@sphereon/ssi-sdk.kms-rest 0.34.1-feature.SSISDK.82.and.SSISDK.70.346 → 0.34.1-feature.SSISDK.82.and.SSISDK.70.352

package/dist/index.cjs

@@ -107,7 +107,7 @@ var RestKeyManagementSystem = class extends import_key_manager.AbstractKeyManage
         ],
         jwkThumbprint: (0, import_ssi_sdk_ext.calculateJwkThumbprint)({
           jwk,
-          digestAlgorithm: this.signatureAlgorithmToDigestAlgorithm(signatureAlgorithm)
+          digestAlgorithm: jwk.alg ? (0, import_ssi_sdk_ext.joseAlgorithmToDigest)(jwk.alg) : "sha256"
         })
       },
       publicKeyHex: Buffer.from(key.keyPair.jose.publicJwk.toString(), "utf8").toString("base64")
@@ -115,7 +115,6 @@ var RestKeyManagementSystem = class extends import_key_manager.AbstractKeyManage
   }
   async importKey(args) {
     const { type } = args;
-    const signatureAlgorithm = this.mapKeyTypeToSignatureAlgorithm(type);
     const importKey = this.mapImportKey(args);
     const result = this.providerId ? await this.client.methods.kmsClientProviderStoreKey({
       ...importKey.key,
@@ -146,7 +145,7 @@ var RestKeyManagementSystem = class extends import_key_manager.AbstractKeyManage
         ],
         jwkThumbprint: (0, import_ssi_sdk_ext.calculateJwkThumbprint)({
           jwk: importKey.publicKeyJwk,
-          digestAlgorithm: this.signatureAlgorithmToDigestAlgorithm(signatureAlgorithm)
+          digestAlgorithm: importKey.publicKeyJwk.alg ? (0, import_ssi_sdk_ext.joseAlgorithmToDigest)(importKey.publicKeyJwk.alg) : "sha256"
         })
       },
       publicKeyHex: Buffer.from(result.keyInfo.key.toString(), "utf8").toString("base64")
@@ -191,16 +190,9 @@ var RestKeyManagementSystem = class extends import_key_manager.AbstractKeyManage
       }
     });
     const restKeys = (0, import_ssi_sdk.ListKeysResponseToJSONTyped)(keys, false).keyInfos;
-    return restKeys.map((restKey) => {
+    return Promise.all(restKeys.map(async (restKey) => {
       const jwk = restKey.key;
-      let publicKeyHex = "";
-      if (jwk.kty === "EC") {
-        publicKeyHex = jwk.x || "";
-      } else if (jwk.kty === "RSA") {
-        publicKeyHex = jwk.n || "";
-      } else if (jwk.kty === "OKP") {
-        publicKeyHex = jwk.x || "";
-      }
+      const publicKeyHex = await (0, import_ssi_sdk_ext.jwkToRawHexKey)(jwk);
       const keyType = this.mapRestKeyTypeToTKeyType(restKey.keyType);
       return {
         kid: restKey.kid || restKey.alias,
@@ -214,7 +206,7 @@ var RestKeyManagementSystem = class extends import_key_manager.AbstractKeyManage
           jwk,
           jwkThumbprint: (0, import_ssi_sdk_ext.calculateJwkThumbprint)({
             jwk,
-            digestAlgorithm: restKey.signatureAlgorithm ? this.signatureAlgorithmToDigestAlgorithm(restKey.signatureAlgorithm) : "sha256"
+            digestAlgorithm: restKey.key.alg ? (0, import_ssi_sdk_ext.joseAlgorithmToDigest)(restKey.key.alg) : "sha256"
           }),
           alias: restKey.alias,
           providerId: restKey.providerId,
@@ -224,7 +216,7 @@ var RestKeyManagementSystem = class extends import_key_manager.AbstractKeyManage
           ...restKey.opts
         }
       };
-    });
+    }));
   }
   mapRestKeyTypeToTKeyType(keyType) {
     switch (keyType) {
@@ -244,7 +236,7 @@ var RestKeyManagementSystem = class extends import_key_manager.AbstractKeyManage
     }
   }
   async sign(args) {
-    const { keyRef, data } = args;
+    const { keyRef, data, algorithm = "SHA-256" } = args;
     const key = this.providerId ? await this.client.methods.kmsClientProviderGetKey({
       aliasOrKid: keyRef.kid,
       providerId: this.providerId,
@@ -263,9 +255,10 @@ var RestKeyManagementSystem = class extends import_key_manager.AbstractKeyManage
         userId: this.userId
       }
     });
+    const dataToBeSigned = (0, import_ssi_sdk_ext.isHashString)(data) ? data : (0, import_ssi_sdk_ext.shaHasher)(data.buffer.slice(data.byteOffset, data.byteOffset + data.byteLength), algorithm);
     const signingResult = await this.client.methods.kmsClientCreateRawSignature({
       keyInfo: key.keyInfo,
-      input: toString(data, "base64"),
+      input: toString(dataToBeSigned, "base64"),
       ...this.tenantId && {
         tenantId: this.tenantId
       },
@@ -273,10 +266,10 @@ var RestKeyManagementSystem = class extends import_key_manager.AbstractKeyManage
         userId: this.userId
       }
     });
-    return signingResult.signature;
+    return (0, import_ssi_sdk_ext.base64ToBase64Url)(signingResult.signature);
   }
   async verify(args) {
-    const { keyRef, data, signature } = args;
+    const { keyRef, data, signature, algorithm = "SHA-256" } = args;
     const key = this.providerId ? await this.client.methods.kmsClientProviderGetKey({
       aliasOrKid: keyRef.kid,
       providerId: this.providerId,
@@ -295,9 +288,10 @@ var RestKeyManagementSystem = class extends import_key_manager.AbstractKeyManage
         userId: this.userId
       }
     });
+    const dataToBeVerified = (0, import_ssi_sdk_ext.isHashString)(data) ? data : (0, import_ssi_sdk_ext.shaHasher)(data.buffer.slice(data.byteOffset, data.byteOffset + data.byteLength), algorithm);
     const verification = await this.client.methods.kmsClientIsValidRawSignature({
       keyInfo: key.keyInfo,
-      input: toString(data, "base64"),
+      input: toString(dataToBeVerified, "base64"),
       signature,
       ...this.tenantId && {
         tenantId: this.tenantId
@@ -311,22 +305,6 @@ var RestKeyManagementSystem = class extends import_key_manager.AbstractKeyManage
   async sharedSecret(args) {
     throw new Error("sharedSecret is not implemented for REST KMS.");
   }
-  signatureAlgorithmToDigestAlgorithm = /* @__PURE__ */ __name((signatureAlgorithm) => {
-    switch (signatureAlgorithm) {
-      case import_ssi_sdk.SignatureAlgorithm.EcdsaSha256:
-      case import_ssi_sdk.SignatureAlgorithm.RsaSsaPssSha256Mgf1:
-      case import_ssi_sdk.SignatureAlgorithm.EckaDhSha256:
-      case import_ssi_sdk.SignatureAlgorithm.HmacSha256:
-      case import_ssi_sdk.SignatureAlgorithm.Es256K:
-        return "sha256";
-      case import_ssi_sdk.SignatureAlgorithm.EcdsaSha512:
-      case import_ssi_sdk.SignatureAlgorithm.HmacSha512:
-      case import_ssi_sdk.SignatureAlgorithm.RsaSsaPssSha512Mgf1:
-        return "sha512";
-      default:
-        throw new Error(`Signature algorithm ${signatureAlgorithm} is not supported by REST KMS`);
-    }
-  }, "signatureAlgorithmToDigestAlgorithm");
   mapKeyUsage = /* @__PURE__ */ __name((usage) => {
     switch (usage) {
       case "sig":

