@workit-poa/hedera-kms-wallet 0.1.0

package/dist/index.js

@@ -0,0 +1,22 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./hederaClient"), exports);
+__exportStar(require("./hederaKeyCodec"), exports);
+__exportStar(require("./kmsKeyManager"), exports);
+__exportStar(require("./kmsSigner"), exports);
+__exportStar(require("./walletProvisioning"), exports);
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,iDAA+B;AAC/B,mDAAiC;AACjC,kDAAgC;AAChC,8CAA4B;AAC5B,uDAAqC"}

package/dist/kmsKeyManager.d.ts

@@ -0,0 +1,103 @@
+import { KMSClient, type CreateKeyCommandInput } from "@aws-sdk/client-kms";
+export type KmsAuditOperation = "CreateKey" | "CreateAlias" | "EnableKeyRotation" | "DescribeKey" | "GetPublicKey" | "ListResourceTags" | "Sign" | "ProvisionAccount" | "RotateAccountKey";
+export type KmsAuditStatus = "success" | "failure" | "skipped";
+export interface KmsAuditEvent {
+    operation: KmsAuditOperation;
+    status: KmsAuditStatus;
+    timestamp: string;
+    keyId?: string;
+    keyArn?: string;
+    aliasName?: string;
+    userId?: string;
+    accountId?: string;
+    transactionId?: string;
+    network?: string;
+    detail?: string;
+}
+export type KmsAuditLogger = (event: KmsAuditEvent) => void;
+export interface KmsKeyPolicyBindings {
+    accountId: string;
+    keyAdminPrincipalArn: string;
+    runtimeSignerPrincipalArn: string;
+}
+export interface CreateUserKmsKeyParams {
+    kms: KMSClient;
+    userId: string;
+    descriptionPrefix?: string;
+    aliasPrefix?: string;
+    tags?: NonNullable<CreateKeyCommandInput["Tags"]>;
+    keyPolicy?: Record<string, unknown>;
+    policyBindings?: KmsKeyPolicyBindings;
+    allowUnsafeDefaultKeyPolicy?: boolean;
+    auditLogger?: KmsAuditLogger;
+}
+export interface UserKmsKeyResult {
+    keyId: string;
+    keyArn: string;
+    aliasName?: string;
+    rotationEnabled: boolean;
+    rotationNote?: string;
+}
+export interface ValidatedKmsSigningKey {
+    keyId: string;
+    keyArn: string;
+}
+export declare function createUserKmsKey(params: CreateUserKmsKeyParams): Promise<UserKmsKeyResult>;
+export declare function buildLeastPrivilegeKeyPolicy(bindings: KmsKeyPolicyBindings): Record<string, unknown>;
+export declare function validateKmsSecp256k1SigningKey(kms: KMSClient, keyId: string, auditLogger?: KmsAuditLogger): Promise<ValidatedKmsSigningKey>;
+export declare function getPublicKeyBytes(kms: KMSClient, keyId: string, auditLogger?: KmsAuditLogger): Promise<Buffer>;
+export declare function assertKmsKeyOwnershipForUser(params: {
+    kms: KMSClient;
+    keyId: string;
+    userId: string;
+    expectedAppTag?: string;
+    auditLogger?: KmsAuditLogger;
+}): Promise<void>;
+export declare function kmsAccessPolicyGuidance(keyArn?: string, aliasArn?: string): {
+    runtimeSignerPolicy: {
+        Version: string;
+        Statement: ({
+            Sid: string;
+            Effect: string;
+            Action: string[];
+            Resource: string;
+            Condition: {
+                StringEquals: {
+                    "kms:SigningAlgorithm": string;
+                };
+            };
+        } | {
+            Sid: string;
+            Effect: string;
+            Action: string[];
+            Resource: string;
+            Condition?: undefined;
+        })[];
+    };
+    keyAdminPolicy: {
+        Version: string;
+        Statement: ({
+            Sid: string;
+            Effect: string;
+            Action: string[];
+            Resource: string;
+            Condition: {
+                StringEquals: {
+                    "kms:KeySpec": string;
+                    "kms:KeyUsage": string;
+                    "aws:RequestTag/app": string;
+                };
+                "ForAllValues:StringEquals": {
+                    "aws:TagKeys": string[];
+                };
+            };
+        } | {
+            Sid: string;
+            Effect: string;
+            Action: string[];
+            Resource: string;
+            Condition?: undefined;
+        })[];
+    };
+};
+//# sourceMappingURL=kmsKeyManager.d.ts.map

package/dist/kmsKeyManager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"kmsKeyManager.d.ts","sourceRoot":"","sources":["../src/kmsKeyManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAML,SAAS,EAET,KAAK,qBAAqB,EAE3B,MAAM,qBAAqB,CAAC;AAK7B,MAAM,MAAM,iBAAiB,GACzB,WAAW,GACX,aAAa,GACb,mBAAmB,GACnB,aAAa,GACb,cAAc,GACd,kBAAkB,GAClB,MAAM,GACN,kBAAkB,GAClB,kBAAkB,CAAC;AACvB,MAAM,MAAM,cAAc,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;AAE/D,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,iBAAiB,CAAC;IAC7B,MAAM,EAAE,cAAc,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,cAAc,GAAG,CAAC,KAAK,EAAE,aAAa,KAAK,IAAI,CAAC;AAE5D,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,yBAAyB,EAAE,MAAM,CAAC;CACnC;AAED,MAAM,WAAW,sBAAsB;IACrC,GAAG,EAAE,SAAS,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,WAAW,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAC,CAAC;IAClD,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpC,cAAc,CAAC,EAAE,oBAAoB,CAAC;IACtC,2BAA2B,CAAC,EAAE,OAAO,CAAC;IACtC,WAAW,CAAC,EAAE,cAAc,CAAC;CAC9B;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,EAAE,OAAO,CAAC;IACzB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,sBAAsB;IACrC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB;AAoKD,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,sBAAsB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAsFhG;AAED,wBAAgB,4BAA4B,CAAC,QAAQ,EAAE,oBAAoB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAiEpG;AAED,wBAAsB,8BAA8B,CAClD,GAAG,EAAE,SAAS,EACd,KAAK,EAAE,MAAM,EACb,WAAW,CAAC,EAAE,cAAc,GAC3B,OAAO,CAAC,sBAAsB,CAAC,CAsEjC;AAED,wBAAsB,iBAAiB,CAAC,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC,CAiCpH;AAED,wBAAsB,4BAA4B,CAAC,MAAM,EAAE;IACzD,GAAG,EAAE,SAAS,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,WAAW,CAAC,EAAE,cAAc,CAAC;CAC9B,GAAG,OAAO,CAAC,IAAI,CAAC,CAkEhB;AAED,wBAAgB,uBAAuB,CACrC,MAAM,SAA6C,EACnD,QAAQ,SAAsD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAsE/D"}

