM);
-        const meta = {};
-        if (x509) {
-          meta.x509 = {
-            cn: x509.cn ?? args.alias ?? publicKeyHex
-          };
-          let certChain = x509.certificateChainPEM ?? "";
-          if (x509.certificatePEM) {
-            if (!certChain.includes(x509.certificatePEM)) {
-              certChain = `${x509.certificatePEM}
-${certChain}`;
-            }
-          }
-          if (certChain.length > 0) {
-            meta.x509.certificateChainPEM = certChain;
-            const x5c = (0, import_ssi_sdk_ext2.pemCertChainTox5c)(certChain);
-            if (!x509.certificateChainURL) {
-              publicKeyJwk.x5c = x5c;
-            }
-            meta.x509.x5c = x5c;
-          }
-          if (x509.certificateChainURL) {
-            publicKeyJwk.x5u = x509.certificateChainURL;
-            meta.x509.x5u = x509.certificateChainURL;
-          }
-        }
-        key = {
-          type: args.type,
-          kid: args.alias ?? meta?.x509?.cn ?? publicKeyHex,
-          publicKeyHex,
-          meta: {
-            ...meta,
-            // todo: could als be EcDSA etc
-            algorithms: [
-              "PS256",
-              "PS512",
-              "RS256",
-              "RS512"
-            ],
-            publicKeyJwk,
-            publicKeyPEM
-          }
-        };
-        break;
-      }
-      default:
-        throw Error("not_supported: Key type not supported: " + args.type);
-    }
-    return key;
-  }
-  /**
-  * @returns a base64url encoded signature for the `RS256` alg
-  */
-  async signRSA(privateKey, data, signingAlgorithm) {
-    const { hashAlgorithm, scheme } = (0, import_ssi_sdk_ext2.signAlgorithmToSchemeAndHashAlg)(signingAlgorithm);
-    const signer = new import_ssi_sdk_ext2.RSASigner((0, import_ssi_sdk_ext2.PEMToJwk)((0, import_ssi_sdk_ext2.hexToPEM)(privateKey.privateKeyHex, "private"), "private"), {
-      hashAlgorithm,
-      scheme
-    });
-    const signature = await signer.sign(data);
-    return signature;
-  }
-  async verifyRSA(publicKeyHex, data, signingAlgorithm, signature) {
-    const { hashAlgorithm, scheme } = (0, import_ssi_sdk_ext2.signAlgorithmToSchemeAndHashAlg)(signingAlgorithm);
-    const signer = new import_ssi_sdk_ext2.RSASigner((0, import_ssi_sdk_ext2.PEMToJwk)((0, import_ssi_sdk_ext2.hexToPEM)(publicKeyHex, "public"), "public"), {
-      hashAlgorithm,
-      scheme
-    });
-    return await signer.verify(data, signature);
-  }
-  async listKeys() {
-    return (await this.privateKeyStore.list({})).map((privateKey) => this.asSphereonManagedKeyInfo(privateKey));
-  }
-};
-
-// src/index.ts
-__reExport(index_exports, require("@veramo/kms-local"), module.exports);
-var KeyType = /* @__PURE__ */ function(KeyType2) {
-  KeyType2["Bls12381G2"] = "Bls12381G2";
-  return KeyType2;
-}({});