package/dist/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts","../src/RestKeyManagementSystem.ts"],"sourcesContent":["export { RestKeyManagementSystem } from './RestKeyManagementSystem'\nexport * from './types'\n","import { calculateJwkThumbprint, toJwk, x25519PublicHexFromPrivateHex, type X509Opts } from '@sphereon/ssi-sdk-ext.key-utils'\nimport { hexToPEM, jwkToPEM, pemCertChainTox5c, PEMToHex, PEMToJwk } from '@sphereon/ssi-sdk-ext.x509-utils'\nimport type { ManagedKeyInfo as RestManagedKeyInfo } from '@sphereon/ssi-sdk.kms-rest-client'\nimport {\n  CurveFromJSONTyped,\n  JwkKeyTypeFromJSONTyped,\n  JwkUse,\n  JwkUseFromJSONTyped,\n  KeyOperations,\n  KmsRestClient,\n  ListKeysResponseToJSONTyped,\n  type RestClientAuthenticationOpts,\n  SignatureAlgorithm,\n  type StoreKey,\n} from '@sphereon/ssi-sdk.kms-rest-client'\nimport { JoseSignatureAlgorithm, type JWK } from '@sphereon/ssi-types'\nimport type { ManagedKeyInfo, TKeyType } from '@veramo/core'\nimport { AbstractKeyManagementSystem } from '@veramo/key-manager'\nimport elliptic from 'elliptic'\n// @ts-ignore\nimport * as u8a from 'uint8arrays'\nimport type { CreateKeyArgs, DeleteKeyArgs, ImportKeyArgs, MapImportKeyArgs, MappedImportKey, SharedSecretArgs, SignArgs, VerifyArgs } from './types'\n\nconst { fromString, toString } = u8a\n\ninterface KeyManagementSystemOptions {\n  applicationId: string\n  baseUrl: string\n  providerId?: string\n  tenantId?: string\n  userId?: string\n  authOpts?: RestClientAuthenticationOpts\n}\n\nexport class RestKeyManagementSystem extends AbstractKeyManagementSystem {\n  private client: KmsRestClient\n  private readonly id: string\n  private providerId: string | undefined\n  private tenantId: string | undefined\n  private userId: string | undefined\n\n  constructor(options: KeyManagementSystemOptions) {\n    super()\n\n    const config = {\n      baseUrl: options.baseUrl,\n      authOpts: options.authOpts,\n    }\n\n    this.id = options.applicationId\n    this.providerId = options.providerId\n    this.tenantId = options.tenantId\n    this.userId = options.userId\n    this.client = new KmsRestClient(config)\n  }\n\n  async createKey(args: CreateKeyArgs): Promise<ManagedKeyInfo> {\n    const { type, meta } = args\n\n    const signatureAlgorithm = this.mapKeyTypeToSignatureAlgorithm(type)\n    const options = {\n      use: meta && 'keyUsage' in meta ? this.mapKeyUsage(meta.keyUsage) : JwkUse.Sig,\n      alg: signatureAlgorithm,\n      keyOperations: meta && meta.keyOperations ? this.mapKeyOperations(meta.keyOperations as string[]) : [KeyOperations.Sign],\n      ...(meta && 'keyAlias' in meta && meta.keyAlias ? { alias: meta.keyAlias } : {}),\n      ...(this.tenantId && { tenantId: this.tenantId }),\n      ...(this.userId && { userId: this.userId }),\n    }\n\n    const key = this.providerId\n      ? await this.client.methods.kmsClientProviderGenerateKey({\n          ...options,\n          providerId: this.providerId,\n        })\n      : await this.client.methods.kmsClientGenerateKey(options)\n\n    const jwk = {\n      ...key.keyPair.jose.publicJwk,\n      alg: key.keyPair.jose.publicJwk.alg ? this.mapJoseAlgorithm(key.keyPair.jose.publicJwk.alg) : undefined,\n    } satisfies JWK\n\n    const kid = key.keyPair.kid ?? key.keyPair.jose.publicJwk.kid\n    if (!kid) {\n      throw new Error(`No kid present in key`)\n    }\n\n    return {\n      kid,\n      kms: this.id,\n      type,\n      meta: {\n        alias: key.keyPair.alias,\n        algorithms: [key.keyPair.jose.publicJwk.alg ?? 'PS256'],\n        jwkThumbprint: calculateJwkThumbprint({\n          jwk,\n          digestAlgorithm: this.signatureAlgorithmToDigestAlgorithm(signatureAlgorithm),\n        }),\n      },\n      publicKeyHex: Buffer.from(key.keyPair.jose.publicJwk.toString(), 'utf8').toString('base64'),\n    }\n  }\n\n  async importKey(args: ImportKeyArgs): Promise<ManagedKeyInfo> {\n    const { type } = args\n    const signatureAlgorithm = this.mapKeyTypeToSignatureAlgorithm(type)\n    const importKey = this.mapImportKey(args)\n\n    const result = this.providerId\n      ? await this.client.methods.kmsClientProviderStoreKey({\n          ...importKey.key,\n          providerId: this.providerId,\n          ...(this.tenantId && { tenantId: this.tenantId }),\n          ...(this.userId && { userId: this.userId }),\n        })\n      : await this.client.methods.kmsClientStoreKey({\n          ...importKey.key,\n          ...(this.tenantId && { tenantId: this.tenantId }),\n          ...(this.userId && { userId: this.userId }),\n        })\n\n    return {\n      kid: importKey.kid,\n      kms: this.id,\n      type,\n      meta: {\n        alias: importKey.key.keyInfo.alias,\n        algorithms: [result.keyInfo.key.alg ?? 'PS256'],\n        jwkThumbprint: calculateJwkThumbprint({\n          jwk: importKey.publicKeyJwk,\n          digestAlgorithm: this.signatureAlgorithmToDigestAlgorithm(signatureAlgorithm),\n        }),\n      },\n      publicKeyHex: Buffer.from(result.keyInfo.key.toString(), 'utf8').toString('base64'),\n    }\n  }\n\n  async deleteKey(args: DeleteKeyArgs): Promise<boolean> {\n    const { kid } = args\n\n    return this.providerId\n      ? await this.client.methods.kmsClientProviderDeleteKey({\n          aliasOrKid: kid,\n          providerId: this.providerId,\n          ...(this.tenantId && { tenantId: this.tenantId }),\n          ...(this.userId && { userId: this.userId }),\n        })\n      : await this.client.methods.kmsClientDeleteKey({\n          aliasOrKid: kid,\n          ...(this.tenantId && { tenantId: this.tenantId }),\n          ...(this.userId && { userId: this.userId }),\n        })\n  }\n\n  async listKeys(): Promise<ManagedKeyInfo[]> {\n    const keys = this.providerId\n      ? await this.client.methods.kmsClientProviderListKeys({\n          providerId: this.providerId,\n          ...(this.tenantId && { tenantId: this.tenantId }),\n          ...(this.userId && { userId: this.userId }),\n        })\n      : await this.client.methods.kmsClientListKeys({\n          ...(this.tenantId && { tenantId: this.tenantId }),\n          ...(this.userId && { userId: this.userId }),\n        })\n\n    const restKeys = ListKeysResponseToJSONTyped(keys, false).keyInfos\n\n    return restKeys.map((restKey: RestManagedKeyInfo) => {\n      const jwk = restKey.key\n      let publicKeyHex = ''\n\n      // Derive publicKeyHex from JWK based on key type\n      if (jwk.kty === 'EC') {\n        publicKeyHex = jwk.x || ''\n      } else if (jwk.kty === 'RSA') {\n        publicKeyHex = jwk.n || ''\n      } else if (jwk.kty === 'OKP') {\n        publicKeyHex = jwk.x || ''\n      }\n\n      const keyType = this.mapRestKeyTypeToTKeyType(restKey.keyType)\n\n      return {\n        kid: restKey.kid || restKey.alias,\n        kms: this.id,\n        type: keyType,\n        publicKeyHex,\n        meta: {\n          algorithms: restKey.signatureAlgorithm ? [restKey.signatureAlgorithm] : undefined,\n          jwk,\n          jwkThumbprint: calculateJwkThumbprint({\n            jwk: jwk as JWK,\n            digestAlgorithm: restKey.signatureAlgorithm ? this.signatureAlgorithmToDigestAlgorithm(restKey.signatureAlgorithm) : 'sha256',\n          }),\n          alias: restKey.alias,\n          providerId: restKey.providerId,\n          x5c: restKey.x5c,\n          keyVisibility: restKey.keyVisibility,\n          keyEncoding: restKey.keyEncoding,\n          ...restKey.opts,\n        },\n      } satisfies ManagedKeyInfo\n    })\n  }\n\n  private mapRestKeyTypeToTKeyType(keyType: string | undefined): TKeyType {\n    switch (keyType) {\n      case 'RSA':\n        return 'RSA'\n      case 'EC':\n      case 'P256':\n        return 'Secp256r1'\n      case 'X25519':\n        return 'X25519'\n      case 'Ed25519':\n        return 'Ed25519'\n      case 'secp256k1':\n        return 'Secp256k1'\n      default:\n        throw new Error(`Unknown key type: ${keyType}`)\n    }\n  }\n\n  async sign(args: SignArgs): Promise<string> {\n    const { keyRef, data } = args\n    const key = this.providerId\n      ? await this.client.methods.kmsClientProviderGetKey({\n          aliasOrKid: keyRef.kid,\n          providerId: this.providerId,\n          ...(this.tenantId && { tenantId: this.tenantId }),\n          ...(this.userId && { userId: this.userId }),\n        })\n      : await this.client.methods.kmsClientGetKey({\n          aliasOrKid: keyRef.kid,\n          ...(this.tenantId && { tenantId: this.tenantId }),\n          ...(this.userId && { userId: this.userId }),\n        })\n\n    const signingResult = await this.client.methods.kmsClientCreateRawSignature({\n      keyInfo: key.keyInfo,\n      input: toString(data, 'base64'),\n      ...(this.tenantId && { tenantId: this.tenantId }),\n      ...(this.userId && { userId: this.userId }),\n    })\n\n    return signingResult.signature\n  }\n\n  async verify(args: VerifyArgs): Promise<boolean> {\n    const { keyRef, data, signature } = args\n    const key = this.providerId\n      ? await this.client.methods.kmsClientProviderGetKey({\n          aliasOrKid: keyRef.kid,\n          providerId: this.providerId,\n          ...(this.tenantId && { tenantId: this.tenantId }),\n          ...(this.userId && { userId: this.userId }),\n        })\n      : await this.client.methods.kmsClientGetKey({\n          aliasOrKid: keyRef.kid,\n          ...(this.tenantId && { tenantId: this.tenantId }),\n          ...(this.userId && { userId: this.userId }),\n        })\n\n    const verification = await this.client.methods.kmsClientIsValidRawSignature({\n      keyInfo: key.keyInfo,\n      input: toString(data, 'base64'),\n      signature,\n      ...(this.tenantId && { tenantId: this.tenantId }),\n      ...(this.userId && { userId: this.userId }),\n    })\n\n    return verification.isValid\n  }\n\n  async sharedSecret(args: SharedSecretArgs): Promise<string> {\n    throw new Error('sharedSecret is not implemented for REST KMS.')\n  }\n\n  private signatureAlgorithmToDigestAlgorithm = (signatureAlgorithm: SignatureAlgorithm): 'sha256' | 'sha512' => {\n    switch (signatureAlgorithm) {\n      case SignatureAlgorithm.EcdsaSha256:\n      case SignatureAlgorithm.RsaSsaPssSha256Mgf1:\n      case SignatureAlgorithm.EckaDhSha256:\n      case SignatureAlgorithm.HmacSha256:\n      case SignatureAlgorithm.Es256K:\n        return 'sha256'\n      case SignatureAlgorithm.EcdsaSha512:\n      case SignatureAlgorithm.HmacSha512:\n      case SignatureAlgorithm.RsaSsaPssSha512Mgf1:\n        return 'sha512'\n      default:\n        throw new Error(`Signature algorithm ${signatureAlgorithm} is not supported by REST KMS`)\n    }\n  }\n\n  private mapKeyUsage = (usage: string): JwkUse => {\n    switch (usage) {\n      case 'sig':\n        return JwkUse.Sig\n      case 'enc':\n        return JwkUse.Enc\n      default:\n        throw new Error(`Key usage ${usage} is not supported by REST KMS`)\n    }\n  }\n\n  private mapKeyTypeToSignatureAlgorithm = (type: TKeyType): SignatureAlgorithm => {\n    switch (type) {\n      case 'Secp256r1':\n        return SignatureAlgorithm.EcdsaSha256\n      case 'RSA':\n        return SignatureAlgorithm.RsaSsaPssSha256Mgf1\n      case 'X25519':\n        return SignatureAlgorithm.EckaDhSha256\n      default:\n        throw new Error(`Key type ${type} is not supported by REST KMS`)\n    }\n  }\n\n  private mapJoseAlgorithm = (alg: string): JoseSignatureAlgorithm => {\n    switch (alg) {\n      case 'RS256':\n        return JoseSignatureAlgorithm.RS256\n      case 'RS384':\n        return JoseSignatureAlgorithm.RS384\n      case 'RS512':\n        return JoseSignatureAlgorithm.RS512\n      case 'ES256':\n        return JoseSignatureAlgorithm.ES256\n      case 'ES256K':\n        return JoseSignatureAlgorithm.ES256K\n      case 'ES384':\n        return JoseSignatureAlgorithm.ES384\n      case 'ES512':\n        return JoseSignatureAlgorithm.ES512\n      case 'EdDSA':\n        return JoseSignatureAlgorithm.EdDSA\n      case 'HS256':\n        return JoseSignatureAlgorithm.HS256\n      case 'HS384':\n        return JoseSignatureAlgorithm.HS384\n      case 'HS512':\n        return JoseSignatureAlgorithm.HS512\n      case 'PS256':\n        return JoseSignatureAlgorithm.PS256\n      case 'PS384':\n        return JoseSignatureAlgorithm.PS384\n      case 'PS512':\n        return JoseSignatureAlgorithm.PS512\n      case 'none':\n        return JoseSignatureAlgorithm.none\n      default:\n        throw new Error(`Signature algorithm ${alg} is not supported by REST KMS`)\n    }\n  }\n\n  private mapKeyOperation = (operation: string): KeyOperations => {\n    switch (operation) {\n      case 'sign':\n        return KeyOperations.Sign\n      case 'verify':\n        return KeyOperations.Verify\n      case 'wrapKey':\n        return KeyOperations.WrapKey\n      case 'deriveKey':\n        return KeyOperations.DeriveKey\n      case 'unwrapKey':\n        return KeyOperations.UnwrapKey\n      case 'decrypt':\n        return KeyOperations.Decrypt\n      case 'deriveBits':\n        return KeyOperations.DeriveBits\n      case 'encrypt':\n        return KeyOperations.Encrypt\n      default:\n        throw new Error(`Key operation ${operation} is not supported by REST KMS`)\n    }\n  }\n\n  private mapKeyOperations = (operations: string[]): KeyOperations[] => {\n    return operations.map((operation) => this.mapKeyOperation(operation))\n  }\n\n  private mapImportRsaKey = (args: MapImportKeyArgs): MappedImportKey => {\n    const x509 = args.meta?.x509 as X509Opts\n    const privateKeyPEM = x509?.privateKeyPEM ?? (args.privateKeyHex.includes('---') ? args.privateKeyHex : hexToPEM(args.privateKeyHex, 'private')) // In case we have x509 opts, the private key hex really was a PEM already (yuck)\n    const publicKeyJwk = PEMToJwk(privateKeyPEM, 'public')\n    const privateKeyJwk = PEMToJwk(privateKeyPEM)\n    const publicKeyPEM = jwkToPEM(publicKeyJwk, 'public')\n    const publicKeyHex = PEMToHex(publicKeyPEM)\n\n    const meta = {} as any\n    if (x509) {\n      meta.x509 = {\n        cn: x509.cn ?? args.kid ?? publicKeyHex,\n      }\n      let certChain: string = x509.certificateChainPEM ?? ''\n      if (x509.certificatePEM) {\n        if (!certChain.includes(x509.certificatePEM)) {\n          certChain = `${x509.certificatePEM}\\n${certChain}`\n        }\n      }\n      if (certChain.length > 0) {\n        meta.x509.certificateChainPEM = certChain\n        const x5c = pemCertChainTox5c(certChain)\n        if (!x509.certificateChainURL) {\n          // Do not put the chain in the JWK when the chain is hosted. We do put it in the x509 metadata\n          // @ts-ignore\n          publicKeyJwk.x5c = x5c\n        }\n        meta.x509.x5c = x5c\n      }\n      if (x509.certificateChainURL) {\n        // @ts-ignore\n        publicKeyJwk.x5u = x509.certificateChainURL\n        meta.x509.x5u = x509.certificateChainURL\n      }\n    }\n\n    const kid = args.kid ?? meta?.x509?.cn ?? publicKeyHex\n    return {\n      kid,\n      publicKeyJwk: publicKeyJwk as JWK,\n      key: {\n        keyInfo: {\n          key: {\n            ...privateKeyJwk,\n            kid,\n            kty: JwkKeyTypeFromJSONTyped(privateKeyJwk.kty, false),\n            use: JwkUseFromJSONTyped(privateKeyJwk.use, false),\n            crv: CurveFromJSONTyped(privateKeyJwk.crv, false),\n          },\n        },\n        certChain: meta.x509.x5c,\n      } satisfies StoreKey,\n    }\n  }\n\n  private mapImportSecp256r1Key = (args: MapImportKeyArgs): MappedImportKey => {\n    const { privateKeyHex } = args\n    const privateBytes = fromString(privateKeyHex.toLowerCase(), 'base16')\n    const secp256r1 = new elliptic.ec('p256')\n    const keyPair = secp256r1.keyFromPrivate(privateBytes, 'hex')\n    const publicKeyHex = keyPair.getPublic(true, 'hex')\n    const publicKeyJwk = toJwk(publicKeyHex, 'Secp256r1')\n    const privateKeyJwk = toJwk(privateKeyHex, 'Secp256r1', { isPrivateKey: true })\n    const kid = args.kid ?? publicKeyJwk.kid ?? publicKeyHex\n\n    return {\n      kid,\n      publicKeyJwk: publicKeyJwk as JWK,\n      key: {\n        keyInfo: {\n          key: {\n            ...privateKeyJwk,\n            kid,\n            kty: JwkKeyTypeFromJSONTyped(privateKeyJwk.kty, false),\n            use: JwkUseFromJSONTyped(privateKeyJwk.use, false),\n            crv: CurveFromJSONTyped(privateKeyJwk.crv, false),\n          },\n        },\n      } satisfies StoreKey,\n    }\n  }\n\n  private mapImportX25519Key = (args: MapImportKeyArgs): MappedImportKey => {\n    const { privateKeyHex } = args\n    const privateKeyJwk = toJwk(privateKeyHex, 'X25519', { isPrivateKey: true })\n    const publicKeyHex = x25519PublicHexFromPrivateHex(privateKeyHex)\n    const publicKeyJwk = toJwk(publicKeyHex, 'X25519')\n    const kid = args.kid ?? publicKeyJwk.kid ?? publicKeyHex\n\n    return {\n      kid,\n      publicKeyJwk: publicKeyJwk as JWK,\n      key: {\n        keyInfo: {\n          key: {\n            ...privateKeyJwk,\n            kid,\n            kty: JwkKeyTypeFromJSONTyped(privateKeyJwk.kty, false),\n            use: JwkUseFromJSONTyped(privateKeyJwk.use, false),\n            crv: CurveFromJSONTyped(privateKeyJwk.crv, false),\n          },\n        },\n      } satisfies StoreKey,\n    }\n  }\n\n  private mapImportKey = (args: MapImportKeyArgs): MappedImportKey => {\n    switch (args.type) {\n      case 'RSA': {\n        return this.mapImportRsaKey(args)\n      }\n      case 'Secp256r1': {\n        return this.mapImportSecp256r1Key(args)\n      }\n      case 'X25519': {\n        return this.mapImportX25519Key(args)\n      }\n      default:\n        throw new Error(`Key type ${args.type} is not supported by REST KMS`)\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;;;;;;;ACAA,yBAA4F;AAC5F,IAAAA,sBAA0E;AAE1E,qBAWO;AACP,uBAAiD;AAEjD,yBAA4C;AAC5C,sBAAqB;AAErB,UAAqB;AAGrB,IAAM,EAAEC,YAAYC,SAAQ,IAAKC;AAW1B,IAAMC,0BAAN,cAAsCC,+CAAAA;EAlC7C,OAkC6CA;;;EACnCC;EACSC;EACTC;EACAC;EACAC;EAER,YAAYC,SAAqC;AAC/C,UAAK;AAEL,UAAMC,SAAS;MACbC,SAASF,QAAQE;MACjBC,UAAUH,QAAQG;IACpB;AAEA,SAAKP,KAAKI,QAAQI;AAClB,SAAKP,aAAaG,QAAQH;AAC1B,SAAKC,WAAWE,QAAQF;AACxB,SAAKC,SAASC,QAAQD;AACtB,SAAKJ,SAAS,IAAIU,6BAAcJ,MAAAA;EAClC;EAEA,MAAMK,UAAUC,MAA8C;AAC5D,UAAM,EAAEC,MAAMC,KAAI,IAAKF;AAEvB,UAAMG,qBAAqB,KAAKC,+BAA+BH,IAAAA;AAC/D,UAAMR,UAAU;MACdY,KAAKH,QAAQ,cAAcA,OAAO,KAAKI,YAAYJ,KAAKK,QAAQ,IAAIC,sBAAOC;MAC3EC,KAAKP;MACLQ,eAAeT,QAAQA,KAAKS,gBAAgB,KAAKC,iBAAiBV,KAAKS,aAAa,IAAgB;QAACE,6BAAcC;;MACnH,GAAIZ,QAAQ,cAAcA,QAAQA,KAAKa,WAAW;QAAEC,OAAOd,KAAKa;MAAS,IAAI,CAAC;MAC9E,GAAI,KAAKxB,YAAY;QAAEA,UAAU,KAAKA;MAAS;MAC/C,GAAI,KAAKC,UAAU;QAAEA,QAAQ,KAAKA;MAAO;IAC3C;AAEA,UAAMyB,MAAM,KAAK3B,aACb,MAAM,KAAKF,OAAO8B,QAAQC,6BAA6B;MACrD,GAAG1B;MACHH,YAAY,KAAKA;IACnB,CAAA,IACA,MAAM,KAAKF,OAAO8B,QAAQE,qBAAqB3B,OAAAA;AAEnD,UAAM4B,MAAM;MACV,GAAGJ,IAAIK,QAAQC,KAAKC;MACpBd,KAAKO,IAAIK,QAAQC,KAAKC,UAAUd,MAAM,KAAKe,iBAAiBR,IAAIK,QAAQC,KAAKC,UAAUd,GAAG,IAAIgB;IAChG;AAEA,UAAMC,MAAMV,IAAIK,QAAQK,OAAOV,IAAIK,QAAQC,KAAKC,UAAUG;AAC1D,QAAI,CAACA,KAAK;AACR,YAAM,IAAIC,MAAM,uBAAuB;IACzC;AAEA,WAAO;MACLD;MACAE,KAAK,KAAKxC;MACVY;MACAC,MAAM;QACJc,OAAOC,IAAIK,QAAQN;QACnBc,YAAY;UAACb,IAAIK,QAAQC,KAAKC,UAAUd,OAAO;;QAC/CqB,mBAAeC,2CAAuB;UACpCX;UACAY,iBAAiB,KAAKC,oCAAoC/B,kBAAAA;QAC5D,CAAA;MACF;MACAgC,cAAcC,OAAOC,KAAKpB,IAAIK,QAAQC,KAAKC,UAAUxC,SAAQ,GAAI,MAAA,EAAQA,SAAS,QAAA;IACpF;EACF;EAEA,MAAMsD,UAAUtC,MAA8C;AAC5D,UAAM,EAAEC,KAAI,IAAKD;AACjB,UAAMG,qBAAqB,KAAKC,+BAA+BH,IAAAA;AAC/D,UAAMqC,YAAY,KAAKC,aAAavC,IAAAA;AAEpC,UAAMwC,SAAS,KAAKlD,aAChB,MAAM,KAAKF,OAAO8B,QAAQuB,0BAA0B;MAClD,GAAGH,UAAUrB;MACb3B,YAAY,KAAKA;MACjB,GAAI,KAAKC,YAAY;QAAEA,UAAU,KAAKA;MAAS;MAC/C,GAAI,KAAKC,UAAU;QAAEA,QAAQ,KAAKA;MAAO;IAC3C,CAAA,IACA,MAAM,KAAKJ,OAAO8B,QAAQwB,kBAAkB;MAC1C,GAAGJ,UAAUrB;MACb,GAAI,KAAK1B,YAAY;QAAEA,UAAU,KAAKA;MAAS;MAC/C,GAAI,KAAKC,UAAU;QAAEA,QAAQ,KAAKA;MAAO;IAC3C,CAAA;AAEJ,WAAO;MACLmC,KAAKW,UAAUX;MACfE,KAAK,KAAKxC;MACVY;MACAC,MAAM;QACJc,OAAOsB,UAAUrB,IAAI0B,QAAQ3B;QAC7Bc,YAAY;UAACU,OAAOG,QAAQ1B,IAAIP,OAAO;;QACvCqB,mBAAeC,2CAAuB;UACpCX,KAAKiB,UAAUM;UACfX,iBAAiB,KAAKC,oCAAoC/B,kBAAAA;QAC5D,CAAA;MACF;MACAgC,cAAcC,OAAOC,KAAKG,OAAOG,QAAQ1B,IAAIjC,SAAQ,GAAI,MAAA,EAAQA,SAAS,QAAA;IAC5E;EACF;EAEA,MAAM6D,UAAU7C,MAAuC;AACrD,UAAM,EAAE2B,IAAG,IAAK3B;AAEhB,WAAO,KAAKV,aACR,MAAM,KAAKF,OAAO8B,QAAQ4B,2BAA2B;MACnDC,YAAYpB;MACZrC,YAAY,KAAKA;MACjB,GAAI,KAAKC,YAAY;QAAEA,UAAU,KAAKA;MAAS;MAC/C,GAAI,KAAKC,UAAU;QAAEA,QAAQ,KAAKA;MAAO;IAC3C,CAAA,IACA,MAAM,KAAKJ,OAAO8B,QAAQ8B,mBAAmB;MAC3CD,YAAYpB;MACZ,GAAI,KAAKpC,YAAY;QAAEA,UAAU,KAAKA;MAAS;MAC/C,GAAI,KAAKC,UAAU;QAAEA,QAAQ,KAAKA;MAAO;IAC3C,CAAA;EACN;EAEA,MAAMyD,WAAsC;AAC1C,UAAMC,OAAO,KAAK5D,aACd,MAAM,KAAKF,OAAO8B,QAAQiC,0BAA0B;MAClD7D,YAAY,KAAKA;MACjB,GAAI,KAAKC,YAAY;QAAEA,UAAU,KAAKA;MAAS;MAC/C,GAAI,KAAKC,UAAU;QAAEA,QAAQ,KAAKA;MAAO;IAC3C,CAAA,IACA,MAAM,KAAKJ,OAAO8B,QAAQkC,kBAAkB;MAC1C,GAAI,KAAK7D,YAAY;QAAEA,UAAU,KAAKA;MAAS;MAC/C,GAAI,KAAKC,UAAU;QAAEA,QAAQ,KAAKA;MAAO;IAC3C,CAAA;AAEJ,UAAM6D,eAAWC,4CAA4BJ,MAAM,KAAA,EAAOK;AAE1D,WAAOF,SAASG,IAAI,CAACC,YAAAA;AACnB,YAAMpC,MAAMoC,QAAQxC;AACpB,UAAIkB,eAAe;AAGnB,UAAId,IAAIqC,QAAQ,MAAM;AACpBvB,uBAAed,IAAIsC,KAAK;MAC1B,WAAWtC,IAAIqC,QAAQ,OAAO;AAC5BvB,uBAAed,IAAIuC,KAAK;MAC1B,WAAWvC,IAAIqC,QAAQ,OAAO;AAC5BvB,uBAAed,IAAIsC,KAAK;MAC1B;AAEA,YAAME,UAAU,KAAKC,yBAAyBL,QAAQI,OAAO;AAE7D,aAAO;QACLlC,KAAK8B,QAAQ9B,OAAO8B,QAAQzC;QAC5Ba,KAAK,KAAKxC;QACVY,MAAM4D;QACN1B;QACAjC,MAAM;UACJ4B,YAAY2B,QAAQtD,qBAAqB;YAACsD,QAAQtD;cAAsBuB;UACxEL;UACAU,mBAAeC,2CAAuB;YACpCX;YACAY,iBAAiBwB,QAAQtD,qBAAqB,KAAK+B,oCAAoCuB,QAAQtD,kBAAkB,IAAI;UACvH,CAAA;UACAa,OAAOyC,QAAQzC;UACf1B,YAAYmE,QAAQnE;UACpByE,KAAKN,QAAQM;UACbC,eAAeP,QAAQO;UACvBC,aAAaR,QAAQQ;UACrB,GAAGR,QAAQS;QACb;MACF;IACF,CAAA;EACF;EAEQJ,yBAAyBD,SAAuC;AACtE,YAAQA,SAAAA;MACN,KAAK;AACH,eAAO;MACT,KAAK;MACL,KAAK;AACH,eAAO;MACT,KAAK;AACH,eAAO;MACT,KAAK;AACH,eAAO;MACT,KAAK;AACH,eAAO;MACT;AACE,cAAM,IAAIjC,MAAM,qBAAqBiC,OAAAA,EAAS;IAClD;EACF;EAEA,MAAMM,KAAKnE,MAAiC;AAC1C,UAAM,EAAEoE,QAAQC,KAAI,IAAKrE;AACzB,UAAMiB,MAAM,KAAK3B,aACb,MAAM,KAAKF,OAAO8B,QAAQoD,wBAAwB;MAChDvB,YAAYqB,OAAOzC;MACnBrC,YAAY,KAAKA;MACjB,GAAI,KAAKC,YAAY;QAAEA,UAAU,KAAKA;MAAS;MAC/C,GAAI,KAAKC,UAAU;QAAEA,QAAQ,KAAKA;MAAO;IAC3C,CAAA,IACA,MAAM,KAAKJ,OAAO8B,QAAQqD,gBAAgB;MACxCxB,YAAYqB,OAAOzC;MACnB,GAAI,KAAKpC,YAAY;QAAEA,UAAU,KAAKA;MAAS;MAC/C,GAAI,KAAKC,UAAU;QAAEA,QAAQ,KAAKA;MAAO;IAC3C,CAAA;AAEJ,UAAMgF,gBAAgB,MAAM,KAAKpF,OAAO8B,QAAQuD,4BAA4B;MAC1E9B,SAAS1B,IAAI0B;MACb+B,OAAO1F,SAASqF,MAAM,QAAA;MACtB,GAAI,KAAK9E,YAAY;QAAEA,UAAU,KAAKA;MAAS;MAC/C,GAAI,KAAKC,UAAU;QAAEA,QAAQ,KAAKA;MAAO;IAC3C,CAAA;AAEA,WAAOgF,cAAcG;EACvB;EAEA,MAAMC,OAAO5E,MAAoC;AAC/C,UAAM,EAAEoE,QAAQC,MAAMM,UAAS,IAAK3E;AACpC,UAAMiB,MAAM,KAAK3B,aACb,MAAM,KAAKF,OAAO8B,QAAQoD,wBAAwB;MAChDvB,YAAYqB,OAAOzC;MACnBrC,YAAY,KAAKA;MACjB,GAAI,KAAKC,YAAY;QAAEA,UAAU,KAAKA;MAAS;MAC/C,GAAI,KAAKC,UAAU;QAAEA,QAAQ,KAAKA;MAAO;IAC3C,CAAA,IACA,MAAM,KAAKJ,OAAO8B,QAAQqD,gBAAgB;MACxCxB,YAAYqB,OAAOzC;MACnB,GAAI,KAAKpC,YAAY;QAAEA,UAAU,KAAKA;MAAS;MAC/C,GAAI,KAAKC,UAAU;QAAEA,QAAQ,KAAKA;MAAO;IAC3C,CAAA;AAEJ,UAAMqF,eAAe,MAAM,KAAKzF,OAAO8B,QAAQ4D,6BAA6B;MAC1EnC,SAAS1B,IAAI0B;MACb+B,OAAO1F,SAASqF,MAAM,QAAA;MACtBM;MACA,GAAI,KAAKpF,YAAY;QAAEA,UAAU,KAAKA;MAAS;MAC/C,GAAI,KAAKC,UAAU;QAAEA,QAAQ,KAAKA;MAAO;IAC3C,CAAA;AAEA,WAAOqF,aAAaE;EACtB;EAEA,MAAMC,aAAahF,MAAyC;AAC1D,UAAM,IAAI4B,MAAM,+CAAA;EAClB;EAEQM,sCAAsC,wBAAC/B,uBAAAA;AAC7C,YAAQA,oBAAAA;MACN,KAAK8E,kCAAmBC;MACxB,KAAKD,kCAAmBE;MACxB,KAAKF,kCAAmBG;MACxB,KAAKH,kCAAmBI;MACxB,KAAKJ,kCAAmBK;AACtB,eAAO;MACT,KAAKL,kCAAmBM;MACxB,KAAKN,kCAAmBO;MACxB,KAAKP,kCAAmBQ;AACtB,eAAO;MACT;AACE,cAAM,IAAI7D,MAAM,uBAAuBzB,kBAAAA,+BAAiD;IAC5F;EACF,GAf8C;EAiBtCG,cAAc,wBAACoF,UAAAA;AACrB,YAAQA,OAAAA;MACN,KAAK;AACH,eAAOlF,sBAAOC;MAChB,KAAK;AACH,eAAOD,sBAAOmF;MAChB;AACE,cAAM,IAAI/D,MAAM,aAAa8D,KAAAA,+BAAoC;IACrE;EACF,GATsB;EAWdtF,iCAAiC,wBAACH,SAAAA;AACxC,YAAQA,MAAAA;MACN,KAAK;AACH,eAAOgF,kCAAmBC;MAC5B,KAAK;AACH,eAAOD,kCAAmBE;MAC5B,KAAK;AACH,eAAOF,kCAAmBG;MAC5B;AACE,cAAM,IAAIxD,MAAM,YAAY3B,IAAAA,+BAAmC;IACnE;EACF,GAXyC;EAajCwB,mBAAmB,wBAACf,QAAAA;AAC1B,YAAQA,KAAAA;MACN,KAAK;AACH,eAAOkF,wCAAuBC;MAChC,KAAK;AACH,eAAOD,wCAAuBE;MAChC,KAAK;AACH,eAAOF,wCAAuBG;MAChC,KAAK;AACH,eAAOH,wCAAuBI;MAChC,KAAK;AACH,eAAOJ,wCAAuBK;MAChC,KAAK;AACH,eAAOL,wCAAuBM;MAChC,KAAK;AACH,eAAON,wCAAuBO;MAChC,KAAK;AACH,eAAOP,wCAAuBQ;MAChC,KAAK;AACH,eAAOR,wCAAuBS;MAChC,KAAK;AACH,eAAOT,wCAAuBU;MAChC,KAAK;AACH,eAAOV,wCAAuBW;MAChC,KAAK;AACH,eAAOX,wCAAuBY;MAChC,KAAK;AACH,eAAOZ,wCAAuBa;MAChC,KAAK;AACH,eAAOb,wCAAuBc;MAChC,KAAK;AACH,eAAOd,wCAAuBe;MAChC;AACE,cAAM,IAAI/E,MAAM,uBAAuBlB,GAAAA,+BAAkC;IAC7E;EACF,GAnC2B;EAqCnBkG,kBAAkB,wBAACC,cAAAA;AACzB,YAAQA,WAAAA;MACN,KAAK;AACH,eAAOhG,6BAAcC;MACvB,KAAK;AACH,eAAOD,6BAAciG;MACvB,KAAK;AACH,eAAOjG,6BAAckG;MACvB,KAAK;AACH,eAAOlG,6BAAcmG;MACvB,KAAK;AACH,eAAOnG,6BAAcoG;MACvB,KAAK;AACH,eAAOpG,6BAAcqG;MACvB,KAAK;AACH,eAAOrG,6BAAcsG;MACvB,KAAK;AACH,eAAOtG,6BAAcuG;MACvB;AACE,cAAM,IAAIxF,MAAM,iBAAiBiF,SAAAA,+BAAwC;IAC7E;EACF,GArB0B;EAuBlBjG,mBAAmB,wBAACyG,eAAAA;AAC1B,WAAOA,WAAW7D,IAAI,CAACqD,cAAc,KAAKD,gBAAgBC,SAAAA,CAAAA;EAC5D,GAF2B;EAInBS,kBAAkB,wBAACtH,SAAAA;AACzB,UAAMuH,OAAOvH,KAAKE,MAAMqH;AACxB,UAAMC,gBAAgBD,MAAMC,kBAAkBxH,KAAKyH,cAAcC,SAAS,KAAA,IAAS1H,KAAKyH,oBAAgBE,8BAAS3H,KAAKyH,eAAe,SAAA;AACrI,UAAM7E,mBAAegF,8BAASJ,eAAe,QAAA;AAC7C,UAAMK,oBAAgBD,8BAASJ,aAAAA;AAC/B,UAAMM,mBAAeC,8BAASnF,cAAc,QAAA;AAC5C,UAAMT,mBAAe6F,8BAASF,YAAAA;AAE9B,UAAM5H,OAAO,CAAC;AACd,QAAIqH,MAAM;AACRrH,WAAKqH,OAAO;QACVU,IAAIV,KAAKU,MAAMjI,KAAK2B,OAAOQ;MAC7B;AACA,UAAI+F,YAAoBX,KAAKY,uBAAuB;AACpD,UAAIZ,KAAKa,gBAAgB;AACvB,YAAI,CAACF,UAAUR,SAASH,KAAKa,cAAc,GAAG;AAC5CF,sBAAY,GAAGX,KAAKa,cAAc;EAAKF,SAAAA;QACzC;MACF;AACA,UAAIA,UAAUG,SAAS,GAAG;AACxBnI,aAAKqH,KAAKY,sBAAsBD;AAChC,cAAMnE,UAAMuE,uCAAkBJ,SAAAA;AAC9B,YAAI,CAACX,KAAKgB,qBAAqB;AAG7B3F,uBAAamB,MAAMA;QACrB;AACA7D,aAAKqH,KAAKxD,MAAMA;MAClB;AACA,UAAIwD,KAAKgB,qBAAqB;AAE5B3F,qBAAa4F,MAAMjB,KAAKgB;AACxBrI,aAAKqH,KAAKiB,MAAMjB,KAAKgB;MACvB;IACF;AAEA,UAAM5G,MAAM3B,KAAK2B,OAAOzB,MAAMqH,MAAMU,MAAM9F;AAC1C,WAAO;MACLR;MACAiB;MACA3B,KAAK;QACH0B,SAAS;UACP1B,KAAK;YACH,GAAG4G;YACHlG;YACA+B,SAAK+E,wCAAwBZ,cAAcnE,KAAK,KAAA;YAChDrD,SAAKqI,oCAAoBb,cAAcxH,KAAK,KAAA;YAC5CsI,SAAKC,mCAAmBf,cAAcc,KAAK,KAAA;UAC7C;QACF;QACAT,WAAWhI,KAAKqH,KAAKxD;MACvB;IACF;EACF,GArD0B;EAuDlB8E,wBAAwB,wBAAC7I,SAAAA;AAC/B,UAAM,EAAEyH,cAAa,IAAKzH;AAC1B,UAAM8I,eAAe/J,WAAW0I,cAAcsB,YAAW,GAAI,QAAA;AAC7D,UAAMC,YAAY,IAAIC,gBAAAA,QAASC,GAAG,MAAA;AAClC,UAAM5H,UAAU0H,UAAUG,eAAeL,cAAc,KAAA;AACvD,UAAM3G,eAAeb,QAAQ8H,UAAU,MAAM,KAAA;AAC7C,UAAMxG,mBAAeyG,0BAAMlH,cAAc,WAAA;AACzC,UAAM0F,oBAAgBwB,0BAAM5B,eAAe,aAAa;MAAE6B,cAAc;IAAK,CAAA;AAC7E,UAAM3H,MAAM3B,KAAK2B,OAAOiB,aAAajB,OAAOQ;AAE5C,WAAO;MACLR;MACAiB;MACA3B,KAAK;QACH0B,SAAS;UACP1B,KAAK;YACH,GAAG4G;YACHlG;YACA+B,SAAK+E,wCAAwBZ,cAAcnE,KAAK,KAAA;YAChDrD,SAAKqI,oCAAoBb,cAAcxH,KAAK,KAAA;YAC5CsI,SAAKC,mCAAmBf,cAAcc,KAAK,KAAA;UAC7C;QACF;MACF;IACF;EACF,GAzBgC;EA2BxBY,qBAAqB,wBAACvJ,SAAAA;AAC5B,UAAM,EAAEyH,cAAa,IAAKzH;AAC1B,UAAM6H,oBAAgBwB,0BAAM5B,eAAe,UAAU;MAAE6B,cAAc;IAAK,CAAA;AAC1E,UAAMnH,mBAAeqH,kDAA8B/B,aAAAA;AACnD,UAAM7E,mBAAeyG,0BAAMlH,cAAc,QAAA;AACzC,UAAMR,MAAM3B,KAAK2B,OAAOiB,aAAajB,OAAOQ;AAE5C,WAAO;MACLR;MACAiB;MACA3B,KAAK;QACH0B,SAAS;UACP1B,KAAK;YACH,GAAG4G;YACHlG;YACA+B,SAAK+E,wCAAwBZ,cAAcnE,KAAK,KAAA;YAChDrD,SAAKqI,oCAAoBb,cAAcxH,KAAK,KAAA;YAC5CsI,SAAKC,mCAAmBf,cAAcc,KAAK,KAAA;UAC7C;QACF;MACF;IACF;EACF,GAtB6B;EAwBrBpG,eAAe,wBAACvC,SAAAA;AACtB,YAAQA,KAAKC,MAAI;MACf,KAAK,OAAO;AACV,eAAO,KAAKqH,gBAAgBtH,IAAAA;MAC9B;MACA,KAAK,aAAa;AAChB,eAAO,KAAK6I,sBAAsB7I,IAAAA;MACpC;MACA,KAAK,UAAU;AACb,eAAO,KAAKuJ,mBAAmBvJ,IAAAA;MACjC;MACA;AACE,cAAM,IAAI4B,MAAM,YAAY5B,KAAKC,IAAI,+BAA+B;IACxE;EACF,GAduB;AAezB;","names":["import_ssi_sdk_ext","fromString","toString","u8a","RestKeyManagementSystem","AbstractKeyManagementSystem","client","id","providerId","tenantId","userId","options","config","baseUrl","authOpts","applicationId","KmsRestClient","createKey","args","type","meta","signatureAlgorithm","mapKeyTypeToSignatureAlgorithm","use","mapKeyUsage","keyUsage","JwkUse","Sig","alg","keyOperations","mapKeyOperations","KeyOperations","Sign","keyAlias","alias","key","methods","kmsClientProviderGenerateKey","kmsClientGenerateKey","jwk","keyPair","jose","publicJwk","mapJoseAlgorithm","undefined","kid","Error","kms","algorithms","jwkThumbprint","calculateJwkThumbprint","digestAlgorithm","signatureAlgorithmToDigestAlgorithm","publicKeyHex","Buffer","from","importKey","mapImportKey","result","kmsClientProviderStoreKey","kmsClientStoreKey","keyInfo","publicKeyJwk","deleteKey","kmsClientProviderDeleteKey","aliasOrKid","kmsClientDeleteKey","listKeys","keys","kmsClientProviderListKeys","kmsClientListKeys","restKeys","ListKeysResponseToJSONTyped","keyInfos","map","restKey","kty","x","n","keyType","mapRestKeyTypeToTKeyType","x5c","keyVisibility","keyEncoding","opts","sign","keyRef","data","kmsClientProviderGetKey","kmsClientGetKey","signingResult","kmsClientCreateRawSignature","input","signature","verify","verification","kmsClientIsValidRawSignature","isValid","sharedSecret","SignatureAlgorithm","EcdsaSha256","RsaSsaPssSha256Mgf1","EckaDhSha256","HmacSha256","Es256K","EcdsaSha512","HmacSha512","RsaSsaPssSha512Mgf1","usage","Enc","JoseSignatureAlgorithm","RS256","RS384","RS512","ES256","ES256K","ES384","ES512","EdDSA","HS256","HS384","HS512","PS256","PS384","PS512","none","mapKeyOperation","operation","Verify","WrapKey","DeriveKey","UnwrapKey","Decrypt","DeriveBits","Encrypt","operations","mapImportRsaKey","x509","privateKeyPEM","privateKeyHex","includes","hexToPEM","PEMToJwk","privateKeyJwk","publicKeyPEM","jwkToPEM","PEMToHex","cn","certChain","certificateChainPEM","certificatePEM","length","pemCertChainTox5c","certificateChainURL","x5u","JwkKeyTypeFromJSONTyped","JwkUseFromJSONTyped","crv","CurveFromJSONTyped","mapImportSecp256r1Key","privateBytes","toLowerCase","secp256r1","elliptic","ec","keyFromPrivate","getPublic","toJwk","isPrivateKey","mapImportX25519Key","x25519PublicHexFromPrivateHex"]}