package/dist/kmsKeyManager.js

@@ -0,0 +1,496 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createUserKmsKey = createUserKmsKey;
+exports.buildLeastPrivilegeKeyPolicy = buildLeastPrivilegeKeyPolicy;
+exports.validateKmsSecp256k1SigningKey = validateKmsSecp256k1SigningKey;
+exports.getPublicKeyBytes = getPublicKeyBytes;
+exports.assertKmsKeyOwnershipForUser = assertKmsKeyOwnershipForUser;
+exports.kmsAccessPolicyGuidance = kmsAccessPolicyGuidance;
+const client_kms_1 = require("@aws-sdk/client-kms");
+const AWS_ACCOUNT_ID_PATTERN = /^\d{12}$/;
+const IAM_PRINCIPAL_ARN_PATTERN = /^arn:aws[a-zA-Z-]*:iam::\d{12}:(?:root|role\/[\w+=,.@\-_/]+|user\/[\w+=,.@\-_/]+)$/;
+function emitAuditEvent(auditLogger, event) {
+    if (!auditLogger) {
+        return;
+    }
+    auditLogger({
+        ...event,
+        timestamp: new Date().toISOString()
+    });
+}
+function normalizeAwsAccountId(accountId) {
+    const value = accountId.trim();
+    if (!AWS_ACCOUNT_ID_PATTERN.test(value)) {
+        throw new Error(`Invalid AWS account id "${accountId}". Expected a 12-digit account id.`);
+    }
+    return value;
+}
+function normalizePrincipalArn(principalArn, fieldName) {
+    const value = principalArn.trim();
+    if (!IAM_PRINCIPAL_ARN_PATTERN.test(value)) {
+        throw new Error(`Invalid ${fieldName} "${principalArn}". Expected an IAM principal ARN like arn:aws:iam::123456789012:role/RoleName.`);
+    }
+    return value;
+}
+function normalizeTags(userId, tags) {
+    const defaultTags = [
+        { TagKey: "app", TagValue: "workit" },
+        { TagKey: "userId", TagValue: userId }
+    ];
+    if (!tags) {
+        return defaultTags;
+    }
+    const byTagKey = new Map();
+    for (const tag of defaultTags) {
+        byTagKey.set(tag.TagKey, tag.TagValue);
+    }
+    for (const tag of tags) {
+        if (!tag.TagKey) {
+            throw new Error("KMS key tags must include a non-empty TagKey.");
+        }
+        if (tag.TagValue === undefined) {
+            continue;
+        }
+        if (tag.TagKey === "userId" && tag.TagValue !== userId) {
+            throw new Error(`The userId tag must match the normalized user id "${userId}".`);
+        }
+        byTagKey.set(tag.TagKey, tag.TagValue);
+    }
+    if (!byTagKey.get("app")) {
+        byTagKey.set("app", "workit");
+    }
+    if (!byTagKey.get("userId")) {
+        byTagKey.set("userId", userId);
+    }
+    return Array.from(byTagKey.entries()).map(([TagKey, TagValue]) => ({ TagKey, TagValue }));
+}
+function normalizeAliasName(userId, aliasPrefix = "alias/workit/user") {
+    const normalizedUserId = userId.replace(/[^a-zA-Z0-9/_-]/g, "-").replace(/-+/g, "-");
+    const trimmedAliasPrefix = aliasPrefix.trim();
+    if (!trimmedAliasPrefix) {
+        throw new Error("aliasPrefix is required");
+    }
+    const normalizedPrefix = trimmedAliasPrefix.replace(/^alias\/+/, "");
+    const prefix = `alias/${normalizedPrefix}`.replace(/\/+$/, "");
+    return `${prefix}/${normalizedUserId}`;
+}
+function isUnsupportedAsymmetricRotationError(error) {
+    const name = typeof error === "object" && error ? String(error.name ?? "") : "";
+    const message = error instanceof Error ? error.message : String(error);
+    const lowerName = name.toLowerCase();
+    const lowerMessage = message.toLowerCase();
+    return (lowerName.includes("unsupportedoperationexception") ||
+        lowerName.includes("unsupportedoperation") ||
+        (lowerMessage.includes("asymmetric") && lowerMessage.includes("rotation")) ||
+        (lowerMessage.includes("automatic rotation") && lowerMessage.includes("not supported")));
+}
+function resolveCreateKeyPolicy(params) {
+    if (params.keyPolicy) {
+        throw new Error("Custom keyPolicy overrides are not allowed. Use policyBindings to enforce least-privilege key policy controls.");
+    }
+    if (params.allowUnsafeDefaultKeyPolicy) {
+        throw new Error("allowUnsafeDefaultKeyPolicy is not supported. Explicit policyBindings are required for key creation.");
+    }
+    if (!params.policyBindings) {
+        throw new Error("Missing key policy controls. Provide policyBindings for key creation.");
+    }
+    return buildLeastPrivilegeKeyPolicy(params.policyBindings);
+}
+async function tryEnableRotation(kms, keyId, auditLogger) {
+    try {
+        await kms.send(new client_kms_1.EnableKeyRotationCommand({ KeyId: keyId }));
+        emitAuditEvent(auditLogger, {
+            operation: "EnableKeyRotation",
+            status: "success",
+            keyId
+        });
+        return { enabled: true };
+    }
+    catch (error) {
+        if (!isUnsupportedAsymmetricRotationError(error)) {
+            emitAuditEvent(auditLogger, {
+                operation: "EnableKeyRotation",
+                status: "failure",
+                keyId,
+                detail: error instanceof Error ? error.message : String(error)
+            });
+            throw error;
+        }
+        // Asymmetric SIGN_VERIFY keys do not support automatic rotation in AWS KMS.
