@sphereon/ssi-sdk.kms-rest 0.34.1-feature.IDK.11.54 → 0.34.1-feature.SSISDK.44.finish.dcql.309

package/dist/index.cjs

@@ -36,11 +36,11 @@ __export(index_exports, {
 module.exports = __toCommonJS(index_exports);
 
 // src/RestKeyManagementSystem.ts
-var import_key_manager = require("@veramo/key-manager");
 var import_ssi_sdk_ext = require("@sphereon/ssi-sdk-ext.key-utils");
-var import_ssi_sdk = require("@sphereon/ssi-sdk.kms-rest-client");
 var import_ssi_sdk_ext2 = require("@sphereon/ssi-sdk-ext.x509-utils");
+var import_ssi_sdk = require("@sphereon/ssi-sdk.kms-rest-client");
 var import_ssi_types = require("@sphereon/ssi-types");
+var import_key_manager = require("@veramo/key-manager");
 var import_elliptic = __toESM(require("elliptic"), 1);
 var u8a = __toESM(require("uint8arrays"), 1);
 var { fromString, toString } = u8a;
@@ -50,6 +50,7 @@ var RestKeyManagementSystem = class extends import_key_manager.AbstractKeyManage
   }
   client;
   id;
+  providerId;
   constructor(options) {
     super();
     const config = {
@@ -57,6 +58,7 @@ var RestKeyManagementSystem = class extends import_key_manager.AbstractKeyManage
       authOpts: options.authOpts
     };
     this.id = options.applicationId;
+    this.providerId = options.providerId;
     this.client = new import_ssi_sdk.KmsRestClient(config);
   }
   async createKey(args) {
@@ -69,7 +71,10 @@ var RestKeyManagementSystem = class extends import_key_manager.AbstractKeyManage
         import_ssi_sdk.KeyOperations.Sign
       ]
     };
-    const key = await this.client.methods.kmsClientGenerateKey(options);
+    const key = this.providerId ? await this.client.methods.kmsClientProviderGenerateKey({
+      ...options,
+      providerId: this.providerId
+    }) : await this.client.methods.kmsClientGenerateKey(options);
     const jwk = {
       ...key.keyPair.jose.publicJwk,
       alg: key.keyPair.jose.publicJwk.alg ? this.mapJoseAlgorithm(key.keyPair.jose.publicJwk.alg) : void 0
@@ -83,7 +88,7 @@ var RestKeyManagementSystem = class extends import_key_manager.AbstractKeyManage
       kms: this.id,
       type,
       meta: {
-        alias: key.keyPair.kid,
+        alias: key.keyPair.alias,
         algorithms: [
           key.keyPair.jose.publicJwk.alg ?? "PS256"
         ],
@@ -99,13 +104,16 @@ var RestKeyManagementSystem = class extends import_key_manager.AbstractKeyManage
     const { type } = args;
     const signatureAlgorithm = this.mapKeyTypeToSignatureAlgorithm(type);
     const importKey = this.mapImportKey(args);
-    const result = await this.client.methods.kmsClientStoreKey(importKey.key);
+    const result = this.providerId ? await this.client.methods.kmsClientProviderStoreKey({
+      ...importKey.key,
+      providerId: this.providerId
+    }) : await this.client.methods.kmsClientStoreKey(importKey.key);
     return {
       kid: importKey.kid,
       kms: this.id,
       type,
       meta: {
-        alias: importKey.kid,
+        alias: importKey.key.keyInfo.alias,
         algorithms: [
           result.keyInfo.key.alg ?? "PS256"
         ],
@@ -119,17 +127,76 @@ var RestKeyManagementSystem = class extends import_key_manager.AbstractKeyManage
   }
   async deleteKey(args) {
     const { kid } = args;
-    return await this.client.methods.kmsClientDeleteKey({
+    return this.providerId ? await this.client.methods.kmsClientProviderDeleteKey({
+      aliasOrKid: kid,
+      providerId: this.providerId
+    }) : await this.client.methods.kmsClientDeleteKey({
       aliasOrKid: kid
     });
   }
   async listKeys() {
-    const keys = await this.client.methods.kmsClientListKeys();
-    return (0, import_ssi_sdk.ListKeysResponseToJSONTyped)(keys, false).keyInfos;
+    const keys = this.providerId ? await this.client.methods.kmsClientProviderListKeys({
+      providerId: this.providerId
+    }) : await this.client.methods.kmsClientListKeys();
+    const restKeys = (0, import_ssi_sdk.ListKeysResponseToJSONTyped)(keys, false).keyInfos;
+    return restKeys.map((restKey) => {
+      const jwk = restKey.key;
+      let publicKeyHex = "";
+      if (jwk.kty === "EC") {
+        publicKeyHex = jwk.x || "";
+      } else if (jwk.kty === "RSA") {
+        publicKeyHex = jwk.n || "";
+      } else if (jwk.kty === "OKP") {
+        publicKeyHex = jwk.x || "";
+      }
+      const keyType = this.mapRestKeyTypeToTKeyType(restKey.keyType);
+      return {
+        kid: restKey.kid || restKey.alias,
+        kms: this.id,
+        type: keyType,
+        publicKeyHex,
+        meta: {
+          algorithms: restKey.signatureAlgorithm ? [
+            restKey.signatureAlgorithm
+          ] : void 0,
+          jwk,
+          jwkThumbprint: (0, import_ssi_sdk_ext.calculateJwkThumbprint)({
+            jwk,
+            digestAlgorithm: restKey.signatureAlgorithm ? this.signatureAlgorithmToDigestAlgorithm(restKey.signatureAlgorithm) : "sha256"
+          }),
+          alias: restKey.alias,
+          providerId: restKey.providerId,
+          x5c: restKey.x5c,
+          keyVisibility: restKey.keyVisibility,
+          keyEncoding: restKey.keyEncoding,
+          ...restKey.opts
+        }
+      };
+    });
+  }
+  mapRestKeyTypeToTKeyType(keyType) {
+    switch (keyType) {
+      case "RSA":
+        return "RSA";
+      case "EC":
+      case "P256":
+        return "Secp256r1";
+      case "X25519":
+        return "X25519";
+      case "Ed25519":
+        return "Ed25519";
+      case "secp256k1":
+        return "Secp256k1";
+      default:
+        throw new Error(`Unknown key type: ${keyType}`);
+    }
   }
   async sign(args) {
     const { keyRef, data } = args;
-    const key = await this.client.methods.kmsClientGetKey({
+    const key = this.providerId ? await this.client.methods.kmsClientProviderGetKey({
+      aliasOrKid: keyRef.kid,
+      providerId: this.providerId
+    }) : await this.client.methods.kmsClientGetKey({
       aliasOrKid: keyRef.kid
     });
     const signingResult = await this.client.methods.kmsClientCreateRawSignature({
@@ -140,7 +207,10 @@ var RestKeyManagementSystem = class extends import_key_manager.AbstractKeyManage
   }
   async verify(args) {
     const { keyRef, data, signature } = args;
-    const key = await this.client.methods.kmsClientGetKey({
+    const key = this.providerId ? await this.client.methods.kmsClientProviderGetKey({
+      aliasOrKid: keyRef.kid,
+      providerId: this.providerId
+    }) : await this.client.methods.kmsClientGetKey({
       aliasOrKid: keyRef.kid
     });
     const verification = await this.client.methods.kmsClientIsValidRawSignature({