+{"version":3,"sources":["../src/index.ts","../src/RestKeyManagementSystem.ts"],"sourcesContent":["export { RestKeyManagementSystem } from './RestKeyManagementSystem'\nexport * from './types'\n","import {\n  base64ToBase64Url,\n  calculateJwkThumbprint,\n  isHashString,\n  joseAlgorithmToDigest,\n  jwkToRawHexKey,\n  shaHasher,\n  toJwk,\n  x25519PublicHexFromPrivateHex,\n  type X509Opts,\n} from '@sphereon/ssi-sdk-ext.key-utils'\nimport { hexToPEM, jwkToPEM, pemCertChainTox5c, PEMToHex, PEMToJwk } from '@sphereon/ssi-sdk-ext.x509-utils'\nimport type { ManagedKeyInfo as RestManagedKeyInfo } from '@sphereon/ssi-sdk.kms-rest-client'\nimport {\n  CurveFromJSONTyped,\n  JwkKeyTypeFromJSONTyped,\n  JwkUse,\n  JwkUseFromJSONTyped,\n  KeyOperations,\n  KmsRestClient,\n  ListKeysResponseToJSONTyped,\n  type RestClientAuthenticationOpts,\n  SignatureAlgorithm,\n  type StoreKey,\n} from '@sphereon/ssi-sdk.kms-rest-client'\nimport { JoseSignatureAlgorithm, type JWK } from '@sphereon/ssi-types'\nimport type { ManagedKeyInfo, TKeyType } from '@veramo/core'\nimport { AbstractKeyManagementSystem } from '@veramo/key-manager'\nimport elliptic from 'elliptic'\n// @ts-ignore\nimport * as u8a from 'uint8arrays'\nimport type { CreateKeyArgs, DeleteKeyArgs, ImportKeyArgs, MapImportKeyArgs, MappedImportKey, SharedSecretArgs, SignArgs, VerifyArgs } from './types'\n\nconst { fromString, toString } = u8a\n\ninterface KeyManagementSystemOptions {\n  applicationId: string\n  baseUrl: string\n  providerId?: string\n  tenantId?: string\n  userId?: string\n  authOpts?: RestClientAuthenticationOpts\n}\n\nexport class RestKeyManagementSystem extends AbstractKeyManagementSystem {\n  private client: KmsRestClient\n  private readonly id: string\n  private providerId: string | undefined\n  private tenantId: string | undefined\n  private userId: string | undefined\n\n  constructor(options: KeyManagementSystemOptions) {\n    super()\n\n    const config = {\n      baseUrl: options.baseUrl,\n      authOpts: options.authOpts,\n    }\n\n    this.id = options.applicationId\n    this.providerId = options.providerId\n    this.tenantId = options.tenantId\n    this.userId = options.userId\n    this.client = new KmsRestClient(config)\n  }\n\n  async createKey(args: CreateKeyArgs): Promise<ManagedKeyInfo> {\n    const { type, meta } = args\n\n    const signatureAlgorithm = this.mapKeyTypeToSignatureAlgorithm(type)\n    const options = {\n      use: meta && 'keyUsage' in meta ? this.mapKeyUsage(meta.keyUsage) : JwkUse.Sig,\n      alg: signatureAlgorithm,\n      keyOperations: meta && meta.keyOperations ? this.mapKeyOperations(meta.keyOperations as string[]) : [KeyOperations.Sign],\n      ...(meta && 'keyAlias' in meta && meta.keyAlias ? { alias: meta.keyAlias } : {}),\n      ...(this.tenantId && { tenantId: this.tenantId }),\n      ...(this.userId && { userId: this.userId }),\n    }\n\n    const key = this.providerId\n      ? await this.client.methods.kmsClientProviderGenerateKey({\n          ...options,\n          providerId: this.providerId,\n        })\n      : await this.client.methods.kmsClientGenerateKey(options)\n\n    const jwk = {\n      ...key.keyPair.jose.publicJwk,\n      alg: key.keyPair.jose.publicJwk.alg ? this.mapJoseAlgorithm(key.keyPair.jose.publicJwk.alg) : undefined,\n    } satisfies JWK\n\n    const kid = key.keyPair.kid ?? key.keyPair.jose.publicJwk.kid\n    if (!kid) {\n      throw new Error(`No kid present in key`)\n    }\n\n    return {\n      kid,\n      kms: this.id,\n      type,\n      meta: {\n        alias: key.keyPair.alias,\n        algorithms: [key.keyPair.jose.publicJwk.alg ?? 'PS256'],\n        jwkThumbprint: calculateJwkThumbprint({\n          jwk,\n          digestAlgorithm: jwk.alg ? joseAlgorithmToDigest(jwk.alg) : 'sha256',\n        }),\n      },\n      publicKeyHex: Buffer.from(key.keyPair.jose.publicJwk.toString(), 'utf8').toString('base64'),\n    }\n  }\n\n  async importKey(args: ImportKeyArgs): Promise<ManagedKeyInfo> {\n    const { type } = args\n    const importKey = this.mapImportKey(args)\n\n    const result = this.providerId\n      ? await this.client.methods.kmsClientProviderStoreKey({\n          ...importKey.key,\n          providerId: this.providerId,\n          ...(this.tenantId && { tenantId: this.tenantId }),\n          ...(this.userId && { userId: this.userId }),\n        })\n      : await this.client.methods.kmsClientStoreKey({\n          ...importKey.key,\n          ...(this.tenantId && { tenantId: this.tenantId }),\n          ...(this.userId && { userId: this.userId }),\n        })\n\n    return {\n      kid: importKey.kid,\n      kms: this.id,\n      type,\n      meta: {\n        alias: importKey.key.keyInfo.alias,\n        algorithms: [result.keyInfo.key.alg ?? 'PS256'],\n        jwkThumbprint: calculateJwkThumbprint({\n          jwk: importKey.publicKeyJwk,\n          digestAlgorithm: importKey.publicKeyJwk.alg ? joseAlgorithmToDigest(importKey.publicKeyJwk.alg) : 'sha256',\n        }),\n      },\n      publicKeyHex: Buffer.from(result.keyInfo.key.toString(), 'utf8').toString('base64'),\n    }\n  }\n\n  async deleteKey(args: DeleteKeyArgs): Promise<boolean> {\n    const { kid } = args\n\n    return this.providerId\n      ? await this.client.methods.kmsClientProviderDeleteKey({\n          aliasOrKid: kid,\n          providerId: this.providerId,\n          ...(this.tenantId && { tenantId: this.tenantId }),\n          ...(this.userId && { userId: this.userId }),\n        })\n      : await this.client.methods.kmsClientDeleteKey({\n          aliasOrKid: kid,\n          ...(this.tenantId && { tenantId: this.tenantId }),\n          ...(this.userId && { userId: this.userId }),\n        })\n  }\n\n  async listKeys(): Promise<ManagedKeyInfo[]> {\n    const keys = this.providerId\n      ? await this.client.methods.kmsClientProviderListKeys({\n          providerId: this.providerId,\n          ...(this.tenantId && { tenantId: this.tenantId }),\n          ...(this.userId && { userId: this.userId }),\n        })\n      : await this.client.methods.kmsClientListKeys({\n          ...(this.tenantId && { tenantId: this.tenantId }),\n          ...(this.userId && { userId: this.userId }),\n        })\n\n    const restKeys = ListKeysResponseToJSONTyped(keys, false).keyInfos\n\n    return Promise.all(\n      restKeys.map(async (restKey: RestManagedKeyInfo) => {\n        const jwk = restKey.key\n        const publicKeyHex = await jwkToRawHexKey(jwk as JWK)\n        const keyType = this.mapRestKeyTypeToTKeyType(restKey.keyType)\n\n        return {\n          kid: restKey.kid || restKey.alias,\n          kms: this.id,\n          type: keyType,\n          publicKeyHex,\n          meta: {\n            algorithms: restKey.signatureAlgorithm ? [restKey.signatureAlgorithm] : undefined,\n            jwk,\n            jwkThumbprint: calculateJwkThumbprint({\n              jwk: jwk as JWK,\n              digestAlgorithm: restKey.key.alg ? joseAlgorithmToDigest(restKey.key.alg) : 'sha256',\n            }),\n            alias: restKey.alias,\n            providerId: restKey.providerId,\n            x5c: restKey.x5c,\n            keyVisibility: restKey.keyVisibility,\n            keyEncoding: restKey.keyEncoding,\n            ...restKey.opts,\n          },\n        } satisfies ManagedKeyInfo\n      }),\n    )\n  }\n\n  private mapRestKeyTypeToTKeyType(keyType: string | undefined): TKeyType {\n    switch (keyType) {\n      case 'RSA':\n        return 'RSA'\n      case 'EC':\n      case 'P256':\n        return 'Secp256r1'\n      case 'X25519':\n        return 'X25519'\n      case 'Ed25519':\n        return 'Ed25519'\n      case 'secp256k1':\n        return 'Secp256k1'\n      default:\n        throw new Error(`Unknown key type: ${keyType}`)\n    }\n  }\n\n  async sign(args: SignArgs): Promise<string> {\n    const { keyRef, data, algorithm = 'SHA-256' } = args\n    const key = this.providerId\n      ? await this.client.methods.kmsClientProviderGetKey({\n          aliasOrKid: keyRef.kid,\n          providerId: this.providerId,\n          ...(this.tenantId && { tenantId: this.tenantId }),\n          ...(this.userId && { userId: this.userId }),\n        })\n      : await this.client.methods.kmsClientGetKey({\n          aliasOrKid: keyRef.kid,\n          ...(this.tenantId && { tenantId: this.tenantId }),\n          ...(this.userId && { userId: this.userId }),\n        })\n\n    // with remote signing we are not going to send the whole data over the network, we need to hash it (unless we already get a hash\n    const dataToBeSigned: Uint8Array = isHashString(data)\n      ? data\n      : shaHasher(data.buffer.slice(data.byteOffset, data.byteOffset + data.byteLength), algorithm)\n    const signingResult = await this.client.methods.kmsClientCreateRawSignature({\n      keyInfo: key.keyInfo,\n      input: toString(dataToBeSigned, 'base64'),\n      ...(this.tenantId && { tenantId: this.tenantId }),\n      ...(this.userId && { userId: this.userId }),\n    })\n\n    return base64ToBase64Url(signingResult.signature)\n  }\n\n  async verify(args: VerifyArgs): Promise<boolean> {\n    const { keyRef, data, signature, algorithm = 'SHA-256' } = args\n    const key = this.providerId\n      ? await this.client.methods.kmsClientProviderGetKey({\n          aliasOrKid: keyRef.kid,\n          providerId: this.providerId,\n          ...(this.tenantId && { tenantId: this.tenantId }),\n          ...(this.userId && { userId: this.userId }),\n        })\n      : await this.client.methods.kmsClientGetKey({\n          aliasOrKid: keyRef.kid,\n          ...(this.tenantId && { tenantId: this.tenantId }),\n          ...(this.userId && { userId: this.userId }),\n        })\n\n    // with remote signing we are not going to send the whole data over the network, we need to hash it (unless we already get a hash\n    const dataToBeVerified: Uint8Array = isHashString(data)\n      ? data\n      : shaHasher(data.buffer.slice(data.byteOffset, data.byteOffset + data.byteLength), algorithm)\n    const verification = await this.client.methods.kmsClientIsValidRawSignature({\n      keyInfo: key.keyInfo,\n      input: toString(dataToBeVerified, 'base64'),\n      signature,\n      ...(this.tenantId && { tenantId: this.tenantId }),\n      ...(this.userId && { userId: this.userId }),\n    })\n\n    return verification.isValid\n  }\n\n  async sharedSecret(args: SharedSecretArgs): Promise<string> {\n    throw new Error('sharedSecret is not implemented for REST KMS.')\n  }\n\n  private mapKeyUsage = (usage: string): JwkUse => {\n    switch (usage) {\n      case 'sig':\n        return JwkUse.Sig\n      case 'enc':\n        return JwkUse.Enc\n      default:\n        throw new Error(`Key usage ${usage} is not supported by REST KMS`)\n    }\n  }\n\n  private mapKeyTypeToSignatureAlgorithm = (type: TKeyType): SignatureAlgorithm => {\n    switch (type) {\n      case 'Secp256r1':\n        return SignatureAlgorithm.EcdsaSha256\n      case 'RSA':\n        return SignatureAlgorithm.RsaSsaPssSha256Mgf1\n      case 'X25519':\n        return SignatureAlgorithm.EckaDhSha256\n      default:\n        throw new Error(`Key type ${type} is not supported by REST KMS`)\n    }\n  }\n\n  private mapJoseAlgorithm = (alg: string): JoseSignatureAlgorithm => {\n    switch (alg) {\n      case 'RS256':\n        return JoseSignatureAlgorithm.RS256\n      case 'RS384':\n        return JoseSignatureAlgorithm.RS384\n      case 'RS512':\n        return JoseSignatureAlgorithm.RS512\n      case 'ES256':\n        return JoseSignatureAlgorithm.ES256\n      case 'ES256K':\n        return JoseSignatureAlgorithm.ES256K\n      case 'ES384':\n        return JoseSignatureAlgorithm.ES384\n      case 'ES512':\n        return JoseSignatureAlgorithm.ES512\n      case 'EdDSA':\n        return JoseSignatureAlgorithm.EdDSA\n      case 'HS256':\n        return JoseSignatureAlgorithm.HS256\n      case 'HS384':\n        return JoseSignatureAlgorithm.HS384\n      case 'HS512':\n        return JoseSignatureAlgorithm.HS512\n      case 'PS256':\n        return JoseSignatureAlgorithm.PS256\n      case 'PS384':\n        return JoseSignatureAlgorithm.PS384\n      case 'PS512':\n        return JoseSignatureAlgorithm.PS512\n      case 'none':\n        return JoseSignatureAlgorithm.none\n      default:\n        throw new Error(`Signature algorithm ${alg} is not supported by REST KMS`)\n    }\n  }\n\n  private mapKeyOperation = (operation: string): KeyOperations => {\n    switch (operation) {\n      case 'sign':\n        return KeyOperations.Sign\n      case 'verify':\n        return KeyOperations.Verify\n      case 'wrapKey':\n        return KeyOperations.WrapKey\n      case 'deriveKey':\n        return KeyOperations.DeriveKey\n      case 'unwrapKey':\n        return KeyOperations.UnwrapKey\n      case 'decrypt':\n        return KeyOperations.Decrypt\n      case 'deriveBits':\n        return KeyOperations.DeriveBits\n      case 'encrypt':\n        return KeyOperations.Encrypt\n      default:\n        throw new Error(`Key operation ${operation} is not supported by REST KMS`)\n    }\n  }\n\n  private mapKeyOperations = (operations: string[]): KeyOperations[] => {\n    return operations.map((operation) => this.mapKeyOperation(operation))\n  }\n\n  private mapImportRsaKey = (args: MapImportKeyArgs): MappedImportKey => {\n    const x509 = args.meta?.x509 as X509Opts\n    const privateKeyPEM = x509?.privateKeyPEM ?? (args.privateKeyHex.includes('---') ? args.privateKeyHex : hexToPEM(args.privateKeyHex, 'private')) // In case we have x509 opts, the private key hex really was a PEM already (yuck)\n    const publicKeyJwk = PEMToJwk(privateKeyPEM, 'public')\n    const privateKeyJwk = PEMToJwk(privateKeyPEM)\n    const publicKeyPEM = jwkToPEM(publicKeyJwk, 'public')\n    const publicKeyHex = PEMToHex(publicKeyPEM)\n\n    const meta = {} as any\n    if (x509) {\n      meta.x509 = {\n        cn: x509.cn ?? args.kid ?? publicKeyHex,\n      }\n      let certChain: string = x509.certificateChainPEM ?? ''\n      if (x509.certificatePEM) {\n        if (!certChain.includes(x509.certificatePEM)) {\n          certChain = `${x509.certificatePEM}\\n${certChain}`\n        }\n      }\n      if (certChain.length > 0) {\n        meta.x509.certificateChainPEM = certChain\n        const x5c = pemCertChainTox5c(certChain)\n        if (!x509.certificateChainURL) {\n          // Do not put the chain in the JWK when the chain is hosted. We do put it in the x509 metadata\n          // @ts-ignore\n          publicKeyJwk.x5c = x5c\n        }\n        meta.x509.x5c = x5c\n      }\n      if (x509.certificateChainURL) {\n        // @ts-ignore\n        publicKeyJwk.x5u = x509.certificateChainURL\n        meta.x509.x5u = x509.certificateChainURL\n      }\n    }\n\n    const kid = args.kid ?? meta?.x509?.cn ?? publicKeyHex\n    return {\n      kid,\n      publicKeyJwk: publicKeyJwk as JWK,\n      key: {\n        keyInfo: {\n          key: {\n            ...privateKeyJwk,\n            kid,\n            kty: JwkKeyTypeFromJSONTyped(privateKeyJwk.kty, false),\n            use: JwkUseFromJSONTyped(privateKeyJwk.use, false),\n            crv: CurveFromJSONTyped(privateKeyJwk.crv, false),\n          },\n        },\n        certChain: meta.x509.x5c,\n      } satisfies StoreKey,\n    }\n  }\n\n  private mapImportSecp256r1Key = (args: MapImportKeyArgs): MappedImportKey => {\n    const { privateKeyHex } = args\n    const privateBytes = fromString(privateKeyHex.toLowerCase(), 'base16')\n    const secp256r1 = new elliptic.ec('p256')\n    const keyPair = secp256r1.keyFromPrivate(privateBytes, 'hex')\n    const publicKeyHex = keyPair.getPublic(true, 'hex')\n    const publicKeyJwk = toJwk(publicKeyHex, 'Secp256r1')\n    const privateKeyJwk = toJwk(privateKeyHex, 'Secp256r1', { isPrivateKey: true })\n    const kid = args.kid ?? publicKeyJwk.kid ?? publicKeyHex\n\n    return {\n      kid,\n      publicKeyJwk: publicKeyJwk as JWK,\n      key: {\n        keyInfo: {\n          key: {\n            ...privateKeyJwk,\n            kid,\n            kty: JwkKeyTypeFromJSONTyped(privateKeyJwk.kty, false),\n            use: JwkUseFromJSONTyped(privateKeyJwk.use, false),\n            crv: CurveFromJSONTyped(privateKeyJwk.crv, false),\n          },\n        },\n      } satisfies StoreKey,\n    }\n  }\n\n  private mapImportX25519Key = (args: MapImportKeyArgs): MappedImportKey => {\n    const { privateKeyHex } = args\n    const privateKeyJwk = toJwk(privateKeyHex, 'X25519', { isPrivateKey: true })\n    const publicKeyHex = x25519PublicHexFromPrivateHex(privateKeyHex)\n    const publicKeyJwk = toJwk(publicKeyHex, 'X25519')\n    const kid = args.kid ?? publicKeyJwk.kid ?? publicKeyHex\n\n    return {\n      kid,\n      publicKeyJwk: publicKeyJwk as JWK,\n      key: {\n        keyInfo: {\n          key: {\n            ...privateKeyJwk,\n            kid,\n            kty: JwkKeyTypeFromJSONTyped(privateKeyJwk.kty, false),\n            use: JwkUseFromJSONTyped(privateKeyJwk.use, false),\n            crv: CurveFromJSONTyped(privateKeyJwk.crv, false),\n          },\n        },\n      } satisfies StoreKey,\n    }\n  }\n\n  private mapImportKey = (args: MapImportKeyArgs): MappedImportKey => {\n    switch (args.type) {\n      case 'RSA': {\n        return this.mapImportRsaKey(args)\n      }\n      case 'Secp256r1': {\n        return this.mapImportSecp256r1Key(args)\n      }\n      case 'X25519': {\n        return this.mapImportX25519Key(args)\n      }\n      default:\n        throw new Error(`Key type ${args.type} is not supported by REST KMS`)\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;;;;;;;ACAA,yBAUO;AACP,IAAAA,sBAA0E;AAE1E,qBAWO;AACP,uBAAiD;AAEjD,yBAA4C;AAC5C,sBAAqB;AAErB,UAAqB;AAGrB,IAAM,EAAEC,YAAYC,SAAQ,IAAKC;AAW1B,IAAMC,0BAAN,cAAsCC,+CAAAA;EA5C7C,OA4C6CA;;;EACnCC;EACSC;EACTC;EACAC;EACAC;EAER,YAAYC,SAAqC;AAC/C,UAAK;AAEL,UAAMC,SAAS;MACbC,SAASF,QAAQE;MACjBC,UAAUH,QAAQG;IACpB;AAEA,SAAKP,KAAKI,QAAQI;AAClB,SAAKP,aAAaG,QAAQH;AAC1B,SAAKC,WAAWE,QAAQF;AACxB,SAAKC,SAASC,QAAQD;AACtB,SAAKJ,SAAS,IAAIU,6BAAcJ,MAAAA;EAClC;EAEA,MAAMK,UAAUC,MAA8C;AAC5D,UAAM,EAAEC,MAAMC,KAAI,IAAKF;AAEvB,UAAMG,qBAAqB,KAAKC,+BAA+BH,IAAAA;AAC/D,UAAMR,UAAU;MACdY,KAAKH,QAAQ,cAAcA,OAAO,KAAKI,YAAYJ,KAAKK,QAAQ,IAAIC,sBAAOC;MAC3EC,KAAKP;MACLQ,eAAeT,QAAQA,KAAKS,gBAAgB,KAAKC,iBAAiBV,KAAKS,aAAa,IAAgB;QAACE,6BAAcC;;MACnH,GAAIZ,QAAQ,cAAcA,QAAQA,KAAKa,WAAW;QAAEC,OAAOd,KAAKa;MAAS,IAAI,CAAC;MAC9E,GAAI,KAAKxB,YAAY;QAAEA,UAAU,KAAKA;MAAS;MAC/C,GAAI,KAAKC,UAAU;QAAEA,QAAQ,KAAKA;MAAO;IAC3C;AAEA,UAAMyB,MAAM,KAAK3B,aACb,MAAM,KAAKF,OAAO8B,QAAQC,6BAA6B;MACrD,GAAG1B;MACHH,YAAY,KAAKA;IACnB,CAAA,IACA,MAAM,KAAKF,OAAO8B,QAAQE,qBAAqB3B,OAAAA;AAEnD,UAAM4B,MAAM;MACV,GAAGJ,IAAIK,QAAQC,KAAKC;MACpBd,KAAKO,IAAIK,QAAQC,KAAKC,UAAUd,MAAM,KAAKe,iBAAiBR,IAAIK,QAAQC,KAAKC,UAAUd,GAAG,IAAIgB;IAChG;AAEA,UAAMC,MAAMV,IAAIK,QAAQK,OAAOV,IAAIK,QAAQC,KAAKC,UAAUG;AAC1D,QAAI,CAACA,KAAK;AACR,YAAM,IAAIC,MAAM,uBAAuB;IACzC;AAEA,WAAO;MACLD;MACAE,KAAK,KAAKxC;MACVY;MACAC,MAAM;QACJc,OAAOC,IAAIK,QAAQN;QACnBc,YAAY;UAACb,IAAIK,QAAQC,KAAKC,UAAUd,OAAO;;QAC/CqB,mBAAeC,2CAAuB;UACpCX;UACAY,iBAAiBZ,IAAIX,UAAMwB,0CAAsBb,IAAIX,GAAG,IAAI;QAC9D,CAAA;MACF;MACAyB,cAAcC,OAAOC,KAAKpB,IAAIK,QAAQC,KAAKC,UAAUxC,SAAQ,GAAI,MAAA,EAAQA,SAAS,QAAA;IACpF;EACF;EAEA,MAAMsD,UAAUtC,MAA8C;AAC5D,UAAM,EAAEC,KAAI,IAAKD;AACjB,UAAMsC,YAAY,KAAKC,aAAavC,IAAAA;AAEpC,UAAMwC,SAAS,KAAKlD,aAChB,MAAM,KAAKF,OAAO8B,QAAQuB,0BAA0B;MAClD,GAAGH,UAAUrB;MACb3B,YAAY,KAAKA;MACjB,GAAI,KAAKC,YAAY;QAAEA,UAAU,KAAKA;MAAS;MAC/C,GAAI,KAAKC,UAAU;QAAEA,QAAQ,KAAKA;MAAO;IAC3C,CAAA,IACA,MAAM,KAAKJ,OAAO8B,QAAQwB,kBAAkB;MAC1C,GAAGJ,UAAUrB;MACb,GAAI,KAAK1B,YAAY;QAAEA,UAAU,KAAKA;MAAS;MAC/C,GAAI,KAAKC,UAAU;QAAEA,QAAQ,KAAKA;MAAO;IAC3C,CAAA;AAEJ,WAAO;MACLmC,KAAKW,UAAUX;MACfE,KAAK,KAAKxC;MACVY;MACAC,MAAM;QACJc,OAAOsB,UAAUrB,IAAI0B,QAAQ3B;QAC7Bc,YAAY;UAACU,OAAOG,QAAQ1B,IAAIP,OAAO;;QACvCqB,mBAAeC,2CAAuB;UACpCX,KAAKiB,UAAUM;UACfX,iBAAiBK,UAAUM,aAAalC,UAAMwB,0CAAsBI,UAAUM,aAAalC,GAAG,IAAI;QACpG,CAAA;MACF;MACAyB,cAAcC,OAAOC,KAAKG,OAAOG,QAAQ1B,IAAIjC,SAAQ,GAAI,MAAA,EAAQA,SAAS,QAAA;IAC5E;EACF;EAEA,MAAM6D,UAAU7C,MAAuC;AACrD,UAAM,EAAE2B,IAAG,IAAK3B;AAEhB,WAAO,KAAKV,aACR,MAAM,KAAKF,OAAO8B,QAAQ4B,2BAA2B;MACnDC,YAAYpB;MACZrC,YAAY,KAAKA;MACjB,GAAI,KAAKC,YAAY;QAAEA,UAAU,KAAKA;MAAS;MAC/C,GAAI,KAAKC,UAAU;QAAEA,QAAQ,KAAKA;MAAO;IAC3C,CAAA,IACA,MAAM,KAAKJ,OAAO8B,QAAQ8B,mBAAmB;MAC3CD,YAAYpB;MACZ,GAAI,KAAKpC,YAAY;QAAEA,UAAU,KAAKA;MAAS;MAC/C,GAAI,KAAKC,UAAU;QAAEA,QAAQ,KAAKA;MAAO;IAC3C,CAAA;EACN;EAEA,MAAMyD,WAAsC;AAC1C,UAAMC,OAAO,KAAK5D,aACd,MAAM,KAAKF,OAAO8B,QAAQiC,0BAA0B;MAClD7D,YAAY,KAAKA;MACjB,GAAI,KAAKC,YAAY;QAAEA,UAAU,KAAKA;MAAS;MAC/C,GAAI,KAAKC,UAAU;QAAEA,QAAQ,KAAKA;MAAO;IAC3C,CAAA,IACA,MAAM,KAAKJ,OAAO8B,QAAQkC,kBAAkB;MAC1C,GAAI,KAAK7D,YAAY;QAAEA,UAAU,KAAKA;MAAS;MAC/C,GAAI,KAAKC,UAAU;QAAEA,QAAQ,KAAKA;MAAO;IAC3C,CAAA;AAEJ,UAAM6D,eAAWC,4CAA4BJ,MAAM,KAAA,EAAOK;AAE1D,WAAOC,QAAQC,IACbJ,SAASK,IAAI,OAAOC,YAAAA;AAClB,YAAMtC,MAAMsC,QAAQ1C;AACpB,YAAMkB,eAAe,UAAMyB,mCAAevC,GAAAA;AAC1C,YAAMwC,UAAU,KAAKC,yBAAyBH,QAAQE,OAAO;AAE7D,aAAO;QACLlC,KAAKgC,QAAQhC,OAAOgC,QAAQ3C;QAC5Ba,KAAK,KAAKxC;QACVY,MAAM4D;QACN1B;QACAjC,MAAM;UACJ4B,YAAY6B,QAAQxD,qBAAqB;YAACwD,QAAQxD;cAAsBuB;UACxEL;UACAU,mBAAeC,2CAAuB;YACpCX;YACAY,iBAAiB0B,QAAQ1C,IAAIP,UAAMwB,0CAAsByB,QAAQ1C,IAAIP,GAAG,IAAI;UAC9E,CAAA;UACAM,OAAO2C,QAAQ3C;UACf1B,YAAYqE,QAAQrE;UACpByE,KAAKJ,QAAQI;UACbC,eAAeL,QAAQK;UACvBC,aAAaN,QAAQM;UACrB,GAAGN,QAAQO;QACb;MACF;IACF,CAAA,CAAA;EAEJ;EAEQJ,yBAAyBD,SAAuC;AACtE,YAAQA,SAAAA;MACN,KAAK;AACH,eAAO;MACT,KAAK;MACL,KAAK;AACH,eAAO;MACT,KAAK;AACH,eAAO;MACT,KAAK;AACH,eAAO;MACT,KAAK;AACH,eAAO;MACT;AACE,cAAM,IAAIjC,MAAM,qBAAqBiC,OAAAA,EAAS;IAClD;EACF;EAEA,MAAMM,KAAKnE,MAAiC;AAC1C,UAAM,EAAEoE,QAAQC,MAAMC,YAAY,UAAS,IAAKtE;AAChD,UAAMiB,MAAM,KAAK3B,aACb,MAAM,KAAKF,OAAO8B,QAAQqD,wBAAwB;MAChDxB,YAAYqB,OAAOzC;MACnBrC,YAAY,KAAKA;MACjB,GAAI,KAAKC,YAAY;QAAEA,UAAU,KAAKA;MAAS;MAC/C,GAAI,KAAKC,UAAU;QAAEA,QAAQ,KAAKA;MAAO;IAC3C,CAAA,IACA,MAAM,KAAKJ,OAAO8B,QAAQsD,gBAAgB;MACxCzB,YAAYqB,OAAOzC;MACnB,GAAI,KAAKpC,YAAY;QAAEA,UAAU,KAAKA;MAAS;MAC/C,GAAI,KAAKC,UAAU;QAAEA,QAAQ,KAAKA;MAAO;IAC3C,CAAA;AAGJ,UAAMiF,qBAA6BC,iCAAaL,IAAAA,IAC5CA,WACAM,8BAAUN,KAAKO,OAAOC,MAAMR,KAAKS,YAAYT,KAAKS,aAAaT,KAAKU,UAAU,GAAGT,SAAAA;AACrF,UAAMU,gBAAgB,MAAM,KAAK5F,OAAO8B,QAAQ+D,4BAA4B;MAC1EtC,SAAS1B,IAAI0B;MACbuC,OAAOlG,SAASyF,gBAAgB,QAAA;MAChC,GAAI,KAAKlF,YAAY;QAAEA,UAAU,KAAKA;MAAS;MAC/C,GAAI,KAAKC,UAAU;QAAEA,QAAQ,KAAKA;MAAO;IAC3C,CAAA;AAEA,eAAO2F,sCAAkBH,cAAcI,SAAS;EAClD;EAEA,MAAMC,OAAOrF,MAAoC;AAC/C,UAAM,EAAEoE,QAAQC,MAAMe,WAAWd,YAAY,UAAS,IAAKtE;AAC3D,UAAMiB,MAAM,KAAK3B,aACb,MAAM,KAAKF,OAAO8B,QAAQqD,wBAAwB;MAChDxB,YAAYqB,OAAOzC;MACnBrC,YAAY,KAAKA;MACjB,GAAI,KAAKC,YAAY;QAAEA,UAAU,KAAKA;MAAS;MAC/C,GAAI,KAAKC,UAAU;QAAEA,QAAQ,KAAKA;MAAO;IAC3C,CAAA,IACA,MAAM,KAAKJ,OAAO8B,QAAQsD,gBAAgB;MACxCzB,YAAYqB,OAAOzC;MACnB,GAAI,KAAKpC,YAAY;QAAEA,UAAU,KAAKA;MAAS;MAC/C,GAAI,KAAKC,UAAU;QAAEA,QAAQ,KAAKA;MAAO;IAC3C,CAAA;AAGJ,UAAM8F,uBAA+BZ,iCAAaL,IAAAA,IAC9CA,WACAM,8BAAUN,KAAKO,OAAOC,MAAMR,KAAKS,YAAYT,KAAKS,aAAaT,KAAKU,UAAU,GAAGT,SAAAA;AACrF,UAAMiB,eAAe,MAAM,KAAKnG,OAAO8B,QAAQsE,6BAA6B;MAC1E7C,SAAS1B,IAAI0B;MACbuC,OAAOlG,SAASsG,kBAAkB,QAAA;MAClCF;MACA,GAAI,KAAK7F,YAAY;QAAEA,UAAU,KAAKA;MAAS;MAC/C,GAAI,KAAKC,UAAU;QAAEA,QAAQ,KAAKA;MAAO;IAC3C,CAAA;AAEA,WAAO+F,aAAaE;EACtB;EAEA,MAAMC,aAAa1F,MAAyC;AAC1D,UAAM,IAAI4B,MAAM,+CAAA;EAClB;EAEQtB,cAAc,wBAACqF,UAAAA;AACrB,YAAQA,OAAAA;MACN,KAAK;AACH,eAAOnF,sBAAOC;MAChB,KAAK;AACH,eAAOD,sBAAOoF;MAChB;AACE,cAAM,IAAIhE,MAAM,aAAa+D,KAAAA,+BAAoC;IACrE;EACF,GATsB;EAWdvF,iCAAiC,wBAACH,SAAAA;AACxC,YAAQA,MAAAA;MACN,KAAK;AACH,eAAO4F,kCAAmBC;MAC5B,KAAK;AACH,eAAOD,kCAAmBE;MAC5B,KAAK;AACH,eAAOF,kCAAmBG;MAC5B;AACE,cAAM,IAAIpE,MAAM,YAAY3B,IAAAA,+BAAmC;IACnE;EACF,GAXyC;EAajCwB,mBAAmB,wBAACf,QAAAA;AAC1B,YAAQA,KAAAA;MACN,KAAK;AACH,eAAOuF,wCAAuBC;MAChC,KAAK;AACH,eAAOD,wCAAuBE;MAChC,KAAK;AACH,eAAOF,wCAAuBG;MAChC,KAAK;AACH,eAAOH,wCAAuBI;MAChC,KAAK;AACH,eAAOJ,wCAAuBK;MAChC,KAAK;AACH,eAAOL,wCAAuBM;MAChC,KAAK;AACH,eAAON,wCAAuBO;MAChC,KAAK;AACH,eAAOP,wCAAuBQ;MAChC,KAAK;AACH,eAAOR,wCAAuBS;MAChC,KAAK;AACH,eAAOT,wCAAuBU;MAChC,KAAK;AACH,eAAOV,wCAAuBW;MAChC,KAAK;AACH,eAAOX,wCAAuBY;MAChC,KAAK;AACH,eAAOZ,wCAAuBa;MAChC,KAAK;AACH,eAAOb,wCAAuBc;MAChC,KAAK;AACH,eAAOd,wCAAuBe;MAChC;AACE,cAAM,IAAIpF,MAAM,uBAAuBlB,GAAAA,+BAAkC;IAC7E;EACF,GAnC2B;EAqCnBuG,kBAAkB,wBAACC,cAAAA;AACzB,YAAQA,WAAAA;MACN,KAAK;AACH,eAAOrG,6BAAcC;MACvB,KAAK;AACH,eAAOD,6BAAcsG;MACvB,KAAK;AACH,eAAOtG,6BAAcuG;MACvB,KAAK;AACH,eAAOvG,6BAAcwG;MACvB,KAAK;AACH,eAAOxG,6BAAcyG;MACvB,KAAK;AACH,eAAOzG,6BAAc0G;MACvB,KAAK;AACH,eAAO1G,6BAAc2G;MACvB,KAAK;AACH,eAAO3G,6BAAc4G;MACvB;AACE,cAAM,IAAI7F,MAAM,iBAAiBsF,SAAAA,+BAAwC;IAC7E;EACF,GArB0B;EAuBlBtG,mBAAmB,wBAAC8G,eAAAA;AAC1B,WAAOA,WAAWhE,IAAI,CAACwD,cAAc,KAAKD,gBAAgBC,SAAAA,CAAAA;EAC5D,GAF2B;EAInBS,kBAAkB,wBAAC3H,SAAAA;AACzB,UAAM4H,OAAO5H,KAAKE,MAAM0H;AACxB,UAAMC,gBAAgBD,MAAMC,kBAAkB7H,KAAK8H,cAAcC,SAAS,KAAA,IAAS/H,KAAK8H,oBAAgBE,8BAAShI,KAAK8H,eAAe,SAAA;AACrI,UAAMlF,mBAAeqF,8BAASJ,eAAe,QAAA;AAC7C,UAAMK,oBAAgBD,8BAASJ,aAAAA;AAC/B,UAAMM,mBAAeC,8BAASxF,cAAc,QAAA;AAC5C,UAAMT,mBAAekG,8BAASF,YAAAA;AAE9B,UAAMjI,OAAO,CAAC;AACd,QAAI0H,MAAM;AACR1H,WAAK0H,OAAO;QACVU,IAAIV,KAAKU,MAAMtI,KAAK2B,OAAOQ;MAC7B;AACA,UAAIoG,YAAoBX,KAAKY,uBAAuB;AACpD,UAAIZ,KAAKa,gBAAgB;AACvB,YAAI,CAACF,UAAUR,SAASH,KAAKa,cAAc,GAAG;AAC5CF,sBAAY,GAAGX,KAAKa,cAAc;EAAKF,SAAAA;QACzC;MACF;AACA,UAAIA,UAAUG,SAAS,GAAG;AACxBxI,aAAK0H,KAAKY,sBAAsBD;AAChC,cAAMxE,UAAM4E,uCAAkBJ,SAAAA;AAC9B,YAAI,CAACX,KAAKgB,qBAAqB;AAG7BhG,uBAAamB,MAAMA;QACrB;AACA7D,aAAK0H,KAAK7D,MAAMA;MAClB;AACA,UAAI6D,KAAKgB,qBAAqB;AAE5BhG,qBAAaiG,MAAMjB,KAAKgB;AACxB1I,aAAK0H,KAAKiB,MAAMjB,KAAKgB;MACvB;IACF;AAEA,UAAMjH,MAAM3B,KAAK2B,OAAOzB,MAAM0H,MAAMU,MAAMnG;AAC1C,WAAO;MACLR;MACAiB;MACA3B,KAAK;QACH0B,SAAS;UACP1B,KAAK;YACH,GAAGiH;YACHvG;YACAmH,SAAKC,wCAAwBb,cAAcY,KAAK,KAAA;YAChDzI,SAAK2I,oCAAoBd,cAAc7H,KAAK,KAAA;YAC5C4I,SAAKC,mCAAmBhB,cAAce,KAAK,KAAA;UAC7C;QACF;QACAV,WAAWrI,KAAK0H,KAAK7D;MACvB;IACF;EACF,GArD0B;EAuDlBoF,wBAAwB,wBAACnJ,SAAAA;AAC/B,UAAM,EAAE8H,cAAa,IAAK9H;AAC1B,UAAMoJ,eAAerK,WAAW+I,cAAcuB,YAAW,GAAI,QAAA;AAC7D,UAAMC,YAAY,IAAIC,gBAAAA,QAASC,GAAG,MAAA;AAClC,UAAMlI,UAAUgI,UAAUG,eAAeL,cAAc,KAAA;AACvD,UAAMjH,eAAeb,QAAQoI,UAAU,MAAM,KAAA;AAC7C,UAAM9G,mBAAe+G,0BAAMxH,cAAc,WAAA;AACzC,UAAM+F,oBAAgByB,0BAAM7B,eAAe,aAAa;MAAE8B,cAAc;IAAK,CAAA;AAC7E,UAAMjI,MAAM3B,KAAK2B,OAAOiB,aAAajB,OAAOQ;AAE5C,WAAO;MACLR;MACAiB;MACA3B,KAAK;QACH0B,SAAS;UACP1B,KAAK;YACH,GAAGiH;YACHvG;YACAmH,SAAKC,wCAAwBb,cAAcY,KAAK,KAAA;YAChDzI,SAAK2I,oCAAoBd,cAAc7H,KAAK,KAAA;YAC5C4I,SAAKC,mCAAmBhB,cAAce,KAAK,KAAA;UAC7C;QACF;MACF;IACF;EACF,GAzBgC;EA2BxBY,qBAAqB,wBAAC7J,SAAAA;AAC5B,UAAM,EAAE8H,cAAa,IAAK9H;AAC1B,UAAMkI,oBAAgByB,0BAAM7B,eAAe,UAAU;MAAE8B,cAAc;IAAK,CAAA;AAC1E,UAAMzH,mBAAe2H,kDAA8BhC,aAAAA;AACnD,UAAMlF,mBAAe+G,0BAAMxH,cAAc,QAAA;AACzC,UAAMR,MAAM3B,KAAK2B,OAAOiB,aAAajB,OAAOQ;AAE5C,WAAO;MACLR;MACAiB;MACA3B,KAAK;QACH0B,SAAS;UACP1B,KAAK;YACH,GAAGiH;YACHvG;YACAmH,SAAKC,wCAAwBb,cAAcY,KAAK,KAAA;YAChDzI,SAAK2I,oCAAoBd,cAAc7H,KAAK,KAAA;YAC5C4I,SAAKC,mCAAmBhB,cAAce,KAAK,KAAA;UAC7C;QACF;MACF;IACF;EACF,GAtB6B;EAwBrB1G,eAAe,wBAACvC,SAAAA;AACtB,YAAQA,KAAKC,MAAI;MACf,KAAK,OAAO;AACV,eAAO,KAAK0H,gBAAgB3H,IAAAA;MAC9B;MACA,KAAK,aAAa;AAChB,eAAO,KAAKmJ,sBAAsBnJ,IAAAA;MACpC;MACA,KAAK,UAAU;AACb,eAAO,KAAK6J,mBAAmB7J,IAAAA;MACjC;MACA;AACE,cAAM,IAAI4B,MAAM,YAAY5B,KAAKC,IAAI,+BAA+B;IACxE;EACF,GAduB;AAezB;","names":["import_ssi_sdk_ext","fromString","toString","u8a","RestKeyManagementSystem","AbstractKeyManagementSystem","client","id","providerId","tenantId","userId","options","config","baseUrl","authOpts","applicationId","KmsRestClient","createKey","args","type","meta","signatureAlgorithm","mapKeyTypeToSignatureAlgorithm","use","mapKeyUsage","keyUsage","JwkUse","Sig","alg","keyOperations","mapKeyOperations","KeyOperations","Sign","keyAlias","alias","key","methods","kmsClientProviderGenerateKey","kmsClientGenerateKey","jwk","keyPair","jose","publicJwk","mapJoseAlgorithm","undefined","kid","Error","kms","algorithms","jwkThumbprint","calculateJwkThumbprint","digestAlgorithm","joseAlgorithmToDigest","publicKeyHex","Buffer","from","importKey","mapImportKey","result","kmsClientProviderStoreKey","kmsClientStoreKey","keyInfo","publicKeyJwk","deleteKey","kmsClientProviderDeleteKey","aliasOrKid","kmsClientDeleteKey","listKeys","keys","kmsClientProviderListKeys","kmsClientListKeys","restKeys","ListKeysResponseToJSONTyped","keyInfos","Promise","all","map","restKey","jwkToRawHexKey","keyType","mapRestKeyTypeToTKeyType","x5c","keyVisibility","keyEncoding","opts","sign","keyRef","data","algorithm","kmsClientProviderGetKey","kmsClientGetKey","dataToBeSigned","isHashString","shaHasher","buffer","slice","byteOffset","byteLength","signingResult","kmsClientCreateRawSignature","input","base64ToBase64Url","signature","verify","dataToBeVerified","verification","kmsClientIsValidRawSignature","isValid","sharedSecret","usage","Enc","SignatureAlgorithm","EcdsaSha256","RsaSsaPssSha256Mgf1","EckaDhSha256","JoseSignatureAlgorithm","RS256","RS384","RS512","ES256","ES256K","ES384","ES512","EdDSA","HS256","HS384","HS512","PS256","PS384","PS512","none","mapKeyOperation","operation","Verify","WrapKey","DeriveKey","UnwrapKey","Decrypt","DeriveBits","Encrypt","operations","mapImportRsaKey","x509","privateKeyPEM","privateKeyHex","includes","hexToPEM","PEMToJwk","privateKeyJwk","publicKeyPEM","jwkToPEM","PEMToHex","cn","certChain","certificateChainPEM","certificatePEM","length","pemCertChainTox5c","certificateChainURL","x5u","kty","JwkKeyTypeFromJSONTyped","JwkUseFromJSONTyped","crv","CurveFromJSONTyped","mapImportSecp256r1Key","privateBytes","toLowerCase","secp256r1","elliptic","ec","keyFromPrivate","getPublic","toJwk","isPrivateKey","mapImportX25519Key","x25519PublicHexFromPrivateHex"]}