+        const message = error instanceof Error ? error.message : String(error);
+        emitAuditEvent(auditLogger, {
+            operation: "EnableKeyRotation",
+            status: "skipped",
+            keyId,
+            detail: message
+        });
+        return {
+            enabled: false,
+            note: `Automatic rotation unavailable for this key type. Use managed key replacement + Hedera AccountUpdate for rotation. Detail: ${message}`
+        };
+    }
+}
+async function createUserKmsKey(params) {
+    const { kms, userId, descriptionPrefix = "Workit Hedera key for user", aliasPrefix = "alias/workit/user", tags, auditLogger } = params;
+    const normalizedUserId = userId.trim();
+    if (!normalizedUserId) {
+        throw new Error("userId is required");
+    }
+    const keyPolicy = resolveCreateKeyPolicy(params);
+    const createKeyInput = {
+        KeySpec: "ECC_SECG_P256K1",
+        KeyUsage: "SIGN_VERIFY",
+        Description: `${descriptionPrefix} ${normalizedUserId}`,
+        Tags: normalizeTags(normalizedUserId, tags)
+    };
+    if (keyPolicy) {
+        createKeyInput.Policy = JSON.stringify(keyPolicy);
+    }
+    const createResp = await kms.send(new client_kms_1.CreateKeyCommand(createKeyInput)).catch(error => {
+        emitAuditEvent(auditLogger, {
+            operation: "CreateKey",
+            status: "failure",
+            detail: error instanceof Error ? error.message : String(error)
+        });
+        throw error;
+    });
+    const metadata = createResp.KeyMetadata;
+    if (!metadata?.KeyId || !metadata.Arn) {
+        emitAuditEvent(auditLogger, {
+            operation: "CreateKey",
+            status: "failure",
+            detail: "AWS KMS did not return key metadata"
+        });
+        throw new Error("AWS KMS did not return key metadata");
+    }
+    emitAuditEvent(auditLogger, {
+        operation: "CreateKey",
+        status: "success",
+        keyId: metadata.KeyId,
+        keyArn: metadata.Arn
+    });
+    const aliasName = normalizeAliasName(normalizedUserId, aliasPrefix);
+    try {
+        await kms.send(new client_kms_1.CreateAliasCommand({
+            AliasName: aliasName,
+            TargetKeyId: metadata.KeyId
+        }));
+        emitAuditEvent(auditLogger, {
+            operation: "CreateAlias",
+            status: "success",
+            keyId: metadata.KeyId,
+            keyArn: metadata.Arn,
+            aliasName
+        });
+    }
+    catch (error) {
+        emitAuditEvent(auditLogger, {
+            operation: "CreateAlias",
+            status: "failure",
+            keyId: metadata.KeyId,
+            keyArn: metadata.Arn,
+            aliasName,
+            detail: error instanceof Error ? error.message : String(error)
+        });
+        throw error;
+    }
+    const rotation = await tryEnableRotation(kms, metadata.KeyId, auditLogger);
+    return {
+        keyId: metadata.KeyId,
+        keyArn: metadata.Arn,
+        aliasName,
+        rotationEnabled: rotation.enabled,
+        rotationNote: rotation.note
+    };
+}
+function buildLeastPrivilegeKeyPolicy(bindings) {
+    const accountId = normalizeAwsAccountId(bindings.accountId);
+    const keyAdminPrincipalArn = normalizePrincipalArn(bindings.keyAdminPrincipalArn, "keyAdminPrincipalArn");
+    const runtimeSignerPrincipalArn = normalizePrincipalArn(bindings.runtimeSignerPrincipalArn, "runtimeSignerPrincipalArn");
+    return {
+        Version: "2012-10-17",
+        Statement: [
+            {
+                Sid: "AllowAccountRootRecovery",
+                Effect: "Allow",
+                Principal: {
+                    AWS: `arn:aws:iam::${accountId}:root`
+                },
+                Action: "kms:*",
+                Resource: "*"
+            },
+            {
+                Sid: "AllowKeyAdministration",
+                Effect: "Allow",
+                Principal: {
+                    AWS: keyAdminPrincipalArn
+                },
+                Action: [
+                    "kms:DescribeKey",
+                    "kms:ListResourceTags",
+                    "kms:GetKeyPolicy",
+                    "kms:PutKeyPolicy",
+                    "kms:CreateAlias",
+                    "kms:UpdateAlias",
+                    "kms:DeleteAlias",
+                    "kms:TagResource",
+                    "kms:UntagResource",
+                    "kms:EnableKey",
+                    "kms:DisableKey",
+                    "kms:ScheduleKeyDeletion",
+                    "kms:CancelKeyDeletion"
+                ],
+                Resource: "*"
+            },
+            {
+                Sid: "AllowRuntimeSigningOnly",
+                Effect: "Allow",