package/dist/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts","../src/RestKeyManagementSystem.ts"],"sourcesContent":["export { RestKeyManagementSystem } from './RestKeyManagementSystem'\nexport * from './types'\n","import type { ManagedKeyInfo, TKeyType } from '@veramo/core'\nimport { AbstractKeyManagementSystem } from '@veramo/key-manager'\nimport {\n  calculateJwkThumbprint,\n  toJwk,\n  x25519PublicHexFromPrivateHex,\n  type X509Opts\n} from '@sphereon/ssi-sdk-ext.key-utils'\nimport {\n  CurveFromJSONTyped,\n  JwkKeyTypeFromJSONTyped,\n  JwkUse,\n  JwkUseFromJSONTyped,\n  KeyOperations,\n  KmsRestClient,\n  ListKeysResponseToJSONTyped,\n  type RestClientAuthenticationOpts,\n  SignatureAlgorithm,\n  type StoreKey\n} from '@sphereon/ssi-sdk.kms-rest-client'\nimport {\n  hexToPEM,\n  jwkToPEM,\n  pemCertChainTox5c,\n  PEMToHex,\n  PEMToJwk\n} from '@sphereon/ssi-sdk-ext.x509-utils'\nimport { JoseSignatureAlgorithm, type JWK } from '@sphereon/ssi-types'\nimport elliptic from 'elliptic'\n// @ts-ignore\nimport * as u8a from 'uint8arrays'\nimport type {\n  CreateKeyArgs,\n  DeleteKeyArgs,\n  ImportKeyArgs,\n  MapImportKeyArgs,\n  MappedImportKey,\n  SharedSecretArgs,\n  SignArgs,\n  VerifyArgs\n} from './types'\n\nconst { fromString, toString } = u8a\n\ninterface AbstractKeyManagementSystemOptions {\n  applicationId: string\n  baseUrl: string\n  authOpts?: RestClientAuthenticationOpts\n}\n\nexport class RestKeyManagementSystem extends AbstractKeyManagementSystem {\n  private client: KmsRestClient\n  private readonly id: string\n\n  constructor(options: AbstractKeyManagementSystemOptions) {\n    super()\n\n    const config = {\n      baseUrl: options.baseUrl,\n      authOpts: options.authOpts\n    }\n\n    this.id = options.applicationId\n    this.client = new KmsRestClient(config)\n  }\n\n  async createKey(args: CreateKeyArgs): Promise<ManagedKeyInfo> {\n    const { type, meta } = args\n\n    const signatureAlgorithm = this.mapKeyTypeToSignatureAlgorithm(type)\n    const options  = {\n      use: meta && 'keyUsage' in meta ? this.mapKeyUsage(meta.keyUsage) : JwkUse.Sig,\n      alg: signatureAlgorithm,\n      keyOperations: meta ? this.mapKeyOperations(meta.keyOperations as string[]) : [KeyOperations.Sign]\n    }\n\n    const key = await this.client.methods.kmsClientGenerateKey(options)\n\n    const jwk = {\n      ...key.keyPair.jose.publicJwk,\n      alg: key.keyPair.jose.publicJwk.alg ? this.mapJoseAlgorithm(key.keyPair.jose.publicJwk.alg) : undefined,\n    } satisfies JWK\n\n    const kid = key.keyPair.kid ?? key.keyPair.jose.publicJwk.kid\n    if (!kid) {\n      throw new Error(`No kid present in key`)\n    }\n\n    return {\n      kid,\n      kms: this.id,\n      type,\n      meta: {\n        alias: key.keyPair.kid,\n        algorithms: [key.keyPair.jose.publicJwk.alg ?? 'PS256'],\n        jwkThumbprint: calculateJwkThumbprint({\n          jwk,\n          digestAlgorithm: this.signatureAlgorithmToDigestAlgorithm(signatureAlgorithm),\n        }),\n      },\n      publicKeyHex: Buffer.from(key.keyPair.jose.publicJwk.toString(), 'utf8').toString('base64'),\n    }\n  }\n\n  async importKey(args: ImportKeyArgs): Promise<ManagedKeyInfo> {\n    const { type } = args\n    const signatureAlgorithm = this.mapKeyTypeToSignatureAlgorithm(type)\n    const importKey = this.mapImportKey(args)\n\n    const result = await this.client.methods.kmsClientStoreKey(importKey.key)\n\n    return {\n      kid: importKey.kid,\n      kms: this.id,\n      type,\n      meta: {\n        alias: importKey.kid,\n        algorithms: [result.keyInfo.key.alg ?? 'PS256'],\n        jwkThumbprint: calculateJwkThumbprint({\n          jwk: importKey.publicKeyJwk,\n          digestAlgorithm: this.signatureAlgorithmToDigestAlgorithm(signatureAlgorithm),\n        }),\n      },\n      publicKeyHex: Buffer.from(result.keyInfo.key.toString(), 'utf8').toString('base64'),\n    }\n  }\n\n  async deleteKey(args: DeleteKeyArgs): Promise<boolean> {\n    const { kid } = args\n\n    return await this.client.methods.kmsClientDeleteKey({ aliasOrKid: kid })\n  }\n\n  async listKeys(): Promise<ManagedKeyInfo[]> {\n    const keys = await this.client.methods.kmsClientListKeys()\n\n    return ListKeysResponseToJSONTyped(keys, false).keyInfos //ListKeysResponseFromJSONTyped\n  }\n\n  async sign(args: SignArgs): Promise<string> {\n    const { keyRef, data } = args\n    const key = await this.client.methods.kmsClientGetKey({ aliasOrKid: keyRef.kid })\n    const signingResult = await this.client.methods.kmsClientCreateRawSignature({\n      keyInfo: key.keyInfo,\n      input: toString(data, 'base64')\n    })\n\n    return signingResult.signature\n  }\n\n  async verify(args: VerifyArgs): Promise<boolean> {\n    const { keyRef, data, signature } = args\n    const key = await this.client.methods.kmsClientGetKey({ aliasOrKid: keyRef.kid })\n    const verification = await this.client.methods.kmsClientIsValidRawSignature({\n      keyInfo: key.keyInfo,\n      input: toString(data, 'base64'),\n      signature\n    })\n\n    return verification.isValid\n  }\n\n  async sharedSecret(args: SharedSecretArgs): Promise<string> {\n    throw new Error('sharedSecret is not implemented for REST KMS.')\n  }\n\n  private signatureAlgorithmToDigestAlgorithm = (signatureAlgorithm: SignatureAlgorithm): 'sha256' | 'sha512' => {\n    switch (signatureAlgorithm) {\n      case SignatureAlgorithm.EcdsaSha256:\n      case SignatureAlgorithm.RsaSsaPssSha256Mgf1:\n      case SignatureAlgorithm.EckaDhSha256:\n      case SignatureAlgorithm.HmacSha256:\n      case SignatureAlgorithm.Es256K:\n        return 'sha256'\n      case SignatureAlgorithm.EcdsaSha512:\n      case SignatureAlgorithm.HmacSha512:\n      case SignatureAlgorithm.RsaSsaPssSha512Mgf1:\n        return 'sha512'\n      default:\n        throw new Error(`Signature algorithm ${signatureAlgorithm} is not supported by REST KMS`)\n    }\n  }\n\n  private mapKeyUsage = (usage: string): JwkUse => {\n    switch (usage) {\n      case 'sig':\n        return JwkUse.Sig\n      case 'enc':\n        return JwkUse.Enc\n      default:\n        throw new Error(`Key usage ${usage} is not supported by REST KMS`)\n    }\n  }\n\n  private mapKeyTypeToSignatureAlgorithm = (type: TKeyType): SignatureAlgorithm => {\n    switch (type) {\n      case 'Secp256r1':\n        return SignatureAlgorithm.EcdsaSha256\n      case 'RSA':\n        return SignatureAlgorithm.RsaSsaPssSha256Mgf1\n      case 'X25519':\n        return SignatureAlgorithm.EckaDhSha256\n      default:\n        throw new Error(`Key type ${type} is not supported by REST KMS`)\n    }\n  }\n\n  private mapJoseAlgorithm = (alg: string): JoseSignatureAlgorithm => {\n    switch (alg) {\n      case 'RS256': return JoseSignatureAlgorithm.RS256;\n      case 'RS384': return JoseSignatureAlgorithm.RS384;\n      case 'RS512': return JoseSignatureAlgorithm.RS512;\n      case 'ES256': return JoseSignatureAlgorithm.ES256;\n      case 'ES256K': return JoseSignatureAlgorithm.ES256K;\n      case 'ES384': return JoseSignatureAlgorithm.ES384;\n      case 'ES512': return JoseSignatureAlgorithm.ES512;\n      case 'EdDSA': return JoseSignatureAlgorithm.EdDSA;\n      case 'HS256': return JoseSignatureAlgorithm.HS256;\n      case 'HS384': return JoseSignatureAlgorithm.HS384;\n      case 'HS512': return JoseSignatureAlgorithm.HS512;\n      case 'PS256': return JoseSignatureAlgorithm.PS256;\n      case 'PS384': return JoseSignatureAlgorithm.PS384;\n      case 'PS512': return JoseSignatureAlgorithm.PS512;\n      case 'none':  return JoseSignatureAlgorithm.none;\n      default:\n        throw new Error(`Signature algorithm ${alg} is not supported by REST KMS`)\n    }\n  }\n\n  private mapKeyOperation = (operation: string): KeyOperations => {\n    switch (operation) {\n      case 'sign':\n        return KeyOperations.Sign\n      case 'verify':\n        return KeyOperations.Verify\n      case 'wrapKey':\n        return KeyOperations.WrapKey\n      case 'deriveKey':\n        return KeyOperations.DeriveKey\n      case 'unwrapKey':\n        return KeyOperations.UnwrapKey\n      case 'decrypt':\n        return KeyOperations.Decrypt\n      case 'deriveBits':\n        return KeyOperations.DeriveBits\n      case 'encrypt':\n        return KeyOperations.Encrypt\n      default:\n        throw new Error(`Key operation ${operation} is not supported by REST KMS`)\n    }\n  }\n\n  private mapKeyOperations = (operations: string[]): KeyOperations[] => {\n    return operations.map((operation) => this.mapKeyOperation(operation))\n  }\n\n  private mapImportRsaKey = (args: MapImportKeyArgs): MappedImportKey => {\n    const x509 = args.meta?.x509 as X509Opts\n    const privateKeyPEM = x509?.privateKeyPEM ?? (args.privateKeyHex.includes('---')\n      ? args.privateKeyHex\n      : hexToPEM(args.privateKeyHex, 'private')\n    ) // In case we have x509 opts, the private key hex really was a PEM already (yuck)\n    const publicKeyJwk = PEMToJwk(privateKeyPEM, 'public')\n    const privateKeyJwk = PEMToJwk(privateKeyPEM)\n    const publicKeyPEM = jwkToPEM(publicKeyJwk, 'public')\n    const publicKeyHex = PEMToHex(publicKeyPEM)\n\n    const meta = {} as any\n    if (x509) {\n      meta.x509 = {\n        cn: x509.cn ?? args.kid ?? publicKeyHex,\n      }\n      let certChain: string = x509.certificateChainPEM ?? ''\n      if (x509.certificatePEM) {\n        if (!certChain.includes(x509.certificatePEM)) {\n          certChain = `${x509.certificatePEM}\\n${certChain}`\n        }\n      }\n      if (certChain.length > 0) {\n        meta.x509.certificateChainPEM = certChain\n        const x5c = pemCertChainTox5c(certChain)\n        if (!x509.certificateChainURL) {\n          // Do not put the chain in the JWK when the chain is hosted. We do put it in the x509 metadata\n          // @ts-ignore\n          publicKeyJwk.x5c = x5c\n        }\n        meta.x509.x5c = x5c\n      }\n      if (x509.certificateChainURL) {\n        // @ts-ignore\n        publicKeyJwk.x5u = x509.certificateChainURL\n        meta.x509.x5u = x509.certificateChainURL\n      }\n    }\n\n    const kid = args.kid ?? meta?.x509?.cn ?? publicKeyHex\n    return {\n      kid,\n      publicKeyJwk: publicKeyJwk as JWK,\n      key: {\n        keyInfo: {\n          key: {\n            ...privateKeyJwk,\n            kid,\n            kty: JwkKeyTypeFromJSONTyped(privateKeyJwk.kty, false),\n            use: JwkUseFromJSONTyped(privateKeyJwk.use, false),\n            crv: CurveFromJSONTyped(privateKeyJwk.crv, false),\n          },\n        },\n        certChain: meta.x509.x5c\n      } satisfies StoreKey\n    }\n  }\n\n  private mapImportSecp256r1Key = (args: MapImportKeyArgs): MappedImportKey => {\n    const { privateKeyHex } = args\n    const privateBytes = fromString(privateKeyHex.toLowerCase(), 'base16')\n    const secp256r1 = new elliptic.ec('p256')\n    const keyPair = secp256r1.keyFromPrivate(privateBytes, 'hex')\n    const publicKeyHex = keyPair.getPublic(true, 'hex')\n    const publicKeyJwk = toJwk(publicKeyHex, 'Secp256r1')\n    const privateKeyJwk = toJwk(privateKeyHex, 'Secp256r1', { isPrivateKey: true })\n    const kid = args.kid ?? publicKeyJwk.kid ?? publicKeyHex\n\n    return {\n      kid,\n      publicKeyJwk: publicKeyJwk as JWK,\n      key: {\n        keyInfo: {\n          key: {\n            ...privateKeyJwk,\n            kid,\n            kty: JwkKeyTypeFromJSONTyped(privateKeyJwk.kty, false),\n            use: JwkUseFromJSONTyped(privateKeyJwk.use, false),\n            crv: CurveFromJSONTyped(privateKeyJwk.crv, false),\n          }\n        }\n      } satisfies StoreKey\n    }\n  }\n\n  private mapImportX25519Key = (args: MapImportKeyArgs): MappedImportKey => {\n    const { privateKeyHex } = args\n    const privateKeyJwk = toJwk(privateKeyHex, 'X25519', { isPrivateKey: true })\n    const publicKeyHex = x25519PublicHexFromPrivateHex(privateKeyHex)\n    const publicKeyJwk = toJwk(publicKeyHex, 'X25519')\n    const kid = args.kid ?? publicKeyJwk.kid ?? publicKeyHex\n\n    return {\n      kid,\n      publicKeyJwk: publicKeyJwk as JWK,\n      key: {\n        keyInfo: {\n          key: {\n            ...privateKeyJwk,\n            kid,\n            kty: JwkKeyTypeFromJSONTyped(privateKeyJwk.kty, false),\n            use: JwkUseFromJSONTyped(privateKeyJwk.use, false),\n            crv: CurveFromJSONTyped(privateKeyJwk.crv, false),\n          }\n        }\n      } satisfies StoreKey\n    }\n  }\n\n  private mapImportKey = (args: MapImportKeyArgs): MappedImportKey => {\n    switch (args.type) {\n      case 'RSA': {\n        return this.mapImportRsaKey(args)\n      }\n      case 'Secp256r1': {\n        return this.mapImportSecp256r1Key(args)\n      }\n      case 'X25519': {\n        return this.mapImportX25519Key(args)\n      }\n      default:\n        throw new Error(`Key type ${args.type} is not supported by REST KMS`)\n    }\n  }\n\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;;;;;;;ACCA,yBAA4C;AAC5C,yBAKO;AACP,qBAWO;AACP,IAAAA,sBAMO;AACP,uBAAiD;AACjD,sBAAqB;AAErB,UAAqB;AAYrB,IAAM,EAAEC,YAAYC,SAAQ,IAAKC;AAQ1B,IAAMC,0BAAN,cAAsCC,+CAAAA;EAjD7C,OAiD6CA;;;EACnCC;EACSC;EAEjB,YAAYC,SAA6C;AACvD,UAAK;AAEL,UAAMC,SAAS;MACbC,SAASF,QAAQE;MACjBC,UAAUH,QAAQG;IACpB;AAEA,SAAKJ,KAAKC,QAAQI;AAClB,SAAKN,SAAS,IAAIO,6BAAcJ,MAAAA;EAClC;EAEA,MAAMK,UAAUC,MAA8C;AAC5D,UAAM,EAAEC,MAAMC,KAAI,IAAKF;AAEvB,UAAMG,qBAAqB,KAAKC,+BAA+BH,IAAAA;AAC/D,UAAMR,UAAW;MACfY,KAAKH,QAAQ,cAAcA,OAAO,KAAKI,YAAYJ,KAAKK,QAAQ,IAAIC,sBAAOC;MAC3EC,KAAKP;MACLQ,eAAeT,OAAO,KAAKU,iBAAiBV,KAAKS,aAAa,IAAgB;QAACE,6BAAcC;;IAC/F;AAEA,UAAMC,MAAM,MAAM,KAAKxB,OAAOyB,QAAQC,qBAAqBxB,OAAAA;AAE3D,UAAMyB,MAAM;MACV,GAAGH,IAAII,QAAQC,KAAKC;MACpBX,KAAKK,IAAII,QAAQC,KAAKC,UAAUX,MAAM,KAAKY,iBAAiBP,IAAII,QAAQC,KAAKC,UAAUX,GAAG,IAAIa;IAChG;AAEA,UAAMC,MAAMT,IAAII,QAAQK,OAAOT,IAAII,QAAQC,KAAKC,UAAUG;AAC1D,QAAI,CAACA,KAAK;AACR,YAAM,IAAIC,MAAM,uBAAuB;IACzC;AAEA,WAAO;MACLD;MACAE,KAAK,KAAKlC;MACVS;MACAC,MAAM;QACJyB,OAAOZ,IAAII,QAAQK;QACnBI,YAAY;UAACb,IAAII,QAAQC,KAAKC,UAAUX,OAAO;;QAC/CmB,mBAAeC,2CAAuB;UACpCZ;UACAa,iBAAiB,KAAKC,oCAAoC7B,kBAAAA;QAC5D,CAAA;MACF;MACA8B,cAAcC,OAAOC,KAAKpB,IAAII,QAAQC,KAAKC,UAAUlC,SAAQ,GAAI,MAAA,EAAQA,SAAS,QAAA;IACpF;EACF;EAEA,MAAMiD,UAAUpC,MAA8C;AAC5D,UAAM,EAAEC,KAAI,IAAKD;AACjB,UAAMG,qBAAqB,KAAKC,+BAA+BH,IAAAA;AAC/D,UAAMmC,YAAY,KAAKC,aAAarC,IAAAA;AAEpC,UAAMsC,SAAS,MAAM,KAAK/C,OAAOyB,QAAQuB,kBAAkBH,UAAUrB,GAAG;AAExE,WAAO;MACLS,KAAKY,UAAUZ;MACfE,KAAK,KAAKlC;MACVS;MACAC,MAAM;QACJyB,OAAOS,UAAUZ;QACjBI,YAAY;UAACU,OAAOE,QAAQzB,IAAIL,OAAO;;QACvCmB,mBAAeC,2CAAuB;UACpCZ,KAAKkB,UAAUK;UACfV,iBAAiB,KAAKC,oCAAoC7B,kBAAAA;QAC5D,CAAA;MACF;MACA8B,cAAcC,OAAOC,KAAKG,OAAOE,QAAQzB,IAAI5B,SAAQ,GAAI,MAAA,EAAQA,SAAS,QAAA;IAC5E;EACF;EAEA,MAAMuD,UAAU1C,MAAuC;AACrD,UAAM,EAAEwB,IAAG,IAAKxB;AAEhB,WAAO,MAAM,KAAKT,OAAOyB,QAAQ2B,mBAAmB;MAAEC,YAAYpB;IAAI,CAAA;EACxE;EAEA,MAAMqB,WAAsC;AAC1C,UAAMC,OAAO,MAAM,KAAKvD,OAAOyB,QAAQ+B,kBAAiB;AAExD,eAAOC,4CAA4BF,MAAM,KAAA,EAAOG;EAClD;EAEA,MAAMC,KAAKlD,MAAiC;AAC1C,UAAM,EAAEmD,QAAQC,KAAI,IAAKpD;AACzB,UAAMe,MAAM,MAAM,KAAKxB,OAAOyB,QAAQqC,gBAAgB;MAAET,YAAYO,OAAO3B;IAAI,CAAA;AAC/E,UAAM8B,gBAAgB,MAAM,KAAK/D,OAAOyB,QAAQuC,4BAA4B;MAC1Ef,SAASzB,IAAIyB;MACbgB,OAAOrE,SAASiE,MAAM,QAAA;IACxB,CAAA;AAEA,WAAOE,cAAcG;EACvB;EAEA,MAAMC,OAAO1D,MAAoC;AAC/C,UAAM,EAAEmD,QAAQC,MAAMK,UAAS,IAAKzD;AACpC,UAAMe,MAAM,MAAM,KAAKxB,OAAOyB,QAAQqC,gBAAgB;MAAET,YAAYO,OAAO3B;IAAI,CAAA;AAC/E,UAAMmC,eAAe,MAAM,KAAKpE,OAAOyB,QAAQ4C,6BAA6B;MAC1EpB,SAASzB,IAAIyB;MACbgB,OAAOrE,SAASiE,MAAM,QAAA;MACtBK;IACF,CAAA;AAEA,WAAOE,aAAaE;EACtB;EAEA,MAAMC,aAAa9D,MAAyC;AAC1D,UAAM,IAAIyB,MAAM,+CAAA;EAClB;EAEQO,sCAAsC,wBAAC7B,uBAAAA;AAC7C,YAAQA,oBAAAA;MACN,KAAK4D,kCAAmBC;MACxB,KAAKD,kCAAmBE;MACxB,KAAKF,kCAAmBG;MACxB,KAAKH,kCAAmBI;MACxB,KAAKJ,kCAAmBK;AACtB,eAAO;MACT,KAAKL,kCAAmBM;MACxB,KAAKN,kCAAmBO;MACxB,KAAKP,kCAAmBQ;AACtB,eAAO;MACT;AACE,cAAM,IAAI9C,MAAM,uBAAuBtB,kBAAAA,+BAAiD;IAC5F;EACF,GAf8C;EAiBtCG,cAAc,wBAACkE,UAAAA;AACrB,YAAQA,OAAAA;MACN,KAAK;AACH,eAAOhE,sBAAOC;MAChB,KAAK;AACH,eAAOD,sBAAOiE;MAChB;AACE,cAAM,IAAIhD,MAAM,aAAa+C,KAAAA,+BAAoC;IACrE;EACF,GATsB;EAWdpE,iCAAiC,wBAACH,SAAAA;AACxC,YAAQA,MAAAA;MACN,KAAK;AACH,eAAO8D,kCAAmBC;MAC5B,KAAK;AACH,eAAOD,kCAAmBE;MAC5B,KAAK;AACH,eAAOF,kCAAmBG;MAC5B;AACE,cAAM,IAAIzC,MAAM,YAAYxB,IAAAA,+BAAmC;IACnE;EACF,GAXyC;EAajCqB,mBAAmB,wBAACZ,QAAAA;AAC1B,YAAQA,KAAAA;MACN,KAAK;AAAS,eAAOgE,wCAAuBC;MAC5C,KAAK;AAAS,eAAOD,wCAAuBE;MAC5C,KAAK;AAAS,eAAOF,wCAAuBG;MAC5C,KAAK;AAAS,eAAOH,wCAAuBI;MAC5C,KAAK;AAAU,eAAOJ,wCAAuBK;MAC7C,KAAK;AAAS,eAAOL,wCAAuBM;MAC5C,KAAK;AAAS,eAAON,wCAAuBO;MAC5C,KAAK;AAAS,eAAOP,wCAAuBQ;MAC5C,KAAK;AAAS,eAAOR,wCAAuBS;MAC5C,KAAK;AAAS,eAAOT,wCAAuBU;MAC5C,KAAK;AAAS,eAAOV,wCAAuBW;MAC5C,KAAK;AAAS,eAAOX,wCAAuBY;MAC5C,KAAK;AAAS,eAAOZ,wCAAuBa;MAC5C,KAAK;AAAS,eAAOb,wCAAuBc;MAC5C,KAAK;AAAS,eAAOd,wCAAuBe;MAC5C;AACE,cAAM,IAAIhE,MAAM,uBAAuBf,GAAAA,+BAAkC;IAC7E;EACF,GApB2B;EAsBnBgF,kBAAkB,wBAACC,cAAAA;AACzB,YAAQA,WAAAA;MACN,KAAK;AACH,eAAO9E,6BAAcC;MACvB,KAAK;AACH,eAAOD,6BAAc+E;MACvB,KAAK;AACH,eAAO/E,6BAAcgF;MACvB,KAAK;AACH,eAAOhF,6BAAciF;MACvB,KAAK;AACH,eAAOjF,6BAAckF;MACvB,KAAK;AACH,eAAOlF,6BAAcmF;MACvB,KAAK;AACH,eAAOnF,6BAAcoF;MACvB,KAAK;AACH,eAAOpF,6BAAcqF;MACvB;AACE,cAAM,IAAIzE,MAAM,iBAAiBkE,SAAAA,+BAAwC;IAC7E;EACF,GArB0B;EAuBlB/E,mBAAmB,wBAACuF,eAAAA;AAC1B,WAAOA,WAAWC,IAAI,CAACT,cAAc,KAAKD,gBAAgBC,SAAAA,CAAAA;EAC5D,GAF2B;EAInBU,kBAAkB,wBAACrG,SAAAA;AACzB,UAAMsG,OAAOtG,KAAKE,MAAMoG;AACxB,UAAMC,gBAAgBD,MAAMC,kBAAkBvG,KAAKwG,cAAcC,SAAS,KAAA,IACtEzG,KAAKwG,oBACLE,8BAAS1G,KAAKwG,eAAe,SAAA;AAEjC,UAAM/D,mBAAekE,8BAASJ,eAAe,QAAA;AAC7C,UAAMK,oBAAgBD,8BAASJ,aAAAA;AAC/B,UAAMM,mBAAeC,8BAASrE,cAAc,QAAA;AAC5C,UAAMR,mBAAe8E,8BAASF,YAAAA;AAE9B,UAAM3G,OAAO,CAAC;AACd,QAAIoG,MAAM;AACRpG,WAAKoG,OAAO;QACVU,IAAIV,KAAKU,MAAMhH,KAAKwB,OAAOS;MAC7B;AACA,UAAIgF,YAAoBX,KAAKY,uBAAuB;AACpD,UAAIZ,KAAKa,gBAAgB;AACvB,YAAI,CAACF,UAAUR,SAASH,KAAKa,cAAc,GAAG;AAC5CF,sBAAY,GAAGX,KAAKa,cAAc;EAAKF,SAAAA;QACzC;MACF;AACA,UAAIA,UAAUG,SAAS,GAAG;AACxBlH,aAAKoG,KAAKY,sBAAsBD;AAChC,cAAMI,UAAMC,uCAAkBL,SAAAA;AAC9B,YAAI,CAACX,KAAKiB,qBAAqB;AAG7B9E,uBAAa4E,MAAMA;QACrB;AACAnH,aAAKoG,KAAKe,MAAMA;MAClB;AACA,UAAIf,KAAKiB,qBAAqB;AAE5B9E,qBAAa+E,MAAMlB,KAAKiB;AACxBrH,aAAKoG,KAAKkB,MAAMlB,KAAKiB;MACvB;IACF;AAEA,UAAM/F,MAAMxB,KAAKwB,OAAOtB,MAAMoG,MAAMU,MAAM/E;AAC1C,WAAO;MACLT;MACAiB;MACA1B,KAAK;QACHyB,SAAS;UACPzB,KAAK;YACH,GAAG6F;YACHpF;YACAiG,SAAKC,wCAAwBd,cAAca,KAAK,KAAA;YAChDpH,SAAKsH,oCAAoBf,cAAcvG,KAAK,KAAA;YAC5CuH,SAAKC,mCAAmBjB,cAAcgB,KAAK,KAAA;UAC7C;QACF;QACAX,WAAW/G,KAAKoG,KAAKe;MACvB;IACF;EACF,GAxD0B;EA0DlBS,wBAAwB,wBAAC9H,SAAAA;AAC/B,UAAM,EAAEwG,cAAa,IAAKxG;AAC1B,UAAM+H,eAAe7I,WAAWsH,cAAcwB,YAAW,GAAI,QAAA;AAC7D,UAAMC,YAAY,IAAIC,gBAAAA,QAASC,GAAG,MAAA;AAClC,UAAMhH,UAAU8G,UAAUG,eAAeL,cAAc,KAAA;AACvD,UAAM9F,eAAed,QAAQkH,UAAU,MAAM,KAAA;AAC7C,UAAM5F,mBAAe6F,0BAAMrG,cAAc,WAAA;AACzC,UAAM2E,oBAAgB0B,0BAAM9B,eAAe,aAAa;MAAE+B,cAAc;IAAK,CAAA;AAC7E,UAAM/G,MAAMxB,KAAKwB,OAAOiB,aAAajB,OAAOS;AAE5C,WAAO;MACLT;MACAiB;MACA1B,KAAK;QACHyB,SAAS;UACPzB,KAAK;YACH,GAAG6F;YACHpF;YACAiG,SAAKC,wCAAwBd,cAAca,KAAK,KAAA;YAChDpH,SAAKsH,oCAAoBf,cAAcvG,KAAK,KAAA;YAC5CuH,SAAKC,mCAAmBjB,cAAcgB,KAAK,KAAA;UAC7C;QACF;MACF;IACF;EACF,GAzBgC;EA2BxBY,qBAAqB,wBAACxI,SAAAA;AAC5B,UAAM,EAAEwG,cAAa,IAAKxG;AAC1B,UAAM4G,oBAAgB0B,0BAAM9B,eAAe,UAAU;MAAE+B,cAAc;IAAK,CAAA;AAC1E,UAAMtG,mBAAewG,kDAA8BjC,aAAAA;AACnD,UAAM/D,mBAAe6F,0BAAMrG,cAAc,QAAA;AACzC,UAAMT,MAAMxB,KAAKwB,OAAOiB,aAAajB,OAAOS;AAE5C,WAAO;MACLT;MACAiB;MACA1B,KAAK;QACHyB,SAAS;UACPzB,KAAK;YACH,GAAG6F;YACHpF;YACAiG,SAAKC,wCAAwBd,cAAca,KAAK,KAAA;YAChDpH,SAAKsH,oCAAoBf,cAAcvG,KAAK,KAAA;YAC5CuH,SAAKC,mCAAmBjB,cAAcgB,KAAK,KAAA;UAC7C;QACF;MACF;IACF;EACF,GAtB6B;EAwBrBvF,eAAe,wBAACrC,SAAAA;AACtB,YAAQA,KAAKC,MAAI;MACf,KAAK,OAAO;AACV,eAAO,KAAKoG,gBAAgBrG,IAAAA;MAC9B;MACA,KAAK,aAAa;AAChB,eAAO,KAAK8H,sBAAsB9H,IAAAA;MACpC;MACA,KAAK,UAAU;AACb,eAAO,KAAKwI,mBAAmBxI,IAAAA;MACjC;MACA;AACE,cAAM,IAAIyB,MAAM,YAAYzB,KAAKC,IAAI,+BAA+B;IACxE;EACF,GAduB;AAgBzB;","names":["import_ssi_sdk_ext","fromString","toString","u8a","RestKeyManagementSystem","AbstractKeyManagementSystem","client","id","options","config","baseUrl","authOpts","applicationId","KmsRestClient","createKey","args","type","meta","signatureAlgorithm","mapKeyTypeToSignatureAlgorithm","use","mapKeyUsage","keyUsage","JwkUse","Sig","alg","keyOperations","mapKeyOperations","KeyOperations","Sign","key","methods","kmsClientGenerateKey","jwk","keyPair","jose","publicJwk","mapJoseAlgorithm","undefined","kid","Error","kms","alias","algorithms","jwkThumbprint","calculateJwkThumbprint","digestAlgorithm","signatureAlgorithmToDigestAlgorithm","publicKeyHex","Buffer","from","importKey","mapImportKey","result","kmsClientStoreKey","keyInfo","publicKeyJwk","deleteKey","kmsClientDeleteKey","aliasOrKid","listKeys","keys","kmsClientListKeys","ListKeysResponseToJSONTyped","keyInfos","sign","keyRef","data","kmsClientGetKey","signingResult","kmsClientCreateRawSignature","input","signature","verify","verification","kmsClientIsValidRawSignature","isValid","sharedSecret","SignatureAlgorithm","EcdsaSha256","RsaSsaPssSha256Mgf1","EckaDhSha256","HmacSha256","Es256K","EcdsaSha512","HmacSha512","RsaSsaPssSha512Mgf1","usage","Enc","JoseSignatureAlgorithm","RS256","RS384","RS512","ES256","ES256K","ES384","ES512","EdDSA","HS256","HS384","HS512","PS256","PS384","PS512","none","mapKeyOperation","operation","Verify","WrapKey","DeriveKey","UnwrapKey","Decrypt","DeriveBits","Encrypt","operations","map","mapImportRsaKey","x509","privateKeyPEM","privateKeyHex","includes","hexToPEM","PEMToJwk","privateKeyJwk","publicKeyPEM","jwkToPEM","PEMToHex","cn","certChain","certificateChainPEM","certificatePEM","length","x5c","pemCertChainTox5c","certificateChainURL","x5u","kty","JwkKeyTypeFromJSONTyped","JwkUseFromJSONTyped","crv","CurveFromJSONTyped","mapImportSecp256r1Key","privateBytes","toLowerCase","secp256r1","elliptic","ec","keyFromPrivate","getPublic","toJwk","isPrivateKey","mapImportX25519Key","x25519PublicHexFromPrivateHex"]}