package/dist/index.d.cts

@@ -14,12 +14,14 @@ type CreateKeyArgs = {
 type SignArgs = {
     keyRef: Pick<IKey, 'kid'>;
     data: Uint8Array;
+    algorithm?: string;
     [x: string]: any;
 };
 type VerifyArgs = {
     keyRef: Pick<IKey, 'kid'>;
     data: Uint8Array;
     signature: string;
+    algorithm?: string;
     [x: string]: any;
 };
 type SharedSecretArgs = {
@@ -67,7 +69,6 @@ declare class RestKeyManagementSystem extends AbstractKeyManagementSystem {
     sign(args: SignArgs): Promise<string>;
     verify(args: VerifyArgs): Promise<boolean>;
     sharedSecret(args: SharedSecretArgs): Promise<string>;
-    private signatureAlgorithmToDigestAlgorithm;
     private mapKeyUsage;
     private mapKeyTypeToSignatureAlgorithm;
     private mapJoseAlgorithm;

package/dist/index.d.ts

@@ -14,12 +14,14 @@ type CreateKeyArgs = {
 type SignArgs = {
     keyRef: Pick<IKey, 'kid'>;
     data: Uint8Array;
+    algorithm?: string;
     [x: string]: any;
 };
 type VerifyArgs = {
     keyRef: Pick<IKey, 'kid'>;
     data: Uint8Array;
     signature: string;
+    algorithm?: string;
     [x: string]: any;
 };
 type SharedSecretArgs = {
@@ -67,7 +69,6 @@ declare class RestKeyManagementSystem extends AbstractKeyManagementSystem {
     sign(args: SignArgs): Promise<string>;
     verify(args: VerifyArgs): Promise<boolean>;
     sharedSecret(args: SharedSecretArgs): Promise<string>;
-    private signatureAlgorithmToDigestAlgorithm;
     private mapKeyUsage;
     private mapKeyTypeToSignatureAlgorithm;
     private mapJoseAlgorithm;

package/dist/index.js

@@ -2,7 +2,7 @@ var __defProp = Object.defineProperty;
 var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
 
 // src/RestKeyManagementSystem.ts
-import { calculateJwkThumbprint, toJwk, x25519PublicHexFromPrivateHex } from "@sphereon/ssi-sdk-ext.key-utils";
+import { base64ToBase64Url, calculateJwkThumbprint, isHashString, joseAlgorithmToDigest, jwkToRawHexKey, shaHasher, toJwk, x25519PublicHexFromPrivateHex } from "@sphereon/ssi-sdk-ext.key-utils";
 import { hexToPEM, jwkToPEM, pemCertChainTox5c, PEMToHex, PEMToJwk } from "@sphereon/ssi-sdk-ext.x509-utils";
 import { CurveFromJSONTyped, JwkKeyTypeFromJSONTyped, JwkUse, JwkUseFromJSONTyped, KeyOperations, KmsRestClient, ListKeysResponseToJSONTyped, SignatureAlgorithm } from "@sphereon/ssi-sdk.kms-rest-client";
 import { JoseSignatureAlgorithm } from "@sphereon/ssi-types";
@@ -73,7 +73,7 @@ var RestKeyManagementSystem = class extends AbstractKeyManagementSystem {
         ],
         jwkThumbprint: calculateJwkThumbprint({
           jwk,
-          digestAlgorithm: this.signatureAlgorithmToDigestAlgorithm(signatureAlgorithm)
+          digestAlgorithm: jwk.alg ? joseAlgorithmToDigest(jwk.alg) : "sha256"
         })
       },
       publicKeyHex: Buffer.from(key.keyPair.jose.publicJwk.toString(), "utf8").toString("base64")
@@ -81,7 +81,6 @@ var RestKeyManagementSystem = class extends AbstractKeyManagementSystem {
   }
   async importKey(args) {
     const { type } = args;
-    const signatureAlgorithm = this.mapKeyTypeToSignatureAlgorithm(type);
     const importKey = this.mapImportKey(args);
     const result = this.providerId ? await this.client.methods.kmsClientProviderStoreKey({
       ...importKey.key,
@@ -112,7 +111,7 @@ var RestKeyManagementSystem = class extends AbstractKeyManagementSystem {
         ],
         jwkThumbprint: calculateJwkThumbprint({
           jwk: importKey.publicKeyJwk,
-          digestAlgorithm: this.signatureAlgorithmToDigestAlgorithm(signatureAlgorithm)
+          digestAlgorithm: importKey.publicKeyJwk.alg ? joseAlgorithmToDigest(importKey.publicKeyJwk.alg) : "sha256"
         })
       },
       publicKeyHex: Buffer.from(result.keyInfo.key.toString(), "utf8").toString("base64")
@@ -157,16 +156,9 @@ var RestKeyManagementSystem = class extends AbstractKeyManagementSystem {
       }
     });
     const restKeys = ListKeysResponseToJSONTyped(keys, false).keyInfos;
-    return restKeys.map((restKey) => {
+    return Promise.all(restKeys.map(async (restKey) => {
       const jwk = restKey.key;
-      let publicKeyHex = "";
-      if (jwk.kty === "EC") {
-        publicKeyHex = jwk.x || "";
-      } else if (jwk.kty === "RSA") {
-        publicKeyHex = jwk.n || "";
-      } else if (jwk.kty === "OKP") {
-        publicKeyHex = jwk.x || "";
-      }
+      const publicKeyHex = await jwkToRawHexKey(jwk);
       const keyType = this.mapRestKeyTypeToTKeyType(restKey.keyType);
       return {
         kid: restKey.kid || restKey.alias,
@@ -180,7 +172,7 @@ var RestKeyManagementSystem = class extends AbstractKeyManagementSystem {
           jwk,
           jwkThumbprint: calculateJwkThumbprint({
             jwk,
-            digestAlgorithm: restKey.signatureAlgorithm ? this.signatureAlgorithmToDigestAlgorithm(restKey.signatureAlgorithm) : "sha256"
+            digestAlgorithm: restKey.key.alg ? joseAlgorithmToDigest(restKey.key.alg) : "sha256"
           }),
           alias: restKey.alias,
           providerId: restKey.providerId,
@@ -190,7 +182,7 @@ var RestKeyManagementSystem = class extends AbstractKeyManagementSystem {
           ...restKey.opts
         }
       };
-    });
+    }));
   }
   mapRestKeyTypeToTKeyType(keyType) {
     switch (keyType) {
@@ -210,7 +202,7 @@ var RestKeyManagementSystem = class extends AbstractKeyManagementSystem {
     }
   }
   async sign(args) {
-    const { keyRef, data } = args;
+    const { keyRef, data, algorithm = "SHA-256" } = args;
     const key = this.providerId ? await this.client.methods.kmsClientProviderGetKey({
       aliasOrKid: keyRef.kid,
       providerId: this.providerId,
@@ -229,9 +221,10 @@ var RestKeyManagementSystem = class extends AbstractKeyManagementSystem {
         userId: this.userId
       }
     });
+    const dataToBeSigned = isHashString(data) ? data : shaHasher(data.buffer.slice(data.byteOffset, data.byteOffset + data.byteLength), algorithm);
     const signingResult = await this.client.methods.kmsClientCreateRawSignature({
       keyInfo: key.keyInfo,
-      input: toString(data, "base64"),
+      input: toString(dataToBeSigned, "base64"),
       ...this.tenantId && {
         tenantId: this.tenantId
       },
@@ -239,10 +232,10 @@ var RestKeyManagementSystem = class extends AbstractKeyManagementSystem {
         userId: this.userId
       }
     });
-    return signingResult.signature;
+    return base64ToBase64Url(signingResult.signature);
   }
   async verify(args) {
-    const { keyRef, data, signature } = args;
+    const { keyRef, data, signature, algorithm = "SHA-256" } = args;
     const key = this.providerId ? await this.client.methods.kmsClientProviderGetKey({
       aliasOrKid: keyRef.kid,
       providerId: this.providerId,
@@ -261,9 +254,10 @@ var RestKeyManagementSystem = class extends AbstractKeyManagementSystem {
         userId: this.userId
       }
     });
+    const dataToBeVerified = isHashString(data) ? data : shaHasher(data.buffer.slice(data.byteOffset, data.byteOffset + data.byteLength), algorithm);
     const verification = await this.client.methods.kmsClientIsValidRawSignature({
       keyInfo: key.keyInfo,
-      input: toString(data, "base64"),
+      input: toString(dataToBeVerified, "base64"),
       signature,
       ...this.tenantId && {
         tenantId: this.tenantId
@@ -277,22 +271,6 @@ var RestKeyManagementSystem = class extends AbstractKeyManagementSystem {
   async sharedSecret(args) {
     throw new Error("sharedSecret is not implemented for REST KMS.");
   }
-  signatureAlgorithmToDigestAlgorithm = /* @__PURE__ */ __name((signatureAlgorithm) => {
-    switch (signatureAlgorithm) {
-      case SignatureAlgorithm.EcdsaSha256:
-      case SignatureAlgorithm.RsaSsaPssSha256Mgf1:
-      case SignatureAlgorithm.EckaDhSha256:
-      case SignatureAlgorithm.HmacSha256:
-      case SignatureAlgorithm.Es256K:
-        return "sha256";
-      case SignatureAlgorithm.EcdsaSha512:
-      case SignatureAlgorithm.HmacSha512:
-      case SignatureAlgorithm.RsaSsaPssSha512Mgf1:
-        return "sha512";
-      default:
-        throw new Error(`Signature algorithm ${signatureAlgorithm} is not supported by REST KMS`);
-    }
-  }, "signatureAlgorithmToDigestAlgorithm");
   mapKeyUsage = /* @__PURE__ */ __name((usage) => {
     switch (usage) {
       case "sig":