+                Principal: {
+                    AWS: runtimeSignerPrincipalArn
+                },
+                Action: ["kms:Sign"],
+                Resource: "*",
+                Condition: {
+                    StringEquals: {
+                        "kms:SigningAlgorithm": "ECDSA_SHA_256"
+                    }
+                }
+            },
+            {
+                Sid: "AllowRuntimeMetadataReadOnly",
+                Effect: "Allow",
+                Principal: {
+                    AWS: runtimeSignerPrincipalArn
+                },
+                Action: ["kms:GetPublicKey", "kms:DescribeKey", "kms:ListResourceTags"],
+                Resource: "*"
+            }
+        ]
+    };
+}
+async function validateKmsSecp256k1SigningKey(kms, keyId, auditLogger) {
+    const normalizedKeyId = keyId.trim();
+    if (!normalizedKeyId) {
+        throw new Error("keyId is required");
+    }
+    const response = await kms.send(new client_kms_1.DescribeKeyCommand({ KeyId: normalizedKeyId })).catch(error => {
+        emitAuditEvent(auditLogger, {
+            operation: "DescribeKey",
+            status: "failure",
+            keyId: normalizedKeyId,
+            detail: error instanceof Error ? error.message : String(error)
+        });
+        throw error;
+    });
+    const metadata = response.KeyMetadata;
+    if (!metadata?.KeyId || !metadata.Arn) {
+        emitAuditEvent(auditLogger, {
+            operation: "DescribeKey",
+            status: "failure",
+            keyId: normalizedKeyId,
+            detail: "KMS did not return key metadata"
+        });
+        throw new Error("KMS did not return key metadata");
+    }
+    const isKeyEnabled = metadata.Enabled === undefined ? metadata.KeyState === "Enabled" : metadata.Enabled;
+    if (!isKeyEnabled || metadata.KeyState !== "Enabled") {
+        emitAuditEvent(auditLogger, {
+            operation: "DescribeKey",
+            status: "failure",
+            keyId: metadata.KeyId,
+            keyArn: metadata.Arn,
+            detail: `KMS key "${metadata.KeyId}" must be in Enabled state for signing.`
+        });
+        throw new Error(`KMS key "${metadata.KeyId}" must be in Enabled state for signing.`);
+    }
+    if (metadata.KeySpec !== "ECC_SECG_P256K1") {
+        emitAuditEvent(auditLogger, {
+            operation: "DescribeKey",
+            status: "failure",
+            keyId: metadata.KeyId,
+            keyArn: metadata.Arn,
+            detail: `KMS key "${metadata.KeyId}" must use KeySpec ECC_SECG_P256K1.`
+        });
+        throw new Error(`KMS key "${metadata.KeyId}" must use KeySpec ECC_SECG_P256K1.`);
+    }
+    if (metadata.KeyUsage !== "SIGN_VERIFY") {
+        emitAuditEvent(auditLogger, {
+            operation: "DescribeKey",
+            status: "failure",
+            keyId: metadata.KeyId,
+            keyArn: metadata.Arn,
+            detail: `KMS key "${metadata.KeyId}" must use KeyUsage SIGN_VERIFY.`
+        });
+        throw new Error(`KMS key "${metadata.KeyId}" must use KeyUsage SIGN_VERIFY.`);
+    }
+    emitAuditEvent(auditLogger, {
+        operation: "DescribeKey",
+        status: "success",
+        keyId: metadata.KeyId,
+        keyArn: metadata.Arn
+    });
+    return {
+        keyId: metadata.KeyId,
+        keyArn: metadata.Arn
+    };
+}
+async function getPublicKeyBytes(kms, keyId, auditLogger) {
+    const normalizedKeyId = keyId.trim();
+    if (!normalizedKeyId) {
+        throw new Error("keyId is required");
+    }
+    const response = await kms.send(new client_kms_1.GetPublicKeyCommand({ KeyId: normalizedKeyId })).catch(error => {
+        emitAuditEvent(auditLogger, {
+            operation: "GetPublicKey",
+            status: "failure",
+            keyId: normalizedKeyId,
+            detail: error instanceof Error ? error.message : String(error)
+        });
+        throw error;
+    });
+    if (!response.PublicKey) {
+        emitAuditEvent(auditLogger, {
+            operation: "GetPublicKey",
+            status: "failure",
+            keyId: normalizedKeyId,
+            detail: "KMS did not return public key bytes"
+        });
+        throw new Error("KMS did not return public key bytes");
+    }
+    emitAuditEvent(auditLogger, {
+        operation: "GetPublicKey",
+        status: "success",
+        keyId: normalizedKeyId
+    });
+    return Buffer.from(response.PublicKey);
+}
+async function assertKmsKeyOwnershipForUser(params) {
+    const { kms, keyId, userId, expectedAppTag = "workit", auditLogger } = params;
+    const normalizedKeyId = keyId.trim();
+    if (!normalizedKeyId) {
+        throw new Error("keyId is required");
+    }
+    const normalizedUserId = userId.trim();