+{"version":3,"sources":["../src/index.ts","../src/RestKeyManagementSystem.ts"],"sourcesContent":["export { RestKeyManagementSystem } from './RestKeyManagementSystem'\nexport * from './types'\n","import { calculateJwkThumbprint, toJwk, x25519PublicHexFromPrivateHex, type X509Opts } from '@sphereon/ssi-sdk-ext.key-utils'\nimport { hexToPEM, jwkToPEM, pemCertChainTox5c, PEMToHex, PEMToJwk } from '@sphereon/ssi-sdk-ext.x509-utils'\nimport type { ManagedKeyInfo as RestManagedKeyInfo } from '@sphereon/ssi-sdk.kms-rest-client'\nimport {\n  CurveFromJSONTyped,\n  JwkKeyTypeFromJSONTyped,\n  JwkUse,\n  JwkUseFromJSONTyped,\n  KeyOperations,\n  KmsRestClient,\n  ListKeysResponseToJSONTyped,\n  type RestClientAuthenticationOpts,\n  SignatureAlgorithm,\n  type StoreKey,\n} from '@sphereon/ssi-sdk.kms-rest-client'\nimport { JoseSignatureAlgorithm, type JWK } from '@sphereon/ssi-types'\nimport type { ManagedKeyInfo, TKeyType } from '@veramo/core'\nimport { AbstractKeyManagementSystem } from '@veramo/key-manager'\nimport elliptic from 'elliptic'\n// @ts-ignore\nimport * as u8a from 'uint8arrays'\nimport type { CreateKeyArgs, DeleteKeyArgs, ImportKeyArgs, MapImportKeyArgs, MappedImportKey, SharedSecretArgs, SignArgs, VerifyArgs } from './types'\n\nconst { fromString, toString } = u8a\n\ninterface KeyManagementSystemOptions {\n  applicationId: string\n  baseUrl: string\n  providerId?: string\n  authOpts?: RestClientAuthenticationOpts\n}\n\nexport class RestKeyManagementSystem extends AbstractKeyManagementSystem {\n  private client: KmsRestClient\n  private readonly id: string\n  private providerId: string | undefined\n\n  constructor(options: KeyManagementSystemOptions) {\n    super()\n\n    const config = {\n      baseUrl: options.baseUrl,\n      authOpts: options.authOpts,\n    }\n\n    this.id = options.applicationId\n    this.providerId = options.providerId\n    this.client = new KmsRestClient(config)\n  }\n\n  async createKey(args: CreateKeyArgs): Promise<ManagedKeyInfo> {\n    const { type, meta } = args\n\n    const signatureAlgorithm = this.mapKeyTypeToSignatureAlgorithm(type)\n    const options = {\n      use: meta && 'keyUsage' in meta ? this.mapKeyUsage(meta.keyUsage) : JwkUse.Sig,\n      alg: signatureAlgorithm,\n      keyOperations: meta ? this.mapKeyOperations(meta.keyOperations as string[]) : [KeyOperations.Sign],\n    }\n\n    const key = this.providerId\n      ? await this.client.methods.kmsClientProviderGenerateKey({\n          ...options,\n          providerId: this.providerId,\n        })\n      : await this.client.methods.kmsClientGenerateKey(options)\n\n    const jwk = {\n      ...key.keyPair.jose.publicJwk,\n      alg: key.keyPair.jose.publicJwk.alg ? this.mapJoseAlgorithm(key.keyPair.jose.publicJwk.alg) : undefined,\n    } satisfies JWK\n\n    const kid = key.keyPair.kid ?? key.keyPair.jose.publicJwk.kid\n    if (!kid) {\n      throw new Error(`No kid present in key`)\n    }\n\n    return {\n      kid,\n      kms: this.id,\n      type,\n      meta: {\n        alias: key.keyPair.alias,\n        algorithms: [key.keyPair.jose.publicJwk.alg ?? 'PS256'],\n        jwkThumbprint: calculateJwkThumbprint({\n          jwk,\n          digestAlgorithm: this.signatureAlgorithmToDigestAlgorithm(signatureAlgorithm),\n        }),\n      },\n      publicKeyHex: Buffer.from(key.keyPair.jose.publicJwk.toString(), 'utf8').toString('base64'),\n    }\n  }\n\n  async importKey(args: ImportKeyArgs): Promise<ManagedKeyInfo> {\n    const { type } = args\n    const signatureAlgorithm = this.mapKeyTypeToSignatureAlgorithm(type)\n    const importKey = this.mapImportKey(args)\n\n    const result = this.providerId\n      ? await this.client.methods.kmsClientProviderStoreKey({\n          ...importKey.key,\n          providerId: this.providerId,\n        })\n      : await this.client.methods.kmsClientStoreKey(importKey.key)\n\n    return {\n      kid: importKey.kid,\n      kms: this.id,\n      type,\n      meta: {\n        alias: importKey.key.keyInfo.alias,\n        algorithms: [result.keyInfo.key.alg ?? 'PS256'],\n        jwkThumbprint: calculateJwkThumbprint({\n          jwk: importKey.publicKeyJwk,\n          digestAlgorithm: this.signatureAlgorithmToDigestAlgorithm(signatureAlgorithm),\n        }),\n      },\n      publicKeyHex: Buffer.from(result.keyInfo.key.toString(), 'utf8').toString('base64'),\n    }\n  }\n\n  async deleteKey(args: DeleteKeyArgs): Promise<boolean> {\n    const { kid } = args\n\n    return this.providerId\n      ? await this.client.methods.kmsClientProviderDeleteKey({\n          aliasOrKid: kid,\n          providerId: this.providerId,\n        })\n      : await this.client.methods.kmsClientDeleteKey({ aliasOrKid: kid })\n  }\n\n  async listKeys(): Promise<ManagedKeyInfo[]> {\n    const keys = this.providerId\n      ? await this.client.methods.kmsClientProviderListKeys({ providerId: this.providerId })\n      : await this.client.methods.kmsClientListKeys()\n\n    const restKeys = ListKeysResponseToJSONTyped(keys, false).keyInfos\n\n    return restKeys.map((restKey: RestManagedKeyInfo) => {\n      const jwk = restKey.key\n      let publicKeyHex = ''\n\n      // Derive publicKeyHex from JWK based on key type\n      if (jwk.kty === 'EC') {\n        publicKeyHex = jwk.x || ''\n      } else if (jwk.kty === 'RSA') {\n        publicKeyHex = jwk.n || ''\n      } else if (jwk.kty === 'OKP') {\n        publicKeyHex = jwk.x || ''\n      }\n\n      const keyType = this.mapRestKeyTypeToTKeyType(restKey.keyType)\n\n      return {\n        kid: restKey.kid || restKey.alias,\n        kms: this.id,\n        type: keyType,\n        publicKeyHex,\n        meta: {\n          algorithms: restKey.signatureAlgorithm ? [restKey.signatureAlgorithm] : undefined,\n          jwk,\n          jwkThumbprint: calculateJwkThumbprint({\n            jwk: jwk as JWK,\n            digestAlgorithm: restKey.signatureAlgorithm ? this.signatureAlgorithmToDigestAlgorithm(restKey.signatureAlgorithm) : 'sha256',\n          }),\n          alias: restKey.alias,\n          providerId: restKey.providerId,\n          x5c: restKey.x5c,\n          keyVisibility: restKey.keyVisibility,\n          keyEncoding: restKey.keyEncoding,\n          ...restKey.opts,\n        },\n      } satisfies ManagedKeyInfo\n    })\n  }\n\n  private mapRestKeyTypeToTKeyType(keyType: string | undefined): TKeyType {\n    switch (keyType) {\n      case 'RSA':\n        return 'RSA'\n      case 'EC':\n      case 'P256':\n        return 'Secp256r1'\n      case 'X25519':\n        return 'X25519'\n      case 'Ed25519':\n        return 'Ed25519'\n      case 'secp256k1':\n        return 'Secp256k1'\n      default:\n        throw new Error(`Unknown key type: ${keyType}`)\n    }\n  }\n\n  async sign(args: SignArgs): Promise<string> {\n    const { keyRef, data } = args\n    const key = this.providerId\n      ? await this.client.methods.kmsClientProviderGetKey({\n          aliasOrKid: keyRef.kid,\n          providerId: this.providerId,\n        })\n      : await this.client.methods.kmsClientGetKey({ aliasOrKid: keyRef.kid })\n\n    const signingResult = await this.client.methods.kmsClientCreateRawSignature({\n      keyInfo: key.keyInfo,\n      input: toString(data, 'base64'),\n    })\n\n    return signingResult.signature\n  }\n\n  async verify(args: VerifyArgs): Promise<boolean> {\n    const { keyRef, data, signature } = args\n    const key = this.providerId\n      ? await this.client.methods.kmsClientProviderGetKey({\n          aliasOrKid: keyRef.kid,\n          providerId: this.providerId,\n        })\n      : await this.client.methods.kmsClientGetKey({ aliasOrKid: keyRef.kid })\n\n    const verification = await this.client.methods.kmsClientIsValidRawSignature({\n      keyInfo: key.keyInfo,\n      input: toString(data, 'base64'),\n      signature,\n    })\n\n    return verification.isValid\n  }\n\n  async sharedSecret(args: SharedSecretArgs): Promise<string> {\n    throw new Error('sharedSecret is not implemented for REST KMS.')\n  }\n\n  private signatureAlgorithmToDigestAlgorithm = (signatureAlgorithm: SignatureAlgorithm): 'sha256' | 'sha512' => {\n    switch (signatureAlgorithm) {\n      case SignatureAlgorithm.EcdsaSha256:\n      case SignatureAlgorithm.RsaSsaPssSha256Mgf1:\n      case SignatureAlgorithm.EckaDhSha256:\n      case SignatureAlgorithm.HmacSha256:\n      case SignatureAlgorithm.Es256K:\n        return 'sha256'\n      case SignatureAlgorithm.EcdsaSha512:\n      case SignatureAlgorithm.HmacSha512:\n      case SignatureAlgorithm.RsaSsaPssSha512Mgf1:\n        return 'sha512'\n      default:\n        throw new Error(`Signature algorithm ${signatureAlgorithm} is not supported by REST KMS`)\n    }\n  }\n\n  private mapKeyUsage = (usage: string): JwkUse => {\n    switch (usage) {\n      case 'sig':\n        return JwkUse.Sig\n      case 'enc':\n        return JwkUse.Enc\n      default:\n        throw new Error(`Key usage ${usage} is not supported by REST KMS`)\n    }\n  }\n\n  private mapKeyTypeToSignatureAlgorithm = (type: TKeyType): SignatureAlgorithm => {\n    switch (type) {\n      case 'Secp256r1':\n        return SignatureAlgorithm.EcdsaSha256\n      case 'RSA':\n        return SignatureAlgorithm.RsaSsaPssSha256Mgf1\n      case 'X25519':\n        return SignatureAlgorithm.EckaDhSha256\n      default:\n        throw new Error(`Key type ${type} is not supported by REST KMS`)\n    }\n  }\n\n  private mapJoseAlgorithm = (alg: string): JoseSignatureAlgorithm => {\n    switch (alg) {\n      case 'RS256':\n        return JoseSignatureAlgorithm.RS256\n      case 'RS384':\n        return JoseSignatureAlgorithm.RS384\n      case 'RS512':\n        return JoseSignatureAlgorithm.RS512\n      case 'ES256':\n        return JoseSignatureAlgorithm.ES256\n      case 'ES256K':\n        return JoseSignatureAlgorithm.ES256K\n      case 'ES384':\n        return JoseSignatureAlgorithm.ES384\n      case 'ES512':\n        return JoseSignatureAlgorithm.ES512\n      case 'EdDSA':\n        return JoseSignatureAlgorithm.EdDSA\n      case 'HS256':\n        return JoseSignatureAlgorithm.HS256\n      case 'HS384':\n        return JoseSignatureAlgorithm.HS384\n      case 'HS512':\n        return JoseSignatureAlgorithm.HS512\n      case 'PS256':\n        return JoseSignatureAlgorithm.PS256\n      case 'PS384':\n        return JoseSignatureAlgorithm.PS384\n      case 'PS512':\n        return JoseSignatureAlgorithm.PS512\n      case 'none':\n        return JoseSignatureAlgorithm.none\n      default:\n        throw new Error(`Signature algorithm ${alg} is not supported by REST KMS`)\n    }\n  }\n\n  private mapKeyOperation = (operation: string): KeyOperations => {\n    switch (operation) {\n      case 'sign':\n        return KeyOperations.Sign\n      case 'verify':\n        return KeyOperations.Verify\n      case 'wrapKey':\n        return KeyOperations.WrapKey\n      case 'deriveKey':\n        return KeyOperations.DeriveKey\n      case 'unwrapKey':\n        return KeyOperations.UnwrapKey\n      case 'decrypt':\n        return KeyOperations.Decrypt\n      case 'deriveBits':\n        return KeyOperations.DeriveBits\n      case 'encrypt':\n        return KeyOperations.Encrypt\n      default:\n        throw new Error(`Key operation ${operation} is not supported by REST KMS`)\n    }\n  }\n\n  private mapKeyOperations = (operations: string[]): KeyOperations[] => {\n    return operations.map((operation) => this.mapKeyOperation(operation))\n  }\n\n  private mapImportRsaKey = (args: MapImportKeyArgs): MappedImportKey => {\n    const x509 = args.meta?.x509 as X509Opts\n    const privateKeyPEM = x509?.privateKeyPEM ?? (args.privateKeyHex.includes('---') ? args.privateKeyHex : hexToPEM(args.privateKeyHex, 'private')) // In case we have x509 opts, the private key hex really was a PEM already (yuck)\n    const publicKeyJwk = PEMToJwk(privateKeyPEM, 'public')\n    const privateKeyJwk = PEMToJwk(privateKeyPEM)\n    const publicKeyPEM = jwkToPEM(publicKeyJwk, 'public')\n    const publicKeyHex = PEMToHex(publicKeyPEM)\n\n    const meta = {} as any\n    if (x509) {\n      meta.x509 = {\n        cn: x509.cn ?? args.kid ?? publicKeyHex,\n      }\n      let certChain: string = x509.certificateChainPEM ?? ''\n      if (x509.certificatePEM) {\n        if (!certChain.includes(x509.certificatePEM)) {\n          certChain = `${x509.certificatePEM}\\n${certChain}`\n        }\n      }\n      if (certChain.length > 0) {\n        meta.x509.certificateChainPEM = certChain\n        const x5c = pemCertChainTox5c(certChain)\n        if (!x509.certificateChainURL) {\n          // Do not put the chain in the JWK when the chain is hosted. We do put it in the x509 metadata\n          // @ts-ignore\n          publicKeyJwk.x5c = x5c\n        }\n        meta.x509.x5c = x5c\n      }\n      if (x509.certificateChainURL) {\n        // @ts-ignore\n        publicKeyJwk.x5u = x509.certificateChainURL\n        meta.x509.x5u = x509.certificateChainURL\n      }\n    }\n\n    const kid = args.kid ?? meta?.x509?.cn ?? publicKeyHex\n    return {\n      kid,\n      publicKeyJwk: publicKeyJwk as JWK,\n      key: {\n        keyInfo: {\n          key: {\n            ...privateKeyJwk,\n            kid,\n            kty: JwkKeyTypeFromJSONTyped(privateKeyJwk.kty, false),\n            use: JwkUseFromJSONTyped(privateKeyJwk.use, false),\n            crv: CurveFromJSONTyped(privateKeyJwk.crv, false),\n          },\n        },\n        certChain: meta.x509.x5c,\n      } satisfies StoreKey,\n    }\n  }\n\n  private mapImportSecp256r1Key = (args: MapImportKeyArgs): MappedImportKey => {\n    const { privateKeyHex } = args\n    const privateBytes = fromString(privateKeyHex.toLowerCase(), 'base16')\n    const secp256r1 = new elliptic.ec('p256')\n    const keyPair = secp256r1.keyFromPrivate(privateBytes, 'hex')\n    const publicKeyHex = keyPair.getPublic(true, 'hex')\n    const publicKeyJwk = toJwk(publicKeyHex, 'Secp256r1')\n    const privateKeyJwk = toJwk(privateKeyHex, 'Secp256r1', { isPrivateKey: true })\n    const kid = args.kid ?? publicKeyJwk.kid ?? publicKeyHex\n\n    return {\n      kid,\n      publicKeyJwk: publicKeyJwk as JWK,\n      key: {\n        keyInfo: {\n          key: {\n            ...privateKeyJwk,\n            kid,\n            kty: JwkKeyTypeFromJSONTyped(privateKeyJwk.kty, false),\n            use: JwkUseFromJSONTyped(privateKeyJwk.use, false),\n            crv: CurveFromJSONTyped(privateKeyJwk.crv, false),\n          },\n        },\n      } satisfies StoreKey,\n    }\n  }\n\n  private mapImportX25519Key = (args: MapImportKeyArgs): MappedImportKey => {\n    const { privateKeyHex } = args\n    const privateKeyJwk = toJwk(privateKeyHex, 'X25519', { isPrivateKey: true })\n    const publicKeyHex = x25519PublicHexFromPrivateHex(privateKeyHex)\n    const publicKeyJwk = toJwk(publicKeyHex, 'X25519')\n    const kid = args.kid ?? publicKeyJwk.kid ?? publicKeyHex\n\n    return {\n      kid,\n      publicKeyJwk: publicKeyJwk as JWK,\n      key: {\n        keyInfo: {\n          key: {\n            ...privateKeyJwk,\n            kid,\n            kty: JwkKeyTypeFromJSONTyped(privateKeyJwk.kty, false),\n            use: JwkUseFromJSONTyped(privateKeyJwk.use, false),\n            crv: CurveFromJSONTyped(privateKeyJwk.crv, false),\n          },\n        },\n      } satisfies StoreKey,\n    }\n  }\n\n  private mapImportKey = (args: MapImportKeyArgs): MappedImportKey => {\n    switch (args.type) {\n      case 'RSA': {\n        return this.mapImportRsaKey(args)\n      }\n      case 'Secp256r1': {\n        return this.mapImportSecp256r1Key(args)\n      }\n      case 'X25519': {\n        return this.mapImportX25519Key(args)\n      }\n      default:\n        throw new Error(`Key type ${args.type} is not supported by REST KMS`)\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;;;;;;;ACAA,yBAA4F;AAC5F,IAAAA,sBAA0E;AAE1E,qBAWO;AACP,uBAAiD;AAEjD,yBAA4C;AAC5C,sBAAqB;AAErB,UAAqB;AAGrB,IAAM,EAAEC,YAAYC,SAAQ,IAAKC;AAS1B,IAAMC,0BAAN,cAAsCC,+CAAAA;EAhC7C,OAgC6CA;;;EACnCC;EACSC;EACTC;EAER,YAAYC,SAAqC;AAC/C,UAAK;AAEL,UAAMC,SAAS;MACbC,SAASF,QAAQE;MACjBC,UAAUH,QAAQG;IACpB;AAEA,SAAKL,KAAKE,QAAQI;AAClB,SAAKL,aAAaC,QAAQD;AAC1B,SAAKF,SAAS,IAAIQ,6BAAcJ,MAAAA;EAClC;EAEA,MAAMK,UAAUC,MAA8C;AAC5D,UAAM,EAAEC,MAAMC,KAAI,IAAKF;AAEvB,UAAMG,qBAAqB,KAAKC,+BAA+BH,IAAAA;AAC/D,UAAMR,UAAU;MACdY,KAAKH,QAAQ,cAAcA,OAAO,KAAKI,YAAYJ,KAAKK,QAAQ,IAAIC,sBAAOC;MAC3EC,KAAKP;MACLQ,eAAeT,OAAO,KAAKU,iBAAiBV,KAAKS,aAAa,IAAgB;QAACE,6BAAcC;;IAC/F;AAEA,UAAMC,MAAM,KAAKvB,aACb,MAAM,KAAKF,OAAO0B,QAAQC,6BAA6B;MACrD,GAAGxB;MACHD,YAAY,KAAKA;IACnB,CAAA,IACA,MAAM,KAAKF,OAAO0B,QAAQE,qBAAqBzB,OAAAA;AAEnD,UAAM0B,MAAM;MACV,GAAGJ,IAAIK,QAAQC,KAAKC;MACpBZ,KAAKK,IAAIK,QAAQC,KAAKC,UAAUZ,MAAM,KAAKa,iBAAiBR,IAAIK,QAAQC,KAAKC,UAAUZ,GAAG,IAAIc;IAChG;AAEA,UAAMC,MAAMV,IAAIK,QAAQK,OAAOV,IAAIK,QAAQC,KAAKC,UAAUG;AAC1D,QAAI,CAACA,KAAK;AACR,YAAM,IAAIC,MAAM,uBAAuB;IACzC;AAEA,WAAO;MACLD;MACAE,KAAK,KAAKpC;MACVU;MACAC,MAAM;QACJ0B,OAAOb,IAAIK,QAAQQ;QACnBC,YAAY;UAACd,IAAIK,QAAQC,KAAKC,UAAUZ,OAAO;;QAC/CoB,mBAAeC,2CAAuB;UACpCZ;UACAa,iBAAiB,KAAKC,oCAAoC9B,kBAAAA;QAC5D,CAAA;MACF;MACA+B,cAAcC,OAAOC,KAAKrB,IAAIK,QAAQC,KAAKC,UAAUpC,SAAQ,GAAI,MAAA,EAAQA,SAAS,QAAA;IACpF;EACF;EAEA,MAAMmD,UAAUrC,MAA8C;AAC5D,UAAM,EAAEC,KAAI,IAAKD;AACjB,UAAMG,qBAAqB,KAAKC,+BAA+BH,IAAAA;AAC/D,UAAMoC,YAAY,KAAKC,aAAatC,IAAAA;AAEpC,UAAMuC,SAAS,KAAK/C,aAChB,MAAM,KAAKF,OAAO0B,QAAQwB,0BAA0B;MAClD,GAAGH,UAAUtB;MACbvB,YAAY,KAAKA;IACnB,CAAA,IACA,MAAM,KAAKF,OAAO0B,QAAQyB,kBAAkBJ,UAAUtB,GAAG;AAE7D,WAAO;MACLU,KAAKY,UAAUZ;MACfE,KAAK,KAAKpC;MACVU;MACAC,MAAM;QACJ0B,OAAOS,UAAUtB,IAAI2B,QAAQd;QAC7BC,YAAY;UAACU,OAAOG,QAAQ3B,IAAIL,OAAO;;QACvCoB,mBAAeC,2CAAuB;UACpCZ,KAAKkB,UAAUM;UACfX,iBAAiB,KAAKC,oCAAoC9B,kBAAAA;QAC5D,CAAA;MACF;MACA+B,cAAcC,OAAOC,KAAKG,OAAOG,QAAQ3B,IAAI7B,SAAQ,GAAI,MAAA,EAAQA,SAAS,QAAA;IAC5E;EACF;EAEA,MAAM0D,UAAU5C,MAAuC;AACrD,UAAM,EAAEyB,IAAG,IAAKzB;AAEhB,WAAO,KAAKR,aACR,MAAM,KAAKF,OAAO0B,QAAQ6B,2BAA2B;MACnDC,YAAYrB;MACZjC,YAAY,KAAKA;IACnB,CAAA,IACA,MAAM,KAAKF,OAAO0B,QAAQ+B,mBAAmB;MAAED,YAAYrB;IAAI,CAAA;EACrE;EAEA,MAAMuB,WAAsC;AAC1C,UAAMC,OAAO,KAAKzD,aACd,MAAM,KAAKF,OAAO0B,QAAQkC,0BAA0B;MAAE1D,YAAY,KAAKA;IAAW,CAAA,IAClF,MAAM,KAAKF,OAAO0B,QAAQmC,kBAAiB;AAE/C,UAAMC,eAAWC,4CAA4BJ,MAAM,KAAA,EAAOK;AAE1D,WAAOF,SAASG,IAAI,CAACC,YAAAA;AACnB,YAAMrC,MAAMqC,QAAQzC;AACpB,UAAImB,eAAe;AAGnB,UAAIf,IAAIsC,QAAQ,MAAM;AACpBvB,uBAAef,IAAIuC,KAAK;MAC1B,WAAWvC,IAAIsC,QAAQ,OAAO;AAC5BvB,uBAAef,IAAIwC,KAAK;MAC1B,WAAWxC,IAAIsC,QAAQ,OAAO;AAC5BvB,uBAAef,IAAIuC,KAAK;MAC1B;AAEA,YAAME,UAAU,KAAKC,yBAAyBL,QAAQI,OAAO;AAE7D,aAAO;QACLnC,KAAK+B,QAAQ/B,OAAO+B,QAAQ5B;QAC5BD,KAAK,KAAKpC;QACVU,MAAM2D;QACN1B;QACAhC,MAAM;UACJ2B,YAAY2B,QAAQrD,qBAAqB;YAACqD,QAAQrD;cAAsBqB;UACxEL;UACAW,mBAAeC,2CAAuB;YACpCZ;YACAa,iBAAiBwB,QAAQrD,qBAAqB,KAAK8B,oCAAoCuB,QAAQrD,kBAAkB,IAAI;UACvH,CAAA;UACAyB,OAAO4B,QAAQ5B;UACfpC,YAAYgE,QAAQhE;UACpBsE,KAAKN,QAAQM;UACbC,eAAeP,QAAQO;UACvBC,aAAaR,QAAQQ;UACrB,GAAGR,QAAQS;QACb;MACF;IACF,CAAA;EACF;EAEQJ,yBAAyBD,SAAuC;AACtE,YAAQA,SAAAA;MACN,KAAK;AACH,eAAO;MACT,KAAK;MACL,KAAK;AACH,eAAO;MACT,KAAK;AACH,eAAO;MACT,KAAK;AACH,eAAO;MACT,KAAK;AACH,eAAO;MACT;AACE,cAAM,IAAIlC,MAAM,qBAAqBkC,OAAAA,EAAS;IAClD;EACF;EAEA,MAAMM,KAAKlE,MAAiC;AAC1C,UAAM,EAAEmE,QAAQC,KAAI,IAAKpE;AACzB,UAAMe,MAAM,KAAKvB,aACb,MAAM,KAAKF,OAAO0B,QAAQqD,wBAAwB;MAChDvB,YAAYqB,OAAO1C;MACnBjC,YAAY,KAAKA;IACnB,CAAA,IACA,MAAM,KAAKF,OAAO0B,QAAQsD,gBAAgB;MAAExB,YAAYqB,OAAO1C;IAAI,CAAA;AAEvE,UAAM8C,gBAAgB,MAAM,KAAKjF,OAAO0B,QAAQwD,4BAA4B;MAC1E9B,SAAS3B,IAAI2B;MACb+B,OAAOvF,SAASkF,MAAM,QAAA;IACxB,CAAA;AAEA,WAAOG,cAAcG;EACvB;EAEA,MAAMC,OAAO3E,MAAoC;AAC/C,UAAM,EAAEmE,QAAQC,MAAMM,UAAS,IAAK1E;AACpC,UAAMe,MAAM,KAAKvB,aACb,MAAM,KAAKF,OAAO0B,QAAQqD,wBAAwB;MAChDvB,YAAYqB,OAAO1C;MACnBjC,YAAY,KAAKA;IACnB,CAAA,IACA,MAAM,KAAKF,OAAO0B,QAAQsD,gBAAgB;MAAExB,YAAYqB,OAAO1C;IAAI,CAAA;AAEvE,UAAMmD,eAAe,MAAM,KAAKtF,OAAO0B,QAAQ6D,6BAA6B;MAC1EnC,SAAS3B,IAAI2B;MACb+B,OAAOvF,SAASkF,MAAM,QAAA;MACtBM;IACF,CAAA;AAEA,WAAOE,aAAaE;EACtB;EAEA,MAAMC,aAAa/E,MAAyC;AAC1D,UAAM,IAAI0B,MAAM,+CAAA;EAClB;EAEQO,sCAAsC,wBAAC9B,uBAAAA;AAC7C,YAAQA,oBAAAA;MACN,KAAK6E,kCAAmBC;MACxB,KAAKD,kCAAmBE;MACxB,KAAKF,kCAAmBG;MACxB,KAAKH,kCAAmBI;MACxB,KAAKJ,kCAAmBK;AACtB,eAAO;MACT,KAAKL,kCAAmBM;MACxB,KAAKN,kCAAmBO;MACxB,KAAKP,kCAAmBQ;AACtB,eAAO;MACT;AACE,cAAM,IAAI9D,MAAM,uBAAuBvB,kBAAAA,+BAAiD;IAC5F;EACF,GAf8C;EAiBtCG,cAAc,wBAACmF,UAAAA;AACrB,YAAQA,OAAAA;MACN,KAAK;AACH,eAAOjF,sBAAOC;MAChB,KAAK;AACH,eAAOD,sBAAOkF;MAChB;AACE,cAAM,IAAIhE,MAAM,aAAa+D,KAAAA,+BAAoC;IACrE;EACF,GATsB;EAWdrF,iCAAiC,wBAACH,SAAAA;AACxC,YAAQA,MAAAA;MACN,KAAK;AACH,eAAO+E,kCAAmBC;MAC5B,KAAK;AACH,eAAOD,kCAAmBE;MAC5B,KAAK;AACH,eAAOF,kCAAmBG;MAC5B;AACE,cAAM,IAAIzD,MAAM,YAAYzB,IAAAA,+BAAmC;IACnE;EACF,GAXyC;EAajCsB,mBAAmB,wBAACb,QAAAA;AAC1B,YAAQA,KAAAA;MACN,KAAK;AACH,eAAOiF,wCAAuBC;MAChC,KAAK;AACH,eAAOD,wCAAuBE;MAChC,KAAK;AACH,eAAOF,wCAAuBG;MAChC,KAAK;AACH,eAAOH,wCAAuBI;MAChC,KAAK;AACH,eAAOJ,wCAAuBK;MAChC,KAAK;AACH,eAAOL,wCAAuBM;MAChC,KAAK;AACH,eAAON,wCAAuBO;MAChC,KAAK;AACH,eAAOP,wCAAuBQ;MAChC,KAAK;AACH,eAAOR,wCAAuBS;MAChC,KAAK;AACH,eAAOT,wCAAuBU;MAChC,KAAK;AACH,eAAOV,wCAAuBW;MAChC,KAAK;AACH,eAAOX,wCAAuBY;MAChC,KAAK;AACH,eAAOZ,wCAAuBa;MAChC,KAAK;AACH,eAAOb,wCAAuBc;MAChC,KAAK;AACH,eAAOd,wCAAuBe;MAChC;AACE,cAAM,IAAIhF,MAAM,uBAAuBhB,GAAAA,+BAAkC;IAC7E;EACF,GAnC2B;EAqCnBiG,kBAAkB,wBAACC,cAAAA;AACzB,YAAQA,WAAAA;MACN,KAAK;AACH,eAAO/F,6BAAcC;MACvB,KAAK;AACH,eAAOD,6BAAcgG;MACvB,KAAK;AACH,eAAOhG,6BAAciG;MACvB,KAAK;AACH,eAAOjG,6BAAckG;MACvB,KAAK;AACH,eAAOlG,6BAAcmG;MACvB,KAAK;AACH,eAAOnG,6BAAcoG;MACvB,KAAK;AACH,eAAOpG,6BAAcqG;MACvB,KAAK;AACH,eAAOrG,6BAAcsG;MACvB;AACE,cAAM,IAAIzF,MAAM,iBAAiBkF,SAAAA,+BAAwC;IAC7E;EACF,GArB0B;EAuBlBhG,mBAAmB,wBAACwG,eAAAA;AAC1B,WAAOA,WAAW7D,IAAI,CAACqD,cAAc,KAAKD,gBAAgBC,SAAAA,CAAAA;EAC5D,GAF2B;EAInBS,kBAAkB,wBAACrH,SAAAA;AACzB,UAAMsH,OAAOtH,KAAKE,MAAMoH;AACxB,UAAMC,gBAAgBD,MAAMC,kBAAkBvH,KAAKwH,cAAcC,SAAS,KAAA,IAASzH,KAAKwH,oBAAgBE,8BAAS1H,KAAKwH,eAAe,SAAA;AACrI,UAAM7E,mBAAegF,8BAASJ,eAAe,QAAA;AAC7C,UAAMK,oBAAgBD,8BAASJ,aAAAA;AAC/B,UAAMM,mBAAeC,8BAASnF,cAAc,QAAA;AAC5C,UAAMT,mBAAe6F,8BAASF,YAAAA;AAE9B,UAAM3H,OAAO,CAAC;AACd,QAAIoH,MAAM;AACRpH,WAAKoH,OAAO;QACVU,IAAIV,KAAKU,MAAMhI,KAAKyB,OAAOS;MAC7B;AACA,UAAI+F,YAAoBX,KAAKY,uBAAuB;AACpD,UAAIZ,KAAKa,gBAAgB;AACvB,YAAI,CAACF,UAAUR,SAASH,KAAKa,cAAc,GAAG;AAC5CF,sBAAY,GAAGX,KAAKa,cAAc;EAAKF,SAAAA;QACzC;MACF;AACA,UAAIA,UAAUG,SAAS,GAAG;AACxBlI,aAAKoH,KAAKY,sBAAsBD;AAChC,cAAMnE,UAAMuE,uCAAkBJ,SAAAA;AAC9B,YAAI,CAACX,KAAKgB,qBAAqB;AAG7B3F,uBAAamB,MAAMA;QACrB;AACA5D,aAAKoH,KAAKxD,MAAMA;MAClB;AACA,UAAIwD,KAAKgB,qBAAqB;AAE5B3F,qBAAa4F,MAAMjB,KAAKgB;AACxBpI,aAAKoH,KAAKiB,MAAMjB,KAAKgB;MACvB;IACF;AAEA,UAAM7G,MAAMzB,KAAKyB,OAAOvB,MAAMoH,MAAMU,MAAM9F;AAC1C,WAAO;MACLT;MACAkB;MACA5B,KAAK;QACH2B,SAAS;UACP3B,KAAK;YACH,GAAG6G;YACHnG;YACAgC,SAAK+E,wCAAwBZ,cAAcnE,KAAK,KAAA;YAChDpD,SAAKoI,oCAAoBb,cAAcvH,KAAK,KAAA;YAC5CqI,SAAKC,mCAAmBf,cAAcc,KAAK,KAAA;UAC7C;QACF;QACAT,WAAW/H,KAAKoH,KAAKxD;MACvB;IACF;EACF,GArD0B;EAuDlB8E,wBAAwB,wBAAC5I,SAAAA;AAC/B,UAAM,EAAEwH,cAAa,IAAKxH;AAC1B,UAAM6I,eAAe5J,WAAWuI,cAAcsB,YAAW,GAAI,QAAA;AAC7D,UAAMC,YAAY,IAAIC,gBAAAA,QAASC,GAAG,MAAA;AAClC,UAAM7H,UAAU2H,UAAUG,eAAeL,cAAc,KAAA;AACvD,UAAM3G,eAAed,QAAQ+H,UAAU,MAAM,KAAA;AAC7C,UAAMxG,mBAAeyG,0BAAMlH,cAAc,WAAA;AACzC,UAAM0F,oBAAgBwB,0BAAM5B,eAAe,aAAa;MAAE6B,cAAc;IAAK,CAAA;AAC7E,UAAM5H,MAAMzB,KAAKyB,OAAOkB,aAAalB,OAAOS;AAE5C,WAAO;MACLT;MACAkB;MACA5B,KAAK;QACH2B,SAAS;UACP3B,KAAK;YACH,GAAG6G;YACHnG;YACAgC,SAAK+E,wCAAwBZ,cAAcnE,KAAK,KAAA;YAChDpD,SAAKoI,oCAAoBb,cAAcvH,KAAK,KAAA;YAC5CqI,SAAKC,mCAAmBf,cAAcc,KAAK,KAAA;UAC7C;QACF;MACF;IACF;EACF,GAzBgC;EA2BxBY,qBAAqB,wBAACtJ,SAAAA;AAC5B,UAAM,EAAEwH,cAAa,IAAKxH;AAC1B,UAAM4H,oBAAgBwB,0BAAM5B,eAAe,UAAU;MAAE6B,cAAc;IAAK,CAAA;AAC1E,UAAMnH,mBAAeqH,kDAA8B/B,aAAAA;AACnD,UAAM7E,mBAAeyG,0BAAMlH,cAAc,QAAA;AACzC,UAAMT,MAAMzB,KAAKyB,OAAOkB,aAAalB,OAAOS;AAE5C,WAAO;MACLT;MACAkB;MACA5B,KAAK;QACH2B,SAAS;UACP3B,KAAK;YACH,GAAG6G;YACHnG;YACAgC,SAAK+E,wCAAwBZ,cAAcnE,KAAK,KAAA;YAChDpD,SAAKoI,oCAAoBb,cAAcvH,KAAK,KAAA;YAC5CqI,SAAKC,mCAAmBf,cAAcc,KAAK,KAAA;UAC7C;QACF;MACF;IACF;EACF,GAtB6B;EAwBrBpG,eAAe,wBAACtC,SAAAA;AACtB,YAAQA,KAAKC,MAAI;MACf,KAAK,OAAO;AACV,eAAO,KAAKoH,gBAAgBrH,IAAAA;MAC9B;MACA,KAAK,aAAa;AAChB,eAAO,KAAK4I,sBAAsB5I,IAAAA;MACpC;MACA,KAAK,UAAU;AACb,eAAO,KAAKsJ,mBAAmBtJ,IAAAA;MACjC;MACA;AACE,cAAM,IAAI0B,MAAM,YAAY1B,KAAKC,IAAI,+BAA+B;IACxE;EACF,GAduB;AAezB;","names":["import_ssi_sdk_ext","fromString","toString","u8a","RestKeyManagementSystem","AbstractKeyManagementSystem","client","id","providerId","options","config","baseUrl","authOpts","applicationId","KmsRestClient","createKey","args","type","meta","signatureAlgorithm","mapKeyTypeToSignatureAlgorithm","use","mapKeyUsage","keyUsage","JwkUse","Sig","alg","keyOperations","mapKeyOperations","KeyOperations","Sign","key","methods","kmsClientProviderGenerateKey","kmsClientGenerateKey","jwk","keyPair","jose","publicJwk","mapJoseAlgorithm","undefined","kid","Error","kms","alias","algorithms","jwkThumbprint","calculateJwkThumbprint","digestAlgorithm","signatureAlgorithmToDigestAlgorithm","publicKeyHex","Buffer","from","importKey","mapImportKey","result","kmsClientProviderStoreKey","kmsClientStoreKey","keyInfo","publicKeyJwk","deleteKey","kmsClientProviderDeleteKey","aliasOrKid","kmsClientDeleteKey","listKeys","keys","kmsClientProviderListKeys","kmsClientListKeys","restKeys","ListKeysResponseToJSONTyped","keyInfos","map","restKey","kty","x","n","keyType","mapRestKeyTypeToTKeyType","x5c","keyVisibility","keyEncoding","opts","sign","keyRef","data","kmsClientProviderGetKey","kmsClientGetKey","signingResult","kmsClientCreateRawSignature","input","signature","verify","verification","kmsClientIsValidRawSignature","isValid","sharedSecret","SignatureAlgorithm","EcdsaSha256","RsaSsaPssSha256Mgf1","EckaDhSha256","HmacSha256","Es256K","EcdsaSha512","HmacSha512","RsaSsaPssSha512Mgf1","usage","Enc","JoseSignatureAlgorithm","RS256","RS384","RS512","ES256","ES256K","ES384","ES512","EdDSA","HS256","HS384","HS512","PS256","PS384","PS512","none","mapKeyOperation","operation","Verify","WrapKey","DeriveKey","UnwrapKey","Decrypt","DeriveBits","Encrypt","operations","mapImportRsaKey","x509","privateKeyPEM","privateKeyHex","includes","hexToPEM","PEMToJwk","privateKeyJwk","publicKeyPEM","jwkToPEM","PEMToHex","cn","certChain","certificateChainPEM","certificatePEM","length","pemCertChainTox5c","certificateChainURL","x5u","JwkKeyTypeFromJSONTyped","JwkUseFromJSONTyped","crv","CurveFromJSONTyped","mapImportSecp256r1Key","privateBytes","toLowerCase","secp256r1","elliptic","ec","keyFromPrivate","getPublic","toJwk","isPrivateKey","mapImportX25519Key","x25519PublicHexFromPrivateHex"]}