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/RestKeyManagementSystem.ts"],"sourcesContent":["import { calculateJwkThumbprint, toJwk, x25519PublicHexFromPrivateHex, type X509Opts } from '@sphereon/ssi-sdk-ext.key-utils'\nimport { hexToPEM, jwkToPEM, pemCertChainTox5c, PEMToHex, PEMToJwk } from '@sphereon/ssi-sdk-ext.x509-utils'\nimport type { ManagedKeyInfo as RestManagedKeyInfo } from '@sphereon/ssi-sdk.kms-rest-client'\nimport {\n  CurveFromJSONTyped,\n  JwkKeyTypeFromJSONTyped,\n  JwkUse,\n  JwkUseFromJSONTyped,\n  KeyOperations,\n  KmsRestClient,\n  ListKeysResponseToJSONTyped,\n  type RestClientAuthenticationOpts,\n  SignatureAlgorithm,\n  type StoreKey,\n} from '@sphereon/ssi-sdk.kms-rest-client'\nimport { JoseSignatureAlgorithm, type JWK } from '@sphereon/ssi-types'\nimport type { ManagedKeyInfo, TKeyType } from '@veramo/core'\nimport { AbstractKeyManagementSystem } from '@veramo/key-manager'\nimport elliptic from 'elliptic'\n// @ts-ignore\nimport * as u8a from 'uint8arrays'\nimport type { CreateKeyArgs, DeleteKeyArgs, ImportKeyArgs, MapImportKeyArgs, MappedImportKey, SharedSecretArgs, SignArgs, VerifyArgs } from './types'\n\nconst { fromString, toString } = u8a\n\ninterface KeyManagementSystemOptions {\n  applicationId: string\n  baseUrl: string\n  providerId?: string\n  tenantId?: string\n  userId?: string\n  authOpts?: RestClientAuthenticationOpts\n}\n\nexport class RestKeyManagementSystem extends AbstractKeyManagementSystem {\n  private client: KmsRestClient\n  private readonly id: string\n  private providerId: string | undefined\n  private tenantId: string | undefined\n  private userId: string | undefined\n\n  constructor(options: KeyManagementSystemOptions) {\n    super()\n\n    const config = {\n      baseUrl: options.baseUrl,\n      authOpts: options.authOpts,\n    }\n\n    this.id = options.applicationId\n    this.providerId = options.providerId\n    this.tenantId = options.tenantId\n    this.userId = options.userId\n    this.client = new KmsRestClient(config)\n  }\n\n  async createKey(args: CreateKeyArgs): Promise<ManagedKeyInfo> {\n    const { type, meta } = args\n\n    const signatureAlgorithm = this.mapKeyTypeToSignatureAlgorithm(type)\n    const options = {\n      use: meta && 'keyUsage' in meta ? this.mapKeyUsage(meta.keyUsage) : JwkUse.Sig,\n      alg: signatureAlgorithm,\n      keyOperations: meta && meta.keyOperations ? this.mapKeyOperations(meta.keyOperations as string[]) : [KeyOperations.Sign],\n      ...(meta && 'keyAlias' in meta && meta.keyAlias ? { alias: meta.keyAlias } : {}),\n      ...(this.tenantId && { tenantId: this.tenantId }),\n      ...(this.userId && { userId: this.userId }),\n    }\n\n    const key = this.providerId\n      ? await this.client.methods.kmsClientProviderGenerateKey({\n          ...options,\n          providerId: this.providerId,\n        })\n      : await this.client.methods.kmsClientGenerateKey(options)\n\n    const jwk = {\n      ...key.keyPair.jose.publicJwk,\n      alg: key.keyPair.jose.publicJwk.alg ? this.mapJoseAlgorithm(key.keyPair.jose.publicJwk.alg) : undefined,\n    } satisfies JWK\n\n    const kid = key.keyPair.kid ?? key.keyPair.jose.publicJwk.kid\n    if (!kid) {\n      throw new Error(`No kid present in key`)\n    }\n\n    return {\n      kid,\n      kms: this.id,\n      type,\n      meta: {\n        alias: key.keyPair.alias,\n        algorithms: [key.keyPair.jose.publicJwk.alg ?? 'PS256'],\n        jwkThumbprint: calculateJwkThumbprint({\n          jwk,\n          digestAlgorithm: this.signatureAlgorithmToDigestAlgorithm(signatureAlgorithm),\n        }),\n      },\n      publicKeyHex: Buffer.from(key.keyPair.jose.publicJwk.toString(), 'utf8').toString('base64'),\n    }\n  }\n\n  async importKey(args: ImportKeyArgs): Promise<ManagedKeyInfo> {\n    const { type } = args\n    const signatureAlgorithm = this.mapKeyTypeToSignatureAlgorithm(type)\n    const importKey = this.mapImportKey(args)\n\n    const result = this.providerId\n      ? await this.client.methods.kmsClientProviderStoreKey({\n          ...importKey.key,\n          providerId: this.providerId,\n          ...(this.tenantId && { tenantId: this.tenantId }),\n          ...(this.userId && { userId: this.userId }),\n        })\n      : await this.client.methods.kmsClientStoreKey({\n          ...importKey.key,\n          ...(this.tenantId && { tenantId: this.tenantId }),\n          ...(this.userId && { userId: this.userId }),\n        })\n\n    return {\n      kid: importKey.kid,\n      kms: this.id,\n      type,\n      meta: {\n        alias: importKey.key.keyInfo.alias,\n        algorithms: [result.keyInfo.key.alg ?? 'PS256'],\n        jwkThumbprint: calculateJwkThumbprint({\n          jwk: importKey.publicKeyJwk,\n          digestAlgorithm: this.signatureAlgorithmToDigestAlgorithm(signatureAlgorithm),\n        }),\n      },\n      publicKeyHex: Buffer.from(result.keyInfo.key.toString(), 'utf8').toString('base64'),\n    }\n  }\n\n  async deleteKey(args: DeleteKeyArgs): Promise<boolean> {\n    const { kid } = args\n\n    return this.providerId\n      ? await this.client.methods.kmsClientProviderDeleteKey({\n          aliasOrKid: kid,\n          providerId: this.providerId,\n          ...(this.tenantId && { tenantId: this.tenantId }),\n          ...(this.userId && { userId: this.userId }),\n        })\n      : await this.client.methods.kmsClientDeleteKey({\n          aliasOrKid: kid,\n          ...(this.tenantId && { tenantId: this.tenantId }),\n          ...(this.userId && { userId: this.userId }),\n        })\n  }\n\n  async listKeys(): Promise<ManagedKeyInfo[]> {\n    const keys = this.providerId\n      ? await this.client.methods.kmsClientProviderListKeys({\n          providerId: this.providerId,\n          ...(this.tenantId && { tenantId: this.tenantId }),\n          ...(this.userId && { userId: this.userId }),\n        })\n      : await this.client.methods.kmsClientListKeys({\n          ...(this.tenantId && { tenantId: this.tenantId }),\n          ...(this.userId && { userId: this.userId }),\n        })\n\n    const restKeys = ListKeysResponseToJSONTyped(keys, false).keyInfos\n\n    return restKeys.map((restKey: RestManagedKeyInfo) => {\n      const jwk = restKey.key\n      let publicKeyHex = ''\n\n      // Derive publicKeyHex from JWK based on key type\n      if (jwk.kty === 'EC') {\n        publicKeyHex = jwk.x || ''\n      } else if (jwk.kty === 'RSA') {\n        publicKeyHex = jwk.n || ''\n      } else if (jwk.kty === 'OKP') {\n        publicKeyHex = jwk.x || ''\n      }\n\n      const keyType = this.mapRestKeyTypeToTKeyType(restKey.keyType)\n\n      return {\n        kid: restKey.kid || restKey.alias,\n        kms: this.id,\n        type: keyType,\n        publicKeyHex,\n        meta: {\n          algorithms: restKey.signatureAlgorithm ? [restKey.signatureAlgorithm] : undefined,\n          jwk,\n          jwkThumbprint: calculateJwkThumbprint({\n            jwk: jwk as JWK,\n            digestAlgorithm: restKey.signatureAlgorithm ? this.signatureAlgorithmToDigestAlgorithm(restKey.signatureAlgorithm) : 'sha256',\n          }),\n          alias: restKey.alias,\n          providerId: restKey.providerId,\n          x5c: restKey.x5c,\n          keyVisibility: restKey.keyVisibility,\n          keyEncoding: restKey.keyEncoding,\n          ...restKey.opts,\n        },\n      } satisfies ManagedKeyInfo\n    })\n  }\n\n  private mapRestKeyTypeToTKeyType(keyType: string | undefined): TKeyType {\n    switch (keyType) {\n      case 'RSA':\n        return 'RSA'\n      case 'EC':\n      case 'P256':\n        return 'Secp256r1'\n      case 'X25519':\n        return 'X25519'\n      case 'Ed25519':\n        return 'Ed25519'\n      case 'secp256k1':\n        return 'Secp256k1'\n      default:\n        throw new Error(`Unknown key type: ${keyType}`)\n    }\n  }\n\n  async sign(args: SignArgs): Promise<string> {\n    const { keyRef, data } = args\n    const key = this.providerId\n      ? await this.client.methods.kmsClientProviderGetKey({\n          aliasOrKid: keyRef.kid,\n          providerId: this.providerId,\n          ...(this.tenantId && { tenantId: this.tenantId }),\n          ...(this.userId && { userId: this.userId }),\n        })\n      : await this.client.methods.kmsClientGetKey({\n          aliasOrKid: keyRef.kid,\n          ...(this.tenantId && { tenantId: this.tenantId }),\n          ...(this.userId && { userId: this.userId }),\n        })\n\n    const signingResult = await this.client.methods.kmsClientCreateRawSignature({\n      keyInfo: key.keyInfo,\n      input: toString(data, 'base64'),\n      ...(this.tenantId && { tenantId: this.tenantId }),\n      ...(this.userId && { userId: this.userId }),\n    })\n\n    return signingResult.signature\n  }\n\n  async verify(args: VerifyArgs): Promise<boolean> {\n    const { keyRef, data, signature } = args\n    const key = this.providerId\n      ? await this.client.methods.kmsClientProviderGetKey({\n          aliasOrKid: keyRef.kid,\n          providerId: this.providerId,\n          ...(this.tenantId && { tenantId: this.tenantId }),\n          ...(this.userId && { userId: this.userId }),\n        })\n      : await this.client.methods.kmsClientGetKey({\n          aliasOrKid: keyRef.kid,\n          ...(this.tenantId && { tenantId: this.tenantId }),\n          ...(this.userId && { userId: this.userId }),\n        })\n\n    const verification = await this.client.methods.kmsClientIsValidRawSignature({\n      keyInfo: key.keyInfo,\n      input: toString(data, 'base64'),\n      signature,\n      ...(this.tenantId && { tenantId: this.tenantId }),\n      ...(this.userId && { userId: this.userId }),\n    })\n\n    return verification.isValid\n  }\n\n  async sharedSecret(args: SharedSecretArgs): Promise<string> {\n    throw new Error('sharedSecret is not implemented for REST KMS.')\n  }\n\n  private signatureAlgorithmToDigestAlgorithm = (signatureAlgorithm: SignatureAlgorithm): 'sha256' | 'sha512' => {\n    switch (signatureAlgorithm) {\n      case SignatureAlgorithm.EcdsaSha256:\n      case SignatureAlgorithm.RsaSsaPssSha256Mgf1:\n      case SignatureAlgorithm.EckaDhSha256:\n      case SignatureAlgorithm.HmacSha256:\n      case SignatureAlgorithm.Es256K:\n        return 'sha256'\n      case SignatureAlgorithm.EcdsaSha512:\n      case SignatureAlgorithm.HmacSha512:\n      case SignatureAlgorithm.RsaSsaPssSha512Mgf1:\n        return 'sha512'\n      default:\n        throw new Error(`Signature algorithm ${signatureAlgorithm} is not supported by REST KMS`)\n    }\n  }\n\n  private mapKeyUsage = (usage: string): JwkUse => {\n    switch (usage) {\n      case 'sig':\n        return JwkUse.Sig\n      case 'enc':\n        return JwkUse.Enc\n      default:\n        throw new Error(`Key usage ${usage} is not supported by REST KMS`)\n    }\n  }\n\n  private mapKeyTypeToSignatureAlgorithm = (type: TKeyType): SignatureAlgorithm => {\n    switch (type) {\n      case 'Secp256r1':\n        return SignatureAlgorithm.EcdsaSha256\n      case 'RSA':\n        return SignatureAlgorithm.RsaSsaPssSha256Mgf1\n      case 'X25519':\n        return SignatureAlgorithm.EckaDhSha256\n      default:\n        throw new Error(`Key type ${type} is not supported by REST KMS`)\n    }\n  }\n\n  private mapJoseAlgorithm = (alg: string): JoseSignatureAlgorithm => {\n    switch (alg) {\n      case 'RS256':\n        return JoseSignatureAlgorithm.RS256\n      case 'RS384':\n        return JoseSignatureAlgorithm.RS384\n      case 'RS512':\n        return JoseSignatureAlgorithm.RS512\n      case 'ES256':\n        return JoseSignatureAlgorithm.ES256\n      case 'ES256K':\n        return JoseSignatureAlgorithm.ES256K\n      case 'ES384':\n        return JoseSignatureAlgorithm.ES384\n      case 'ES512':\n        return JoseSignatureAlgorithm.ES512\n      case 'EdDSA':\n        return JoseSignatureAlgorithm.EdDSA\n      case 'HS256':\n        return JoseSignatureAlgorithm.HS256\n      case 'HS384':\n        return JoseSignatureAlgorithm.HS384\n      case 'HS512':\n        return JoseSignatureAlgorithm.HS512\n      case 'PS256':\n        return JoseSignatureAlgorithm.PS256\n      case 'PS384':\n        return JoseSignatureAlgorithm.PS384\n      case 'PS512':\n        return JoseSignatureAlgorithm.PS512\n      case 'none':\n        return JoseSignatureAlgorithm.none\n      default:\n        throw new Error(`Signature algorithm ${alg} is not supported by REST KMS`)\n    }\n  }\n\n  private mapKeyOperation = (operation: string): KeyOperations => {\n    switch (operation) {\n      case 'sign':\n        return KeyOperations.Sign\n      case 'verify':\n        return KeyOperations.Verify\n      case 'wrapKey':\n        return KeyOperations.WrapKey\n      case 'deriveKey':\n        return KeyOperations.DeriveKey\n      case 'unwrapKey':\n        return KeyOperations.UnwrapKey\n      case 'decrypt':\n        return KeyOperations.Decrypt\n      case 'deriveBits':\n        return KeyOperations.DeriveBits\n      case 'encrypt':\n        return KeyOperations.Encrypt\n      default:\n        throw new Error(`Key operation ${operation} is not supported by REST KMS`)\n    }\n  }\n\n  private mapKeyOperations = (operations: string[]): KeyOperations[] => {\n    return operations.map((operation) => this.mapKeyOperation(operation))\n  }\n\n  private mapImportRsaKey = (args: MapImportKeyArgs): MappedImportKey => {\n    const x509 = args.meta?.x509 as X509Opts\n    const privateKeyPEM = x509?.privateKeyPEM ?? (args.privateKeyHex.includes('---') ? args.privateKeyHex : hexToPEM(args.privateKeyHex, 'private')) // In case we have x509 opts, the private key hex really was a PEM already (yuck)\n    const publicKeyJwk = PEMToJwk(privateKeyPEM, 'public')\n    const privateKeyJwk = PEMToJwk(privateKeyPEM)\n    const publicKeyPEM = jwkToPEM(publicKeyJwk, 'public')\n    const publicKeyHex = PEMToHex(publicKeyPEM)\n\n    const meta = {} as any\n    if (x509) {\n      meta.x509 = {\n        cn: x509.cn ?? args.kid ?? publicKeyHex,\n      }\n      let certChain: string = x509.certificateChainPEM ?? ''\n      if (x509.certificatePEM) {\n        if (!certChain.includes(x509.certificatePEM)) {\n          certChain = `${x509.certificatePEM}\\n${certChain}`\n        }\n      }\n      if (certChain.length > 0) {\n        meta.x509.certificateChainPEM = certChain\n        const x5c = pemCertChainTox5c(certChain)\n        if (!x509.certificateChainURL) {\n          // Do not put the chain in the JWK when the chain is hosted. We do put it in the x509 metadata\n          // @ts-ignore\n          publicKeyJwk.x5c = x5c\n        }\n        meta.x509.x5c = x5c\n      }\n      if (x509.certificateChainURL) {\n        // @ts-ignore\n        publicKeyJwk.x5u = x509.certificateChainURL\n        meta.x509.x5u = x509.certificateChainURL\n      }\n    }\n\n    const kid = args.kid ?? meta?.x509?.cn ?? publicKeyHex\n    return {\n      kid,\n      publicKeyJwk: publicKeyJwk as JWK,\n      key: {\n        keyInfo: {\n          key: {\n            ...privateKeyJwk,\n            kid,\n            kty: JwkKeyTypeFromJSONTyped(privateKeyJwk.kty, false),\n            use: JwkUseFromJSONTyped(privateKeyJwk.use, false),\n            crv: CurveFromJSONTyped(privateKeyJwk.crv, false),\n          },\n        },\n        certChain: meta.x509.x5c,\n      } satisfies StoreKey,\n    }\n  }\n\n  private mapImportSecp256r1Key = (args: MapImportKeyArgs): MappedImportKey => {\n    const { privateKeyHex } = args\n    const privateBytes = fromString(privateKeyHex.toLowerCase(), 'base16')\n    const secp256r1 = new elliptic.ec('p256')\n    const keyPair = secp256r1.keyFromPrivate(privateBytes, 'hex')\n    const publicKeyHex = keyPair.getPublic(true, 'hex')\n    const publicKeyJwk = toJwk(publicKeyHex, 'Secp256r1')\n    const privateKeyJwk = toJwk(privateKeyHex, 'Secp256r1', { isPrivateKey: true })\n    const kid = args.kid ?? publicKeyJwk.kid ?? publicKeyHex\n\n    return {\n      kid,\n      publicKeyJwk: publicKeyJwk as JWK,\n      key: {\n        keyInfo: {\n          key: {\n            ...privateKeyJwk,\n            kid,\n            kty: JwkKeyTypeFromJSONTyped(privateKeyJwk.kty, false),\n            use: JwkUseFromJSONTyped(privateKeyJwk.use, false),\n            crv: CurveFromJSONTyped(privateKeyJwk.crv, false),\n          },\n        },\n      } satisfies StoreKey,\n    }\n  }\n\n  private mapImportX25519Key = (args: MapImportKeyArgs): MappedImportKey => {\n    const { privateKeyHex } = args\n    const privateKeyJwk = toJwk(privateKeyHex, 'X25519', { isPrivateKey: true })\n    const publicKeyHex = x25519PublicHexFromPrivateHex(privateKeyHex)\n    const publicKeyJwk = toJwk(publicKeyHex, 'X25519')\n    const kid = args.kid ?? publicKeyJwk.kid ?? publicKeyHex\n\n    return {\n      kid,\n      publicKeyJwk: publicKeyJwk as JWK,\n      key: {\n        keyInfo: {\n          key: {\n            ...privateKeyJwk,\n            kid,\n            kty: JwkKeyTypeFromJSONTyped(privateKeyJwk.kty, false),\n            use: JwkUseFromJSONTyped(privateKeyJwk.use, false),\n            crv: CurveFromJSONTyped(privateKeyJwk.crv, false),\n          },\n        },\n      } satisfies StoreKey,\n    }\n  }\n\n  private mapImportKey = (args: MapImportKeyArgs): MappedImportKey => {\n    switch (args.type) {\n      case 'RSA': {\n        return this.mapImportRsaKey(args)\n      }\n      case 'Secp256r1': {\n        return this.mapImportSecp256r1Key(args)\n      }\n      case 'X25519': {\n        return this.mapImportX25519Key(args)\n      }\n      default:\n        throw new Error(`Key type ${args.type} is not supported by REST KMS`)\n    }\n  }\n}\n"],"mappings":";;;;AAAA,SAASA,wBAAwBC,OAAOC,qCAAoD;AAC5F,SAASC,UAAUC,UAAUC,mBAAmBC,UAAUC,gBAAgB;AAE1E,SACEC,oBACAC,yBACAC,QACAC,qBACAC,eACAC,eACAC,6BAEAC,0BAEK;AACP,SAASC,8BAAwC;AAEjD,SAASC,mCAAmC;AAC5C,OAAOC,cAAc;AAErB,YAAYC,SAAS;AAGrB,IAAM,EAAEC,YAAYC,SAAQ,IAAKC;AAW1B,IAAMC,0BAAN,cAAsCC,4BAAAA;EAlC7C,OAkC6CA;;;EACnCC;EACSC;EACTC;EACAC;EACAC;EAER,YAAYC,SAAqC;AAC/C,UAAK;AAEL,UAAMC,SAAS;MACbC,SAASF,QAAQE;MACjBC,UAAUH,QAAQG;IACpB;AAEA,SAAKP,KAAKI,QAAQI;AAClB,SAAKP,aAAaG,QAAQH;AAC1B,SAAKC,WAAWE,QAAQF;AACxB,SAAKC,SAASC,QAAQD;AACtB,SAAKJ,SAAS,IAAIU,cAAcJ,MAAAA;EAClC;EAEA,MAAMK,UAAUC,MAA8C;AAC5D,UAAM,EAAEC,MAAMC,KAAI,IAAKF;AAEvB,UAAMG,qBAAqB,KAAKC,+BAA+BH,IAAAA;AAC/D,UAAMR,UAAU;MACdY,KAAKH,QAAQ,cAAcA,OAAO,KAAKI,YAAYJ,KAAKK,QAAQ,IAAIC,OAAOC;MAC3EC,KAAKP;MACLQ,eAAeT,QAAQA,KAAKS,gBAAgB,KAAKC,iBAAiBV,KAAKS,aAAa,IAAgB;QAACE,cAAcC;;MACnH,GAAIZ,QAAQ,cAAcA,QAAQA,KAAKa,WAAW;QAAEC,OAAOd,KAAKa;MAAS,IAAI,CAAC;MAC9E,GAAI,KAAKxB,YAAY;QAAEA,UAAU,KAAKA;MAAS;MAC/C,GAAI,KAAKC,UAAU;QAAEA,QAAQ,KAAKA;MAAO;IAC3C;AAEA,UAAMyB,MAAM,KAAK3B,aACb,MAAM,KAAKF,OAAO8B,QAAQC,6BAA6B;MACrD,GAAG1B;MACHH,YAAY,KAAKA;IACnB,CAAA,IACA,MAAM,KAAKF,OAAO8B,QAAQE,qBAAqB3B,OAAAA;AAEnD,UAAM4B,MAAM;MACV,GAAGJ,IAAIK,QAAQC,KAAKC;MACpBd,KAAKO,IAAIK,QAAQC,KAAKC,UAAUd,MAAM,KAAKe,iBAAiBR,IAAIK,QAAQC,KAAKC,UAAUd,GAAG,IAAIgB;IAChG;AAEA,UAAMC,MAAMV,IAAIK,QAAQK,OAAOV,IAAIK,QAAQC,KAAKC,UAAUG;AAC1D,QAAI,CAACA,KAAK;AACR,YAAM,IAAIC,MAAM,uBAAuB;IACzC;AAEA,WAAO;MACLD;MACAE,KAAK,KAAKxC;MACVY;MACAC,MAAM;QACJc,OAAOC,IAAIK,QAAQN;QACnBc,YAAY;UAACb,IAAIK,QAAQC,KAAKC,UAAUd,OAAO;;QAC/CqB,eAAeC,uBAAuB;UACpCX;UACAY,iBAAiB,KAAKC,oCAAoC/B,kBAAAA;QAC5D,CAAA;MACF;MACAgC,cAAcC,OAAOC,KAAKpB,IAAIK,QAAQC,KAAKC,UAAUxC,SAAQ,GAAI,MAAA,EAAQA,SAAS,QAAA;IACpF;EACF;EAEA,MAAMsD,UAAUtC,MAA8C;AAC5D,UAAM,EAAEC,KAAI,IAAKD;AACjB,UAAMG,qBAAqB,KAAKC,+BAA+BH,IAAAA;AAC/D,UAAMqC,YAAY,KAAKC,aAAavC,IAAAA;AAEpC,UAAMwC,SAAS,KAAKlD,aAChB,MAAM,KAAKF,OAAO8B,QAAQuB,0BAA0B;MAClD,GAAGH,UAAUrB;MACb3B,YAAY,KAAKA;MACjB,GAAI,KAAKC,YAAY;QAAEA,UAAU,KAAKA;MAAS;MAC/C,GAAI,KAAKC,UAAU;QAAEA,QAAQ,KAAKA;MAAO;IAC3C,CAAA,IACA,MAAM,KAAKJ,OAAO8B,QAAQwB,kBAAkB;MAC1C,GAAGJ,UAAUrB;MACb,GAAI,KAAK1B,YAAY;QAAEA,UAAU,KAAKA;MAAS;MAC/C,GAAI,KAAKC,UAAU;QAAEA,QAAQ,KAAKA;MAAO;IAC3C,CAAA;AAEJ,WAAO;MACLmC,KAAKW,UAAUX;MACfE,KAAK,KAAKxC;MACVY;MACAC,MAAM;QACJc,OAAOsB,UAAUrB,IAAI0B,QAAQ3B;QAC7Bc,YAAY;UAACU,OAAOG,QAAQ1B,IAAIP,OAAO;;QACvCqB,eAAeC,uBAAuB;UACpCX,KAAKiB,UAAUM;UACfX,iBAAiB,KAAKC,oCAAoC/B,kBAAAA;QAC5D,CAAA;MACF;MACAgC,cAAcC,OAAOC,KAAKG,OAAOG,QAAQ1B,IAAIjC,SAAQ,GAAI,MAAA,EAAQA,SAAS,QAAA;IAC5E;EACF;EAEA,MAAM6D,UAAU7C,MAAuC;AACrD,UAAM,EAAE2B,IAAG,IAAK3B;AAEhB,WAAO,KAAKV,aACR,MAAM,KAAKF,OAAO8B,QAAQ4B,2BAA2B;MACnDC,YAAYpB;MACZrC,YAAY,KAAKA;MACjB,GAAI,KAAKC,YAAY;QAAEA,UAAU,KAAKA;MAAS;MAC/C,GAAI,KAAKC,UAAU;QAAEA,QAAQ,KAAKA;MAAO;IAC3C,CAAA,IACA,MAAM,KAAKJ,OAAO8B,QAAQ8B,mBAAmB;MAC3CD,YAAYpB;MACZ,GAAI,KAAKpC,YAAY;QAAEA,UAAU,KAAKA;MAAS;MAC/C,GAAI,KAAKC,UAAU;QAAEA,QAAQ,KAAKA;MAAO;IAC3C,CAAA;EACN;EAEA,MAAMyD,WAAsC;AAC1C,UAAMC,OAAO,KAAK5D,aACd,MAAM,KAAKF,OAAO8B,QAAQiC,0BAA0B;MAClD7D,YAAY,KAAKA;MACjB,GAAI,KAAKC,YAAY;QAAEA,UAAU,KAAKA;MAAS;MAC/C,GAAI,KAAKC,UAAU;QAAEA,QAAQ,KAAKA;MAAO;IAC3C,CAAA,IACA,MAAM,KAAKJ,OAAO8B,QAAQkC,kBAAkB;MAC1C,GAAI,KAAK7D,YAAY;QAAEA,UAAU,KAAKA;MAAS;MAC/C,GAAI,KAAKC,UAAU;QAAEA,QAAQ,KAAKA;MAAO;IAC3C,CAAA;AAEJ,UAAM6D,WAAWC,4BAA4BJ,MAAM,KAAA,EAAOK;AAE1D,WAAOF,SAASG,IAAI,CAACC,YAAAA;AACnB,YAAMpC,MAAMoC,QAAQxC;AACpB,UAAIkB,eAAe;AAGnB,UAAId,IAAIqC,QAAQ,MAAM;AACpBvB,uBAAed,IAAIsC,KAAK;MAC1B,WAAWtC,IAAIqC,QAAQ,OAAO;AAC5BvB,uBAAed,IAAIuC,KAAK;MAC1B,WAAWvC,IAAIqC,QAAQ,OAAO;AAC5BvB,uBAAed,IAAIsC,KAAK;MAC1B;AAEA,YAAME,UAAU,KAAKC,yBAAyBL,QAAQI,OAAO;AAE7D,aAAO;QACLlC,KAAK8B,QAAQ9B,OAAO8B,QAAQzC;QAC5Ba,KAAK,KAAKxC;QACVY,MAAM4D;QACN1B;QACAjC,MAAM;UACJ4B,YAAY2B,QAAQtD,qBAAqB;YAACsD,QAAQtD;cAAsBuB;UACxEL;UACAU,eAAeC,uBAAuB;YACpCX;YACAY,iBAAiBwB,QAAQtD,qBAAqB,KAAK+B,oCAAoCuB,QAAQtD,kBAAkB,IAAI;UACvH,CAAA;UACAa,OAAOyC,QAAQzC;UACf1B,YAAYmE,QAAQnE;UACpByE,KAAKN,QAAQM;UACbC,eAAeP,QAAQO;UACvBC,aAAaR,QAAQQ;UACrB,GAAGR,QAAQS;QACb;MACF;IACF,CAAA;EACF;EAEQJ,yBAAyBD,SAAuC;AACtE,YAAQA,SAAAA;MACN,KAAK;AACH,eAAO;MACT,KAAK;MACL,KAAK;AACH,eAAO;MACT,KAAK;AACH,eAAO;MACT,KAAK;AACH,eAAO;MACT,KAAK;AACH,eAAO;MACT;AACE,cAAM,IAAIjC,MAAM,qBAAqBiC,OAAAA,EAAS;IAClD;EACF;EAEA,MAAMM,KAAKnE,MAAiC;AAC1C,UAAM,EAAEoE,QAAQC,KAAI,IAAKrE;AACzB,UAAMiB,MAAM,KAAK3B,aACb,MAAM,KAAKF,OAAO8B,QAAQoD,wBAAwB;MAChDvB,YAAYqB,OAAOzC;MACnBrC,YAAY,KAAKA;MACjB,GAAI,KAAKC,YAAY;QAAEA,UAAU,KAAKA;MAAS;MAC/C,GAAI,KAAKC,UAAU;QAAEA,QAAQ,KAAKA;MAAO;IAC3C,CAAA,IACA,MAAM,KAAKJ,OAAO8B,QAAQqD,gBAAgB;MACxCxB,YAAYqB,OAAOzC;MACnB,GAAI,KAAKpC,YAAY;QAAEA,UAAU,KAAKA;MAAS;MAC/C,GAAI,KAAKC,UAAU;QAAEA,QAAQ,KAAKA;MAAO;IAC3C,CAAA;AAEJ,UAAMgF,gBAAgB,MAAM,KAAKpF,OAAO8B,QAAQuD,4BAA4B;MAC1E9B,SAAS1B,IAAI0B;MACb+B,OAAO1F,SAASqF,MAAM,QAAA;MACtB,GAAI,KAAK9E,YAAY;QAAEA,UAAU,KAAKA;MAAS;MAC/C,GAAI,KAAKC,UAAU;QAAEA,QAAQ,KAAKA;MAAO;IAC3C,CAAA;AAEA,WAAOgF,cAAcG;EACvB;EAEA,MAAMC,OAAO5E,MAAoC;AAC/C,UAAM,EAAEoE,QAAQC,MAAMM,UAAS,IAAK3E;AACpC,UAAMiB,MAAM,KAAK3B,aACb,MAAM,KAAKF,OAAO8B,QAAQoD,wBAAwB;MAChDvB,YAAYqB,OAAOzC;MACnBrC,YAAY,KAAKA;MACjB,GAAI,KAAKC,YAAY;QAAEA,UAAU,KAAKA;MAAS;MAC/C,GAAI,KAAKC,UAAU;QAAEA,QAAQ,KAAKA;MAAO;IAC3C,CAAA,IACA,MAAM,KAAKJ,OAAO8B,QAAQqD,gBAAgB;MACxCxB,YAAYqB,OAAOzC;MACnB,GAAI,KAAKpC,YAAY;QAAEA,UAAU,KAAKA;MAAS;MAC/C,GAAI,KAAKC,UAAU;QAAEA,QAAQ,KAAKA;MAAO;IAC3C,CAAA;AAEJ,UAAMqF,eAAe,MAAM,KAAKzF,OAAO8B,QAAQ4D,6BAA6B;MAC1EnC,SAAS1B,IAAI0B;MACb+B,OAAO1F,SAASqF,MAAM,QAAA;MACtBM;MACA,GAAI,KAAKpF,YAAY;QAAEA,UAAU,KAAKA;MAAS;MAC/C,GAAI,KAAKC,UAAU;QAAEA,QAAQ,KAAKA;MAAO;IAC3C,CAAA;AAEA,WAAOqF,aAAaE;EACtB;EAEA,MAAMC,aAAahF,MAAyC;AAC1D,UAAM,IAAI4B,MAAM,+CAAA;EAClB;EAEQM,sCAAsC,wBAAC/B,uBAAAA;AAC7C,YAAQA,oBAAAA;MACN,KAAK8E,mBAAmBC;MACxB,KAAKD,mBAAmBE;MACxB,KAAKF,mBAAmBG;MACxB,KAAKH,mBAAmBI;MACxB,KAAKJ,mBAAmBK;AACtB,eAAO;MACT,KAAKL,mBAAmBM;MACxB,KAAKN,mBAAmBO;MACxB,KAAKP,mBAAmBQ;AACtB,eAAO;MACT;AACE,cAAM,IAAI7D,MAAM,uBAAuBzB,kBAAAA,+BAAiD;IAC5F;EACF,GAf8C;EAiBtCG,cAAc,wBAACoF,UAAAA;AACrB,YAAQA,OAAAA;MACN,KAAK;AACH,eAAOlF,OAAOC;MAChB,KAAK;AACH,eAAOD,OAAOmF;MAChB;AACE,cAAM,IAAI/D,MAAM,aAAa8D,KAAAA,+BAAoC;IACrE;EACF,GATsB;EAWdtF,iCAAiC,wBAACH,SAAAA;AACxC,YAAQA,MAAAA;MACN,KAAK;AACH,eAAOgF,mBAAmBC;MAC5B,KAAK;AACH,eAAOD,mBAAmBE;MAC5B,KAAK;AACH,eAAOF,mBAAmBG;MAC5B;AACE,cAAM,IAAIxD,MAAM,YAAY3B,IAAAA,+BAAmC;IACnE;EACF,GAXyC;EAajCwB,mBAAmB,wBAACf,QAAAA;AAC1B,YAAQA,KAAAA;MACN,KAAK;AACH,eAAOkF,uBAAuBC;MAChC,KAAK;AACH,eAAOD,uBAAuBE;MAChC,KAAK;AACH,eAAOF,uBAAuBG;MAChC,KAAK;AACH,eAAOH,uBAAuBI;MAChC,KAAK;AACH,eAAOJ,uBAAuBK;MAChC,KAAK;AACH,eAAOL,uBAAuBM;MAChC,KAAK;AACH,eAAON,uBAAuBO;MAChC,KAAK;AACH,eAAOP,uBAAuBQ;MAChC,KAAK;AACH,eAAOR,uBAAuBS;MAChC,KAAK;AACH,eAAOT,uBAAuBU;MAChC,KAAK;AACH,eAAOV,uBAAuBW;MAChC,KAAK;AACH,eAAOX,uBAAuBY;MAChC,KAAK;AACH,eAAOZ,uBAAuBa;MAChC,KAAK;AACH,eAAOb,uBAAuBc;MAChC,KAAK;AACH,eAAOd,uBAAuBe;MAChC;AACE,cAAM,IAAI/E,MAAM,uBAAuBlB,GAAAA,+BAAkC;IAC7E;EACF,GAnC2B;EAqCnBkG,kBAAkB,wBAACC,cAAAA;AACzB,YAAQA,WAAAA;MACN,KAAK;AACH,eAAOhG,cAAcC;MACvB,KAAK;AACH,eAAOD,cAAciG;MACvB,KAAK;AACH,eAAOjG,cAAckG;MACvB,KAAK;AACH,eAAOlG,cAAcmG;MACvB,KAAK;AACH,eAAOnG,cAAcoG;MACvB,KAAK;AACH,eAAOpG,cAAcqG;MACvB,KAAK;AACH,eAAOrG,cAAcsG;MACvB,KAAK;AACH,eAAOtG,cAAcuG;MACvB;AACE,cAAM,IAAIxF,MAAM,iBAAiBiF,SAAAA,+BAAwC;IAC7E;EACF,GArB0B;EAuBlBjG,mBAAmB,wBAACyG,eAAAA;AAC1B,WAAOA,WAAW7D,IAAI,CAACqD,cAAc,KAAKD,gBAAgBC,SAAAA,CAAAA;EAC5D,GAF2B;EAInBS,kBAAkB,wBAACtH,SAAAA;AACzB,UAAMuH,OAAOvH,KAAKE,MAAMqH;AACxB,UAAMC,gBAAgBD,MAAMC,kBAAkBxH,KAAKyH,cAAcC,SAAS,KAAA,IAAS1H,KAAKyH,gBAAgBE,SAAS3H,KAAKyH,eAAe,SAAA;AACrI,UAAM7E,eAAegF,SAASJ,eAAe,QAAA;AAC7C,UAAMK,gBAAgBD,SAASJ,aAAAA;AAC/B,UAAMM,eAAeC,SAASnF,cAAc,QAAA;AAC5C,UAAMT,eAAe6F,SAASF,YAAAA;AAE9B,UAAM5H,OAAO,CAAC;AACd,QAAIqH,MAAM;AACRrH,WAAKqH,OAAO;QACVU,IAAIV,KAAKU,MAAMjI,KAAK2B,OAAOQ;MAC7B;AACA,UAAI+F,YAAoBX,KAAKY,uBAAuB;AACpD,UAAIZ,KAAKa,gBAAgB;AACvB,YAAI,CAACF,UAAUR,SAASH,KAAKa,cAAc,GAAG;AAC5CF,sBAAY,GAAGX,KAAKa,cAAc;EAAKF,SAAAA;QACzC;MACF;AACA,UAAIA,UAAUG,SAAS,GAAG;AACxBnI,aAAKqH,KAAKY,sBAAsBD;AAChC,cAAMnE,MAAMuE,kBAAkBJ,SAAAA;AAC9B,YAAI,CAACX,KAAKgB,qBAAqB;AAG7B3F,uBAAamB,MAAMA;QACrB;AACA7D,aAAKqH,KAAKxD,MAAMA;MAClB;AACA,UAAIwD,KAAKgB,qBAAqB;AAE5B3F,qBAAa4F,MAAMjB,KAAKgB;AACxBrI,aAAKqH,KAAKiB,MAAMjB,KAAKgB;MACvB;IACF;AAEA,UAAM5G,MAAM3B,KAAK2B,OAAOzB,MAAMqH,MAAMU,MAAM9F;AAC1C,WAAO;MACLR;MACAiB;MACA3B,KAAK;QACH0B,SAAS;UACP1B,KAAK;YACH,GAAG4G;YACHlG;YACA+B,KAAK+E,wBAAwBZ,cAAcnE,KAAK,KAAA;YAChDrD,KAAKqI,oBAAoBb,cAAcxH,KAAK,KAAA;YAC5CsI,KAAKC,mBAAmBf,cAAcc,KAAK,KAAA;UAC7C;QACF;QACAT,WAAWhI,KAAKqH,KAAKxD;MACvB;IACF;EACF,GArD0B;EAuDlB8E,wBAAwB,wBAAC7I,SAAAA;AAC/B,UAAM,EAAEyH,cAAa,IAAKzH;AAC1B,UAAM8I,eAAe/J,WAAW0I,cAAcsB,YAAW,GAAI,QAAA;AAC7D,UAAMC,YAAY,IAAIC,SAASC,GAAG,MAAA;AAClC,UAAM5H,UAAU0H,UAAUG,eAAeL,cAAc,KAAA;AACvD,UAAM3G,eAAeb,QAAQ8H,UAAU,MAAM,KAAA;AAC7C,UAAMxG,eAAeyG,MAAMlH,cAAc,WAAA;AACzC,UAAM0F,gBAAgBwB,MAAM5B,eAAe,aAAa;MAAE6B,cAAc;IAAK,CAAA;AAC7E,UAAM3H,MAAM3B,KAAK2B,OAAOiB,aAAajB,OAAOQ;AAE5C,WAAO;MACLR;MACAiB;MACA3B,KAAK;QACH0B,SAAS;UACP1B,KAAK;YACH,GAAG4G;YACHlG;YACA+B,KAAK+E,wBAAwBZ,cAAcnE,KAAK,KAAA;YAChDrD,KAAKqI,oBAAoBb,cAAcxH,KAAK,KAAA;YAC5CsI,KAAKC,mBAAmBf,cAAcc,KAAK,KAAA;UAC7C;QACF;MACF;IACF;EACF,GAzBgC;EA2BxBY,qBAAqB,wBAACvJ,SAAAA;AAC5B,UAAM,EAAEyH,cAAa,IAAKzH;AAC1B,UAAM6H,gBAAgBwB,MAAM5B,eAAe,UAAU;MAAE6B,cAAc;IAAK,CAAA;AAC1E,UAAMnH,eAAeqH,8BAA8B/B,aAAAA;AACnD,UAAM7E,eAAeyG,MAAMlH,cAAc,QAAA;AACzC,UAAMR,MAAM3B,KAAK2B,OAAOiB,aAAajB,OAAOQ;AAE5C,WAAO;MACLR;MACAiB;MACA3B,KAAK;QACH0B,SAAS;UACP1B,KAAK;YACH,GAAG4G;YACHlG;YACA+B,KAAK+E,wBAAwBZ,cAAcnE,KAAK,KAAA;YAChDrD,KAAKqI,oBAAoBb,cAAcxH,KAAK,KAAA;YAC5CsI,KAAKC,mBAAmBf,cAAcc,KAAK,KAAA;UAC7C;QACF;MACF;IACF;EACF,GAtB6B;EAwBrBpG,eAAe,wBAACvC,SAAAA;AACtB,YAAQA,KAAKC,MAAI;MACf,KAAK,OAAO;AACV,eAAO,KAAKqH,gBAAgBtH,IAAAA;MAC9B;MACA,KAAK,aAAa;AAChB,eAAO,KAAK6I,sBAAsB7I,IAAAA;MACpC;MACA,KAAK,UAAU;AACb,eAAO,KAAKuJ,mBAAmBvJ,IAAAA;MACjC;MACA;AACE,cAAM,IAAI4B,MAAM,YAAY5B,KAAKC,IAAI,+BAA+B;IACxE;EACF,GAduB;AAezB;","names":["calculateJwkThumbprint","toJwk","x25519PublicHexFromPrivateHex","hexToPEM","jwkToPEM","pemCertChainTox5c","PEMToHex","PEMToJwk","CurveFromJSONTyped","JwkKeyTypeFromJSONTyped","JwkUse","JwkUseFromJSONTyped","KeyOperations","KmsRestClient","ListKeysResponseToJSONTyped","SignatureAlgorithm","JoseSignatureAlgorithm","AbstractKeyManagementSystem","elliptic","u8a","fromString","toString","u8a","RestKeyManagementSystem","AbstractKeyManagementSystem","client","id","providerId","tenantId","userId","options","config","baseUrl","authOpts","applicationId","KmsRestClient","createKey","args","type","meta","signatureAlgorithm","mapKeyTypeToSignatureAlgorithm","use","mapKeyUsage","keyUsage","JwkUse","Sig","alg","keyOperations","mapKeyOperations","KeyOperations","Sign","keyAlias","alias","key","methods","kmsClientProviderGenerateKey","kmsClientGenerateKey","jwk","keyPair","jose","publicJwk","mapJoseAlgorithm","undefined","kid","Error","kms","algorithms","jwkThumbprint","calculateJwkThumbprint","digestAlgorithm","signatureAlgorithmToDigestAlgorithm","publicKeyHex","Buffer","from","importKey","mapImportKey","result","kmsClientProviderStoreKey","kmsClientStoreKey","keyInfo","publicKeyJwk","deleteKey","kmsClientProviderDeleteKey","aliasOrKid","kmsClientDeleteKey","listKeys","keys","kmsClientProviderListKeys","kmsClientListKeys","restKeys","ListKeysResponseToJSONTyped","keyInfos","map","restKey","kty","x","n","keyType","mapRestKeyTypeToTKeyType","x5c","keyVisibility","keyEncoding","opts","sign","keyRef","data","kmsClientProviderGetKey","kmsClientGetKey","signingResult","kmsClientCreateRawSignature","input","signature","verify","verification","kmsClientIsValidRawSignature","isValid","sharedSecret","SignatureAlgorithm","EcdsaSha256","RsaSsaPssSha256Mgf1","EckaDhSha256","HmacSha256","Es256K","EcdsaSha512","HmacSha512","RsaSsaPssSha512Mgf1","usage","Enc","JoseSignatureAlgorithm","RS256","RS384","RS512","ES256","ES256K","ES384","ES512","EdDSA","HS256","HS384","HS512","PS256","PS384","PS512","none","mapKeyOperation","operation","Verify","WrapKey","DeriveKey","UnwrapKey","Decrypt","DeriveBits","Encrypt","operations","mapImportRsaKey","x509","privateKeyPEM","privateKeyHex","includes","hexToPEM","PEMToJwk","privateKeyJwk","publicKeyPEM","jwkToPEM","PEMToHex","cn","certChain","certificateChainPEM","certificatePEM","length","pemCertChainTox5c","certificateChainURL","x5u","JwkKeyTypeFromJSONTyped","JwkUseFromJSONTyped","crv","CurveFromJSONTyped","mapImportSecp256r1Key","privateBytes","toLowerCase","secp256r1","elliptic","ec","keyFromPrivate","getPublic","toJwk","isPrivateKey","mapImportX25519Key","x25519PublicHexFromPrivateHex"]}
+{"version":3,"sources":["../src/RestKeyManagementSystem.ts"],"sourcesContent":["import {\n  base64ToBase64Url,\n  calculateJwkThumbprint,\n  isHashString,\n  joseAlgorithmToDigest,\n  jwkToRawHexKey,\n  shaHasher,\n  toJwk,\n  x25519PublicHexFromPrivateHex,\n  type X509Opts,\n} from '@sphereon/ssi-sdk-ext.key-utils'\nimport { hexToPEM, jwkToPEM, pemCertChainTox5c, PEMToHex, PEMToJwk } from '@sphereon/ssi-sdk-ext.x509-utils'\nimport type { ManagedKeyInfo as RestManagedKeyInfo } from '@sphereon/ssi-sdk.kms-rest-client'\nimport {\n  CurveFromJSONTyped,\n  JwkKeyTypeFromJSONTyped,\n  JwkUse,\n  JwkUseFromJSONTyped,\n  KeyOperations,\n  KmsRestClient,\n  ListKeysResponseToJSONTyped,\n  type RestClientAuthenticationOpts,\n  SignatureAlgorithm,\n  type StoreKey,\n} from '@sphereon/ssi-sdk.kms-rest-client'\nimport { JoseSignatureAlgorithm, type JWK } from '@sphereon/ssi-types'\nimport type { ManagedKeyInfo, TKeyType } from '@veramo/core'\nimport { AbstractKeyManagementSystem } from '@veramo/key-manager'\nimport elliptic from 'elliptic'\n// @ts-ignore\nimport * as u8a from 'uint8arrays'\nimport type { CreateKeyArgs, DeleteKeyArgs, ImportKeyArgs, MapImportKeyArgs, MappedImportKey, SharedSecretArgs, SignArgs, VerifyArgs } from './types'\n\nconst { fromString, toString } = u8a\n\ninterface KeyManagementSystemOptions {\n  applicationId: string\n  baseUrl: string\n  providerId?: string\n  tenantId?: string\n  userId?: string\n  authOpts?: RestClientAuthenticationOpts\n}\n\nexport class RestKeyManagementSystem extends AbstractKeyManagementSystem {\n  private client: KmsRestClient\n  private readonly id: string\n  private providerId: string | undefined\n  private tenantId: string | undefined\n  private userId: string | undefined\n\n  constructor(options: KeyManagementSystemOptions) {\n    super()\n\n    const config = {\n      baseUrl: options.baseUrl,\n      authOpts: options.authOpts,\n    }\n\n    this.id = options.applicationId\n    this.providerId = options.providerId\n    this.tenantId = options.tenantId\n    this.userId = options.userId\n    this.client = new KmsRestClient(config)\n  }\n\n  async createKey(args: CreateKeyArgs): Promise<ManagedKeyInfo> {\n    const { type, meta } = args\n\n    const signatureAlgorithm = this.mapKeyTypeToSignatureAlgorithm(type)\n    const options = {\n      use: meta && 'keyUsage' in meta ? this.mapKeyUsage(meta.keyUsage) : JwkUse.Sig,\n      alg: signatureAlgorithm,\n      keyOperations: meta && meta.keyOperations ? this.mapKeyOperations(meta.keyOperations as string[]) : [KeyOperations.Sign],\n      ...(meta && 'keyAlias' in meta && meta.keyAlias ? { alias: meta.keyAlias } : {}),\n      ...(this.tenantId && { tenantId: this.tenantId }),\n      ...(this.userId && { userId: this.userId }),\n    }\n\n    const key = this.providerId\n      ? await this.client.methods.kmsClientProviderGenerateKey({\n          ...options,\n          providerId: this.providerId,\n        })\n      : await this.client.methods.kmsClientGenerateKey(options)\n\n    const jwk = {\n      ...key.keyPair.jose.publicJwk,\n      alg: key.keyPair.jose.publicJwk.alg ? this.mapJoseAlgorithm(key.keyPair.jose.publicJwk.alg) : undefined,\n    } satisfies JWK\n\n    const kid = key.keyPair.kid ?? key.keyPair.jose.publicJwk.kid\n    if (!kid) {\n      throw new Error(`No kid present in key`)\n    }\n\n    return {\n      kid,\n      kms: this.id,\n      type,\n      meta: {\n        alias: key.keyPair.alias,\n        algorithms: [key.keyPair.jose.publicJwk.alg ?? 'PS256'],\n        jwkThumbprint: calculateJwkThumbprint({\n          jwk,\n          digestAlgorithm: jwk.alg ? joseAlgorithmToDigest(jwk.alg) : 'sha256',\n        }),\n      },\n      publicKeyHex: Buffer.from(key.keyPair.jose.publicJwk.toString(), 'utf8').toString('base64'),\n    }\n  }\n\n  async importKey(args: ImportKeyArgs): Promise<ManagedKeyInfo> {\n    const { type } = args\n    const importKey = this.mapImportKey(args)\n\n    const result = this.providerId\n      ? await this.client.methods.kmsClientProviderStoreKey({\n          ...importKey.key,\n          providerId: this.providerId,\n          ...(this.tenantId && { tenantId: this.tenantId }),\n          ...(this.userId && { userId: this.userId }),\n        })\n      : await this.client.methods.kmsClientStoreKey({\n          ...importKey.key,\n          ...(this.tenantId && { tenantId: this.tenantId }),\n          ...(this.userId && { userId: this.userId }),\n        })\n\n    return {\n      kid: importKey.kid,\n      kms: this.id,\n      type,\n      meta: {\n        alias: importKey.key.keyInfo.alias,\n        algorithms: [result.keyInfo.key.alg ?? 'PS256'],\n        jwkThumbprint: calculateJwkThumbprint({\n          jwk: importKey.publicKeyJwk,\n          digestAlgorithm: importKey.publicKeyJwk.alg ? joseAlgorithmToDigest(importKey.publicKeyJwk.alg) : 'sha256',\n        }),\n      },\n      publicKeyHex: Buffer.from(result.keyInfo.key.toString(), 'utf8').toString('base64'),\n    }\n  }\n\n  async deleteKey(args: DeleteKeyArgs): Promise<boolean> {\n    const { kid } = args\n\n    return this.providerId\n      ? await this.client.methods.kmsClientProviderDeleteKey({\n          aliasOrKid: kid,\n          providerId: this.providerId,\n          ...(this.tenantId && { tenantId: this.tenantId }),\n          ...(this.userId && { userId: this.userId }),\n        })\n      : await this.client.methods.kmsClientDeleteKey({\n          aliasOrKid: kid,\n          ...(this.tenantId && { tenantId: this.tenantId }),\n          ...(this.userId && { userId: this.userId }),\n        })\n  }\n\n  async listKeys(): Promise<ManagedKeyInfo[]> {\n    const keys = this.providerId\n      ? await this.client.methods.kmsClientProviderListKeys({\n          providerId: this.providerId,\n          ...(this.tenantId && { tenantId: this.tenantId }),\n          ...(this.userId && { userId: this.userId }),\n        })\n      : await this.client.methods.kmsClientListKeys({\n          ...(this.tenantId && { tenantId: this.tenantId }),\n          ...(this.userId && { userId: this.userId }),\n        })\n\n    const restKeys = ListKeysResponseToJSONTyped(keys, false).keyInfos\n\n    return Promise.all(\n      restKeys.map(async (restKey: RestManagedKeyInfo) => {\n        const jwk = restKey.key\n        const publicKeyHex = await jwkToRawHexKey(jwk as JWK)\n        const keyType = this.mapRestKeyTypeToTKeyType(restKey.keyType)\n\n        return {\n          kid: restKey.kid || restKey.alias,\n          kms: this.id,\n          type: keyType,\n          publicKeyHex,\n          meta: {\n            algorithms: restKey.signatureAlgorithm ? [restKey.signatureAlgorithm] : undefined,\n            jwk,\n            jwkThumbprint: calculateJwkThumbprint({\n              jwk: jwk as JWK,\n              digestAlgorithm: restKey.key.alg ? joseAlgorithmToDigest(restKey.key.alg) : 'sha256',\n            }),\n            alias: restKey.alias,\n            providerId: restKey.providerId,\n            x5c: restKey.x5c,\n            keyVisibility: restKey.keyVisibility,\n            keyEncoding: restKey.keyEncoding,\n            ...restKey.opts,\n          },\n        } satisfies ManagedKeyInfo\n      }),\n    )\n  }\n\n  private mapRestKeyTypeToTKeyType(keyType: string | undefined): TKeyType {\n    switch (keyType) {\n      case 'RSA':\n        return 'RSA'\n      case 'EC':\n      case 'P256':\n        return 'Secp256r1'\n      case 'X25519':\n        return 'X25519'\n      case 'Ed25519':\n        return 'Ed25519'\n      case 'secp256k1':\n        return 'Secp256k1'\n      default:\n        throw new Error(`Unknown key type: ${keyType}`)\n    }\n  }\n\n  async sign(args: SignArgs): Promise<string> {\n    const { keyRef, data, algorithm = 'SHA-256' } = args\n    const key = this.providerId\n      ? await this.client.methods.kmsClientProviderGetKey({\n          aliasOrKid: keyRef.kid,\n          providerId: this.providerId,\n          ...(this.tenantId && { tenantId: this.tenantId }),\n          ...(this.userId && { userId: this.userId }),\n        })\n      : await this.client.methods.kmsClientGetKey({\n          aliasOrKid: keyRef.kid,\n          ...(this.tenantId && { tenantId: this.tenantId }),\n          ...(this.userId && { userId: this.userId }),\n        })\n\n    // with remote signing we are not going to send the whole data over the network, we need to hash it (unless we already get a hash\n    const dataToBeSigned: Uint8Array = isHashString(data)\n      ? data\n      : shaHasher(data.buffer.slice(data.byteOffset, data.byteOffset + data.byteLength), algorithm)\n    const signingResult = await this.client.methods.kmsClientCreateRawSignature({\n      keyInfo: key.keyInfo,\n      input: toString(dataToBeSigned, 'base64'),\n      ...(this.tenantId && { tenantId: this.tenantId }),\n      ...(this.userId && { userId: this.userId }),\n    })\n\n    return base64ToBase64Url(signingResult.signature)\n  }\n\n  async verify(args: VerifyArgs): Promise<boolean> {\n    const { keyRef, data, signature, algorithm = 'SHA-256' } = args\n    const key = this.providerId\n      ? await this.client.methods.kmsClientProviderGetKey({\n          aliasOrKid: keyRef.kid,\n          providerId: this.providerId,\n          ...(this.tenantId && { tenantId: this.tenantId }),\n          ...(this.userId && { userId: this.userId }),\n        })\n      : await this.client.methods.kmsClientGetKey({\n          aliasOrKid: keyRef.kid,\n          ...(this.tenantId && { tenantId: this.tenantId }),\n          ...(this.userId && { userId: this.userId }),\n        })\n\n    // with remote signing we are not going to send the whole data over the network, we need to hash it (unless we already get a hash\n    const dataToBeVerified: Uint8Array = isHashString(data)\n      ? data\n      : shaHasher(data.buffer.slice(data.byteOffset, data.byteOffset + data.byteLength), algorithm)\n    const verification = await this.client.methods.kmsClientIsValidRawSignature({\n      keyInfo: key.keyInfo,\n      input: toString(dataToBeVerified, 'base64'),\n      signature,\n      ...(this.tenantId && { tenantId: this.tenantId }),\n      ...(this.userId && { userId: this.userId }),\n    })\n\n    return verification.isValid\n  }\n\n  async sharedSecret(args: SharedSecretArgs): Promise<string> {\n    throw new Error('sharedSecret is not implemented for REST KMS.')