+    if (!normalizedUserId) {
+        throw new Error("userId is required");
+    }
+    const response = await kms.send(new client_kms_1.ListResourceTagsCommand({ KeyId: normalizedKeyId })).catch(error => {
+        emitAuditEvent(auditLogger, {
+            operation: "ListResourceTags",
+            status: "failure",
+            keyId: normalizedKeyId,
+            userId: normalizedUserId,
+            detail: error instanceof Error ? error.message : String(error)
+        });
+        throw error;
+    });
+    const tags = new Map((response.Tags ?? [])
+        .filter(tag => Boolean(tag.TagKey))
+        .map(tag => [String(tag.TagKey), tag.TagValue === undefined ? "" : String(tag.TagValue)]));
+    const keyUserId = tags.get("userId");
+    if (keyUserId !== normalizedUserId) {
+        const detail = keyUserId === undefined
+            ? `KMS key "${normalizedKeyId}" is missing required userId tag for "${normalizedUserId}".`
+            : `KMS key "${normalizedKeyId}" is tagged for userId "${keyUserId}", expected "${normalizedUserId}".`;
+        emitAuditEvent(auditLogger, {
+            operation: "ListResourceTags",
+            status: "failure",
+            keyId: normalizedKeyId,
+            userId: normalizedUserId,
+            detail
+        });
+        throw new Error(detail);
+    }
+    const appTag = tags.get("app");
+    if (appTag !== expectedAppTag) {
+        const detail = appTag === undefined
+            ? `KMS key "${normalizedKeyId}" is missing required app tag "${expectedAppTag}".`
+            : `KMS key "${normalizedKeyId}" has app tag "${appTag}", expected "${expectedAppTag}".`;
+        emitAuditEvent(auditLogger, {
+            operation: "ListResourceTags",
+            status: "failure",
+            keyId: normalizedKeyId,
+            userId: normalizedUserId,
+            detail
+        });
+        throw new Error(detail);
+    }
+    emitAuditEvent(auditLogger, {
+        operation: "ListResourceTags",
+        status: "success",
+        keyId: normalizedKeyId,
+        userId: normalizedUserId,
+        detail: `Verified key ownership for userId "${normalizedUserId}".`
+    });
+}
+function kmsAccessPolicyGuidance(keyArn = "arn:aws:kms:REGION:ACCOUNT_ID:key/KEY_ID", aliasArn = "arn:aws:kms:REGION:ACCOUNT_ID:alias/workit/user/*") {
+    return {
+        runtimeSignerPolicy: {
+            Version: "2012-10-17",
+            Statement: [
+                {
+                    Sid: "AllowSign",
+                    Effect: "Allow",
+                    Action: ["kms:Sign"],
+                    Resource: keyArn,
+                    Condition: {
+                        StringEquals: {
+                            "kms:SigningAlgorithm": "ECDSA_SHA_256"
+                        }
+                    }
+                },
+                {
+                    Sid: "AllowReadPublicMetadata",
+                    Effect: "Allow",
+                    Action: ["kms:GetPublicKey", "kms:DescribeKey", "kms:ListResourceTags"],
+                    Resource: keyArn
+                }
+            ]
+        },
+        keyAdminPolicy: {
+            Version: "2012-10-17",
+            Statement: [
+                {
+                    Sid: "AllowCreationOfSecp256k1SigningKeysWithRequiredTags",
+                    Effect: "Allow",
+                    Action: ["kms:CreateKey"],
+                    Resource: "*",
+                    Condition: {
+                        StringEquals: {
+                            "kms:KeySpec": "ECC_SECG_P256K1",
+                            "kms:KeyUsage": "SIGN_VERIFY",
+                            "aws:RequestTag/app": "workit"
+                        },
+                        "ForAllValues:StringEquals": {
+                            "aws:TagKeys": ["app", "userId"]
+                        }
+                    }
+                },
+                {
+                    Sid: "AllowScopedAliasManagement",
+                    Effect: "Allow",
+                    Action: ["kms:CreateAlias", "kms:UpdateAlias", "kms:DeleteAlias"],
+                    Resource: aliasArn
+                },
+                {
+                    Sid: "AllowScopedKeyLifecycleManagement",
+                    Effect: "Allow",
+                    Action: [
+                        "kms:TagResource",
+                        "kms:UntagResource",
+                        "kms:DescribeKey",
+                        "kms:ListResourceTags",
+                        "kms:GetKeyPolicy",
+                        "kms:PutKeyPolicy",
+                        "kms:EnableKey",
+                        "kms:DisableKey",
+                        "kms:ScheduleKeyDeletion",