package/dist/index.d.cts

@@ -1,6 +1,6 @@
+import { StoreKey, RestClientAuthenticationOpts } from '@sphereon/ssi-sdk.kms-rest-client';
 import { TKeyType, MinimalImportableKey, IKey, ManagedKeyInfo } from '@veramo/core';
 import { AbstractKeyManagementSystem } from '@veramo/key-manager';
-import { StoreKey, RestClientAuthenticationOpts } from '@sphereon/ssi-sdk.kms-rest-client';
 import { JWK } from '@sphereon/ssi-types';
 
 type KeyMetadata = {
@@ -44,19 +44,22 @@ type MappedImportKey = {
     publicKeyJwk: JWK;
 };
 
-interface AbstractKeyManagementSystemOptions {
+interface KeyManagementSystemOptions {
     applicationId: string;
     baseUrl: string;
+    providerId?: string;
     authOpts?: RestClientAuthenticationOpts;
 }
 declare class RestKeyManagementSystem extends AbstractKeyManagementSystem {
     private client;
     private readonly id;
-    constructor(options: AbstractKeyManagementSystemOptions);
+    private providerId;
+    constructor(options: KeyManagementSystemOptions);
     createKey(args: CreateKeyArgs): Promise<ManagedKeyInfo>;
     importKey(args: ImportKeyArgs): Promise<ManagedKeyInfo>;
     deleteKey(args: DeleteKeyArgs): Promise<boolean>;
     listKeys(): Promise<ManagedKeyInfo[]>;
+    private mapRestKeyTypeToTKeyType;
     sign(args: SignArgs): Promise<string>;
     verify(args: VerifyArgs): Promise<boolean>;
     sharedSecret(args: SharedSecretArgs): Promise<string>;

package/dist/index.d.ts

@@ -1,6 +1,6 @@
+import { StoreKey, RestClientAuthenticationOpts } from '@sphereon/ssi-sdk.kms-rest-client';
 import { TKeyType, MinimalImportableKey, IKey, ManagedKeyInfo } from '@veramo/core';
 import { AbstractKeyManagementSystem } from '@veramo/key-manager';
-import { StoreKey, RestClientAuthenticationOpts } from '@sphereon/ssi-sdk.kms-rest-client';
 import { JWK } from '@sphereon/ssi-types';
 
 type KeyMetadata = {
@@ -44,19 +44,22 @@ type MappedImportKey = {
     publicKeyJwk: JWK;
 };
 
-interface AbstractKeyManagementSystemOptions {
+interface KeyManagementSystemOptions {
     applicationId: string;
     baseUrl: string;
+    providerId?: string;
     authOpts?: RestClientAuthenticationOpts;
 }
 declare class RestKeyManagementSystem extends AbstractKeyManagementSystem {
     private client;
     private readonly id;
-    constructor(options: AbstractKeyManagementSystemOptions);
+    private providerId;
+    constructor(options: KeyManagementSystemOptions);
     createKey(args: CreateKeyArgs): Promise<ManagedKeyInfo>;
     importKey(args: ImportKeyArgs): Promise<ManagedKeyInfo>;
     deleteKey(args: DeleteKeyArgs): Promise<boolean>;
     listKeys(): Promise<ManagedKeyInfo[]>;
+    private mapRestKeyTypeToTKeyType;
     sign(args: SignArgs): Promise<string>;
     verify(args: VerifyArgs): Promise<boolean>;
     sharedSecret(args: SharedSecretArgs): Promise<string>;

package/dist/index.js

@@ -2,11 +2,11 @@ var __defProp = Object.defineProperty;
 var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
 
 // src/RestKeyManagementSystem.ts
-import { AbstractKeyManagementSystem } from "@veramo/key-manager";
 import { calculateJwkThumbprint, toJwk, x25519PublicHexFromPrivateHex } from "@sphereon/ssi-sdk-ext.key-utils";
-import { CurveFromJSONTyped, JwkKeyTypeFromJSONTyped, JwkUse, JwkUseFromJSONTyped, KeyOperations, KmsRestClient, ListKeysResponseToJSONTyped, SignatureAlgorithm } from "@sphereon/ssi-sdk.kms-rest-client";
 import { hexToPEM, jwkToPEM, pemCertChainTox5c, PEMToHex, PEMToJwk } from "@sphereon/ssi-sdk-ext.x509-utils";
+import { CurveFromJSONTyped, JwkKeyTypeFromJSONTyped, JwkUse, JwkUseFromJSONTyped, KeyOperations, KmsRestClient, ListKeysResponseToJSONTyped, SignatureAlgorithm } from "@sphereon/ssi-sdk.kms-rest-client";
 import { JoseSignatureAlgorithm } from "@sphereon/ssi-types";
+import { AbstractKeyManagementSystem } from "@veramo/key-manager";
 import elliptic from "elliptic";
 import * as u8a from "uint8arrays";
 var { fromString, toString } = u8a;
@@ -16,6 +16,7 @@ var RestKeyManagementSystem = class extends AbstractKeyManagementSystem {
   }
   client;
   id;
+  providerId;
   constructor(options) {
     super();
     const config = {
@@ -23,6 +24,7 @@ var RestKeyManagementSystem = class extends AbstractKeyManagementSystem {
       authOpts: options.authOpts
     };
     this.id = options.applicationId;
+    this.providerId = options.providerId;
     this.client = new KmsRestClient(config);
   }
   async createKey(args) {
@@ -35,7 +37,10 @@ var RestKeyManagementSystem = class extends AbstractKeyManagementSystem {
         KeyOperations.Sign
       ]
     };
-    const key = await this.client.methods.kmsClientGenerateKey(options);
+    const key = this.providerId ? await this.client.methods.kmsClientProviderGenerateKey({
+      ...options,
+      providerId: this.providerId
+    }) : await this.client.methods.kmsClientGenerateKey(options);
     const jwk = {
       ...key.keyPair.jose.publicJwk,
       alg: key.keyPair.jose.publicJwk.alg ? this.mapJoseAlgorithm(key.keyPair.jose.publicJwk.alg) : void 0
@@ -49,7 +54,7 @@ var RestKeyManagementSystem = class extends AbstractKeyManagementSystem {
       kms: this.id,
       type,
       meta: {
-        alias: key.keyPair.kid,
+        alias: key.keyPair.alias,
         algorithms: [
           key.keyPair.jose.publicJwk.alg ?? "PS256"
         ],
@@ -65,13 +70,16 @@ var RestKeyManagementSystem = class extends AbstractKeyManagementSystem {
     const { type } = args;
     const signatureAlgorithm = this.mapKeyTypeToSignatureAlgorithm(type);
     const importKey = this.mapImportKey(args);
-    const result = await this.client.methods.kmsClientStoreKey(importKey.key);
+    const result = this.providerId ? await this.client.methods.kmsClientProviderStoreKey({
+      ...importKey.key,
+      providerId: this.providerId
+    }) : await this.client.methods.kmsClientStoreKey(importKey.key);
     return {
       kid: importKey.kid,
       kms: this.id,
       type,
       meta: {
-        alias: importKey.kid,
+        alias: importKey.key.keyInfo.alias,
         algorithms: [
           result.keyInfo.key.alg ?? "PS256"
         ],
@@ -85,17 +93,76 @@ var RestKeyManagementSystem = class extends AbstractKeyManagementSystem {
   }
   async deleteKey(args) {
     const { kid } = args;
-    return await this.client.methods.kmsClientDeleteKey({
+    return this.providerId ? await this.client.methods.kmsClientProviderDeleteKey({
+      aliasOrKid: kid,
+      providerId: this.providerId
+    }) : await this.client.methods.kmsClientDeleteKey({
       aliasOrKid: kid
     });
   }
   async listKeys() {
-    const keys = await this.client.methods.kmsClientListKeys();
-    return ListKeysResponseToJSONTyped(keys, false).keyInfos;
+    const keys = this.providerId ? await this.client.methods.kmsClientProviderListKeys({
+      providerId: this.providerId
+    }) : await this.client.methods.kmsClientListKeys();
+    const restKeys = ListKeysResponseToJSONTyped(keys, false).keyInfos;
+    return restKeys.map((restKey) => {
+      const jwk = restKey.key;
+      let publicKeyHex = "";
+      if (jwk.kty === "EC") {
+        publicKeyHex = jwk.x || "";
+      } else if (jwk.kty === "RSA") {
+        publicKeyHex = jwk.n || "";
+      } else if (jwk.kty === "OKP") {
+        publicKeyHex = jwk.x || "";
+      }
+      const keyType = this.mapRestKeyTypeToTKeyType(restKey.keyType);
+      return {
+        kid: restKey.kid || restKey.alias,
+        kms: this.id,
+        type: keyType,
+        publicKeyHex,
+        meta: {
+          algorithms: restKey.signatureAlgorithm ? [
+            restKey.signatureAlgorithm
+          ] : void 0,
+          jwk,
+          jwkThumbprint: calculateJwkThumbprint({
+            jwk,
+            digestAlgorithm: restKey.signatureAlgorithm ? this.signatureAlgorithmToDigestAlgorithm(restKey.signatureAlgorithm) : "sha256"
+          }),
+          alias: restKey.alias,
+          providerId: restKey.providerId,
+          x5c: restKey.x5c,
+          keyVisibility: restKey.keyVisibility,
+          keyEncoding: restKey.keyEncoding,
+          ...restKey.opts
+        }
+      };
+    });
+  }
+  mapRestKeyTypeToTKeyType(keyType) {
+    switch (keyType) {
+      case "RSA":
+        return "RSA";
+      case "EC":
+      case "P256":
+        return "Secp256r1";
+      case "X25519":
+        return "X25519";
+      case "Ed25519":
+        return "Ed25519";
+      case "secp256k1":
+        return "Secp256k1";
+      default:
+        throw new Error(`Unknown key type: ${keyType}`);
+    }
   }
   async sign(args) {
     const { keyRef, data } = args;
-    const key = await this.client.methods.kmsClientGetKey({
+    const key = this.providerId ? await this.client.methods.kmsClientProviderGetKey({
+      aliasOrKid: keyRef.kid,
+      providerId: this.providerId
+    }) : await this.client.methods.kmsClientGetKey({
       aliasOrKid: keyRef.kid
     });
     const signingResult = await this.client.methods.kmsClientCreateRawSignature({
@@ -106,7 +173,10 @@ var RestKeyManagementSystem = class extends AbstractKeyManagementSystem {
   }
   async verify(args) {
     const { keyRef, data, signature } = args;
-    const key = await this.client.methods.kmsClientGetKey({
+    const key = this.providerId ? await this.client.methods.kmsClientProviderGetKey({
+      aliasOrKid: keyRef.kid,
+      providerId: this.providerId
+    }) : await this.client.methods.kmsClientGetKey({
       aliasOrKid: keyRef.kid
     });
     const verification = await this.client.methods.kmsClientIsValidRawSignature({