\n  }\n\n  private mapKeyUsage = (usage: string): JwkUse => {\n    switch (usage) {\n      case 'sig':\n        return JwkUse.Sig\n      case 'enc':\n        return JwkUse.Enc\n      default:\n        throw new Error(`Key usage ${usage} is not supported by REST KMS`)\n    }\n  }\n\n  private mapKeyTypeToSignatureAlgorithm = (type: TKeyType): SignatureAlgorithm => {\n    switch (type) {\n      case 'Secp256r1':\n        return SignatureAlgorithm.EcdsaSha256\n      case 'RSA':\n        return SignatureAlgorithm.RsaSsaPssSha256Mgf1\n      case 'X25519':\n        return SignatureAlgorithm.EckaDhSha256\n      default:\n        throw new Error(`Key type ${type} is not supported by REST KMS`)\n    }\n  }\n\n  private mapJoseAlgorithm = (alg: string): JoseSignatureAlgorithm => {\n    switch (alg) {\n      case 'RS256':\n        return JoseSignatureAlgorithm.RS256\n      case 'RS384':\n        return JoseSignatureAlgorithm.RS384\n      case 'RS512':\n        return JoseSignatureAlgorithm.RS512\n      case 'ES256':\n        return JoseSignatureAlgorithm.ES256\n      case 'ES256K':\n        return JoseSignatureAlgorithm.ES256K\n      case 'ES384':\n        return JoseSignatureAlgorithm.ES384\n      case 'ES512':\n        return JoseSignatureAlgorithm.ES512\n      case 'EdDSA':\n        return JoseSignatureAlgorithm.EdDSA\n      case 'HS256':\n        return JoseSignatureAlgorithm.HS256\n      case 'HS384':\n        return JoseSignatureAlgorithm.HS384\n      case 'HS512':\n        return JoseSignatureAlgorithm.HS512\n      case 'PS256':\n        return JoseSignatureAlgorithm.PS256\n      case 'PS384':\n        return JoseSignatureAlgorithm.PS384\n      case 'PS512':\n        return JoseSignatureAlgorithm.PS512\n      case 'none':\n        return JoseSignatureAlgorithm.none\n      default:\n        throw new Error(`Signature algorithm ${alg} is not supported by REST KMS`)\n    }\n  }\n\n  private mapKeyOperation = (operation: string): KeyOperations => {\n    switch (operation) {\n      case 'sign':\n        return KeyOperations.Sign\n      case 'verify':\n        return KeyOperations.Verify\n      case 'wrapKey':\n        return KeyOperations.WrapKey\n      case 'deriveKey':\n        return KeyOperations.DeriveKey\n      case 'unwrapKey':\n        return KeyOperations.UnwrapKey\n      case 'decrypt':\n        return KeyOperations.Decrypt\n      case 'deriveBits':\n        return KeyOperations.DeriveBits\n      case 'encrypt':\n        return KeyOperations.Encrypt\n      default:\n        throw new Error(`Key operation ${operation} is not supported by REST KMS`)\n    }\n  }\n\n  private mapKeyOperations = (operations: string[]): KeyOperations[] => {\n    return operations.map((operation) => this.mapKeyOperation(operation))\n  }\n\n  private mapImportRsaKey = (args: MapImportKeyArgs): MappedImportKey => {\n    const x509 = args.meta?.x509 as X509Opts\n    const privateKeyPEM = x509?.privateKeyPEM ?? (args.privateKeyHex.includes('---') ? args.privateKeyHex : hexToPEM(args.privateKeyHex, 'private')) // In case we have x509 opts, the private key hex really was a PEM already (yuck)\n    const publicKeyJwk = PEMToJwk(privateKeyPEM, 'public')\n    const privateKeyJwk = PEMToJwk(privateKeyPEM)\n    const publicKeyPEM = jwkToPEM(publicKeyJwk, 'public')\n    const publicKeyHex = PEMToHex(publicKeyPEM)\n\n    const meta = {} as any\n    if (x509) {\n      meta.x509 = {\n        cn: x509.cn ?? args.kid ?? publicKeyHex,\n      }\n      let certChain: string = x509.certificateChainPEM ?? ''\n      if (x509.certificatePEM) {\n        if (!certChain.includes(x509.certificatePEM)) {\n          certChain = `${x509.certificatePEM}\\n${certChain}`\n        }\n      }\n      if (certChain.length > 0) {\n        meta.x509.certificateChainPEM = certChain\n        const x5c = pemCertChainTox5c(certChain)\n        if (!x509.certificateChainURL) {\n          // Do not put the chain in the JWK when the chain is hosted. We do put it in the x509 metadata\n          // @ts-ignore\n          publicKeyJwk.x5c = x5c\n        }\n        meta.x509.x5c = x5c\n      }\n      if (x509.certificateChainURL) {\n        // @ts-ignore\n        publicKeyJwk.x5u = x509.certificateChainURL\n        meta.x509.x5u = x509.certificateChainURL\n      }\n    }\n\n    const kid = args.kid ?? meta?.x509?.cn ?? publicKeyHex\n    return {\n      kid,\n      publicKeyJwk: publicKeyJwk as JWK,\n      key: {\n        keyInfo: {\n          key: {\n            ...privateKeyJwk,\n            kid,\n            kty: JwkKeyTypeFromJSONTyped(privateKeyJwk.kty, false),\n            use: JwkUseFromJSONTyped(privateKeyJwk.use, false),\n            crv: CurveFromJSONTyped(privateKeyJwk.crv, false),\n          },\n        },\n        certChain: meta.x509.x5c,\n      } satisfies StoreKey,\n    }\n  }\n\n  private mapImportSecp256r1Key = (args: MapImportKeyArgs): MappedImportKey => {\n    const { privateKeyHex } = args\n    const privateBytes = fromString(privateKeyHex.toLowerCase(), 'base16')\n    const secp256r1 = new elliptic.ec('p256')\n    const keyPair = secp256r1.keyFromPrivate(privateBytes, 'hex')\n    const publicKeyHex = keyPair.getPublic(true, 'hex')\n    const publicKeyJwk = toJwk(publicKeyHex, 'Secp256r1')\n    const privateKeyJwk = toJwk(privateKeyHex, 'Secp256r1', { isPrivateKey: true })\n    const kid = args.kid ?? publicKeyJwk.kid ?? publicKeyHex\n\n    return {\n      kid,\n      publicKeyJwk: publicKeyJwk as JWK,\n      key: {\n        keyInfo: {\n          key: {\n            ...privateKeyJwk,\n            kid,\n            kty: JwkKeyTypeFromJSONTyped(privateKeyJwk.kty, false),\n            use: JwkUseFromJSONTyped(privateKeyJwk.use, false),\n            crv: CurveFromJSONTyped(privateKeyJwk.crv, false),\n          },\n        },\n      } satisfies StoreKey,\n    }\n  }\n\n  private mapImportX25519Key = (args: MapImportKeyArgs): MappedImportKey => {\n    const { privateKeyHex } = args\n    const privateKeyJwk = toJwk(privateKeyHex, 'X25519', { isPrivateKey: true })\n    const publicKeyHex = x25519PublicHexFromPrivateHex(privateKeyHex)\n    const publicKeyJwk = toJwk(publicKeyHex, 'X25519')\n    const kid = args.kid ?? publicKeyJwk.kid ?? publicKeyHex\n\n    return {\n      kid,\n      publicKeyJwk: publicKeyJwk as JWK,\n      key: {\n        keyInfo: {\n          key: {\n            ...privateKeyJwk,\n            kid,\n            kty: JwkKeyTypeFromJSONTyped(privateKeyJwk.kty, false),\n            use: JwkUseFromJSONTyped(privateKeyJwk.use, false),\n            crv: CurveFromJSONTyped(privateKeyJwk.crv, false),\n          },\n        },\n      } satisfies StoreKey,\n    }\n  }\n\n  private mapImportKey = (args: MapImportKeyArgs): MappedImportKey => {\n    switch (args.type) {\n      case 'RSA': {\n        return this.mapImportRsaKey(args)\n      }\n      case 'Secp256r1': {\n        return this.mapImportSecp256r1Key(args)\n      }\n      case 'X25519': {\n        return this.mapImportX25519Key(args)\n      }\n      default:\n        throw new Error(`Key type ${args.type} is not supported by REST KMS`)\n    }\n  }\n}\n"],"mappings":";;;;AAAA,SACEA,mBACAC,wBACAC,cACAC,uBACAC,gBACAC,WACAC,OACAC,qCAEK;AACP,SAASC,UAAUC,UAAUC,mBAAmBC,UAAUC,gBAAgB;AAE1E,SACEC,oBACAC,yBACAC,QACAC,qBACAC,eACAC,eACAC,6BAEAC,0BAEK;AACP,SAASC,8BAAwC;AAEjD,SAASC,mCAAmC;AAC5C,OAAOC,cAAc;AAErB,YAAYC,SAAS;AAGrB,IAAM,EAAEC,YAAYC,SAAQ,IAAKC;AAW1B,IAAMC,0BAAN,cAAsCC,4BAAAA;EA5C7C,OA4C6CA;;;EACnCC;EACSC;EACTC;EACAC;EACAC;EAER,YAAYC,SAAqC;AAC/C,UAAK;AAEL,UAAMC,SAAS;MACbC,SAASF,QAAQE;MACjBC,UAAUH,QAAQG;IACpB;AAEA,SAAKP,KAAKI,QAAQI;AAClB,SAAKP,aAAaG,QAAQH;AAC1B,SAAKC,WAAWE,QAAQF;AACxB,SAAKC,SAASC,QAAQD;AACtB,SAAKJ,SAAS,IAAIU,cAAcJ,MAAAA;EAClC;EAEA,MAAMK,UAAUC,MAA8C;AAC5D,UAAM,EAAEC,MAAMC,KAAI,IAAKF;AAEvB,UAAMG,qBAAqB,KAAKC,+BAA+BH,IAAAA;AAC/D,UAAMR,UAAU;MACdY,KAAKH,QAAQ,cAAcA,OAAO,KAAKI,YAAYJ,KAAKK,QAAQ,IAAIC,OAAOC;MAC3EC,KAAKP;MACLQ,eAAeT,QAAQA,KAAKS,gBAAgB,KAAKC,iBAAiBV,KAAKS,aAAa,IAAgB;QAACE,cAAcC;;MACnH,GAAIZ,QAAQ,cAAcA,QAAQA,KAAKa,WAAW;QAAEC,OAAOd,KAAKa;MAAS,IAAI,CAAC;MAC9E,GAAI,KAAKxB,YAAY;QAAEA,UAAU,KAAKA;MAAS;MAC/C,GAAI,KAAKC,UAAU;QAAEA,QAAQ,KAAKA;MAAO;IAC3C;AAEA,UAAMyB,MAAM,KAAK3B,aACb,MAAM,KAAKF,OAAO8B,QAAQC,6BAA6B;MACrD,GAAG1B;MACHH,YAAY,KAAKA;IACnB,CAAA,IACA,MAAM,KAAKF,OAAO8B,QAAQE,qBAAqB3B,OAAAA;AAEnD,UAAM4B,MAAM;MACV,GAAGJ,IAAIK,QAAQC,KAAKC;MACpBd,KAAKO,IAAIK,QAAQC,KAAKC,UAAUd,MAAM,KAAKe,iBAAiBR,IAAIK,QAAQC,KAAKC,UAAUd,GAAG,IAAIgB;IAChG;AAEA,UAAMC,MAAMV,IAAIK,QAAQK,OAAOV,IAAIK,QAAQC,KAAKC,UAAUG;AAC1D,QAAI,CAACA,KAAK;AACR,YAAM,IAAIC,MAAM,uBAAuB;IACzC;AAEA,WAAO;MACLD;MACAE,KAAK,KAAKxC;MACVY;MACAC,MAAM;QACJc,OAAOC,IAAIK,QAAQN;QACnBc,YAAY;UAACb,IAAIK,QAAQC,KAAKC,UAAUd,OAAO;;QAC/CqB,eAAeC,uBAAuB;UACpCX;UACAY,iBAAiBZ,IAAIX,MAAMwB,sBAAsBb,IAAIX,GAAG,IAAI;QAC9D,CAAA;MACF;MACAyB,cAAcC,OAAOC,KAAKpB,IAAIK,QAAQC,KAAKC,UAAUxC,SAAQ,GAAI,MAAA,EAAQA,SAAS,QAAA;IACpF;EACF;EAEA,MAAMsD,UAAUtC,MAA8C;AAC5D,UAAM,EAAEC,KAAI,IAAKD;AACjB,UAAMsC,YAAY,KAAKC,aAAavC,IAAAA;AAEpC,UAAMwC,SAAS,KAAKlD,aAChB,MAAM,KAAKF,OAAO8B,QAAQuB,0BAA0B;MAClD,GAAGH,UAAUrB;MACb3B,YAAY,KAAKA;MACjB,GAAI,KAAKC,YAAY;QAAEA,UAAU,KAAKA;MAAS;MAC/C,GAAI,KAAKC,UAAU;QAAEA,QAAQ,KAAKA;MAAO;IAC3C,CAAA,IACA,MAAM,KAAKJ,OAAO8B,QAAQwB,kBAAkB;MAC1C,GAAGJ,UAAUrB;MACb,GAAI,KAAK1B,YAAY;QAAEA,UAAU,KAAKA;MAAS;MAC/C,GAAI,KAAKC,UAAU;QAAEA,QAAQ,KAAKA;MAAO;IAC3C,CAAA;AAEJ,WAAO;MACLmC,KAAKW,UAAUX;MACfE,KAAK,KAAKxC;MACVY;MACAC,MAAM;QACJc,OAAOsB,UAAUrB,IAAI0B,QAAQ3B;QAC7Bc,YAAY;UAACU,OAAOG,QAAQ1B,IAAIP,OAAO;;QACvCqB,eAAeC,uBAAuB;UACpCX,KAAKiB,UAAUM;UACfX,iBAAiBK,UAAUM,aAAalC,MAAMwB,sBAAsBI,UAAUM,aAAalC,GAAG,IAAI;QACpG,CAAA;MACF;MACAyB,cAAcC,OAAOC,KAAKG,OAAOG,QAAQ1B,IAAIjC,SAAQ,GAAI,MAAA,EAAQA,SAAS,QAAA;IAC5E;EACF;EAEA,MAAM6D,UAAU7C,MAAuC;AACrD,UAAM,EAAE2B,IAAG,IAAK3B;AAEhB,WAAO,KAAKV,aACR,MAAM,KAAKF,OAAO8B,QAAQ4B,2BAA2B;MACnDC,YAAYpB;MACZrC,YAAY,KAAKA;MACjB,GAAI,KAAKC,YAAY;QAAEA,UAAU,KAAKA;MAAS;MAC/C,GAAI,KAAKC,UAAU;QAAEA,QAAQ,KAAKA;MAAO;IAC3C,CAAA,IACA,MAAM,KAAKJ,OAAO8B,QAAQ8B,mBAAmB;MAC3CD,YAAYpB;MACZ,GAAI,KAAKpC,YAAY;QAAEA,UAAU,KAAKA;MAAS;MAC/C,GAAI,KAAKC,UAAU;QAAEA,QAAQ,KAAKA;MAAO;IAC3C,CAAA;EACN;EAEA,MAAMyD,WAAsC;AAC1C,UAAMC,OAAO,KAAK5D,aACd,MAAM,KAAKF,OAAO8B,QAAQiC,0BAA0B;MAClD7D,YAAY,KAAKA;MACjB,GAAI,KAAKC,YAAY;QAAEA,UAAU,KAAKA;MAAS;MAC/C,GAAI,KAAKC,UAAU;QAAEA,QAAQ,KAAKA;MAAO;IAC3C,CAAA,IACA,MAAM,KAAKJ,OAAO8B,QAAQkC,kBAAkB;MAC1C,GAAI,KAAK7D,YAAY;QAAEA,UAAU,KAAKA;MAAS;MAC/C,GAAI,KAAKC,UAAU;QAAEA,QAAQ,KAAKA;MAAO;IAC3C,CAAA;AAEJ,UAAM6D,WAAWC,4BAA4BJ,MAAM,KAAA,EAAOK;AAE1D,WAAOC,QAAQC,IACbJ,SAASK,IAAI,OAAOC,YAAAA;AAClB,YAAMtC,MAAMsC,QAAQ1C;AACpB,YAAMkB,eAAe,MAAMyB,eAAevC,GAAAA;AAC1C,YAAMwC,UAAU,KAAKC,yBAAyBH,QAAQE,OAAO;AAE7D,aAAO;QACLlC,KAAKgC,QAAQhC,OAAOgC,QAAQ3C;QAC5Ba,KAAK,KAAKxC;QACVY,MAAM4D;QACN1B;QACAjC,MAAM;UACJ4B,YAAY6B,QAAQxD,qBAAqB;YAACwD,QAAQxD;cAAsBuB;UACxEL;UACAU,eAAeC,uBAAuB;YACpCX;YACAY,iBAAiB0B,QAAQ1C,IAAIP,MAAMwB,sBAAsByB,QAAQ1C,IAAIP,GAAG,IAAI;UAC9E,CAAA;UACAM,OAAO2C,QAAQ3C;UACf1B,YAAYqE,QAAQrE;UACpByE,KAAKJ,QAAQI;UACbC,eAAeL,QAAQK;UACvBC,aAAaN,QAAQM;UACrB,GAAGN,QAAQO;QACb;MACF;IACF,CAAA,CAAA;EAEJ;EAEQJ,yBAAyBD,SAAuC;AACtE,YAAQA,SAAAA;MACN,KAAK;AACH,eAAO;MACT,KAAK;MACL,KAAK;AACH,eAAO;MACT,KAAK;AACH,eAAO;MACT,KAAK;AACH,eAAO;MACT,KAAK;AACH,eAAO;MACT;AACE,cAAM,IAAIjC,MAAM,qBAAqBiC,OAAAA,EAAS;IAClD;EACF;EAEA,MAAMM,KAAKnE,MAAiC;AAC1C,UAAM,EAAEoE,QAAQC,MAAMC,YAAY,UAAS,IAAKtE;AAChD,UAAMiB,MAAM,KAAK3B,aACb,MAAM,KAAKF,OAAO8B,QAAQqD,wBAAwB;MAChDxB,YAAYqB,OAAOzC;MACnBrC,YAAY,KAAKA;MACjB,GAAI,KAAKC,YAAY;QAAEA,UAAU,KAAKA;MAAS;MAC/C,GAAI,KAAKC,UAAU;QAAEA,QAAQ,KAAKA;MAAO;IAC3C,CAAA,IACA,MAAM,KAAKJ,OAAO8B,QAAQsD,gBAAgB;MACxCzB,YAAYqB,OAAOzC;MACnB,GAAI,KAAKpC,YAAY;QAAEA,UAAU,KAAKA;MAAS;MAC/C,GAAI,KAAKC,UAAU;QAAEA,QAAQ,KAAKA;MAAO;IAC3C,CAAA;AAGJ,UAAMiF,iBAA6BC,aAAaL,IAAAA,IAC5CA,OACAM,UAAUN,KAAKO,OAAOC,MAAMR,KAAKS,YAAYT,KAAKS,aAAaT,KAAKU,UAAU,GAAGT,SAAAA;AACrF,UAAMU,gBAAgB,MAAM,KAAK5F,OAAO8B,QAAQ+D,4BAA4B;MAC1EtC,SAAS1B,IAAI0B;MACbuC,OAAOlG,SAASyF,gBAAgB,QAAA;MAChC,GAAI,KAAKlF,YAAY;QAAEA,UAAU,KAAKA;MAAS;MAC/C,GAAI,KAAKC,UAAU;QAAEA,QAAQ,KAAKA;MAAO;IAC3C,CAAA;AAEA,WAAO2F,kBAAkBH,cAAcI,SAAS;EAClD;EAEA,MAAMC,OAAOrF,MAAoC;AAC/C,UAAM,EAAEoE,QAAQC,MAAMe,WAAWd,YAAY,UAAS,IAAKtE;AAC3D,UAAMiB,MAAM,KAAK3B,aACb,MAAM,KAAKF,OAAO8B,QAAQqD,wBAAwB;MAChDxB,YAAYqB,OAAOzC;MACnBrC,YAAY,KAAKA;MACjB,GAAI,KAAKC,YAAY;QAAEA,UAAU,KAAKA;MAAS;MAC/C,GAAI,KAAKC,UAAU;QAAEA,QAAQ,KAAKA;MAAO;IAC3C,CAAA,IACA,MAAM,KAAKJ,OAAO8B,QAAQsD,gBAAgB;MACxCzB,YAAYqB,OAAOzC;MACnB,GAAI,KAAKpC,YAAY;QAAEA,UAAU,KAAKA;MAAS;MAC/C,GAAI,KAAKC,UAAU;QAAEA,QAAQ,KAAKA;MAAO;IAC3C,CAAA;AAGJ,UAAM8F,mBAA+BZ,aAAaL,IAAAA,IAC9CA,OACAM,UAAUN,KAAKO,OAAOC,MAAMR,KAAKS,YAAYT,KAAKS,aAAaT,KAAKU,UAAU,GAAGT,SAAAA;AACrF,UAAMiB,eAAe,MAAM,KAAKnG,OAAO8B,QAAQsE,6BAA6B;MAC1E7C,SAAS1B,IAAI0B;MACbuC,OAAOlG,SAASsG,kBAAkB,QAAA;MAClCF;MACA,GAAI,KAAK7F,YAAY;QAAEA,UAAU,KAAKA;MAAS;MAC/C,GAAI,KAAKC,UAAU;QAAEA,QAAQ,KAAKA;MAAO;IAC3C,CAAA;AAEA,WAAO+F,aAAaE;EACtB;EAEA,MAAMC,aAAa1F,MAAyC;AAC1D,UAAM,IAAI4B,MAAM,+CAAA;EAClB;EAEQtB,cAAc,wBAACqF,UAAAA;AACrB,YAAQA,OAAAA;MACN,KAAK;AACH,eAAOnF,OAAOC;MAChB,KAAK;AACH,eAAOD,OAAOoF;MAChB;AACE,cAAM,IAAIhE,MAAM,aAAa+D,KAAAA,+BAAoC;IACrE;EACF,GATsB;EAWdvF,iCAAiC,wBAACH,SAAAA;AACxC,YAAQA,MAAAA;MACN,KAAK;AACH,eAAO4F,mBAAmBC;MAC5B,KAAK;AACH,eAAOD,mBAAmBE;MAC5B,KAAK;AACH,eAAOF,mBAAmBG;MAC5B;AACE,cAAM,IAAIpE,MAAM,YAAY3B,IAAAA,+BAAmC;IACnE;EACF,GAXyC;EAajCwB,mBAAmB,wBAACf,QAAAA;AAC1B,YAAQA,KAAAA;MACN,KAAK;AACH,eAAOuF,uBAAuBC;MAChC,KAAK;AACH,eAAOD,uBAAuBE;MAChC,KAAK;AACH,eAAOF,uBAAuBG;MAChC,KAAK;AACH,eAAOH,uBAAuBI;MAChC,KAAK;AACH,eAAOJ,uBAAuBK;MAChC,KAAK;AACH,eAAOL,uBAAuBM;MAChC,KAAK;AACH,eAAON,uBAAuBO;MAChC,KAAK;AACH,eAAOP,uBAAuBQ;MAChC,KAAK;AACH,eAAOR,uBAAuBS;MAChC,KAAK;AACH,eAAOT,uBAAuBU;MAChC,KAAK;AACH,eAAOV,uBAAuBW;MAChC,KAAK;AACH,eAAOX,uBAAuBY;MAChC,KAAK;AACH,eAAOZ,uBAAuBa;MAChC,KAAK;AACH,eAAOb,uBAAuBc;MAChC,KAAK;AACH,eAAOd,uBAAuBe;MAChC;AACE,cAAM,IAAIpF,MAAM,uBAAuBlB,GAAAA,+BAAkC;IAC7E;EACF,GAnC2B;EAqCnBuG,kBAAkB,wBAACC,cAAAA;AACzB,YAAQA,WAAAA;MACN,KAAK;AACH,eAAOrG,cAAcC;MACvB,KAAK;AACH,eAAOD,cAAcsG;MACvB,KAAK;AACH,eAAOtG,cAAcuG;MACvB,KAAK;AACH,eAAOvG,cAAcwG;MACvB,KAAK;AACH,eAAOxG,cAAcyG;MACvB,KAAK;AACH,eAAOzG,cAAc0G;MACvB,KAAK;AACH,eAAO1G,cAAc2G;MACvB,KAAK;AACH,eAAO3G,cAAc4G;MACvB;AACE,cAAM,IAAI7F,MAAM,iBAAiBsF,SAAAA,+BAAwC;IAC7E;EACF,GArB0B;EAuBlBtG,mBAAmB,wBAAC8G,eAAAA;AAC1B,WAAOA,WAAWhE,IAAI,CAACwD,cAAc,KAAKD,gBAAgBC,SAAAA,CAAAA;EAC5D,GAF2B;EAInBS,kBAAkB,wBAAC3H,SAAAA;AACzB,UAAM4H,OAAO5H,KAAKE,MAAM0H;AACxB,UAAMC,gBAAgBD,MAAMC,kBAAkB7H,KAAK8H,cAAcC,SAAS,KAAA,IAAS/H,KAAK8H,gBAAgBE,SAAShI,KAAK8H,eAAe,SAAA;AACrI,UAAMlF,eAAeqF,SAASJ,eAAe,QAAA;AAC7C,UAAMK,gBAAgBD,SAASJ,aAAAA;AAC/B,UAAMM,eAAeC,SAASxF,cAAc,QAAA;AAC5C,UAAMT,eAAekG,SAASF,YAAAA;AAE9B,UAAMjI,OAAO,CAAC;AACd,QAAI0H,MAAM;AACR1H,WAAK0H,OAAO;QACVU,IAAIV,KAAKU,MAAMtI,KAAK2B,OAAOQ;MAC7B;AACA,UAAIoG,YAAoBX,KAAKY,uBAAuB;AACpD,UAAIZ,KAAKa,gBAAgB;AACvB,YAAI,CAACF,UAAUR,SAASH,KAAKa,cAAc,GAAG;AAC5CF,sBAAY,GAAGX,KAAKa,cAAc;EAAKF,SAAAA;QACzC;MACF;AACA,UAAIA,UAAUG,SAAS,GAAG;AACxBxI,aAAK0H,KAAKY,sBAAsBD;AAChC,cAAMxE,MAAM4E,kBAAkBJ,SAAAA;AAC9B,YAAI,CAACX,KAAKgB,qBAAqB;AAG7BhG,uBAAamB,MAAMA;QACrB;AACA7D,aAAK0H,KAAK7D,MAAMA;MAClB;AACA,UAAI6D,KAAKgB,qBAAqB;AAE5BhG,qBAAaiG,MAAMjB,KAAKgB;AACxB1I,aAAK0H,KAAKiB,MAAMjB,KAAKgB;MACvB;IACF;AAEA,UAAMjH,MAAM3B,KAAK2B,OAAOzB,MAAM0H,MAAMU,MAAMnG;AAC1C,WAAO;MACLR;MACAiB;MACA3B,KAAK;QACH0B,SAAS;UACP1B,KAAK;YACH,GAAGiH;YACHvG;YACAmH,KAAKC,wBAAwBb,cAAcY,KAAK,KAAA;YAChDzI,KAAK2I,oBAAoBd,cAAc7H,KAAK,KAAA;YAC5C4I,KAAKC,mBAAmBhB,cAAce,KAAK,KAAA;UAC7C;QACF;QACAV,WAAWrI,KAAK0H,KAAK7D;MACvB;IACF;EACF,GArD0B;EAuDlBoF,wBAAwB,wBAACnJ,SAAAA;AAC/B,UAAM,EAAE8H,cAAa,IAAK9H;AAC1B,UAAMoJ,eAAerK,WAAW+I,cAAcuB,YAAW,GAAI,QAAA;AAC7D,UAAMC,YAAY,IAAIC,SAASC,GAAG,MAAA;AAClC,UAAMlI,UAAUgI,UAAUG,eAAeL,cAAc,KAAA;AACvD,UAAMjH,eAAeb,QAAQoI,UAAU,MAAM,KAAA;AAC7C,UAAM9G,eAAe+G,MAAMxH,cAAc,WAAA;AACzC,UAAM+F,gBAAgByB,MAAM7B,eAAe,aAAa;MAAE8B,cAAc;IAAK,CAAA;AAC7E,UAAMjI,MAAM3B,KAAK2B,OAAOiB,aAAajB,OAAOQ;AAE5C,WAAO;MACLR;MACAiB;MACA3B,KAAK;QACH0B,SAAS;UACP1B,KAAK;YACH,GAAGiH;YACHvG;YACAmH,KAAKC,wBAAwBb,cAAcY,KAAK,KAAA;YAChDzI,KAAK2I,oBAAoBd,cAAc7H,KAAK,KAAA;YAC5C4I,KAAKC,mBAAmBhB,cAAce,KAAK,KAAA;UAC7C;QACF;MACF;IACF;EACF,GAzBgC;EA2BxBY,qBAAqB,wBAAC7J,SAAAA;AAC5B,UAAM,EAAE8H,cAAa,IAAK9H;AAC1B,UAAMkI,gBAAgByB,MAAM7B,eAAe,UAAU;MAAE8B,cAAc;IAAK,CAAA;AAC1E,UAAMzH,eAAe2H,8BAA8BhC,aAAAA;AACnD,UAAMlF,eAAe+G,MAAMxH,cAAc,QAAA;AACzC,UAAMR,MAAM3B,KAAK2B,OAAOiB,aAAajB,OAAOQ;AAE5C,WAAO;MACLR;MACAiB;MACA3B,KAAK;QACH0B,SAAS;UACP1B,KAAK;YACH,GAAGiH;YACHvG;YACAmH,KAAKC,wBAAwBb,cAAcY,KAAK,KAAA;YAChDzI,KAAK2I,oBAAoBd,cAAc7H,KAAK,KAAA;YAC5C4I,KAAKC,mBAAmBhB,cAAce,KAAK,KAAA;UAC7C;QACF;MACF;IACF;EACF,GAtB6B;EAwBrB1G,eAAe,wBAACvC,SAAAA;AACtB,YAAQA,KAAKC,MAAI;MACf,KAAK,OAAO;AACV,eAAO,KAAK0H,gBAAgB3H,IAAAA;MAC9B;MACA,KAAK,aAAa;AAChB,eAAO,KAAKmJ,sBAAsBnJ,IAAAA;MACpC;MACA,KAAK,UAAU;AACb,eAAO,KAAK6J,mBAAmB7J,IAAAA;MACjC;MACA;AACE,cAAM,IAAI4B,MAAM,YAAY5B,KAAKC,IAAI,+BAA+B;IACxE;EACF,GAduB;AAezB;","names":["base64ToBase64Url","calculateJwkThumbprint","isHashString","joseAlgorithmToDigest","jwkToRawHexKey","shaHasher","toJwk","x25519PublicHexFromPrivateHex","hexToPEM","jwkToPEM","pemCertChainTox5c","PEMToHex","PEMToJwk","CurveFromJSONTyped","JwkKeyTypeFromJSONTyped","JwkUse","JwkUseFromJSONTyped","KeyOperations","KmsRestClient","ListKeysResponseToJSONTyped","SignatureAlgorithm","JoseSignatureAlgorithm","AbstractKeyManagementSystem","elliptic","u8a","fromString","toString","u8a","RestKeyManagementSystem","AbstractKeyManagementSystem","client","id","providerId","tenantId","userId","options","config","baseUrl","authOpts","applicationId","KmsRestClient","createKey","args","type","meta","signatureAlgorithm","mapKeyTypeToSignatureAlgorithm","use","mapKeyUsage","keyUsage","JwkUse","Sig","alg","keyOperations","mapKeyOperations","KeyOperations","Sign","keyAlias","alias","key","methods","kmsClientProviderGenerateKey","kmsClientGenerateKey","jwk","keyPair","jose","publicJwk","mapJoseAlgorithm","undefined","kid","Error","kms","algorithms","jwkThumbprint","calculateJwkThumbprint","digestAlgorithm","joseAlgorithmToDigest","publicKeyHex","Buffer","from","importKey","mapImportKey","result","kmsClientProviderStoreKey","kmsClientStoreKey","keyInfo","publicKeyJwk","deleteKey","kmsClientProviderDeleteKey","aliasOrKid","kmsClientDeleteKey","listKeys","keys","kmsClientProviderListKeys","kmsClientListKeys","restKeys","ListKeysResponseToJSONTyped","keyInfos","Promise","all","map","restKey","jwkToRawHexKey","keyType","mapRestKeyTypeToTKeyType","x5c","keyVisibility","keyEncoding","opts","sign","keyRef","data","algorithm","kmsClientProviderGetKey","kmsClientGetKey","dataToBeSigned","isHashString","shaHasher","buffer","slice","byteOffset","byteLength","signingResult","kmsClientCreateRawSignature","input","base64ToBase64Url","signature","verify","dataToBeVerified","verification","kmsClientIsValidRawSignature","isValid","sharedSecret","usage","Enc","SignatureAlgorithm","EcdsaSha256","RsaSsaPssSha256Mgf1","EckaDhSha256","JoseSignatureAlgorithm","RS256","RS384","RS512","ES256","ES256K","ES384","ES512","EdDSA","HS256","HS384","HS512","PS256","PS384","PS512","none","mapKeyOperation","operation","Verify","WrapKey","DeriveKey","UnwrapKey","Decrypt","DeriveBits","Encrypt","operations","mapImportRsaKey","x509","privateKeyPEM","privateKeyHex","includes","hexToPEM","PEMToJwk","privateKeyJwk","publicKeyPEM","jwkToPEM","PEMToHex","cn","certChain","certificateChainPEM","certificatePEM","length","pemCertChainTox5c","certificateChainURL","x5u","kty","JwkKeyTypeFromJSONTyped","JwkUseFromJSONTyped","crv","CurveFromJSONTyped","mapImportSecp256r1Key","privateBytes","toLowerCase","secp256r1","elliptic","ec","keyFromPrivate","getPublic","toJwk","isPrivateKey","mapImportX25519Key","x25519PublicHexFromPrivateHex"]}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@sphereon/ssi-sdk.kms-rest",
   "description": "Sphereon SSI-SDK plugin for REST Key Management System.",
-  "version": "0.34.1-feature.SSISDK.82.and.SSISDK.70.346+6bddc62b",
+  "version": "0.34.1-feature.SSISDK.82.and.SSISDK.70.352+54837639",
   "source": "./src/index.ts",
   "type": "module",
   "main": "./dist/index.cjs",
@@ -22,10 +22,10 @@
     "build": "tsup --config ../../tsup.config.ts --tsconfig ../../tsconfig.tsup.json"
   },
   "dependencies": {
-    "@sphereon/ssi-sdk-ext.key-utils": "0.34.1-feature.SSISDK.82.and.SSISDK.70.346+6bddc62b",
-    "@sphereon/ssi-sdk-ext.x509-utils": "0.34.1-feature.SSISDK.82.and.SSISDK.70.346+6bddc62b",
-    "@sphereon/ssi-sdk.kms-rest-client": "0.34.1-feature.SSISDK.82.and.SSISDK.70.346+6bddc62b",
-    "@sphereon/ssi-types": "0.34.1-feature.SSISDK.82.and.SSISDK.70.346+6bddc62b",
+    "@sphereon/ssi-sdk-ext.key-utils": "0.34.1-feature.SSISDK.82.and.SSISDK.70.352+54837639",
+    "@sphereon/ssi-sdk-ext.x509-utils": "0.34.1-feature.SSISDK.82.and.SSISDK.70.352+54837639",
+    "@sphereon/ssi-sdk.kms-rest-client": "0.34.1-feature.SSISDK.82.and.SSISDK.70.352+54837639",
+    "@sphereon/ssi-types": "0.34.1-feature.SSISDK.82.and.SSISDK.70.352+54837639",
     "@veramo/core": "4.2.0",
     "@veramo/key-manager": "4.2.0",
     "elliptic": "^6.5.4",
@@ -54,5 +54,5 @@
     "key-management",
     "Veramo"
   ],
-  "gitHead": "6bddc62b9e6c51c49ed95336ac485cde68ca8df0"
+  "gitHead": "54837639c5105ab91196f760a56749e935583712"
 }