-//# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/index.ts","../src/SphereonKeyManagementSystem.ts"],"sourcesContent":["import type { X509Opts } from '@sphereon/ssi-sdk-ext.key-utils'\nimport type { KeyMetadata, TKeyType } from '@veramo/core'\n\nexport { SphereonKeyManagementSystem } from './SphereonKeyManagementSystem'\n\nexport * from '@veramo/kms-local'\n\nexport interface ManagedKeyInfoArgs {\n  alias?: string\n  type: TKeyType\n  privateKeyHex: string\n  publicKeyHex?: string\n  meta?: ManageKeyInfoMeta | undefined | null\n}\n\nexport interface ManageKeyInfoMeta extends KeyMetadata {\n  x509?: X509Opts\n  [x: string]: any\n}\nexport enum KeyType {\n  Bls12381G2 = 'Bls12381G2',\n}\n","import { calculateJwkThumbprint, generatePrivateKeyHex, toJwk, type X509Opts } from '@sphereon/ssi-sdk-ext.key-utils'\n\nimport type { IKey, ManagedKeyInfo, MinimalImportableKey, TKeyType } from '@veramo/core'\nimport { AbstractPrivateKeyStore, type ManagedPrivateKey } from '@veramo/key-manager'\nimport { KeyManagementSystem } from '@veramo/kms-local'\nimport Debug from 'debug'\nimport elliptic from 'elliptic'\n// @ts-ignore\nimport * as u8a from 'uint8arrays'\nconst { fromString } = u8a\nimport { KeyType, type ManagedKeyInfoArgs } from './index'\nimport {\n  hexToPEM,\n  jwkToPEM,\n  pemCertChainTox5c,\n  PEMToHex,\n  PEMToJwk,\n  RSASigner,\n  signAlgorithmToSchemeAndHashAlg,\n} from '@sphereon/ssi-sdk-ext.x509-utils'\n\nconst debug = Debug('sphereon:kms:local')\n\nexport class SphereonKeyManagementSystem extends KeyManagementSystem {\n  private readonly privateKeyStore: AbstractPrivateKeyStore\n\n  constructor(keyStore: AbstractPrivateKeyStore) {\n    super(keyStore)\n    this.privateKeyStore = keyStore\n  }\n\n  async importKey(args: Omit<MinimalImportableKey, 'kms'> & { privateKeyPEM?: string }): Promise<ManagedKeyInfo> {\n    switch (args.type) {\n      case KeyType.Bls12381G2.toString():\n        if (!args.privateKeyHex || !args.publicKeyHex) {\n          throw new Error('invalid_argument: type, publicKeyHex and privateKeyHex are required to import a key')\n        }\n        const managedKey = this.asSphereonManagedKeyInfo({\n          ...args,\n          alias: args.kid,\n          privateKeyHex: args.privateKeyHex,\n          publicKeyHex: args.publicKeyHex,\n          type: args.type,\n        })\n        await this.privateKeyStore.import({ alias: managedKey.kid, ...args })\n        debug('imported key', managedKey.type, managedKey.publicKeyHex)\n        return managedKey\n\n      case 'Secp256k1':\n      case 'Secp256r1':\n      // @ts-ignore\n      case 'RSA': {\n        if (!args.privateKeyHex && !args.privateKeyPEM) {\n          throw new Error('invalid_argument: type and privateKeyHex (or privateKeyPEM for RSA) are required to import a key')\n        }\n        const managedKey = this.asSphereonManagedKeyInfo({ alias: args.kid, ...args })\n        await this.privateKeyStore.import({ alias: managedKey.kid, ...args })\n        debug('imported key', managedKey.type, managedKey.publicKeyHex)\n        return managedKey\n      }\n      default:\n        return await super.importKey(args)\n    }\n  }\n\n  async createKey({ type }: { type: TKeyType }): Promise<ManagedKeyInfo> {\n    let key: ManagedKeyInfo\n\n    switch (type) {\n      case KeyType.Bls12381G2: {\n        throw Error(\n          'BLS support not available because upstream is not really providing Windows and React-Native support; giving too much headache. We soon will move to @digitalbazaar/bbs-signatures'\n        )\n        /*// @ts-ignore\n        const bbs = await import('@digitalbazaar/bbs-signatures')\n        const keyPairBls12381G2 = await bbs.generateKeyPair({\n          ciphersuite: 'BLS12-381-SHA-256'\n        })\n        key = await this.importKey({\n          type,\n          privateKeyHex: Buffer.from(keyPairBls12381G2.secretKey).toString('hex'),\n          publicKeyHex: Buffer.from(keyPairBls12381G2.publicKey).toString('hex'),\n        })\n        break*/\n      }\n\n      // @ts-ignore\n      case 'RSA': {\n        const privateKeyHex = await generatePrivateKeyHex(type)\n        key = await this.importKey({\n          type,\n          privateKeyHex,\n        })\n        break\n      }\n      default:\n        key = await super.createKey({ type })\n    }\n\n    debug('Created key', type, key.publicKeyHex)\n\n    return key\n  }\n\n  async sign({ keyRef, algorithm, data }: { keyRef: Pick<IKey, 'kid'>; algorithm?: string; data: Uint8Array }): Promise<string> {\n    let privateKey: ManagedPrivateKey\n    try {\n      privateKey = await this.privateKeyStore.get({ alias: keyRef.kid })\n    } catch (e) {\n      throw new Error(`key_not_found: No key entry found for kid=${keyRef.kid}`)\n    }\n\n    if (privateKey.type === KeyType.Bls12381G2) {\n      throw Error(\n        'BLS support not available because upstream is not really providing Windows and React-Native support; giving too much headache. We soon will move to @digitalbazaar/bbs-signatures'\n      )\n      /*// @ts-ignore\n      const bbs = await import('@digitalbazaar/bbs-signatures')\n      if (!data || Array.isArray(data)) {\n        throw new Error('Data must be defined and cannot be an array')\n      }\n      const keyPair = {\n        keyPair: {\n          secretKey: Uint8Array.from(Buffer.from(privateKey.privateKeyHex, 'hex')),\n          publicKey: Uint8Array.from(Buffer.from(keyRef.kid, 'hex')),\n        },\n        messages: [data],\n      }\n      const signature = await bbs.sign({secretKey: privateKey, publicKey, header, messages});\n      return signature*/\n    } else if (\n      // @ts-ignore\n      privateKey.type === 'RSA'\n    ) {\n      if (typeof algorithm === 'undefined' || algorithm === 'RS256' || algorithm === 'RS512' || algorithm === 'PS256' || algorithm === 'PS512') {\n        return await this.signRSA(privateKey, data, algorithm ?? 