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/RestKeyManagementSystem.ts"],"sourcesContent":["import type { ManagedKeyInfo, TKeyType } from '@veramo/core'\nimport { AbstractKeyManagementSystem } from '@veramo/key-manager'\nimport {\n  calculateJwkThumbprint,\n  toJwk,\n  x25519PublicHexFromPrivateHex,\n  type X509Opts\n} from '@sphereon/ssi-sdk-ext.key-utils'\nimport {\n  CurveFromJSONTyped,\n  JwkKeyTypeFromJSONTyped,\n  JwkUse,\n  JwkUseFromJSONTyped,\n  KeyOperations,\n  KmsRestClient,\n  ListKeysResponseToJSONTyped,\n  type RestClientAuthenticationOpts,\n  SignatureAlgorithm,\n  type StoreKey\n} from '@sphereon/ssi-sdk.kms-rest-client'\nimport {\n  hexToPEM,\n  jwkToPEM,\n  pemCertChainTox5c,\n  PEMToHex,\n  PEMToJwk\n} from '@sphereon/ssi-sdk-ext.x509-utils'\nimport { JoseSignatureAlgorithm, type JWK } from '@sphereon/ssi-types'\nimport elliptic from 'elliptic'\n// @ts-ignore\nimport * as u8a from 'uint8arrays'\nimport type {\n  CreateKeyArgs,\n  DeleteKeyArgs,\n  ImportKeyArgs,\n  MapImportKeyArgs,\n  MappedImportKey,\n  SharedSecretArgs,\n  SignArgs,\n  VerifyArgs\n} from './types'\n\nconst { fromString, toString } = u8a\n\ninterface AbstractKeyManagementSystemOptions {\n  applicationId: string\n  baseUrl: string\n  authOpts?: RestClientAuthenticationOpts\n}\n\nexport class RestKeyManagementSystem extends AbstractKeyManagementSystem {\n  private client: KmsRestClient\n  private readonly id: string\n\n  constructor(options: AbstractKeyManagementSystemOptions) {\n    super()\n\n    const config = {\n      baseUrl: options.baseUrl,\n      authOpts: options.authOpts\n    }\n\n    this.id = options.applicationId\n    this.client = new KmsRestClient(config)\n  }\n\n  async createKey(args: CreateKeyArgs): Promise<ManagedKeyInfo> {\n    const { type, meta } = args\n\n    const signatureAlgorithm = this.mapKeyTypeToSignatureAlgorithm(type)\n    const options  = {\n      use: meta && 'keyUsage' in meta ? this.mapKeyUsage(meta.keyUsage) : JwkUse.Sig,\n      alg: signatureAlgorithm,\n      keyOperations: meta ? this.mapKeyOperations(meta.keyOperations as string[]) : [KeyOperations.Sign]\n    }\n\n    const key = await this.client.methods.kmsClientGenerateKey(options)\n\n    const jwk = {\n      ...key.keyPair.jose.publicJwk,\n      alg: key.keyPair.jose.publicJwk.alg ? this.mapJoseAlgorithm(key.keyPair.jose.publicJwk.alg) : undefined,\n    } satisfies JWK\n\n    const kid = key.keyPair.kid ?? key.keyPair.jose.publicJwk.kid\n    if (!kid) {\n      throw new Error(`No kid present in key`)\n    }\n\n    return {\n      kid,\n      kms: this.id,\n      type,\n      meta: {\n        alias: key.keyPair.kid,\n        algorithms: [key.keyPair.jose.publicJwk.alg ?? 'PS256'],\n        jwkThumbprint: calculateJwkThumbprint({\n          jwk,\n          digestAlgorithm: this.signatureAlgorithmToDigestAlgorithm(signatureAlgorithm),\n        }),\n      },\n      publicKeyHex: Buffer.from(key.keyPair.jose.publicJwk.toString(), 'utf8').toString('base64'),\n    }\n  }\n\n  async importKey(args: ImportKeyArgs): Promise<ManagedKeyInfo> {\n    const { type } = args\n    const signatureAlgorithm = this.mapKeyTypeToSignatureAlgorithm(type)\n    const importKey = this.mapImportKey(args)\n\n    const result = await this.client.methods.kmsClientStoreKey(importKey.key)\n\n    return {\n      kid: importKey.kid,\n      kms: this.id,\n      type,\n      meta: {\n        alias: importKey.kid,\n        algorithms: [result.keyInfo.key.alg ?? 'PS256'],\n        jwkThumbprint: calculateJwkThumbprint({\n          jwk: importKey.publicKeyJwk,\n          digestAlgorithm: this.signatureAlgorithmToDigestAlgorithm(signatureAlgorithm),\n        }),\n      },\n      publicKeyHex: Buffer.from(result.keyInfo.key.toString(), 'utf8').toString('base64'),\n    }\n  }\n\n  async deleteKey(args: DeleteKeyArgs): Promise<boolean> {\n    const { kid } = args\n\n    return await this.client.methods.kmsClientDeleteKey({ aliasOrKid: kid })\n  }\n\n  async listKeys(): Promise<ManagedKeyInfo[]> {\n    const keys = await this.client.methods.kmsClientListKeys()\n\n    return ListKeysResponseToJSONTyped(keys, false).keyInfos //ListKeysResponseFromJSONTyped\n  }\n\n  async sign(args: SignArgs): Promise<string> {\n    const { keyRef, data } = args\n    const key = await this.client.methods.kmsClientGetKey({ aliasOrKid: keyRef.kid })\n    const signingResult = await this.client.methods.kmsClientCreateRawSignature({\n      keyInfo: key.keyInfo,\n      input: toString(data, 'base64')\n    })\n\n    return signingResult.signature\n  }\n\n  async verify(args: VerifyArgs): Promise<boolean> {\n    const { keyRef, data, signature } = args\n    const key = await this.client.methods.kmsClientGetKey({ aliasOrKid: keyRef.kid })\n    const verification = await this.client.methods.kmsClientIsValidRawSignature({\n      keyInfo: key.keyInfo,\n      input: toString(data, 'base64'),\n      signature\n    })\n\n    return verification.isValid\n  }\n\n  async sharedSecret(args: SharedSecretArgs): Promise<string> {\n    throw new Error('sharedSecret is not implemented for REST KMS.')\n  }\n\n  private signatureAlgorithmToDigestAlgorithm = (signatureAlgorithm: SignatureAlgorithm): 'sha256' | 'sha512' => {\n    switch (signatureAlgorithm) {\n      case SignatureAlgorithm.EcdsaSha256:\n      case SignatureAlgorithm.RsaSsaPssSha256Mgf1:\n      case SignatureAlgorithm.EckaDhSha256:\n      case SignatureAlgorithm.HmacSha256:\n      case SignatureAlgorithm.Es256K:\n        return 'sha256'\n      case SignatureAlgorithm.EcdsaSha512:\n      case SignatureAlgorithm.HmacSha512:\n      case SignatureAlgorithm.RsaSsaPssSha512Mgf1:\n        return 'sha512'\n      default:\n        throw new Error(`Signature algorithm ${signatureAlgorithm} is not supported by REST KMS`)\n    }\n  }\n\n  private mapKeyUsage = (usage: string): JwkUse => {\n    switch (usage) {\n      case 'sig':\n        return JwkUse.Sig\n      case 'enc':\n        return JwkUse.Enc\n      default:\n        throw new Error(`Key usage ${usage} is not supported by REST KMS`)\n    }\n  }\n\n  private mapKeyTypeToSignatureAlgorithm = (type: TKeyType): SignatureAlgorithm => {\n    switch (type) {\n      case 'Secp256r1':\n        return SignatureAlgorithm.EcdsaSha256\n      case 'RSA':\n        return SignatureAlgorithm.RsaSsaPssSha256Mgf1\n      case 'X25519':\n        return SignatureAlgorithm.EckaDhSha256\n      default:\n        throw new Error(`Key type ${type} is not supported by REST KMS`)\n    }\n  }\n\n  private mapJoseAlgorithm = (alg: string): JoseSignatureAlgorithm => {\n    switch (alg) {\n      case 'RS256': return JoseSignatureAlgorithm.RS256;\n      case 'RS384': return JoseSignatureAlgorithm.RS384;\n      case 'RS512': return JoseSignatureAlgorithm.RS512;\n      case 'ES256': return JoseSignatureAlgorithm.ES256;\n      case 'ES256K': return JoseSignatureAlgorithm.ES256K;\n      case 'ES384': return JoseSignatureAlgorithm.ES384;\n      case 'ES512': return JoseSignatureAlgorithm.ES512;\n      case 'EdDSA': return JoseSignatureAlgorithm.EdDSA;\n      case 'HS256': return JoseSignatureAlgorithm.HS256;\n      case 'HS384': return JoseSignatureAlgorithm.HS384;\n      case 'HS512': return JoseSignatureAlgorithm.HS512;\n      case 'PS256': return JoseSignatureAlgorithm.PS256;\n      case 'PS384': return JoseSignatureAlgorithm.PS384;\n      case 'PS512': return JoseSignatureAlgorithm.PS512;\n      case 'none':  return JoseSignatureAlgorithm.none;\n      default:\n        throw new Error(`Signature algorithm ${alg} is not supported by REST KMS`)\n    }\n  }\n\n  private mapKeyOperation = (operation: string): KeyOperations => {\n    switch (operation) {\n      case 'sign':\n        return KeyOperations.Sign\n      case 'verify':\n        return KeyOperations.Verify\n      case 'wrapKey':\n        return KeyOperations.WrapKey\n      case 'deriveKey':\n        return KeyOperations.DeriveKey\n      case 'unwrapKey':\n        return KeyOperations.UnwrapKey\n      case 'decrypt':\n        return KeyOperations.Decrypt\n      case 'deriveBits':\n        return KeyOperations.DeriveBits\n      case 'encrypt':\n        return KeyOperations.Encrypt\n      default:\n        throw new Error(`Key operation ${operation} is not supported by REST KMS`)\n    }\n  }\n\n  private mapKeyOperations = (operations: string[]): KeyOperations[] => {\n    return operations.map((operation) => this.mapKeyOperation(operation))\n  }\n\n  private mapImportRsaKey = (args: MapImportKeyArgs): MappedImportKey => {\n    const x509 = args.meta?.x509 as X509Opts\n    const privateKeyPEM = x509?.privateKeyPEM ?? (args.privateKeyHex.includes('---')\n      ? args.privateKeyHex\n      : hexToPEM(args.privateKeyHex, 'private')\n    ) // In case we have x509 opts, the private key hex really was a PEM already (yuck)\n    const publicKeyJwk = PEMToJwk(privateKeyPEM, 'public')\n    const privateKeyJwk = PEMToJwk(privateKeyPEM)\n    const publicKeyPEM = jwkToPEM(publicKeyJwk, 'public')\n    const publicKeyHex = PEMToHex(publicKeyPEM)\n\n    const meta = {} as any\n    if (x509) {\n      meta.x509 = {\n        cn: x509.cn ?? args.kid ?? publicKeyHex,\n      }\n      let certChain: string = x509.certificateChainPEM ?? ''\n      if (x509.certificatePEM) {\n        if (!certChain.includes(x509.certificatePEM)) {\n          certChain = `${x509.certificatePEM}\\n${certChain}`\n        }\n      }\n      if (certChain.length > 0) {\n        meta.x509.certificateChainPEM = certChain\n        const x5c = pemCertChainTox5c(certChain)\n        if (!x509.certificateChainURL) {\n          // Do not put the chain in the JWK when the chain is hosted. We do put it in the x509 metadata\n          // @ts-ignore\n          publicKeyJwk.x5c = x5c\n        }\n        meta.x509.x5c = x5c\n      }\n      if (x509.certificateChainURL) {\n        // @ts-ignore\n        publicKeyJwk.x5u = x509.certificateChainURL\n        meta.x509.x5u = x509.certificateChainURL\n      }\n    }\n\n    const kid = args.kid ?? meta?.x509?.cn ?? publicKeyHex\n    return {\n      kid,\n      publicKeyJwk: publicKeyJwk as JWK,\n      key: {\n        keyInfo: {\n          key: {\n            ...privateKeyJwk,\n            kid,\n            kty: JwkKeyTypeFromJSONTyped(privateKeyJwk.kty, false),\n            use: JwkUseFromJSONTyped(privateKeyJwk.use, false),\n            crv: CurveFromJSONTyped(privateKeyJwk.crv, false),\n          },\n        },\n        certChain: meta.x509.x5c\n      } satisfies StoreKey\n    }\n  }\n\n  private mapImportSecp256r1Key = (args: MapImportKeyArgs): MappedImportKey => {\n    const { privateKeyHex } = args\n    const privateBytes = fromString(privateKeyHex.toLowerCase(), 'base16')\n    const secp256r1 = new elliptic.ec('p256')\n    const keyPair = secp256r1.keyFromPrivate(privateBytes, 'hex')\n    const publicKeyHex = keyPair.getPublic(true, 'hex')\n    const publicKeyJwk = toJwk(publicKeyHex, 'Secp256r1')\n    const privateKeyJwk = toJwk(privateKeyHex, 'Secp256r1', { isPrivateKey: true })\n    const kid = args.kid ?? publicKeyJwk.kid ?? publicKeyHex\n\n    return {\n      kid,\n      publicKeyJwk: publicKeyJwk as JWK,\n      key: {\n        keyInfo: {\n          key: {\n            ...privateKeyJwk,\n            kid,\n            kty: JwkKeyTypeFromJSONTyped(privateKeyJwk.kty, false),\n            use: JwkUseFromJSONTyped(privateKeyJwk.use, false),\n            crv: CurveFromJSONTyped(privateKeyJwk.crv, false),\n          }\n        }\n      } satisfies StoreKey\n    }\n  }\n\n  private mapImportX25519Key = (args: MapImportKeyArgs): MappedImportKey => {\n    const { privateKeyHex } = args\n    const privateKeyJwk = toJwk(privateKeyHex, 'X25519', { isPrivateKey: true })\n    const publicKeyHex = x25519PublicHexFromPrivateHex(privateKeyHex)\n    const publicKeyJwk = toJwk(publicKeyHex, 'X25519')\n    const kid = args.kid ?? publicKeyJwk.kid ?? publicKeyHex\n\n    return {\n      kid,\n      publicKeyJwk: publicKeyJwk as JWK,\n      key: {\n        keyInfo: {\n          key: {\n            ...privateKeyJwk,\n            kid,\n            kty: JwkKeyTypeFromJSONTyped(privateKeyJwk.kty, false),\n            use: JwkUseFromJSONTyped(privateKeyJwk.use, false),\n            crv: CurveFromJSONTyped(privateKeyJwk.crv, false),\n          }\n        }\n      } satisfies StoreKey\n    }\n  }\n\n  private mapImportKey = (args: MapImportKeyArgs): MappedImportKey => {\n    switch (args.type) {\n      case 'RSA': {\n        return this.mapImportRsaKey(args)\n      }\n      case 'Secp256r1': {\n        return this.mapImportSecp256r1Key(args)\n      }\n      case 'X25519': {\n        return this.mapImportX25519Key(args)\n      }\n      default:\n        throw new Error(`Key type ${args.type} is not supported by REST KMS`)\n    }\n  }\n\n}\n"],"mappings":";;;;AACA,SAASA,mCAAmC;AAC5C,SACEC,wBACAC,OACAC,qCAEK;AACP,SACEC,oBACAC,yBACAC,QACAC,qBACAC,eACAC,eACAC,6BAEAC,0BAEK;AACP,SACEC,UACAC,UACAC,mBACAC,UACAC,gBACK;AACP,SAASC,8BAAwC;AACjD,OAAOC,cAAc;AAErB,YAAYC,SAAS;AAYrB,IAAM,EAAEC,YAAYC,SAAQ,IAAKC;AAQ1B,IAAMC,0BAAN,cAAsCC,4BAAAA;EAjD7C,OAiD6CA;;;EACnCC;EACSC;EAEjB,YAAYC,SAA6C;AACvD,UAAK;AAEL,UAAMC,SAAS;MACbC,SAASF,QAAQE;MACjBC,UAAUH,QAAQG;IACpB;AAEA,SAAKJ,KAAKC,QAAQI;AAClB,SAAKN,SAAS,IAAIO,cAAcJ,MAAAA;EAClC;EAEA,MAAMK,UAAUC,MAA8C;AAC5D,UAAM,EAAEC,MAAMC,KAAI,IAAKF;AAEvB,UAAMG,qBAAqB,KAAKC,+BAA+BH,IAAAA;AAC/D,UAAMR,UAAW;MACfY,KAAKH,QAAQ,cAAcA,OAAO,KAAKI,YAAYJ,KAAKK,QAAQ,IAAIC,OAAOC;MAC3EC,KAAKP;MACLQ,eAAeT,OAAO,KAAKU,iBAAiBV,KAAKS,aAAa,IAAgB;QAACE,cAAcC;;IAC/F;AAEA,UAAMC,MAAM,MAAM,KAAKxB,OAAOyB,QAAQC,qBAAqBxB,OAAAA;AAE3D,UAAMyB,MAAM;MACV,GAAGH,IAAII,QAAQC,KAAKC;MACpBX,KAAKK,IAAII,QAAQC,KAAKC,UAAUX,MAAM,KAAKY,iBAAiBP,IAAII,QAAQC,KAAKC,UAAUX,GAAG,IAAIa;IAChG;AAEA,UAAMC,MAAMT,IAAII,QAAQK,OAAOT,IAAII,QAAQC,KAAKC,UAAUG;AAC1D,QAAI,CAACA,KAAK;AACR,YAAM,IAAIC,MAAM,uBAAuB;IACzC;AAEA,WAAO;MACLD;MACAE,KAAK,KAAKlC;MACVS;MACAC,MAAM;QACJyB,OAAOZ,IAAII,QAAQK;QACnBI,YAAY;UAACb,IAAII,QAAQC,KAAKC,UAAUX,OAAO;;QAC/CmB,eAAeC,uBAAuB;UACpCZ;UACAa,iBAAiB,KAAKC,oCAAoC7B,kBAAAA;QAC5D,CAAA;MACF;MACA8B,cAAcC,OAAOC,KAAKpB,IAAII,QAAQC,KAAKC,UAAUlC,SAAQ,GAAI,MAAA,EAAQA,SAAS,QAAA;IACpF;EACF;EAEA,MAAMiD,UAAUpC,MAA8C;AAC5D,UAAM,EAAEC,KAAI,IAAKD;AACjB,UAAMG,qBAAqB,KAAKC,+BAA+BH,IAAAA;AAC/D,UAAMmC,YAAY,KAAKC,aAAarC,IAAAA;AAEpC,UAAMsC,SAAS,MAAM,KAAK/C,OAAOyB,QAAQuB,kBAAkBH,UAAUrB,GAAG;AAExE,WAAO;MACLS,KAAKY,UAAUZ;MACfE,KAAK,KAAKlC;MACVS;MACAC,MAAM;QACJyB,OAAOS,UAAUZ;QACjBI,YAAY;UAACU,OAAOE,QAAQzB,IAAIL,OAAO;;QACvCmB,eAAeC,uBAAuB;UACpCZ,KAAKkB,UAAUK;UACfV,iBAAiB,KAAKC,oCAAoC7B,kBAAAA;QAC5D,CAAA;MACF;MACA8B,cAAcC,OAAOC,KAAKG,OAAOE,QAAQzB,IAAI5B,SAAQ,GAAI,MAAA,EAAQA,SAAS,QAAA;IAC5E;EACF;EAEA,MAAMuD,UAAU1C,MAAuC;AACrD,UAAM,EAAEwB,IAAG,IAAKxB;AAEhB,WAAO,MAAM,KAAKT,OAAOyB,QAAQ2B,mBAAmB;MAAEC,YAAYpB;IAAI,CAAA;EACxE;EAEA,MAAMqB,WAAsC;AAC1C,UAAMC,OAAO,MAAM,KAAKvD,OAAOyB,QAAQ+B,kBAAiB;AAExD,WAAOC,4BAA4BF,MAAM,KAAA,EAAOG;EAClD;EAEA,MAAMC,KAAKlD,MAAiC;AAC1C,UAAM,EAAEmD,QAAQC,KAAI,IAAKpD;AACzB,UAAMe,MAAM,MAAM,KAAKxB,OAAOyB,QAAQqC,gBAAgB;MAAET,YAAYO,OAAO3B;IAAI,CAAA;AAC/E,UAAM8B,gBAAgB,MAAM,KAAK/D,OAAOyB,QAAQuC,4BAA4B;MAC1Ef,SAASzB,IAAIyB;MACbgB,OAAOrE,SAASiE,MAAM,QAAA;IACxB,CAAA;AAEA,WAAOE,cAAcG;EACvB;EAEA,MAAMC,OAAO1D,MAAoC;AAC/C,UAAM,EAAEmD,QAAQC,MAAMK,UAAS,IAAKzD;AACpC,UAAMe,MAAM,MAAM,KAAKxB,OAAOyB,QAAQqC,gBAAgB;MAAET,YAAYO,OAAO3B;IAAI,CAAA;AAC/E,UAAMmC,eAAe,MAAM,KAAKpE,OAAOyB,QAAQ4C,6BAA6B;MAC1EpB,SAASzB,IAAIyB;MACbgB,OAAOrE,SAASiE,MAAM,QAAA;MACtBK;IACF,CAAA;AAEA,WAAOE,aAAaE;EACtB;EAEA,MAAMC,aAAa9D,MAAyC;AAC1D,UAAM,IAAIyB,MAAM,+CAAA;EAClB;EAEQO,sCAAsC,wBAAC7B,uBAAAA;AAC7C,YAAQA,oBAAAA;MACN,KAAK4D,mBAAmBC;MACxB,KAAKD,mBAAmBE;MACxB,KAAKF,mBAAmBG;MACxB,KAAKH,mBAAmBI;MACxB,KAAKJ,mBAAmBK;AACtB,eAAO;MACT,KAAKL,mBAAmBM;MACxB,KAAKN,mBAAmBO;MACxB,KAAKP,mBAAmBQ;AACtB,eAAO;MACT;AACE,cAAM,IAAI9C,MAAM,uBAAuBtB,kBAAAA,+BAAiD;IAC5F;EACF,GAf8C;EAiBtCG,cAAc,wBAACkE,UAAAA;AACrB,YAAQA,OAAAA;MACN,KAAK;AACH,eAAOhE,OAAOC;MAChB,KAAK;AACH,eAAOD,OAAOiE;MAChB;AACE,cAAM,IAAIhD,MAAM,aAAa+C,KAAAA,+BAAoC;IACrE;EACF,GATsB;EAWdpE,iCAAiC,wBAACH,SAAAA;AACxC,YAAQA,MAAAA;MACN,KAAK;AACH,eAAO8D,mBAAmBC;MAC5B,KAAK;AACH,eAAOD,mBAAmBE;MAC5B,KAAK;AACH,eAAOF,mBAAmBG;MAC5B;AACE,cAAM,IAAIzC,MAAM,YAAYxB,IAAAA,+BAAmC;IACnE;EACF,GAXyC;EAajCqB,mBAAmB,wBAACZ,QAAAA;AAC1B,YAAQA,KAAAA;MACN,KAAK;AAAS,eAAOgE,uBAAuBC;MAC5C,KAAK;AAAS,eAAOD,uBAAuBE;MAC5C,KAAK;AAAS,eAAOF,uBAAuBG;MAC5C,KAAK;AAAS,eAAOH,uBAAuBI;MAC5C,KAAK;AAAU,eAAOJ,uBAAuBK;MAC7C,KAAK;AAAS,eAAOL,uBAAuBM;MAC5C,KAAK;AAAS,eAAON,uBAAuBO;MAC5C,KAAK;AAAS,eAAOP,uBAAuBQ;MAC5C,KAAK;AAAS,eAAOR,uBAAuBS;MAC5C,KAAK;AAAS,eAAOT,uBAAuBU;MAC5C,KAAK;AAAS,eAAOV,uBAAuBW;MAC5C,KAAK;AAAS,eAAOX,uBAAuBY;MAC5C,KAAK;AAAS,eAAOZ,uBAAuBa;MAC5C,KAAK;AAAS,eAAOb,uBAAuBc;MAC5C,KAAK;AAAS,eAAOd,uBAAuBe;MAC5C;AACE,cAAM,IAAIhE,MAAM,uBAAuBf,GAAAA,+BAAkC;IAC7E;EACF,GApB2B;EAsBnBgF,kBAAkB,wBAACC,cAAAA;AACzB,YAAQA,WAAAA;MACN,KAAK;AACH,eAAO9E,cAAcC;MACvB,KAAK;AACH,eAAOD,cAAc+E;MACvB,KAAK;AACH,eAAO/E,cAAcgF;MACvB,KAAK;AACH,eAAOhF,cAAciF;MACvB,KAAK;AACH,eAAOjF,cAAckF;MACvB,KAAK;AACH,eAAOlF,cAAcmF;MACvB,KAAK;AACH,eAAOnF,cAAcoF;MACvB,KAAK;AACH,eAAOpF,cAAcqF;MACvB;AACE,cAAM,IAAIzE,MAAM,iBAAiBkE,SAAAA,+BAAwC;IAC7E;EACF,GArB0B;EAuBlB/E,mBAAmB,wBAACuF,eAAAA;AAC1B,WAAOA,WAAWC,IAAI,CAACT,cAAc,KAAKD,gBAAgBC,SAAAA,CAAAA;EAC5D,GAF2B;EAInBU,kBAAkB,wBAACrG,SAAAA;AACzB,UAAMsG,OAAOtG,KAAKE,MAAMoG;AACxB,UAAMC,gBAAgBD,MAAMC,kBAAkBvG,KAAKwG,cAAcC,SAAS,KAAA,IACtEzG,KAAKwG,gBACLE,SAAS1G,KAAKwG,eAAe,SAAA;AAEjC,UAAM/D,eAAekE,SAASJ,eAAe,QAAA;AAC7C,UAAMK,gBAAgBD,SAASJ,aAAAA;AAC/B,UAAMM,eAAeC,SAASrE,cAAc,QAAA;AAC5C,UAAMR,eAAe8E,SAASF,YAAAA;AAE9B,UAAM3G,OAAO,CAAC;AACd,QAAIoG,MAAM;AACRpG,WAAKoG,OAAO;QACVU,IAAIV,KAAKU,MAAMhH,KAAKwB,OAAOS;MAC7B;AACA,UAAIgF,YAAoBX,KAAKY,uBAAuB;AACpD,UAAIZ,KAAKa,gBAAgB;AACvB,YAAI,CAACF,UAAUR,SAASH,KAAKa,cAAc,GAAG;AAC5CF,sBAAY,GAAGX,KAAKa,cAAc;EAAKF,SAAAA;QACzC;MACF;AACA,UAAIA,UAAUG,SAAS,GAAG;AACxBlH,aAAKoG,KAAKY,sBAAsBD;AAChC,cAAMI,MAAMC,kBAAkBL,SAAAA;AAC9B,YAAI,CAACX,KAAKiB,qBAAqB;AAG7B9E,uBAAa4E,MAAMA;QACrB;AACAnH,aAAKoG,KAAKe,MAAMA;MAClB;AACA,UAAIf,KAAKiB,qBAAqB;AAE5B9E,qBAAa+E,MAAMlB,KAAKiB;AACxBrH,aAAKoG,KAAKkB,MAAMlB,KAAKiB;MACvB;IACF;AAEA,UAAM/F,MAAMxB,KAAKwB,OAAOtB,MAAMoG,MAAMU,MAAM/E;AAC1C,WAAO;MACLT;MACAiB;MACA1B,KAAK;QACHyB,SAAS;UACPzB,KAAK;YACH,GAAG6F;YACHpF;YACAiG,KAAKC,wBAAwBd,cAAca,KAAK,KAAA;YAChDpH,KAAKsH,oBAAoBf,cAAcvG,KAAK,KAAA;YAC5CuH,KAAKC,mBAAmBjB,cAAcgB,KAAK,KAAA;UAC7C;QACF;QACAX,WAAW/G,KAAKoG,KAAKe;MACvB;IACF;EACF,GAxD0B;EA0DlBS,wBAAwB,wBAAC9H,SAAAA;AAC/B,UAAM,EAAEwG,cAAa,IAAKxG;AAC1B,UAAM+H,eAAe7I,WAAWsH,cAAcwB,YAAW,GAAI,QAAA;AAC7D,UAAMC,YAAY,IAAIC,SAASC,GAAG,MAAA;AAClC,UAAMhH,UAAU8G,UAAUG,eAAeL,cAAc,KAAA;AACvD,UAAM9F,eAAed,QAAQkH,UAAU,MAAM,KAAA;AAC7C,UAAM5F,eAAe6F,MAAMrG,cAAc,WAAA;AACzC,UAAM2E,gBAAgB0B,MAAM9B,eAAe,aAAa;MAAE+B,cAAc;IAAK,CAAA;AAC7E,UAAM/G,MAAMxB,KAAKwB,OAAOiB,aAAajB,OAAOS;AAE5C,WAAO;MACLT;MACAiB;MACA1B,KAAK;QACHyB,SAAS;UACPzB,KAAK;YACH,GAAG6F;YACHpF;YACAiG,KAAKC,wBAAwBd,cAAca,KAAK,KAAA;YAChDpH,KAAKsH,oBAAoBf,cAAcvG,KAAK,KAAA;YAC5CuH,KAAKC,mBAAmBjB,cAAcgB,KAAK,KAAA;UAC7C;QACF;MACF;IACF;EACF,GAzBgC;EA2BxBY,qBAAqB,wBAACxI,SAAAA;AAC5B,UAAM,EAAEwG,cAAa,IAAKxG;AAC1B,UAAM4G,gBAAgB0B,MAAM9B,eAAe,UAAU;MAAE+B,cAAc;IAAK,CAAA;AAC1E,UAAMtG,eAAewG,8BAA8BjC,aAAAA;AACnD,UAAM/D,eAAe6F,MAAMrG,cAAc,QAAA;AACzC,UAAMT,MAAMxB,KAAKwB,OAAOiB,aAAajB,OAAOS;AAE5C,WAAO;MACLT;MACAiB;MACA1B,KAAK;QACHyB,SAAS;UACPzB,KAAK;YACH,GAAG6F;YACHpF;YACAiG,KAAKC,wBAAwBd,cAAca,KAAK,KAAA;YAChDpH,KAAKsH,oBAAoBf,cAAcvG,KAAK,KAAA;YAC5CuH,KAAKC,mBAAmBjB,cAAcgB,KAAK,KAAA;UAC7C;QACF;MACF;IACF;EACF,GAtB6B;EAwBrBvF,eAAe,wBAACrC,SAAAA;AACtB,YAAQA,KAAKC,MAAI;MACf,KAAK,OAAO;AACV,eAAO,KAAKoG,gBAAgBrG,IAAAA;MAC9B;MACA,KAAK,aAAa;AAChB,eAAO,KAAK8H,sBAAsB9H,IAAAA;MACpC;MACA,KAAK,UAAU;AACb,eAAO,KAAKwI,mBAAmBxI,IAAAA;MACjC;MACA;AACE,cAAM,IAAIyB,MAAM,YAAYzB,KAAKC,IAAI,+BAA+B;IACxE;EACF,GAduB;AAgBzB;","names":["AbstractKeyManagementSystem","calculateJwkThumbprint","toJwk","x25519PublicHexFromPrivateHex","CurveFromJSONTyped","JwkKeyTypeFromJSONTyped","JwkUse","JwkUseFromJSONTyped","KeyOperations","KmsRestClient","ListKeysResponseToJSONTyped","SignatureAlgorithm","hexToPEM","jwkToPEM","pemCertChainTox5c","PEMToHex","PEMToJwk","JoseSignatureAlgorithm","elliptic","u8a","fromString","toString","u8a","RestKeyManagementSystem","AbstractKeyManagementSystem","client","id","options","config","baseUrl","authOpts","applicationId","KmsRestClient","createKey","args","type","meta","signatureAlgorithm","mapKeyTypeToSignatureAlgorithm","use","mapKeyUsage","keyUsage","JwkUse","Sig","alg","keyOperations","mapKeyOperations","KeyOperations","Sign","key","methods","kmsClientGenerateKey","jwk","keyPair","jose","publicJwk","mapJoseAlgorithm","undefined","kid","Error","kms","alias","algorithms","jwkThumbprint","calculateJwkThumbprint","digestAlgorithm","signatureAlgorithmToDigestAlgorithm","publicKeyHex","Buffer","from","importKey","mapImportKey","result","kmsClientStoreKey","keyInfo","publicKeyJwk","deleteKey","kmsClientDeleteKey","aliasOrKid","listKeys","keys","kmsClientListKeys","ListKeysResponseToJSONTyped","keyInfos","sign","keyRef","data","kmsClientGetKey","signingResult","kmsClientCreateRawSignature","input","signature","verify","verification","kmsClientIsValidRawSignature","isValid","sharedSecret","SignatureAlgorithm","EcdsaSha256","RsaSsaPssSha256Mgf1","EckaDhSha256","HmacSha256","Es256K","EcdsaSha512","HmacSha512","RsaSsaPssSha512Mgf1","usage","Enc","JoseSignatureAlgorithm","RS256","RS384","RS512","ES256","ES256K","ES384","ES512","EdDSA","HS256","HS384","HS512","PS256","PS384","PS512","none","mapKeyOperation","operation","Verify","WrapKey","DeriveKey","UnwrapKey","Decrypt","DeriveBits","Encrypt","operations","map","mapImportRsaKey","x509","privateKeyPEM","privateKeyHex","includes","hexToPEM","PEMToJwk","privateKeyJwk","publicKeyPEM","jwkToPEM","PEMToHex","cn","certChain","certificateChainPEM","certificatePEM","length","x5c","pemCertChainTox5c","certificateChainURL","x5u","kty","JwkKeyTypeFromJSONTyped","JwkUseFromJSONTyped","crv","CurveFromJSONTyped","mapImportSecp256r1Key","privateBytes","toLowerCase","secp256r1","elliptic","ec","keyFromPrivate","getPublic","toJwk","isPrivateKey","mapImportX25519Key","x25519PublicHexFromPrivateHex"]}
+{"version":3,"sources":["../src/RestKeyManagementSystem.ts"],"sourcesContent":["import { calculateJwkThumbprint, toJwk, x25519PublicHexFromPrivateHex, type X509Opts } from '@sphereon/ssi-sdk-ext.key-utils'\nimport { hexToPEM, jwkToPEM, pemCertChainTox5c, PEMToHex, PEMToJwk } from '@sphereon/ssi-sdk-ext.x509-utils'\nimport type { ManagedKeyInfo as RestManagedKeyInfo } from '@sphereon/ssi-sdk.kms-rest-client'\nimport {\n  CurveFromJSONTyped,\n  JwkKeyTypeFromJSONTyped,\n  JwkUse,\n  JwkUseFromJSONTyped,\n  KeyOperations,\n  KmsRestClient,\n  ListKeysResponseToJSONTyped,\n  type RestClientAuthenticationOpts,\n  SignatureAlgorithm,\n  type StoreKey,\n} from '@sphereon/ssi-sdk.kms-rest-client'\nimport { JoseSignatureAlgorithm, type JWK } from '@sphereon/ssi-types'\nimport type { ManagedKeyInfo, TKeyType } from '@veramo/core'\nimport { AbstractKeyManagementSystem } from '@veramo/key-manager'\nimport elliptic from 'elliptic'\n// @ts-ignore\nimport * as u8a from 'uint8arrays'\nimport type { CreateKeyArgs, DeleteKeyArgs, ImportKeyArgs, MapImportKeyArgs, MappedImportKey, SharedSecretArgs, SignArgs, VerifyArgs } from './types'\n\nconst { fromString, toString } = u8a\n\ninterface KeyManagementSystemOptions {\n  applicationId: string\n  baseUrl: string\n  providerId?: string\n  authOpts?: RestClientAuthenticationOpts\n}\n\nexport class RestKeyManagementSystem extends AbstractKeyManagementSystem {\n  private client: KmsRestClient\n  private readonly id: string\n  private providerId: string | undefined\n\n  constructor(options: KeyManagementSystemOptions) {\n    super()\n\n    const config = {\n      baseUrl: options.baseUrl,\n      authOpts: options.authOpts,\n    }\n\n    this.id = options.applicationId\n    this.providerId = options.providerId\n    this.client = new KmsRestClient(config)\n  }\n\n  async createKey(args: CreateKeyArgs): Promise<ManagedKeyInfo> {\n    const { type, meta } = args\n\n    const signatureAlgorithm = this.mapKeyTypeToSignatureAlgorithm(type)\n    const options = {\n      use: meta && 'keyUsage' in meta ? this.mapKeyUsage(meta.keyUsage) : JwkUse.Sig,\n      alg: signatureAlgorithm,\n      keyOperations: meta ? this.mapKeyOperations(meta.keyOperations as string[]) : [KeyOperations.Sign],\n    }\n\n    const key = this.providerId\n      ? await this.client.methods.kmsClientProviderGenerateKey({\n          ...options,\n          providerId: this.providerId,\n        })\n      : await this.client.methods.kmsClientGenerateKey(options)\n\n    const jwk = {\n      ...key.keyPair.jose.publicJwk,\n      alg: key.keyPair.jose.publicJwk.alg ? this.mapJoseAlgorithm(key.keyPair.jose.publicJwk.alg) : undefined,\n    } satisfies JWK\n\n    const kid = key.keyPair.kid ?? key.keyPair.jose.publicJwk.kid\n    if (!kid) {\n      throw new Error(`No kid present in key`)\n    }\n\n    return {\n      kid,\n      kms: this.id,\n      type,\n      meta: {\n        alias: key.keyPair.alias,\n        algorithms: [key.keyPair.jose.publicJwk.alg ?? 'PS256'],\n        jwkThumbprint: calculateJwkThumbprint({\n          jwk,\n          digestAlgorithm: this.signatureAlgorithmToDigestAlgorithm(signatureAlgorithm),\n        }),\n      },\n      publicKeyHex: Buffer.from(key.keyPair.jose.publicJwk.toString(), 'utf8').toString('base64'),\n    }\n  }\n\n  async importKey(args: ImportKeyArgs): Promise<ManagedKeyInfo> {\n    const { type } = args\n    const signatureAlgorithm = this.mapKeyTypeToSignatureAlgorithm(type)\n    const importKey = this.mapImportKey(args)\n\n    const result = this.providerId\n      ? await this.client.methods.kmsClientProviderStoreKey({\n          ...importKey.key,\n          providerId: this.providerId,\n        })\n      : await this.client.methods.kmsClientStoreKey(importKey.key)\n\n    return {\n      kid: importKey.kid,\n      kms: this.id,\n      type,\n      meta: {\n        alias: importKey.key.keyInfo.alias,\n        algorithms: [result.keyInfo.key.alg ?? 'PS256'],\n        jwkThumbprint: calculateJwkThumbprint({\n          jwk: importKey.publicKeyJwk,\n          digestAlgorithm: this.signatureAlgorithmToDigestAlgorithm(signatureAlgorithm),\n        }),\n      },\n      publicKeyHex: Buffer.from(result.keyInfo.key.toString(), 'utf8').toString('base64'),\n    }\n  }\n\n  async deleteKey(args: DeleteKeyArgs): Promise<boolean> {\n    const { kid } = args\n\n    return this.providerId\n      ? await this.client.methods.kmsClientProviderDeleteKey({\n          aliasOrKid: kid,\n          providerId: this.providerId,\n        })\n      : await this.client.methods.kmsClientDeleteKey({ aliasOrKid: kid })\n  }\n\n  async listKeys(): Promise<ManagedKeyInfo[]> {\n    const keys = this.providerId\n      ? await this.client.methods.kmsClientProviderListKeys({ providerId: this.providerId })\n      : await this.client.methods.kmsClientListKeys()\n\n    const restKeys = ListKeysResponseToJSONTyped(keys, false).keyInfos\n\n    return restKeys.map((restKey: RestManagedKeyInfo) => {\n      const jwk = restKey.key\n      let publicKeyHex = ''\n\n      // Derive publicKeyHex from JWK based on key type\n      if (jwk.kty === 'EC') {\n        publicKeyHex = jwk.x || ''\n      } else if (jwk.kty === 'RSA') {\n        publicKeyHex = jwk.n || ''\n      } else if (jwk.kty === 'OKP') {\n        publicKeyHex = jwk.x || ''\n      }\n\n      const keyType = this.mapRestKeyTypeToTKeyType(restKey.keyType)\n\n      return {\n        kid: restKey.kid || restKey.alias,\n        kms: this.id,\n        type: keyType,\n        publicKeyHex,\n        meta: {\n          algorithms: restKey.signatureAlgorithm ? [restKey.signatureAlgorithm] : undefined,\n          jwk,\n          jwkThumbprint: calculateJwkThumbprint({\n            jwk: jwk as JWK,\n            digestAlgorithm: restKey.signatureAlgorithm ? this.signatureAlgorithmToDigestAlgorithm(restKey.signatureAlgorithm) : 'sha256',\n          }),\n          alias: restKey.alias,\n          providerId: restKey.providerId,\n          x5c: restKey.x5c,\n          keyVisibility: restKey.keyVisibility,\n          keyEncoding: restKey.keyEncoding,\n          ...restKey.opts,\n        },\n      } satisfies ManagedKeyInfo\n    })\n  }\n\n  private mapRestKeyTypeToTKeyType(keyType: string | undefined): TKeyType {\n    switch (keyType) {\n      case 'RSA':\n        return 'RSA'\n      case 'EC':\n      case 'P256':\n        return 'Secp256r1'\n      case 'X25519':\n        return 'X25519'\n      case 'Ed25519':\n        return 'Ed25519'\n      case 'secp256k1':\n        return 'Secp256k1'\n      default:\n        throw new Error(`Unknown key type: ${keyType}`)\n    }\n  }\n\n  async sign(args: SignArgs): Promise<string> {\n    const { keyRef, data } = args\n    const key = this.providerId\n      ? await this.client.methods.kmsClientProviderGetKey({\n          aliasOrKid: keyRef.kid,\n          providerId: this.providerId,\n        })\n      : await this.client.methods.kmsClientGetKey({ aliasOrKid: keyRef.kid })\n\n    const signingResult = await this.client.methods.kmsClientCreateRawSignature({\n      keyInfo: key.keyInfo,\n      input: toString(data, 'base64'),\n    })\n\n    return signingResult.signature\n  }\n\n  async verify(args: VerifyArgs): Promise<boolean> {\n    const { keyRef, data, signature } = args\n    const key = this.providerId\n      ? await this.client.methods.kmsClientProviderGetKey({\n          aliasOrKid: keyRef.kid,\n          providerId: this.providerId,\n        })\n      : await this.client.methods.kmsClientGetKey({ aliasOrKid: keyRef.kid })\n\n    const verification = await this.client.methods.kmsClientIsValidRawSignature({\n      keyInfo: key.keyInfo,\n      input: toString(data, 'base64'),\n      signature,\n    })\n\n    return verification.isValid\n  }\n\n  async sharedSecret(args: SharedSecretArgs): Promise<string> {\n    throw new Error('sharedSecret is not implemented for REST KMS.')\n  }\n\n  private signatureAlgorithmToDigestAlgorithm = (signatureAlgorithm: SignatureAlgorithm): 'sha256' | 'sha512' => {\n    switch (signatureAlgorithm) {\n      case SignatureAlgorithm.EcdsaSha256:\n      case SignatureAlgorithm.RsaSsaPssSha256Mgf1:\n      case SignatureAlgorithm.EckaDhSha256:\n      case SignatureAlgorithm.HmacSha256:\n      case SignatureAlgorithm.Es256K:\n        return 'sha256'\n      case SignatureAlgorithm.EcdsaSha512:\n      case SignatureAlgorithm.HmacSha512:\n      case SignatureAlgorithm.RsaSsaPssSha512Mgf1:\n        return 'sha512'\n      default:\n        throw new Error(`Signature algorithm ${signatureAlgorithm} is not supported by REST KMS`)\n    }\n  }\n\n  private mapKeyUsage = (usage: string): JwkUse => {\n    switch (usage) {\n      case 'sig':\n        return JwkUse.Sig\n      case 'enc':\n        return JwkUse.Enc\n      default:\n        throw new Error(`Key usage ${usage} is not supported by REST KMS`)\n    }\n  }\n\n  private mapKeyTypeToSignatureAlgorithm = (type: TKeyType): SignatureAlgorithm => {\n    switch (type) {\n      case 'Secp256r1':\n        return SignatureAlgorithm.EcdsaSha256\n      case 'RSA':\n        return SignatureAlgorithm.RsaSsaPssSha256Mgf1\n      case 'X25519':\n        return SignatureAlgorithm.EckaDhSha256\n      default:\n        throw new Error(`Key type ${type} is not supported by REST KMS`)\n    }\n  }\n\n  private mapJoseAlgorithm = (alg: string): JoseSignatureAlgorithm => {\n    switch (alg) {\n      case 'RS256':\n        return JoseSignatureAlgorithm.RS256\n      case 'RS384':\n        return JoseSignatureAlgorithm.RS384\n      case 'RS512':\n        return JoseSignatureAlgorithm.RS512\n      case 'ES256':\n        return JoseSignatureAlgorithm.ES256\n      case 'ES256K':\n        return JoseSignatureAlgorithm.ES256K\n      case 'ES384':\n        return JoseSignatureAlgorithm.ES384\n      case 'ES512':\n        return JoseSignatureAlgorithm.ES512\n      case 'EdDSA':\n        return JoseSignatureAlgorithm.EdDSA\n      case 'HS256':\n        return JoseSignatureAlgorithm.HS256\n      case 'HS384':\n        return JoseSignatureAlgorithm.HS384\n      case 'HS512':\n        return JoseSignatureAlgorithm.HS512\n      case 'PS256':\n        return JoseSignatureAlgorithm.PS256\n      case 'PS384':\n        return JoseSignatureAlgorithm.PS384\n      case 'PS512':\n        return JoseSignatureAlgorithm.PS512\n      case 'none':\n        return JoseSignatureAlgorithm.none\n      default:\n        throw new Error(`Signature algorithm ${alg} is not supported by REST KMS`)\n    }\n  }\n\n  private mapKeyOperation = (operation: string): KeyOperations => {\n    switch (operation) {\n      case 'sign':\n        return KeyOperations.Sign\n      case 'verify':\n        return KeyOperations.Verify\n      case 'wrapKey':\n        return KeyOperations.WrapKey\n      case 'deriveKey':\n        return KeyOperations.DeriveKey\n      case 'unwrapKey':\n        return KeyOperations.UnwrapKey\n      case 'decrypt':\n        return KeyOperations.Decrypt\n      case 'deriveBits':\n        return KeyOperations.DeriveBits\n      case 'encrypt':\n        return KeyOperations.Encrypt\n      default:\n        throw new Error(`Key operation ${operation} is not supported by REST KMS`)\n    }\n  }\n\n  private mapKeyOperations = (operations: string[]): KeyOperations[] => {\n    return operations.map((operation) => this.mapKeyOperation(operation))\n  }\n\n  private mapImportRsaKey = (args: MapImportKeyArgs): MappedImportKey => {\n    const x509 = args.meta?.x509 as X509Opts\n    const privateKeyPEM = x509?.privateKeyPEM ?? (args.privateKeyHex.includes('---') ? args.privateKeyHex : hexToPEM(args.privateKeyHex, 'private')) // In case we have x509 opts, the private key hex really was a PEM already (yuck)\n    const publicKeyJwk = PEMToJwk(privateKeyPEM, 'public')\n    const privateKeyJwk = PEMToJwk(privateKeyPEM)\n    const publicKeyPEM = jwkToPEM(publicKeyJwk, 'public')\n    const publicKeyHex = PEMToHex(publicKeyPEM)\n\n    const meta = {} as any\n    if (x509) {\n      meta.x509 = {\n        cn: x509.cn ?? args.kid ?? publicKeyHex,\n      }\n      let certChain: string = x509.certificateChainPEM ?? ''\n      if (x509.certificatePEM) {\n        if (!certChain.includes(x509.certificatePEM)) {\n          certChain = `${x509.certificatePEM}\\n${certChain}`\n        }\n      }\n      if (certChain.length > 0) {\n        meta.x509.certificateChainPEM = certChain\n        const x5c = pemCertChainTox5c(certChain)\n        if (!x509.certificateChainURL) {\n          // Do not put the chain in the JWK when the chain is hosted. We do put it in the x509 metadata\n          // @ts-ignore\n          publicKeyJwk.x5c = x5c\n        }\n        meta.x509.x5c = x5c\n      }\n      if (x509.certificateChainURL) {\n        // @ts-ignore\n        publicKeyJwk.x5u = x509.certificateChainURL\n        meta.x509.x5u = x509.certificateChainURL\n      }\n    }\n\n    const kid = args.kid ?? meta?.x509?.cn ?? publicKeyHex\n    return {\n      kid,\n      publicKeyJwk: publicKeyJwk as JWK,\n      key: {\n        keyInfo: {\n          key: {\n            ...privateKeyJwk,\n            kid,\n            kty: JwkKeyTypeFromJSONTyped(privateKeyJwk.kty, false),\n            use: JwkUseFromJSONTyped(privateKeyJwk.use, false),\n            crv: CurveFromJSONTyped(privateKeyJwk.crv, false),\n          },\n        },\n        certChain: meta.x509.x5c,\n      } satisfies StoreKey,\n    }\n  }\n\n  private mapImportSecp256r1Key = (args: MapImportKeyArgs): MappedImportKey => {\n    const { privateKeyHex } = args\n    const privateBytes = fromString(privateKeyHex.toLowerCase(), 'base16')\n    const secp256r1 = new elliptic.ec('p256')\n    const keyPair = secp256r1.keyFromPrivate(privateBytes, 'hex')\n    const publicKeyHex = keyPair.getPublic(true, 'hex')\n    const publicKeyJwk = toJwk(publicKeyHex, 'Secp256r1')\n    const privateKeyJwk = toJwk(privateKeyHex, 'Secp256r1', { isPrivateKey: true })\n    const kid = args.kid ?? publicKeyJwk.kid ?? publicKeyHex\n\n    return {\n      kid,\n      publicKeyJwk: publicKeyJwk as JWK,\n      key: {\n        keyInfo: {\n          key: {\n            ...privateKeyJwk,\n            kid,\n            kty: JwkKeyTypeFromJSONTyped(privateKeyJwk.kty, false),\n            use: JwkUseFromJSONTyped(privateKeyJwk.use, false),\n            crv: CurveFromJSONTyped(privateKeyJwk.crv, false),\n          },\n        },\n      } satisfies StoreKey,\n    }\n  }\n\n  private mapImportX25519Key = (args: MapImportKeyArgs): MappedImportKey => {\n    const { privateKeyHex } = args\n    const privateKeyJwk = toJwk(privateKeyHex, 'X25519', { isPrivateKey: true })\n    const publicKeyHex = x25519PublicHexFromPrivateHex(privateKeyHex)\n    const publicKeyJwk = toJwk(publicKeyHex, 'X25519')\n    const kid = args.kid ?? publicKeyJwk.kid ?? publicKeyHex\n\n    return {\n      kid,\n      publicKeyJwk: publicKeyJwk as JWK,\n      key: {\n        keyInfo: {\n          key: {\n            ...privateKeyJwk,\n            kid,\n            kty: JwkKeyTypeFromJSONTyped(privateKeyJwk.kty, false),\n            use: JwkUseFromJSONTyped(privateKeyJwk.use, false),\n            crv: CurveFromJSONTyped(privateKeyJwk.crv, false),\n          },\n        },\n      } satisfies StoreKey,\n    }\n  }\n\n  private mapImportKey = (args: MapImportKeyArgs): MappedImportKey => {\n    switch (args.type) {\n      case 'RSA': {\n        return this.mapImportRsaKey(args)\n      }\n      case 'Secp256r1': {\n        return this.mapImportSecp256r1Key(args)\n      }\n      case 'X25519': {\n        return this.mapImportX25519Key(args)\n      }\n      default:\n        throw new Error(`Key type ${args.type} is not supported by REST KMS`)\n    }\n  }\n}\n"],"mappings":";;;;AAAA,SAASA,wBAAwBC,OAAOC,qCAAoD;AAC5F,SAASC,UAAUC,UAAUC,mBAAmBC,UAAUC,gBAAgB;AAE1E,SACEC,oBACAC,yBACAC,QACAC,qBACAC,eACAC,eACAC,6BAEAC,0BAEK;AACP,SAASC,8BAAwC;AAEjD,SAASC,mCAAmC;AAC5C,OAAOC,cAAc;AAErB,YAAYC,SAAS;AAGrB,IAAM,EAAEC,YAAYC,SAAQ,IAAKC;AAS1B,IAAMC,0BAAN,cAAsCC,4BAAAA;EAhC7C,OAgC6CA;;;EACnCC;EACSC;EACTC;EAER,YAAYC,SAAqC;AAC/C,UAAK;AAEL,UAAMC,SAAS;MACbC,SAASF,QAAQE;MACjBC,UAAUH,QAAQG;IACpB;AAEA,SAAKL,KAAKE,QAAQI;AAClB,SAAKL,aAAaC,QAAQD;AAC1B,SAAKF,SAAS,IAAIQ,cAAcJ,MAAAA;EAClC;EAEA,MAAMK,UAAUC,MAA8C;AAC5D,UAAM,EAAEC,MAAMC,KAAI,IAAKF;AAEvB,UAAMG,qBAAqB,KAAKC,+BAA+BH,IAAAA;AAC/D,UAAMR,UAAU;MACdY,KAAKH,QAAQ,cAAcA,OAAO,KAAKI,YAAYJ,KAAKK,QAAQ,IAAIC,OAAOC;MAC3EC,KAAKP;MACLQ,eAAeT,OAAO,KAAKU,iBAAiBV,KAAKS,aAAa,IAAgB;QAACE,cAAcC;;IAC/F;AAEA,UAAMC,MAAM,KAAKvB,aACb,MAAM,KAAKF,OAAO0B,QAAQC,6BAA6B;MACrD,GAAGxB;MACHD,YAAY,KAAKA;IACnB,CAAA,IACA,MAAM,KAAKF,OAAO0B,QAAQE,qBAAqBzB,OAAAA;AAEnD,UAAM0B,MAAM;MACV,GAAGJ,IAAIK,QAAQC,KAAKC;MACpBZ,KAAKK,IAAIK,QAAQC,KAAKC,UAAUZ,MAAM,KAAKa,iBAAiBR,IAAIK,QAAQC,KAAKC,UAAUZ,GAAG,IAAIc;IAChG;AAEA,UAAMC,MAAMV,IAAIK,QAAQK,OAAOV,IAAIK,QAAQC,KAAKC,UAAUG;AAC1D,QAAI,CAACA,KAAK;AACR,YAAM,IAAIC,MAAM,uBAAuB;IACzC;AAEA,WAAO;MACLD;MACAE,KAAK,KAAKpC;MACVU;MACAC,MAAM;QACJ0B,OAAOb,IAAIK,QAAQQ;QACnBC,YAAY;UAACd,IAAIK,QAAQC,KAAKC,UAAUZ,OAAO;;QAC/CoB,eAAeC,uBAAuB;UACpCZ;UACAa,iBAAiB,KAAKC,oCAAoC9B,kBAAAA;QAC5D,CAAA;MACF;MACA+B,cAAcC,OAAOC,KAAKrB,IAAIK,QAAQC,KAAKC,UAAUpC,SAAQ,GAAI,MAAA,EAAQA,SAAS,QAAA;IACpF;EACF;EAEA,MAAMmD,UAAUrC,MAA8C;AAC5D,UAAM,EAAEC,KAAI,IAAKD;AACjB,UAAMG,qBAAqB,KAAKC,+BAA+BH,IAAAA;AAC/D,UAAMoC,YAAY,KAAKC,aAAatC,IAAAA;AAEpC,UAAMuC,SAAS,KAAK/C,aAChB,MAAM,KAAKF,OAAO0B,QAAQwB,0BAA0B;MAClD,GAAGH,UAAUtB;MACbvB,YAAY,KAAKA;IACnB,CAAA,IACA,MAAM,KAAKF,OAAO0B,QAAQyB,kBAAkBJ,UAAUtB,GAAG;AAE7D,WAAO;MACLU,KAAKY,UAAUZ;MACfE,KAAK,KAAKpC;MACVU;MACAC,MAAM;QACJ0B,OAAOS,UAAUtB,IAAI2B,QAAQd;QAC7BC,YAAY;UAACU,OAAOG,QAAQ3B,IAAIL,OAAO;;QACvCoB,eAAeC,uBAAuB;UACpCZ,KAAKkB,UAAUM;UACfX,iBAAiB,KAAKC,oCAAoC9B,kBAAAA;QAC5D,CAAA;MACF;MACA+B,cAAcC,OAAOC,KAAKG,OAAOG,QAAQ3B,IAAI7B,SAAQ,GAAI,MAAA,EAAQA,SAAS,QAAA;IAC5E;EACF;EAEA,MAAM0D,UAAU5C,MAAuC;AACrD,UAAM,EAAEyB,IAAG,IAAKzB;AAEhB,WAAO,KAAKR,aACR,MAAM,KAAKF,OAAO0B,QAAQ6B,2BAA2B;MACnDC,YAAYrB;MACZjC,YAAY,KAAKA;IACnB,CAAA,IACA,MAAM,KAAKF,OAAO0B,QAAQ+B,mBAAmB;MAAED,YAAYrB;IAAI,CAAA;EACrE;EAEA,MAAMuB,WAAsC;AAC1C,UAAMC,OAAO,KAAKzD,aACd,MAAM,KAAKF,OAAO0B,QAAQkC,0BAA0B;MAAE1D,YAAY,KAAKA;IAAW,CAAA,IAClF,MAAM,KAAKF,OAAO0B,QAAQmC,kBAAiB;AAE/C,UAAMC,WAAWC,4BAA4BJ,MAAM,KAAA,EAAOK;AAE1D,WAAOF,SAASG,IAAI,CAACC,YAAAA;AACnB,YAAMrC,MAAMqC,QAAQzC;AACpB,UAAImB,eAAe;AAGnB,UAAIf,IAAIsC,QAAQ,MAAM;AACpBvB,uBAAef,IAAIuC,KAAK;MAC1B,WAAWvC,IAAIsC,QAAQ,OAAO;AAC5BvB,uBAAef,IAAIwC,KAAK;MAC1B,WAAWxC,IAAIsC,QAAQ,OAAO;AAC5BvB,uBAAef,IAAIuC,KAAK;MAC1B;AAEA,YAAME,UAAU,KAAKC,yBAAyBL,QAAQI,OAAO;AAE7D,aAAO;QACLnC,KAAK+B,QAAQ/B,OAAO+B,QAAQ5B;QAC5BD,KAAK,KAAKpC;QACVU,MAAM2D;QACN1B;QACAhC,MAAM;UACJ2B,YAAY2B,QAAQrD,qBAAqB;YAACqD,QAAQrD;cAAsBqB;UACxEL;UACAW,eAAeC,uBAAuB;YACpCZ;YACAa,iBAAiBwB,QAAQrD,qBAAqB,KAAK8B,oCAAoCuB,QAAQrD,kBAAkB,IAAI;UACvH,CAAA;UACAyB,OAAO4B,QAAQ5B;UACfpC,YAAYgE,QAAQhE;UACpBsE,KAAKN,QAAQM;UACbC,eAAeP,QAAQO;UACvBC,aAAaR,QAAQQ;UACrB,GAAGR,QAAQS;QACb;MACF;IACF,CAAA;EACF;EAEQJ,yBAAyBD,SAAuC;AACtE,YAAQA,SAAAA;MACN,KAAK;AACH,eAAO;MACT,KAAK;MACL,KAAK;AACH,eAAO;MACT,KAAK;AACH,eAAO;MACT,KAAK;AACH,eAAO;MACT,KAAK;AACH,eAAO;MACT;AACE,cAAM,IAAIlC,MAAM,qBAAqBkC,OAAAA,EAAS;IAClD;EACF;EAEA,MAAMM,KAAKlE,MAAiC;AAC1C,UAAM,EAAEmE,QAAQC,KAAI,IAAKpE;AACzB,UAAMe,MAAM,KAAKvB,aACb,MAAM,KAAKF,OAAO0B,QAAQqD,wBAAwB;MAChDvB,YAAYqB,OAAO1C;MACnBjC,YAAY,KAAKA;IACnB,CAAA,IACA,MAAM,KAAKF,OAAO0B,QAAQsD,gBAAgB;MAAExB,YAAYqB,OAAO1C;IAAI,CAAA;AAEvE,UAAM8C,gBAAgB,MAAM,KAAKjF,OAAO0B,QAAQwD,4BAA4B;MAC1E9B,SAAS3B,IAAI2B;MACb+B,OAAOvF,SAASkF,MAAM,QAAA;IACxB,CAAA;AAEA,WAAOG,cAAcG;EACvB;EAEA,MAAMC,OAAO3E,MAAoC;AAC/C,UAAM,EAAEmE,QAAQC,MAAMM,UAAS,IAAK1E;AACpC,UAAMe,MAAM,KAAKvB,aACb,MAAM,KAAKF,OAAO0B,QAAQqD,wBAAwB;MAChDvB,YAAYqB,OAAO1C;MACnBjC,YAAY,KAAKA;IACnB,CAAA,IACA,MAAM,KAAKF,OAAO0B,QAAQsD,gBAAgB;MAAExB,YAAYqB,OAAO1C;IAAI,CAAA;AAEvE,UAAMmD,eAAe,MAAM,KAAKtF,OAAO0B,QAAQ6D,6BAA6B;MAC1EnC,SAAS3B,IAAI2B;MACb+B,OAAOvF,SAASkF,MAAM,QAAA;MACtBM;IACF,CAAA;AAEA,WAAOE,aAAaE;EACtB;EAEA,MAAMC,aAAa/E,MAAyC;AAC1D,UAAM,IAAI0B,MAAM,+CAAA;EAClB;EAEQO,sCAAsC,wBAAC9B,uBAAAA;AAC7C,YAAQA,oBAAAA;MACN,KAAK6E,mBAAmBC;MACxB,KAAKD,mBAAmBE;MACxB,KAAKF,mBAAmBG;MACxB,KAAKH,mBAAmBI;MACxB,KAAKJ,mBAAmBK;AACtB,eAAO;MACT,KAAKL,mBAAmBM;MACxB,KAAKN,mBAAmBO;MACxB,KAAKP,mBAAmBQ;AACtB,eAAO;MACT;AACE,cAAM,IAAI9D,MAAM,uBAAuBvB,kBAAAA,+BAAiD;IAC5F;EACF,GAf8C;EAiBtCG,cAAc,wBAACmF,UAAAA;AACrB,YAAQA,OAAAA;MACN,KAAK;AACH,eAAOjF,OAAOC;MAChB,KAAK;AACH,eAAOD,OAAOkF;MAChB;AACE,cAAM,IAAIhE,MAAM,aAAa+D,KAAAA,+BAAoC;IACrE;EACF,GATsB;EAWdrF,iCAAiC,wBAACH,SAAAA;AACxC,YAAQA,MAAAA;MACN,KAAK;AACH,eAAO+E,mBAAmBC;MAC5B,KAAK;AACH,eAAOD,mBAAmBE;MAC5B,KAAK;AACH,eAAOF,mBAAmBG;MAC5B;AACE,cAAM,IAAIzD,MAAM,YAAYzB,IAAAA,+BAAmC;IACnE;EACF,GAXyC;EAajCsB,mBAAmB,wBAACb,QAAAA;AAC1B,YAAQA,KAAAA;MACN,KAAK;AACH,eAAOiF,uBAAuBC;MAChC,KAAK;AACH,eAAOD,uBAAuBE;MAChC,KAAK;AACH,eAAOF,uBAAuBG;MAChC,KAAK;AACH,eAAOH,uBAAuBI;MAChC,KAAK;AACH,eAAOJ,uBAAuBK;MAChC,KAAK;AACH,eAAOL,uBAAuBM;MAChC,KAAK;AACH,eAAON,uBAAuBO;MAChC,KAAK;AACH,eAAOP,uBAAuBQ;MAChC,KAAK;AACH,eAAOR,uBAAuBS;MAChC,KAAK;AACH,eAAOT,uBAAuBU;MAChC,KAAK;AACH,eAAOV,uBAAuBW;MAChC,KAAK;AACH,eAAOX,uBAAuBY;MAChC,KAAK;AACH,eAAOZ,uBAAuBa;MAChC,KAAK;AACH,eAAOb,uBAAuBc;MAChC,KAAK;AACH,eAAOd,uBAAuBe;MAChC;AACE,cAAM,IAAIhF,MAAM,uBAAuBhB,GAAAA,+BAAkC;IAC7E;EACF,GAnC2B;EAqCnBiG,kBAAkB,wBAACC,cAAAA;AACzB,YAAQA,WAAAA;MACN,KAAK;AACH,eAAO/F,cAAcC;MACvB,KAAK;AACH,eAAOD,cAAcgG;MACvB,KAAK;AACH,eAAOhG,cAAciG;MACvB,KAAK;AACH,eAAOjG,cAAckG;MACvB,KAAK;AACH,eAAOlG,cAAcmG;MACvB,KAAK;AACH,eAAOnG,cAAcoG;MACvB,KAAK;AACH,eAAOpG,cAAcqG;MACvB,KAAK;AACH,eAAOrG,cAAcsG;MACvB;AACE,cAAM,IAAIzF,MAAM,iBAAiBkF,SAAAA,+BAAwC;IAC7E;EACF,GArB0B;EAuBlBhG,mBAAmB,wBAACwG,eAAAA;AAC1B,WAAOA,WAAW7D,IAAI,CAACqD,cAAc,KAAKD,gBAAgBC,SAAAA,CAAAA;EAC5D,GAF2B;EAInBS,kBAAkB,wBAACrH,SAAAA;AACzB,UAAMsH,OAAOtH,KAAKE,MAAMoH;AACxB,UAAMC,gBAAgBD,MAAMC,kBAAkBvH,KAAKwH,cAAcC,SAAS,KAAA,IAASzH,KAAKwH,gBAAgBE,SAAS1H,KAAKwH,eAAe,SAAA;AACrI,UAAM7E,eAAegF,SAASJ,eAAe,QAAA;AAC7C,UAAMK,gBAAgBD,SAASJ,aAAAA;AAC/B,UAAMM,eAAeC,SAASnF,cAAc,QAAA;AAC5C,UAAMT,eAAe6F,SAASF,YAAAA;AAE9B,UAAM3H,OAAO,CAAC;AACd,QAAIoH,MAAM;AACRpH,WAAKoH,OAAO;QACVU,IAAIV,KAAKU,MAAMhI,KAAKyB,OAAOS;MAC7B;AACA,UAAI+F,YAAoBX,KAAKY,uBAAuB;AACpD,UAAIZ,KAAKa,gBAAgB;AACvB,YAAI,CAACF,UAAUR,SAASH,KAAKa,cAAc,GAAG;AAC5CF,sBAAY,GAAGX,KAAKa,cAAc;EAAKF,SAAAA;QACzC;MACF;AACA,UAAIA,UAAUG,SAAS,GAAG;AACxBlI,aAAKoH,KAAKY,sBAAsBD;AAChC,cAAMnE,MAAMuE,kBAAkBJ,SAAAA;AAC9B,YAAI,CAACX,KAAKgB,qBAAqB;AAG7B3F,uBAAamB,MAAMA;QACrB;AACA5D,aAAKoH,KAAKxD,MAAMA;MAClB;AACA,UAAIwD,KAAKgB,qBAAqB;AAE5B3F,qBAAa4F,MAAMjB,KAAKgB;AACxBpI,aAAKoH,KAAKiB,MAAMjB,KAAKgB;MACvB;IACF;AAEA,UAAM7G,MAAMzB,KAAKyB,OAAOvB,MAAMoH,MAAMU,MAAM9F;AAC1C,WAAO;MACLT;MACAkB;MACA5B,KAAK;QACH2B,SAAS;UACP3B,KAAK;YACH,GAAG6G;YACHnG;YACAgC,KAAK+E,wBAAwBZ,cAAcnE,KAAK,KAAA;YAChDpD,KAAKoI,oBAAoBb,cAAcvH,KAAK,KAAA;YAC5CqI,KAAKC,mBAAmBf,cAAcc,KAAK,KAAA;UAC7C;QACF;QACAT,WAAW/H,KAAKoH,KAAKxD;MACvB;IACF;EACF,GArD0B;EAuDlB8E,wBAAwB,wBAAC5I,SAAAA;AAC/B,UAAM,EAAEwH,cAAa,IAAKxH;AAC1B,UAAM6I,eAAe5J,WAAWuI,cAAcsB,YAAW,GAAI,QAAA;AAC7D,UAAMC,YAAY,IAAIC,SAASC,GAAG,MAAA;AAClC,UAAM7H,UAAU2H,UAAUG,eAAeL,cAAc,KAAA;AACvD,UAAM3G,eAAed,QAAQ+H,UAAU,MAAM,KAAA;AAC7C,UAAMxG,eAAeyG,MAAMlH,cAAc,WAAA;AACzC,UAAM0F,gBAAgBwB,MAAM5B,eAAe,aAAa;MAAE6B,cAAc;IAAK,CAAA;AAC7E,UAAM5H,MAAMzB,KAAKyB,OAAOkB,aAAalB,OAAOS;AAE5C,WAAO;MACLT;MACAkB;MACA5B,KAAK;QACH2B,SAAS;UACP3B,KAAK;YACH,GAAG6G;YACHnG;YACAgC,KAAK+E,wBAAwBZ,cAAcnE,KAAK,KAAA;YAChDpD,KAAKoI,oBAAoBb,cAAcvH,KAAK,KAAA;YAC5CqI,KAAKC,mBAAmBf,cAAcc,KAAK,KAAA;UAC7C;QACF;MACF;IACF;EACF,GAzBgC;EA2BxBY,qBAAqB,wBAACtJ,SAAAA;AAC5B,UAAM,EAAEwH,cAAa,IAAKxH;AAC1B,UAAM4H,gBAAgBwB,MAAM5B,eAAe,UAAU;MAAE6B,cAAc;IAAK,CAAA;AAC1E,UAAMnH,eAAeqH,8BAA8B/B,aAAAA;AACnD,UAAM7E,eAAeyG,MAAMlH,cAAc,QAAA;AACzC,UAAMT,MAAMzB,KAAKyB,OAAOkB,aAAalB,OAAOS;AAE5C,WAAO;MACLT;MACAkB;MACA5B,KAAK;QACH2B,SAAS;UACP3B,KAAK;YACH,GAAG6G;YACHnG;YACAgC,KAAK+E,wBAAwBZ,cAAcnE,KAAK,KAAA;YAChDpD,KAAKoI,oBAAoBb,cAAcvH,KAAK,KAAA;YAC5CqI,KAAKC,mBAAmBf,cAAcc,KAAK,KAAA;UAC7C;QACF;MACF;IACF;EACF,GAtB6B;EAwBrBpG,eAAe,wBAACtC,SAAAA;AACtB,YAAQA,KAAKC,MAAI;MACf,KAAK,OAAO;AACV,eAAO,KAAKoH,gBAAgBrH,IAAAA;MAC9B;MACA,KAAK,aAAa;AAChB,eAAO,KAAK4I,sBAAsB5I,IAAAA;MACpC;MACA,KAAK,UAAU;AACb,eAAO,KAAKsJ,mBAAmBtJ,IAAAA;MACjC;MACA;AACE,cAAM,IAAI0B,MAAM,YAAY1B,KAAKC,IAAI,+BAA+B;IACxE;EACF,GAduB;AAezB;","names":["calculateJwkThumbprint","toJwk","x25519PublicHexFromPrivateHex","hexToPEM","jwkToPEM","pemCertChainTox5c","PEMToHex","PEMToJwk","CurveFromJSONTyped","JwkKeyTypeFromJSONTyped","JwkUse","JwkUseFromJSONTyped","KeyOperations","KmsRestClient","ListKeysResponseToJSONTyped","SignatureAlgorithm","JoseSignatureAlgorithm","AbstractKeyManagementSystem","elliptic","u8a","fromString","toString","u8a","RestKeyManagementSystem","AbstractKeyManagementSystem","client","id","providerId","options","config","baseUrl","authOpts","applicationId","KmsRestClient","createKey","args","type","meta","signatureAlgorithm","mapKeyTypeToSignatureAlgorithm","use","mapKeyUsage","keyUsage","JwkUse","Sig","alg","keyOperations","mapKeyOperations","KeyOperations","Sign","key","methods","kmsClientProviderGenerateKey","kmsClientGenerateKey","jwk","keyPair","jose","publicJwk","mapJoseAlgorithm","undefined","kid","Error","kms","alias","algorithms","jwkThumbprint","calculateJwkThumbprint","digestAlgorithm","signatureAlgorithmToDigestAlgorithm","publicKeyHex","Buffer","from","importKey","mapImportKey","result","kmsClientProviderStoreKey","kmsClientStoreKey","keyInfo","publicKeyJwk","deleteKey","kmsClientProviderDeleteKey","aliasOrKid","kmsClientDeleteKey","listKeys","keys","kmsClientProviderListKeys","kmsClientListKeys","restKeys","ListKeysResponseToJSONTyped","keyInfos","map","restKey","kty","x","n","keyType","mapRestKeyTypeToTKeyType","x5c","keyVisibility","keyEncoding","opts","sign","keyRef","data","kmsClientProviderGetKey","kmsClientGetKey","signingResult","kmsClientCreateRawSignature","input","signature","verify","verification","kmsClientIsValidRawSignature","isValid","sharedSecret","SignatureAlgorithm","EcdsaSha256","RsaSsaPssSha256Mgf1","EckaDhSha256","HmacSha256","Es256K","EcdsaSha512","HmacSha512","RsaSsaPssSha512Mgf1","usage","Enc","JoseSignatureAlgorithm","RS256","RS384","RS512","ES256","ES256K","ES384","ES512","EdDSA","HS256","HS384","HS512","PS256","PS384","PS512","none","mapKeyOperation","operation","Verify","WrapKey","DeriveKey","UnwrapKey","Decrypt","DeriveBits","Encrypt","operations","mapImportRsaKey","x509","privateKeyPEM","privateKeyHex","includes","hexToPEM","PEMToJwk","privateKeyJwk","publicKeyPEM","jwkToPEM","PEMToHex","cn","certChain","certificateChainPEM","certificatePEM","length","pemCertChainTox5c","certificateChainURL","x5u","JwkKeyTypeFromJSONTyped","JwkUseFromJSONTyped","crv","CurveFromJSONTyped","mapImportSecp256r1Key","privateBytes","toLowerCase","secp256r1","elliptic","ec","keyFromPrivate","getPublic","toJwk","isPrivateKey","mapImportX25519Key","x25519PublicHexFromPrivateHex"]}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@sphereon/ssi-sdk.kms-rest",
   "description": "Sphereon SSI-SDK plugin for REST Key Management System.",
-  "version": "0.34.1-feature.IDK.11.54+d92e43d4",
+  "version": "0.34.1-feature.SSISDK.44.finish.dcql.309+dbfc561c",
   "source": "./src/index.ts",
   "type": "module",
   "main": "./dist/index.cjs",
@@ -22,10 +22,10 @@
     "build": "tsup --config ../../tsup.config.ts --tsconfig ../../tsconfig.tsup.json"
   },
   "dependencies": {
-    "@sphereon/ssi-sdk-ext.key-utils": "0.34.1-feature.IDK.11.54+d92e43d4",
-    "@sphereon/ssi-sdk-ext.x509-utils": "0.34.1-feature.IDK.11.54+d92e43d4",
-    "@sphereon/ssi-sdk.kms-rest-client": "0.34.1-feature.IDK.11.54+d92e43d4",
-    "@sphereon/ssi-types": "0.34.1-feature.IDK.11.54+d92e43d4",
+    "@sphereon/ssi-sdk-ext.key-utils": "0.34.1-feature.SSISDK.44.finish.dcql.309+dbfc561c",
+    "@sphereon/ssi-sdk-ext.x509-utils": "0.34.1-feature.SSISDK.44.finish.dcql.309+dbfc561c",
+    "@sphereon/ssi-sdk.kms-rest-client": "0.34.1-feature.SSISDK.44.finish.dcql.309+dbfc561c",
+    "@sphereon/ssi-types": "0.34.1-feature.SSISDK.44.finish.dcql.309+dbfc561c",
     "@veramo/core": "4.2.0",
     "@veramo/key-manager": "4.2.0",
     "elliptic": "^6.5.4",
@@ -54,5 +54,5 @@
     "key-management",
     "Veramo"
   ],
-  "gitHead": "d92e43d4d2a604e0c088a26d9c595d87e00382b8"
+  "gitHead": "dbfc561c168d680c69e1808dc13864d35573523c"
 }