package/src/RestKeyManagementSystem.ts

@@ -1,4 +1,14 @@
-import { calculateJwkThumbprint, toJwk, x25519PublicHexFromPrivateHex, type X509Opts } from '@sphereon/ssi-sdk-ext.key-utils'
+import {
+  base64ToBase64Url,
+  calculateJwkThumbprint,
+  isHashString,
+  joseAlgorithmToDigest,
+  jwkToRawHexKey,
+  shaHasher,
+  toJwk,
+  x25519PublicHexFromPrivateHex,
+  type X509Opts,
+} from '@sphereon/ssi-sdk-ext.key-utils'
 import { hexToPEM, jwkToPEM, pemCertChainTox5c, PEMToHex, PEMToJwk } from '@sphereon/ssi-sdk-ext.x509-utils'
 import type { ManagedKeyInfo as RestManagedKeyInfo } from '@sphereon/ssi-sdk.kms-rest-client'
 import {
@@ -93,7 +103,7 @@ export class RestKeyManagementSystem extends AbstractKeyManagementSystem {
         algorithms: [key.keyPair.jose.publicJwk.alg ?? 'PS256'],
         jwkThumbprint: calculateJwkThumbprint({
           jwk,
-          digestAlgorithm: this.signatureAlgorithmToDigestAlgorithm(signatureAlgorithm),
+          digestAlgorithm: jwk.alg ? joseAlgorithmToDigest(jwk.alg) : 'sha256',
         }),
       },
       publicKeyHex: Buffer.from(key.keyPair.jose.publicJwk.toString(), 'utf8').toString('base64'),
@@ -102,7 +112,6 @@ export class RestKeyManagementSystem extends AbstractKeyManagementSystem {
 
   async importKey(args: ImportKeyArgs): Promise<ManagedKeyInfo> {
     const { type } = args
-    const signatureAlgorithm = this.mapKeyTypeToSignatureAlgorithm(type)
     const importKey = this.mapImportKey(args)
 
     const result = this.providerId
@@ -127,7 +136,7 @@ export class RestKeyManagementSystem extends AbstractKeyManagementSystem {
         algorithms: [result.keyInfo.key.alg ?? 'PS256'],
         jwkThumbprint: calculateJwkThumbprint({
           jwk: importKey.publicKeyJwk,
-          digestAlgorithm: this.signatureAlgorithmToDigestAlgorithm(signatureAlgorithm),
+          digestAlgorithm: importKey.publicKeyJwk.alg ? joseAlgorithmToDigest(importKey.publicKeyJwk.alg) : 'sha256',
         }),
       },
       publicKeyHex: Buffer.from(result.keyInfo.key.toString(), 'utf8').toString('base64'),
@@ -165,42 +174,34 @@ export class RestKeyManagementSystem extends AbstractKeyManagementSystem {
 
     const restKeys = ListKeysResponseToJSONTyped(keys, false).keyInfos
 
-    return restKeys.map((restKey: RestManagedKeyInfo) => {
-      const jwk = restKey.key
-      let publicKeyHex = ''
-
-      // Derive publicKeyHex from JWK based on key type
-      if (jwk.kty === 'EC') {
-        publicKeyHex = jwk.x || ''
-      } else if (jwk.kty === 'RSA') {
-        publicKeyHex = jwk.n || ''
-      } else if (jwk.kty === 'OKP') {
-        publicKeyHex = jwk.x || ''
-      }
-
-      const keyType = this.mapRestKeyTypeToTKeyType(restKey.keyType)
-
-      return {
-        kid: restKey.kid || restKey.alias,
-        kms: this.id,
-        type: keyType,
-        publicKeyHex,
-        meta: {
-          algorithms: restKey.signatureAlgorithm ? [restKey.signatureAlgorithm] : undefined,
-          jwk,
-          jwkThumbprint: calculateJwkThumbprint({
-            jwk: jwk as JWK,
-            digestAlgorithm: restKey.signatureAlgorithm ? this.signatureAlgorithmToDigestAlgorithm(restKey.signatureAlgorithm) : 'sha256',
-          }),
-          alias: restKey.alias,
-          providerId: restKey.providerId,
-          x5c: restKey.x5c,
-          keyVisibility: restKey.keyVisibility,
-          keyEncoding: restKey.keyEncoding,
-          ...restKey.opts,
-        },
-      } satisfies ManagedKeyInfo
-    })
+    return Promise.all(
+      restKeys.map(async (restKey: RestManagedKeyInfo) => {
+        const jwk = restKey.key
+        const publicKeyHex = await jwkToRawHexKey(jwk as JWK)
+        const keyType = this.mapRestKeyTypeToTKeyType(restKey.keyType)
+
+        return {
+          kid: restKey.kid || restKey.alias,
+          kms: this.id,
+          type: keyType,
+          publicKeyHex,
+          meta: {
+            algorithms: restKey.signatureAlgorithm ? [restKey.signatureAlgorithm] : undefined,
+            jwk,
+            jwkThumbprint: calculateJwkThumbprint({
+              jwk: jwk as JWK,
+              digestAlgorithm: restKey.key.alg ? joseAlgorithmToDigest(restKey.key.alg) : 'sha256',
+            }),
+            alias: restKey.alias,
+            providerId: restKey.providerId,
+            x5c: restKey.x5c,
+            keyVisibility: restKey.keyVisibility,
+            keyEncoding: restKey.keyEncoding,
+            ...restKey.opts,
+          },
+        } satisfies ManagedKeyInfo
+      }),
+    )
   }
 
   private mapRestKeyTypeToTKeyType(keyType: string | undefined): TKeyType {
@@ -222,7 +223,7 @@ export class RestKeyManagementSystem extends AbstractKeyManagementSystem {
   }
 
   async sign(args: SignArgs): Promise<string> {
-    const { keyRef, data } = args
+    const { keyRef, data, algorithm = 'SHA-256' } = args
     const key = this.providerId
       ? await this.client.methods.kmsClientProviderGetKey({
           aliasOrKid: keyRef.kid,
@@ -236,18 +237,22 @@ export class RestKeyManagementSystem extends AbstractKeyManagementSystem {
           ...(this.userId && { userId: this.userId }),
         })
 
+    // with remote signing we are not going to send the whole data over the network, we need to hash it (unless we already get a hash
+    const dataToBeSigned: Uint8Array = isHashString(data)
+      ? data
+      : shaHasher(data.buffer.slice(data.byteOffset, data.byteOffset + data.byteLength), algorithm)
     const signingResult = await this.client.methods.kmsClientCreateRawSignature({
       keyInfo: key.keyInfo,
-      input: toString(data, 'base64'),
+      input: toString(dataToBeSigned, 'base64'),
       ...(this.tenantId && { tenantId: this.tenantId }),
       ...(this.userId && { userId: this.userId }),
     })
 
-    return signingResult.signature
+    return base64ToBase64Url(signingResult.signature)
   }
 
   async verify(args: VerifyArgs): Promise<boolean> {
-    const { keyRef, data, signature } = args
+    const { keyRef, data, signature, algorithm = 'SHA-256' } = args
     const key = this.providerId
       ? await this.client.methods.kmsClientProviderGetKey({
           aliasOrKid: keyRef.kid,
@@ -261,9 +266,13 @@ export class RestKeyManagementSystem extends AbstractKeyManagementSystem {
           ...(this.userId && { userId: this.userId }),
         })
 
+    // with remote signing we are not going to send the whole data over the network, we need to hash it (unless we already get a hash
+    const dataToBeVerified: Uint8Array = isHashString(data)
+      ? data
+      : shaHasher(data.buffer.slice(data.byteOffset, data.byteOffset + data.byteLength), algorithm)
     const verification = await this.client.methods.kmsClientIsValidRawSignature({
       keyInfo: key.keyInfo,
-      input: toString(data, 'base64'),
+      input: toString(dataToBeVerified, 'base64'),
       signature,
       ...(this.tenantId && { tenantId: this.tenantId }),
       ...(this.userId && { userId: this.userId }),
@@ -276,23 +285,6 @@ export class RestKeyManagementSystem extends AbstractKeyManagementSystem {
     throw new Error('sharedSecret is not implemented for REST KMS.')
   }
 
-  private signatureAlgorithmToDigestAlgorithm = (signatureAlgorithm: SignatureAlgorithm): 'sha256' | 'sha512' => {
-    switch (signatureAlgorithm) {
-      case SignatureAlgorithm.EcdsaSha256:
-      case SignatureAlgorithm.RsaSsaPssSha256Mgf1:
-      case SignatureAlgorithm.EckaDhSha256:
-      case SignatureAlgorithm.HmacSha256:
-      case SignatureAlgorithm.Es256K:
-        return 'sha256'
-      case SignatureAlgorithm.EcdsaSha512:
-      case SignatureAlgorithm.HmacSha512:
-      case SignatureAlgorithm.RsaSsaPssSha512Mgf1:
-        return 'sha512'
-      default:
-        throw new Error(`Signature algorithm ${signatureAlgorithm} is not supported by REST KMS`)
-    }
-  }
-
   private mapKeyUsage = (usage: string): JwkUse => {
     switch (usage) {
       case 'sig':

package/src/types/index.ts

@@ -15,6 +15,7 @@ export type CreateKeyArgs = {
 export type SignArgs = {
   keyRef: Pick<IKey, 'kid'>
   data: Uint8Array
+  algorithm?: string
   [x: string]: any
 }
 
@@ -22,6 +23,7 @@ export type VerifyArgs = {
   keyRef: Pick<IKey, 'kid'>
   data: Uint8Array
   signature: string
+  algorithm?: string
   [x: string]: any
 }