'PS256')\n      }\n      return Promise.reject(\n        new Error(`not_supported: Cannot sign using key of type RSA and alg: ${algorithm}. Only RS and PS algorithms are supported.`)\n      )\n    } else {\n      return await super.sign({ keyRef, algorithm, data })\n    }\n  }\n\n  async verify({\n    publicKeyHex,\n    type,\n    algorithm,\n    data,\n    signature,\n  }: {\n    publicKeyHex: string\n    type: TKeyType\n    algorithm?: string\n    data: Uint8Array\n    signature: string\n  }): Promise<boolean> {\n    if (type === 'RSA') {\n      return await this.verifyRSA(publicKeyHex, data, algorithm ?? 'PS256', signature)\n    }\n    throw Error(`KMS verify is not implemented yet for ${type}`)\n  }\n\n  private asSphereonManagedKeyInfo(args: ManagedKeyInfoArgs): ManagedKeyInfo {\n    let key: Partial<ManagedKeyInfo>\n    switch (args.type) {\n      case KeyType.Bls12381G2:\n        key = {\n          type: args.type,\n          kid: args.alias ?? args.publicKeyHex,\n          publicKeyHex: args.publicKeyHex,\n          meta: {\n            algorithms: ['BLS'],\n          },\n        }\n        break\n      case 'Secp256k1': {\n        const privateBytes = fromString(args.privateKeyHex.toLowerCase(), 'base16')\n        const secp256k1 = new elliptic.ec('secp256k1')\n        const keyPair = secp256k1.keyFromPrivate(privateBytes, 'hex')\n        const publicKeyHex = keyPair.getPublic(true, 'hex')\n        key = {\n          type: args.type,\n          kid: args.alias ?? publicKeyHex,\n          publicKeyHex,\n          meta: {\n            jwkThumbprint: calculateJwkThumbprint({ jwk: toJwk(publicKeyHex, 'Secp256k1') }),\n            algorithms: ['ES256K', 'ES256K-R', 'eth_signTransaction', 'eth_signTypedData', 'eth_signMessage', 'eth_rawSign'],\n          },\n        }\n        break\n      }\n      case 'Secp256r1': {\n        const privateBytes = fromString(args.privateKeyHex.toLowerCase(), 'base16')\n        const secp256r1 = new elliptic.ec('p256')\n        const keyPair = secp256r1.keyFromPrivate(privateBytes, 'hex')\n        const publicKeyHex = keyPair.getPublic(true, 'hex')\n        key = {\n          type: args.type,\n          kid: args.alias ?? publicKeyHex,\n          publicKeyHex,\n          meta: {\n            jwkThumbprint: calculateJwkThumbprint({ jwk: toJwk(publicKeyHex, 'Secp256r1') }),\n            algorithms: ['ES256'],\n          },\n        }\n        break\n      }\n      // @ts-ignore\n      case 'RSA': {\n        const x509 = args.meta?.x509 as X509Opts\n        const privateKeyPEM =\n          x509?.privateKeyPEM ?? (args.privateKeyHex.includes('---') ? args.privateKeyHex : hexToPEM(args.privateKeyHex, 'private')) // In case we have x509 opts, the private key hex really was a PEM already (yuck)\n        const publicKeyJwk = PEMToJwk(privateKeyPEM, 'public')\n        const publicKeyPEM = jwkToPEM(publicKeyJwk, 'public')\n        const publicKeyHex = PEMToHex(publicKeyPEM)\n\n        const meta = {} as any\n        if (x509) {\n          meta.x509 = {\n            cn: x509.cn ?? args.alias ?? publicKeyHex,\n          }\n          let certChain: string = x509.certificateChainPEM ?? ''\n          if (x509.certificatePEM) {\n            if (!certChain.includes(x509.certificatePEM)) {\n              certChain = `${x509.certificatePEM}\\n${certChain}`\n            }\n          }\n          if (certChain.length > 0) {\n            meta.x509.certificateChainPEM = certChain\n            const x5c = pemCertChainTox5c(certChain)\n            if (!x509.certificateChainURL) {\n              // Do not put the chain in the JWK when the chain is hosted. We do put it in the x509 metadata\n              // @ts-ignore\n              publicKeyJwk.x5c = x5c\n            }\n            meta.x509.x5c = x5c\n          }\n          if (x509.certificateChainURL) {\n            // @ts-ignore\n            publicKeyJwk.x5u = x509.certificateChainURL\n            meta.x509.x5u = x509.certificateChainURL\n          }\n        }\n\n        key = {\n          type: args.type,\n          kid: args.alias ?? meta?.x509?.cn ?? publicKeyHex,\n          publicKeyHex,\n          meta: {\n            ...meta,\n            // todo: could als be EcDSA etc\n            algorithms: ['PS256', 'PS512', 'RS256', 'RS512'],\n            publicKeyJwk,\n            publicKeyPEM,\n          },\n        }\n        break\n      }\n\n      default:\n        throw Error('not_supported: Key type not supported: ' + args.type)\n    }\n    return key as ManagedKeyInfo\n  }\n\n  /**\n   * @returns a base64url encoded signature for the `RS256` alg\n   */\n  private async signRSA(privateKey: ManagedPrivateKey, data: Uint8Array, signingAlgorithm: string): Promise<string> {\n    const { hashAlgorithm, scheme } = signAlgorithmToSchemeAndHashAlg(signingAlgorithm)\n    const signer = new RSASigner(PEMToJwk(hexToPEM(privateKey.privateKeyHex, 'private'), 'private'), { hashAlgorithm, scheme })\n    const signature = await signer.sign(data)\n    return signature as string\n  }\n\n  private async verifyRSA(publicKeyHex: string, data: Uint8Array, signingAlgorithm: string, signature: string) {\n    const { hashAlgorithm, scheme } = signAlgorithmToSchemeAndHashAlg(signingAlgorithm)\n    const signer = new RSASigner(PEMToJwk(hexToPEM(publicKeyHex, 'public'), 'public'), { hashAlgorithm, scheme })\n    return await signer.verify(data, signature)\n  }\n\n  public async listKeys(): Promise<Array<ManagedKeyInfo>> {\n    return (await this.privateKeyStore.list({})).map((privateKey: ManagedPrivateKey) => this.asSphereonManagedKeyInfo(privateKey))\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAGA;;;;;;;;ACHA,yBAAoF;AAIpF,uBAAoC;AACpC,mBAAkB;AAClB,sBAAqB;AAErB,UAAqB;AAGrB,IAAAA,sBAQO;AAVP,IAAM,EAAEC,WAAU,IAAKC;AAYvB,IAAMC,YAAQC,aAAAA,SAAM,oBAAA;AAEb,IAAMC,8BAAN,cAA0CC,qCAAAA;EAvBjD,OAuBiDA;;;EAC9BC;EAEjBC,YAAYC,UAAmC;AAC7C,UAAMA,QAAAA;AACN,SAAKF,kBAAkBE;EACzB;EAEA,MAAMC,UAAUC,MAA+F;AAC7G,YAAQA,KAAKC,MAAI;MACf,KAAKC,QAAQC,WAAWC,SAAQ;AAC9B,YAAI,CAACJ,KAAKK,iBAAiB,CAACL,KAAKM,cAAc;AAC7C,gBAAM,IAAIC,MAAM,qFAAA;QAClB;AACA,cAAMC,aAAa,KAAKC,yBAAyB;UAC/C,GAAGT;UACHU,OAAOV,KAAKW;UACZN,eAAeL,KAAKK;UACpBC,cAAcN,KAAKM;UACnBL,MAAMD,KAAKC;QACb,CAAA;AACA,cAAM,KAAKL,gBAAgBgB,OAAO;UAAEF,OAAOF,WAAWG;UAAK,GAAGX;QAAK,CAAA;AACnER,cAAM,gBAAgBgB,WAAWP,MAAMO,WAAWF,YAAY;AAC9D,eAAOE;MAET,KAAK;MACL,KAAK;;MAEL,KAAK,OAAO;AACV,YAAI,CAACR,KAAKK,iBAAiB,CAACL,KAAKa,eAAe;AAC9C,gBAAM,IAAIN,MAAM,kGAAA;QAClB;AACA,cAAMC,cAAa,KAAKC,yBAAyB;UAAEC,OAAOV,KAAKW;UAAK,GAAGX;QAAK,CAAA;AAC5E,cAAM,KAAKJ,gBAAgBgB,OAAO;UAAEF,OAAOF,YAAWG;UAAK,GAAGX;QAAK,CAAA;AACnER,cAAM,gBAAgBgB,YAAWP,MAAMO,YAAWF,YAAY;AAC9D,eAAOE;MACT;MACA;AACE,eAAO,MAAM,MAAMT,UAAUC,IAAAA;IACjC;EACF;EAEA,MAAMc,UAAU,EAAEb,KAAI,GAAiD;AACrE,QAAIc;AAEJ,YAAQd,MAAAA;MACN,KAAKC,QAAQC,YAAY;AACvB,cAAMI,MACJ,mLAAA;MAaJ;;MAGA,KAAK,OAAO;AACV,cAAMF,gBAAgB,UAAMW,0CAAsBf,IAAAA;AAClDc,cAAM,MAAM,KAAKhB,UAAU;UACzBE;UACAI;QACF,CAAA;AACA;MACF;MACA;AACEU,cAAM,MAAM,MAAMD,UAAU;UAAEb;QAAK,CAAA;IACvC;AAEAT,UAAM,eAAeS,MAAMc,IAAIT,YAAY;AAE3C,WAAOS;EACT;EAEA,MAAME,KAAK,EAAEC,QAAQC,WAAWC,KAAI,GAA0F;AAC5H,QAAIC;AACJ,QAAI;AACFA,mBAAa,MAAM,KAAKzB,gBAAgB0B,IAAI;QAAEZ,OAAOQ,OAAOP;MAAI,CAAA;IAClE,SAASY,GAAG;AACV,YAAM,IAAIhB,MAAM,6CAA6CW,OAAOP,GAAG,EAAE;IAC3E;AAEA,QAAIU,WAAWpB,SAASC,QAAQC,YAAY;AAC1C,YAAMI,MACJ,mLAAA;IAgBJ;;MAEEc,WAAWpB,SAAS;MACpB;AACA,UAAI,OAAOkB,cAAc,eAAeA,cAAc,WAAWA,cAAc,WAAWA,cAAc,WAAWA,cAAc,SAAS;AACxI,eAAO,MAAM,KAAKK,QAAQH,YAAYD,MAAMD,aAAa,OAAA;MAC3D;AACA,aAAOM,QAAQC,OACb,IAAInB,MAAM,6DAA6DY,SAAAA,4CAAqD,CAAA;IAEhI,OAAO;AACL,aAAO,MAAM,MAAMF,KAAK;QAAEC;QAAQC;QAAWC;MAAK,CAAA;IACpD;EACF;EAEA,MAAMO,OAAO,EACXrB,cACAL,MACAkB,WACAC,MACAQ,UAAS,GAOU;AACnB,QAAI3B,SAAS,OAAO;AAClB,aAAO,MAAM,KAAK4B,UAAUvB,cAAcc,MAAMD,aAAa,SAASS,SAAAA;IACxE;AACA,UAAMrB,MAAM,yCAAyCN,IAAAA,EAAM;EAC7D;EAEQQ,yBAAyBT,MAA0C;AACzE,QAAIe;AACJ,YAAQf,KAAKC,MAAI;MACf,KAAKC,QAAQC;AACXY,cAAM;UACJd,MAAMD,KAAKC;UACXU,KAAKX,KAAKU,SAASV,KAAKM;UACxBA,cAAcN,KAAKM;UACnBwB,MAAM;YACJC,YAAY;cAAC;;UACf;QACF;AACA;MACF,KAAK,aAAa;AAChB,cAAMC,eAAe1C,WAAWU,KAAKK,cAAc4B,YAAW,GAAI,QAAA;AAClE,cAAMC,YAAY,IAAIC,gBAAAA,QAASC,GAAG,WAAA;AAClC,cAAMC,UAAUH,UAAUI,eAAeN,cAAc,KAAA;AACvD,cAAM1B,eAAe+B,QAAQE,UAAU,MAAM,KAAA;AAC7CxB,cAAM;UACJd,MAAMD,KAAKC;UACXU,KAAKX,KAAKU,SAASJ;UACnBA;UACAwB,MAAM;YACJU,mBAAeC,2CAAuB;cAAEC,SAAKC,0BAAMrC,cAAc,WAAA;YAAa,CAAA;YAC9EyB,YAAY;cAAC;cAAU;cAAY;cAAuB;cAAqB;cAAmB;;UACpG;QACF;AACA;MACF;MACA,KAAK,aAAa;AAChB,cAAMC,eAAe1C,WAAWU,KAAKK,cAAc4B,YAAW,GAAI,QAAA;AAClE,cAAMW,YAAY,IAAIT,gBAAAA,QAASC,GAAG,MAAA;AAClC,cAAMC,UAAUO,UAAUN,eAAeN,cAAc,KAAA;AACvD,cAAM1B,eAAe+B,QAAQE,UAAU,MAAM,KAAA;AAC7CxB,cAAM;UACJd,MAAMD,KAAKC;UACXU,KAAKX,KAAKU,SAASJ;UACnBA;UACAwB,MAAM;YACJU,mBAAeC,2CAAuB;cAAEC,SAAKC,0BAAMrC,cAAc,WAAA;YAAa,CAAA;YAC9EyB,YAAY;cAAC;;UACf;QACF;AACA;MACF;;MAEA,KAAK,OAAO;AACV,cAAMc,OAAO7C,KAAK8B,MAAMe;AACxB,cAAMhC,gBACJgC,MAAMhC,kBAAkBb,KAAKK,cAAcyC,SAAS,KAAA,IAAS9C,KAAKK,oBAAgB0C,8BAAS/C,KAAKK,eAAe,SAAA;AACjH,cAAM2C,mBAAeC,8BAASpC,eAAe,QAAA;AAC7C,cAAMqC,mBAAeC,8BAASH,cAAc,QAAA;AAC5C,cAAM1C,mBAAe8C,8BAASF,YAAAA;AAE9B,cAAMpB,OAAO,CAAC;AACd,YAAIe,MAAM;AACRf,eAAKe,OAAO;YACVQ,IAAIR,KAAKQ,MAAMrD,KAAKU,SAASJ;UAC/B;AACA,cAAIgD,YAAoBT,KAAKU,uBAAuB;AACpD,cAAIV,KAAKW,gBAAgB;AACvB,gBAAI,CAACF,UAAUR,SAASD,KAAKW,cAAc,GAAG;AAC5CF,0BAAY,GAAGT,KAAKW,cAAc;EAAKF,SAAAA;YACzC;UACF;AACA,cAAIA,UAAUG,SAAS,GAAG;AACxB3B,iBAAKe,KAAKU,sBAAsBD;AAChC,kBAAMI,UAAMC,uCAAkBL,SAAAA;AAC9B,gBAAI,CAACT,KAAKe,qBAAqB;AAG7BZ,2BAAaU,MAAMA;YACrB;AACA5B,iBAAKe,KAAKa,MAAMA;UAClB;AACA,cAAIb,KAAKe,qBAAqB;AAE5BZ,yBAAaa,MAAMhB,KAAKe;AACxB9B,iBAAKe,KAAKgB,MAAMhB,KAAKe;UACvB;QACF;AAEA7C,cAAM;UACJd,MAAMD,KAAKC;UACXU,KAAKX,KAAKU,SAASoB,MAAMe,MAAMQ,MAAM/C;UACrCA;UACAwB,MAAM;YACJ,GAAGA;;YAEHC,YAAY;cAAC;cAAS;cAAS;cAAS;;YACxCiB;YACAE;UACF;QACF;AACA;MACF;MAEA;AACE,cAAM3C,MAAM,4CAA4CP,KAAKC,IAAI;IACrE;AACA,WAAOc;EACT;;;;EAKA,MAAcS,QAAQH,YAA+BD,MAAkB0C,kBAA2C;AAChH,UAAM,EAAEC,eAAeC,OAAM,QAAKC,qDAAgCH,gBAAAA;AAClE,UAAMI,SAAS,IAAIC,kCAAUlB,kCAASF,8BAAS1B,WAAWhB,eAAe,SAAA,GAAY,SAAA,GAAY;MAAE0D;MAAeC;IAAO,CAAA;AACzH,UAAMpC,YAAY,MAAMsC,OAAOjD,KAAKG,IAAAA;AACpC,WAAOQ;EACT;EAEA,MAAcC,UAAUvB,cAAsBc,MAAkB0C,kBAA0BlC,WAAmB;AAC3G,UAAM,EAAEmC,eAAeC,OAAM,QAAKC,qDAAgCH,gBAAAA;AAClE,UAAMI,SAAS,IAAIC,kCAAUlB,kCAASF,8BAASzC,cAAc,QAAA,GAAW,QAAA,GAAW;MAAEyD;MAAeC;IAAO,CAAA;AAC3G,WAAO,MAAME,OAAOvC,OAAOP,MAAMQ,SAAAA;EACnC;EAEA,MAAawC,WAA2C;AACtD,YAAQ,MAAM,KAAKxE,gBAAgByE,KAAK,CAAC,CAAA,GAAIC,IAAI,CAACjD,eAAkC,KAAKZ,yBAAyBY,UAAAA,CAAAA;EACpH;AACF;;;ADzRA,0BAAc,8BAFd;AAgBO,IAAKkD,UAAAA,yBAAAA,UAAAA;;SAAAA;;","names":["import_ssi_sdk_ext","fromString","u8a","debug","Debug","SphereonKeyManagementSystem","KeyManagementSystem","privateKeyStore","constructor","keyStore","importKey","args","type","KeyType","Bls12381G2","toString","privateKeyHex","publicKeyHex","Error","managedKey","asSphereonManagedKeyInfo","alias","kid","import","privateKeyPEM","createKey","key","generatePrivateKeyHex","sign","keyRef","algorithm","data","privateKey","get","e","signRSA","Promise","reject","verify","signature","verifyRSA","meta","algorithms","privateBytes","toLowerCase","secp256k1","elliptic","ec","keyPair","keyFromPrivate","getPublic","jwkThumbprint","calculateJwkThumbprint","jwk","toJwk","secp256r1","x509","includes","hexToPEM","publicKeyJwk","PEMToJwk","publicKeyPEM","jwkToPEM","PEMToHex","cn","certChain","certificateChainPEM","certificatePEM","length","x5c","pemCertChainTox5c","certificateChainURL","x5u","signingAlgorithm","hashAlgorithm","scheme","signAlgorithmToSchemeAndHashAlg","signer","RSASigner","listKeys","list","map","KeyType"]}