package/src/RestKeyManagementSystem.ts

@@ -1,11 +1,6 @@
-import type { ManagedKeyInfo, TKeyType } from '@veramo/core'
-import { AbstractKeyManagementSystem } from '@veramo/key-manager'
-import {
-  calculateJwkThumbprint,
-  toJwk,
-  x25519PublicHexFromPrivateHex,
-  type X509Opts
-} from '@sphereon/ssi-sdk-ext.key-utils'
+import { calculateJwkThumbprint, toJwk, x25519PublicHexFromPrivateHex, type X509Opts } from '@sphereon/ssi-sdk-ext.key-utils'
+import { hexToPEM, jwkToPEM, pemCertChainTox5c, PEMToHex, PEMToJwk } from '@sphereon/ssi-sdk-ext.x509-utils'
+import type { ManagedKeyInfo as RestManagedKeyInfo } from '@sphereon/ssi-sdk.kms-rest-client'
 import {
   CurveFromJSONTyped,
   JwkKeyTypeFromJSONTyped,
@@ -16,51 +11,40 @@ import {
   ListKeysResponseToJSONTyped,
   type RestClientAuthenticationOpts,
   SignatureAlgorithm,
-  type StoreKey
+  type StoreKey,
 } from '@sphereon/ssi-sdk.kms-rest-client'
-import {
-  hexToPEM,
-  jwkToPEM,
-  pemCertChainTox5c,
-  PEMToHex,
-  PEMToJwk
-} from '@sphereon/ssi-sdk-ext.x509-utils'
 import { JoseSignatureAlgorithm, type JWK } from '@sphereon/ssi-types'
+import type { ManagedKeyInfo, TKeyType } from '@veramo/core'
+import { AbstractKeyManagementSystem } from '@veramo/key-manager'
 import elliptic from 'elliptic'
 // @ts-ignore
 import * as u8a from 'uint8arrays'
-import type {
-  CreateKeyArgs,
-  DeleteKeyArgs,
-  ImportKeyArgs,
-  MapImportKeyArgs,
-  MappedImportKey,
-  SharedSecretArgs,
-  SignArgs,
-  VerifyArgs
-} from './types'
+import type { CreateKeyArgs, DeleteKeyArgs, ImportKeyArgs, MapImportKeyArgs, MappedImportKey, SharedSecretArgs, SignArgs, VerifyArgs } from './types'
 
 const { fromString, toString } = u8a
 
-interface AbstractKeyManagementSystemOptions {
+interface KeyManagementSystemOptions {
   applicationId: string
   baseUrl: string
+  providerId?: string
   authOpts?: RestClientAuthenticationOpts
 }
 
 export class RestKeyManagementSystem extends AbstractKeyManagementSystem {
   private client: KmsRestClient
   private readonly id: string
+  private providerId: string | undefined
 
-  constructor(options: AbstractKeyManagementSystemOptions) {
+  constructor(options: KeyManagementSystemOptions) {
     super()
 
     const config = {
       baseUrl: options.baseUrl,
-      authOpts: options.authOpts
+      authOpts: options.authOpts,
     }
 
     this.id = options.applicationId
+    this.providerId = options.providerId
     this.client = new KmsRestClient(config)
   }
 
@@ -68,13 +52,18 @@ export class RestKeyManagementSystem extends AbstractKeyManagementSystem {
     const { type, meta } = args
 
     const signatureAlgorithm = this.mapKeyTypeToSignatureAlgorithm(type)
-    const options  = {
+    const options = {
       use: meta && 'keyUsage' in meta ? this.mapKeyUsage(meta.keyUsage) : JwkUse.Sig,
       alg: signatureAlgorithm,
-      keyOperations: meta ? this.mapKeyOperations(meta.keyOperations as string[]) : [KeyOperations.Sign]
+      keyOperations: meta ? this.mapKeyOperations(meta.keyOperations as string[]) : [KeyOperations.Sign],
     }
 
-    const key = await this.client.methods.kmsClientGenerateKey(options)
+    const key = this.providerId
+      ? await this.client.methods.kmsClientProviderGenerateKey({
+          ...options,
+          providerId: this.providerId,
+        })
+      : await this.client.methods.kmsClientGenerateKey(options)
 
     const jwk = {
       ...key.keyPair.jose.publicJwk,
@@ -91,7 +80,7 @@ export class RestKeyManagementSystem extends AbstractKeyManagementSystem {
       kms: this.id,
       type,
       meta: {
-        alias: key.keyPair.kid,
+        alias: key.keyPair.alias,
         algorithms: [key.keyPair.jose.publicJwk.alg ?? 'PS256'],
         jwkThumbprint: calculateJwkThumbprint({
           jwk,
@@ -107,14 +96,19 @@ export class RestKeyManagementSystem extends AbstractKeyManagementSystem {
     const signatureAlgorithm = this.mapKeyTypeToSignatureAlgorithm(type)
     const importKey = this.mapImportKey(args)
 
-    const result = await this.client.methods.kmsClientStoreKey(importKey.key)
+    const result = this.providerId
+      ? await this.client.methods.kmsClientProviderStoreKey({
+          ...importKey.key,
+          providerId: this.providerId,
+        })
+      : await this.client.methods.kmsClientStoreKey(importKey.key)
 
     return {
       kid: importKey.kid,
       kms: this.id,
       type,
       meta: {
-        alias: importKey.kid,
+        alias: importKey.key.keyInfo.alias,
         algorithms: [result.keyInfo.key.alg ?? 'PS256'],
         jwkThumbprint: calculateJwkThumbprint({
           jwk: importKey.publicKeyJwk,
@@ -128,21 +122,89 @@ export class RestKeyManagementSystem extends AbstractKeyManagementSystem {
   async deleteKey(args: DeleteKeyArgs): Promise<boolean> {
     const { kid } = args
 
-    return await this.client.methods.kmsClientDeleteKey({ aliasOrKid: kid })
+    return this.providerId
+      ? await this.client.methods.kmsClientProviderDeleteKey({
+          aliasOrKid: kid,
+          providerId: this.providerId,
+        })
+      : await this.client.methods.kmsClientDeleteKey({ aliasOrKid: kid })
   }
 
   async listKeys(): Promise<ManagedKeyInfo[]> {
-    const keys = await this.client.methods.kmsClientListKeys()
+    const keys = this.providerId
+      ? await this.client.methods.kmsClientProviderListKeys({ providerId: this.providerId })
+      : await this.client.methods.kmsClientListKeys()
+
+    const restKeys = ListKeysResponseToJSONTyped(keys, false).keyInfos
+
+    return restKeys.map((restKey: RestManagedKeyInfo) => {
+      const jwk = restKey.key
+      let publicKeyHex = ''
+
+      // Derive publicKeyHex from JWK based on key type
+      if (jwk.kty === 'EC') {
+        publicKeyHex = jwk.x || ''
+      } else if (jwk.kty === 'RSA') {
+        publicKeyHex = jwk.n || ''
+      } else if (jwk.kty === 'OKP') {
+        publicKeyHex = jwk.x || ''
+      }
 
-    return ListKeysResponseToJSONTyped(keys, false).keyInfos //ListKeysResponseFromJSONTyped
+      const keyType = this.mapRestKeyTypeToTKeyType(restKey.keyType)
+
+      return {
+        kid: restKey.kid || restKey.alias,
+        kms: this.id,
+        type: keyType,
+        publicKeyHex,
+        meta: {
+          algorithms: restKey.signatureAlgorithm ? [restKey.signatureAlgorithm] : undefined,
+          jwk,
+          jwkThumbprint: calculateJwkThumbprint({
+            jwk: jwk as JWK,
+            digestAlgorithm: restKey.signatureAlgorithm ? this.signatureAlgorithmToDigestAlgorithm(restKey.signatureAlgorithm) : 'sha256',
+          }),
+          alias: restKey.alias,
+          providerId: restKey.providerId,
+          x5c: restKey.x5c,
+          keyVisibility: restKey.keyVisibility,
+          keyEncoding: restKey.keyEncoding,
+          ...restKey.opts,
+        },
+      } satisfies ManagedKeyInfo
+    })
+  }
+
+  private mapRestKeyTypeToTKeyType(keyType: string | undefined): TKeyType {
+    switch (keyType) {
+      case 'RSA':
+        return 'RSA'
+      case 'EC':
+      case 'P256':
+        return 'Secp256r1'
+      case 'X25519':
+        return 'X25519'
+      case 'Ed25519':
+        return 'Ed25519'
+      case 'secp256k1':
+        return 'Secp256k1'
+      default:
+        throw new Error(`Unknown key type: ${keyType}`)
+    }
   }
 
   async sign(args: SignArgs): Promise<string> {
     const { keyRef, data } = args
-    const key = await this.client.methods.kmsClientGetKey({ aliasOrKid: keyRef.kid })
+    const key = this.providerId
+      ? await this.client.methods.kmsClientProviderGetKey({
+          aliasOrKid: keyRef.kid,
+          providerId: this.providerId,
+        })
+      : await this.client.methods.kmsClientGetKey({ aliasOrKid: keyRef.kid })
+
     const signingResult = await this.client.methods.kmsClientCreateRawSignature({
       keyInfo: key.keyInfo,
-      input: toString(data, 'base64')
+      input: toString(data, 'base64'),
     })
 
     return signingResult.signature
@@ -150,11 +212,17 @@ export class RestKeyManagementSystem extends AbstractKeyManagementSystem {
 
   async verify(args: VerifyArgs): Promise<boolean> {
     const { keyRef, data, signature } = args
-    const key = await this.client.methods.kmsClientGetKey({ aliasOrKid: keyRef.kid })
+    const key = this.providerId
+      ? await this.client.methods.kmsClientProviderGetKey({
+          aliasOrKid: keyRef.kid,
+          providerId: this.providerId,
+        })
+      : await this.client.methods.kmsClientGetKey({ aliasOrKid: keyRef.kid })
+
     const verification = await this.client.methods.kmsClientIsValidRawSignature({
       keyInfo: key.keyInfo,
       input: toString(data, 'base64'),
-      signature
+      signature,
     })
 
     return verification.isValid
@@ -207,21 +275,36 @@ export class RestKeyManagementSystem extends AbstractKeyManagementSystem {
 
   private mapJoseAlgorithm = (alg: string): JoseSignatureAlgorithm => {
     switch (alg) {
-      case 'RS256': return JoseSignatureAlgorithm.RS256;
-      case 'RS384': return JoseSignatureAlgorithm.RS384;
-      case 'RS512': return JoseSignatureAlgorithm.RS512;
-      case 'ES256': return JoseSignatureAlgorithm.ES256;
-      case 'ES256K': return JoseSignatureAlgorithm.ES256K;
-      case 'ES384': return JoseSignatureAlgorithm.ES384;
-      case 'ES512': return JoseSignatureAlgorithm.ES512;
-      case 'EdDSA': return JoseSignatureAlgorithm.EdDSA;
-      case 'HS256': return JoseSignatureAlgorithm.HS256;
-      case 'HS384': return JoseSignatureAlgorithm.HS384;
-      case 'HS512': return JoseSignatureAlgorithm.HS512;
-      case 'PS256': return JoseSignatureAlgorithm.PS256;
-      case 'PS384': return JoseSignatureAlgorithm.PS384;
-      case 'PS512': return JoseSignatureAlgorithm.PS512;
-      case 'none':  return JoseSignatureAlgorithm.none;
+      case 'RS256':
+        return JoseSignatureAlgorithm.RS256
+      case 'RS384':
+        return JoseSignatureAlgorithm.RS384
+      case 'RS512':
+        return JoseSignatureAlgorithm.RS512
+      case 'ES256':
+        return JoseSignatureAlgorithm.ES256
+      case 'ES256K':
+        return JoseSignatureAlgorithm.ES256K
+      case 'ES384':
+        return JoseSignatureAlgorithm.ES384
+      case 'ES512':
+        return JoseSignatureAlgorithm.ES512
+      case 'EdDSA':
+        return JoseSignatureAlgorithm.EdDSA
+      case 'HS256':
+        return JoseSignatureAlgorithm.HS256
+      case 'HS384':
+        return JoseSignatureAlgorithm.HS384
+      case 'HS512':
+        return JoseSignatureAlgorithm.HS512
+      case 'PS256':
+        return JoseSignatureAlgorithm.PS256
+      case 'PS384':
+        return JoseSignatureAlgorithm.PS384
+      case 'PS512':
+        return JoseSignatureAlgorithm.PS512
+      case 'none':
+        return JoseSignatureAlgorithm.none
       default:
         throw new Error(`Signature algorithm ${alg} is not supported by REST KMS`)
     }
@@ -256,10 +339,7 @@ export class RestKeyManagementSystem extends AbstractKeyManagementSystem {
 
   private mapImportRsaKey = (args: MapImportKeyArgs): MappedImportKey => {
     const x509 = args.meta?.x509 as X509Opts
-    const privateKeyPEM = x509?.privateKeyPEM ?? (args.privateKeyHex.includes('---')
-      ? args.privateKeyHex
-      : hexToPEM(args.privateKeyHex, 'private')
-    ) // In case we have x509 opts, the private key hex really was a PEM already (yuck)
+    const privateKeyPEM = x509?.privateKeyPEM ?? (args.privateKeyHex.includes('---') ? args.privateKeyHex : hexToPEM(args.privateKeyHex, 'private')) // In case we have x509 opts, the private key hex really was a PEM already (yuck)
     const publicKeyJwk = PEMToJwk(privateKeyPEM, 'public')
     const privateKeyJwk = PEMToJwk(privateKeyPEM)
     const publicKeyPEM = jwkToPEM(publicKeyJwk, 'public')
@@ -307,8 +387,8 @@ export class RestKeyManagementSystem extends AbstractKeyManagementSystem {
             crv: CurveFromJSONTyped(privateKeyJwk.crv, false),
           },
         },
-        certChain: meta.x509.x5c
-      } satisfies StoreKey
+        certChain: meta.x509.x5c,
+      } satisfies StoreKey,
     }
   }
 
@@ -333,9 +413,9 @@ export class RestKeyManagementSystem extends AbstractKeyManagementSystem {
             kty: JwkKeyTypeFromJSONTyped(privateKeyJwk.kty, false),
             use: JwkUseFromJSONTyped(privateKeyJwk.use, false),
             crv: CurveFromJSONTyped(privateKeyJwk.crv, false),
-          }
-        }
-      } satisfies StoreKey
+          },
+        },
+      } satisfies StoreKey,
     }
   }
 
@@ -357,9 +437,9 @@ export class RestKeyManagementSystem extends AbstractKeyManagementSystem {
             kty: JwkKeyTypeFromJSONTyped(privateKeyJwk.kty, false),
             use: JwkUseFromJSONTyped(privateKeyJwk.use, false),
             crv: CurveFromJSONTyped(privateKeyJwk.crv, false),
-          }
-        }
-      } satisfies StoreKey
+          },
+        },
+      } satisfies StoreKey,
     }
   }
 
@@ -378,5 +458,4 @@ export class RestKeyManagementSystem extends AbstractKeyManagementSystem {
         throw new Error(`Key type ${args.type} is not supported by REST KMS`)
     }
   }
-
 }