+                        "kms:CancelKeyDeletion"
+                    ],
+                    Resource: keyArn
+                }
+            ]
+        }
+    };
+}
+//# sourceMappingURL=kmsKeyManager.js.map

package/dist/kmsKeyManager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"kmsKeyManager.js","sourceRoot":"","sources":["../src/kmsKeyManager.ts"],"names":[],"mappings":";;AA4OA,4CAsFC;AAED,oEAiEC;AAED,wEA0EC;AAED,8CAiCC;AAED,oEAwEC;AAED,0DAwEC;AAxoBD,oDAU6B;AAE7B,MAAM,sBAAsB,GAAG,UAAU,CAAC;AAC1C,MAAM,yBAAyB,GAAG,oFAAoF,CAAC;AA6DvH,SAAS,cAAc,CACrB,WAAuC,EACvC,KAAuC;IAEvC,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO;IACT,CAAC;IAED,WAAW,CAAC;QACV,GAAG,KAAK;QACR,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,qBAAqB,CAAC,SAAiB;IAC9C,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC;IAC/B,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,2BAA2B,SAAS,oCAAoC,CAAC,CAAC;IAC5F,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,qBAAqB,CAAC,YAAoB,EAAE,SAAiB;IACpE,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC;IAClC,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CACb,WAAW,SAAS,KAAK,YAAY,gFAAgF,CACtH,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CACpB,MAAc,EACd,IAA4D;IAE5D,MAAM,WAAW,GAAgD;QAC/D,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE;QACrC,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE;KACvC,CAAC;IAEF,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC3C,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;QAC9B,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;IACzC,CAAC;IAED,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC;YAChB,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACnE,CAAC;QAED,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC/B,SAAS;QACX,CAAC;QAED,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;YACvD,MAAM,IAAI,KAAK,CAAC,qDAAqD,MAAM,IAAI,CAAC,CAAC;QACnF,CAAC;QAED,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;IACzC,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAChC,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5B,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACjC,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;AAC5F,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAc,EAAE,WAAW,GAAG,mBAAmB;IAC3E,MAAM,gBAAgB,GAAG,MAAM,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAErF,MAAM,kBAAkB,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC;IAC9C,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;IAC7C,CAAC;IAED,MAAM,gBAAgB,GAAG,kBAAkB,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IACrE,MAAM,MAAM,GAAG,SAAS,gBAAgB,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC/D,OAAO,GAAG,MAAM,IAAI,gBAAgB,EAAE,CAAC;AACzC,CAAC;AAED,SAAS,oCAAoC,CAAC,KAAc;IAC1D,MAAM,IAAI,GAAG,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,CAAC,CAAC,MAAM,CAAE,KAA4B,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACxG,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvE,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACrC,MAAM,YAAY,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IAE3C,OAAO,CACL,SAAS,CAAC,QAAQ,CAAC,+BAA+B,CAAC;QACnD,SAAS,CAAC,QAAQ,CAAC,sBAAsB,CAAC;QAC1C,CAAC,YAAY,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,YAAY,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QAC1E,CAAC,YAAY,CAAC,QAAQ,CAAC,oBAAoB,CAAC,IAAI,YAAY,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CACxF,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAAC,MAA8B;IAC5D,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CACb,gHAAgH,CACjH,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,CAAC,2BAA2B,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CACb,sGAAsG,CACvG,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,uEAAuE,CAAC,CAAC;IAC3F,CAAC;IAED,OAAO,4BAA4B,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;AAC7D,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,GAAc,EACd,KAAa,EACb,WAA4B;IAE5B,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,qCAAwB,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;QAC/D,cAAc,CAAC,WAAW,EAAE;YAC1B,SAAS,EAAE,mBAAmB;YAC9B,MAAM,EAAE,SAAS;YACjB,KAAK;SACN,CAAC,CAAC;QACH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC,oCAAoC,CAAC,KAAK,CAAC,EAAE,CAAC;YACjD,cAAc,CAAC,WAAW,EAAE;gBAC1B,SAAS,EAAE,mBAAmB;gBAC9B,MAAM,EAAE,SAAS;gBACjB,KAAK;gBACL,MAAM,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC/D,CAAC,CAAC;YACH,MAAM,KAAK,CAAC;QACd,CAAC;QAED,4EAA4E;QAC5E,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,cAAc,CAAC,WAAW,EAAE;YAC1B,SAAS,EAAE,mBAAmB;YAC9B,MAAM,EAAE,SAAS;YACjB,KAAK;YACL,MAAM,EAAE,OAAO;SAChB,CAAC,CAAC;QACH,OAAO;YACL,OAAO,EAAE,KAAK;YACd,IAAI,EAAE,8HAA8H,OAAO,EAAE;SAC9I,CAAC;IACJ,CAAC;AACH,CAAC;AAEM,KAAK,UAAU,gBAAgB,CAAC,MAA8B;IACnE,MAAM,EACJ,GAAG,EACH,MAAM,EACN,iBAAiB,GAAG,4BAA4B,EAChD,WAAW,GAAG,mBAAmB,EACjC,IAAI,EACJ,WAAW,EACZ,GAAG,MAAM,CAAC;IACX,MAAM,gBAAgB,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IACvC,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;IACxC,CAAC;IAED,MAAM,SAAS,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAC;IACjD,MAAM,cAAc,GAA0B;QAC5C,OAAO,EAAE,iBAAiB;QAC1B,QAAQ,EAAE,aAAa;QACvB,WAAW,EAAE,GAAG,iBAAiB,IAAI,gBAAgB,EAAE;QACvD,IAAI,EAAE,aAAa,CAAC,gBAAgB,EAAE,IAAI,CAAC;KAC5C,CAAC;IACF,IAAI,SAAS,EAAE,CAAC;QACd,cAAc,CAAC,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,6BAAgB,CAAC,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE;QACpF,cAAc,CAAC,WAAW,EAAE;YAC1B,SAAS,EAAE,WAAW;YACtB,MAAM,EAAE,SAAS;YACjB,MAAM,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC/D,CAAC,CAAC;QACH,MAAM,KAAK,CAAC;IACd,CAAC,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,UAAU,CAAC,WAAsC,CAAC;IACnE,IAAI,CAAC,QAAQ,EAAE,KAAK,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;QACtC,cAAc,CAAC,WAAW,EAAE;YAC1B,SAAS,EAAE,WAAW;YACtB,MAAM,EAAE,SAAS;YACjB,MAAM,EAAE,qCAAqC;SAC9C,CAAC,CAAC;QACH,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IACD,cAAc,CAAC,WAAW,EAAE;QAC1B,SAAS,EAAE,WAAW;QACtB,MAAM,EAAE,SAAS;QACjB,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,MAAM,EAAE,QAAQ,CAAC,GAAG;KACrB,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,kBAAkB,CAAC,gBAAgB,EAAE,WAAW,CAAC,CAAC;IACpE,IAAI,CAAC;QACH,MAAM,GAAG,CAAC,IAAI,CACZ,IAAI,+BAAkB,CAAC;YACrB,SAAS,EAAE,SAAS;YACpB,WAAW,EAAE,QAAQ,CAAC,KAAK;SAC5B,CAAC,CACH,CAAC;QACF,cAAc,CAAC,WAAW,EAAE;YAC1B,SAAS,EAAE,aAAa;YACxB,MAAM,EAAE,SAAS;YACjB,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,MAAM,EAAE,QAAQ,CAAC,GAAG;YACpB,SAAS;SACV,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,cAAc,CAAC,WAAW,EAAE;YAC1B,SAAS,EAAE,aAAa;YACxB,MAAM,EAAE,SAAS;YACjB,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,MAAM,EAAE,QAAQ,CAAC,GAAG;YACpB,SAAS;YACT,MAAM,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC/D,CAAC,CAAC;QACH,MAAM,KAAK,CAAC;IACd,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IAE3E,OAAO;QACL,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,MAAM,EAAE,QAAQ,CAAC,GAAG;QACpB,SAAS;QACT,eAAe,EAAE,QAAQ,CAAC,OAAO;QACjC,YAAY,EAAE,QAAQ,CAAC,IAAI;KAC5B,CAAC;AACJ,CAAC;AAED,SAAgB,4BAA4B,CAAC,QAA8B;IACzE,MAAM,SAAS,GAAG,qBAAqB,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IAC5D,MAAM,oBAAoB,GAAG,qBAAqB,CAAC,QAAQ,CAAC,oBAAoB,EAAE,sBAAsB,CAAC,CAAC;IAC1G,MAAM,yBAAyB,GAAG,qBAAqB,CAAC,QAAQ,CAAC,yBAAyB,EAAE,2BAA2B,CAAC,CAAC;IAEzH,OAAO;QACL,OAAO,EAAE,YAAY;QACrB,SAAS,EAAE;YACT;gBACE,GAAG,EAAE,0BAA0B;gBAC/B,MAAM,EAAE,OAAO;gBACf,SAAS,EAAE;oBACT,GAAG,EAAE,gBAAgB,SAAS,OAAO;iBACtC;gBACD,MAAM,EAAE,OAAO;gBACf,QAAQ,EAAE,GAAG;aACd;YACD;gBACE,GAAG,EAAE,wBAAwB;gBAC7B,MAAM,EAAE,OAAO;gBACf,SAAS,EAAE;oBACT,GAAG,EAAE,oBAAoB;iBAC1B;gBACD,MAAM,EAAE;oBACN,iBAAiB;oBACjB,sBAAsB;oBACtB,kBAAkB;oBAClB,kBAAkB;oBAClB,iBAAiB;oBACjB,iBAAiB;oBACjB,iBAAiB;oBACjB,iBAAiB;oBACjB,mBAAmB;oBACnB,eAAe;oBACf,gBAAgB;oBAChB,yBAAyB;oBACzB,uBAAuB;iBACxB;gBACD,QAAQ,EAAE,GAAG;aACd;YACD;gBACE,GAAG,EAAE,yBAAyB;gBAC9B,MAAM,EAAE,OAAO;gBACf,SAAS,EAAE;oBACT,GAAG,EAAE,yBAAyB;iBAC/B;gBACD,MAAM,EAAE,CAAC,UAAU,CAAC;gBACpB,QAAQ,EAAE,GAAG;gBACb,SAAS,EAAE;oBACT,YAAY,EAAE;wBACZ,sBAAsB,EAAE,eAAe;qBACxC;iBACF;aACF;YACD;gBACE,GAAG,EAAE,8BAA8B;gBACnC,MAAM,EAAE,OAAO;gBACf,SAAS,EAAE;oBACT,GAAG,EAAE,yBAAyB;iBAC/B;gBACD,MAAM,EAAE,CAAC,kBAAkB,EAAE,iBAAiB,EAAE,sBAAsB,CAAC;gBACvE,QAAQ,EAAE,GAAG;aACd;SACF;KACF,CAAC;AACJ,CAAC;AAEM,KAAK,UAAU,8BAA8B,CAClD,GAAc,EACd,KAAa,EACb,WAA4B;IAE5B,MAAM,eAAe,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IACrC,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;IACvC,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,+BAAkB,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE;QAChG,cAAc,CAAC,WAAW,EAAE;YAC1B,SAAS,EAAE,aAAa;YACxB,MAAM,EAAE,SAAS;YACjB,KAAK,EAAE,eAAe;YACtB,MAAM,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC/D,CAAC,CAAC;QACH,MAAM,KAAK,CAAC;IACd,CAAC,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,QAAQ,CAAC,WAAsC,CAAC;IACjE,IAAI,CAAC,QAAQ,EAAE,KAAK,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;QACtC,cAAc,CAAC,WAAW,EAAE;YAC1B,SAAS,EAAE,aAAa;YACxB,MAAM,EAAE,SAAS;YACjB,KAAK,EAAE,eAAe;YACtB,MAAM,EAAE,iCAAiC;SAC1C,CAAC,CAAC;QACH,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACrD,CAAC;IAED,MAAM,YAAY,GAAG,QAAQ,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;IACzG,IAAI,CAAC,YAAY,IAAI,QAAQ,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACrD,cAAc,CAAC,WAAW,EAAE;YAC1B,SAAS,EAAE,aAAa;YACxB,MAAM,EAAE,SAAS;YACjB,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,MAAM,EAAE,QAAQ,CAAC,GAAG;YACpB,MAAM,EAAE,YAAY,QAAQ,CAAC,KAAK,yCAAyC;SAC5E,CAAC,CAAC;QACH,MAAM,IAAI,KAAK,CAAC,YAAY,QAAQ,CAAC,KAAK,yCAAyC,CAAC,CAAC;IACvF,CAAC;IACD,IAAI,QAAQ,CAAC,OAAO,KAAK,iBAAiB,EAAE,CAAC;QAC3C,cAAc,CAAC,WAAW,EAAE;YAC1B,SAAS,EAAE,aAAa;YACxB,MAAM,EAAE,SAAS;YACjB,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,MAAM,EAAE,QAAQ,CAAC,GAAG;YACpB,MAAM,EAAE,YAAY,QAAQ,CAAC,KAAK,qCAAqC;SACxE,CAAC,CAAC;QACH,MAAM,IAAI,KAAK,CAAC,YAAY,QAAQ,CAAC,KAAK,qCAAqC,CAAC,CAAC;IACnF,CAAC;IACD,IAAI,QAAQ,CAAC,QAAQ,KAAK,aAAa,EAAE,CAAC;QACxC,cAAc,CAAC,WAAW,EAAE;YAC1B,SAAS,EAAE,aAAa;YACxB,MAAM,EAAE,SAAS;YACjB,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,MAAM,EAAE,QAAQ,CAAC,GAAG;YACpB,MAAM,EAAE,YAAY,QAAQ,CAAC,KAAK,kCAAkC;SACrE,CAAC,CAAC;QACH,MAAM,IAAI,KAAK,CAAC,YAAY,QAAQ,CAAC,KAAK,kCAAkC,CAAC,CAAC;IAChF,CAAC;IAED,cAAc,CAAC,WAAW,EAAE;QAC1B,SAAS,EAAE,aAAa;QACxB,MAAM,EAAE,SAAS;QACjB,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,MAAM,EAAE,QAAQ,CAAC,GAAG;KACrB,CAAC,CAAC;IAEH,OAAO;QACL,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,MAAM,EAAE,QAAQ,CAAC,GAAG;KACrB,CAAC;AACJ,CAAC;AAEM,KAAK,UAAU,iBAAiB,CAAC,GAAc,EAAE,KAAa,EAAE,WAA4B;IACjG,MAAM,eAAe,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IACrC,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;IACvC,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,gCAAmB,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE;QACjG,cAAc,CAAC,WAAW,EAAE;YAC1B,SAAS,EAAE,cAAc;YACzB,MAAM,EAAE,SAAS;YACjB,KAAK,EAAE,eAAe;YACtB,MAAM,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC/D,CAAC,CAAC;QACH,MAAM,KAAK,CAAC;IACd,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC;QACxB,cAAc,CAAC,WAAW,EAAE;YAC1B,SAAS,EAAE,cAAc;YACzB,MAAM,EAAE,SAAS;YACjB,KAAK,EAAE,eAAe;YACtB,MAAM,EAAE,qCAAqC;SAC9C,CAAC,CAAC;QACH,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IAED,cAAc,CAAC,WAAW,EAAE;QAC1B,SAAS,EAAE,cAAc;QACzB,MAAM,EAAE,SAAS;QACjB,KAAK,EAAE,eAAe;KACvB,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;AACzC,CAAC;AAEM,KAAK,UAAU,4BAA4B,CAAC,MAMlD;IACC,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,GAAG,QAAQ,EAAE,WAAW,EAAE,GAAG,MAAM,CAAC;IAC9E,MAAM,eAAe,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IACrC,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;IACvC,CAAC;IACD,MAAM,gBAAgB,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IACvC,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;IACxC,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,oCAAuB,CAAC,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE;QACrG,cAAc,CAAC,WAAW,EAAE;YAC1B,SAAS,EAAE,kBAAkB;YAC7B,MAAM,EAAE,SAAS;YACjB,KAAK,EAAE,eAAe;YACtB,MAAM,EAAE,gBAAgB;YACxB,MAAM,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC/D,CAAC,CAAC;QACH,MAAM,KAAK,CAAC;IACd,CAAC,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,IAAI,GAAG,CAClB,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAC;SAClB,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;SAClC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAC5F,CAAC;IACF,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACrC,IAAI,SAAS,KAAK,gBAAgB,EAAE,CAAC;QACnC,MAAM,MAAM,GACV,SAAS,KAAK,SAAS;YACrB,CAAC,CAAC,YAAY,eAAe,yCAAyC,gBAAgB,IAAI;YAC1F,CAAC,CAAC,YAAY,eAAe,2BAA2B,SAAS,gBAAgB,gBAAgB,IAAI,CAAC;QAC1G,cAAc,CAAC,WAAW,EAAE;YAC1B,SAAS,EAAE,kBAAkB;YAC7B,MAAM,EAAE,SAAS;YACjB,KAAK,EAAE,eAAe;YACtB,MAAM,EAAE,gBAAgB;YACxB,MAAM;SACP,CAAC,CAAC;QACH,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC;IAC1B,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC/B,IAAI,MAAM,KAAK,cAAc,EAAE,CAAC;QAC9B,MAAM,MAAM,GACV,MAAM,KAAK,SAAS;YAClB,CAAC,CAAC,YAAY,eAAe,kCAAkC,cAAc,IAAI;YACjF,CAAC,CAAC,YAAY,eAAe,kBAAkB,MAAM,gBAAgB,cAAc,IAAI,CAAC;QAC5F,cAAc,CAAC,WAAW,EAAE;YAC1B,SAAS,EAAE,kBAAkB;YAC7B,MAAM,EAAE,SAAS;YACjB,KAAK,EAAE,eAAe;YACtB,MAAM,EAAE,gBAAgB;YACxB,MAAM;SACP,CAAC,CAAC;QACH,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC;IAC1B,CAAC;IAED,cAAc,CAAC,WAAW,EAAE;QAC1B,SAAS,EAAE,kBAAkB;QAC7B,MAAM,EAAE,SAAS;QACjB,KAAK,EAAE,eAAe;QACtB,MAAM,EAAE,gBAAgB;QACxB,MAAM,EAAE,sCAAsC,gBAAgB,IAAI;KACnE,CAAC,CAAC;AACL,CAAC;AAED,SAAgB,uBAAuB,CACrC,MAAM,GAAG,0CAA0C,EACnD,QAAQ,GAAG,mDAAmD;IAE9D,OAAO;QACL,mBAAmB,EAAE;YACnB,OAAO,EAAE,YAAY;YACrB,SAAS,EAAE;gBACT;oBACE,GAAG,EAAE,WAAW;oBAChB,MAAM,EAAE,OAAO;oBACf,MAAM,EAAE,CAAC,UAAU,CAAC;oBACpB,QAAQ,EAAE,MAAM;oBAChB,SAAS,EAAE;wBACT,YAAY,EAAE;4BACZ,sBAAsB,EAAE,eAAe;yBACxC;qBACF;iBACF;gBACD;oBACE,GAAG,EAAE,yBAAyB;oBAC9B,MAAM,EAAE,OAAO;oBACf,MAAM,EAAE,CAAC,kBAAkB,EAAE,iBAAiB,EAAE,sBAAsB,CAAC;oBACvE,QAAQ,EAAE,MAAM;iBACjB;aACF;SACF;QACD,cAAc,EAAE;YACd,OAAO,EAAE,YAAY;YACrB,SAAS,EAAE;gBACT;oBACE,GAAG,EAAE,qDAAqD;oBAC1D,MAAM,EAAE,OAAO;oBACf,MAAM,EAAE,CAAC,eAAe,CAAC;oBACzB,QAAQ,EAAE,GAAG;oBACb,SAAS,EAAE;wBACT,YAAY,EAAE;4BACZ,aAAa,EAAE,iBAAiB;4BAChC,cAAc,EAAE,aAAa;4BAC7B,oBAAoB,EAAE,QAAQ;yBAC/B;wBACD,2BAA2B,EAAE;4BAC3B,aAAa,EAAE,CAAC,KAAK,EAAE,QAAQ,CAAC;yBACjC;qBACF;iBACF;gBACD;oBACE,GAAG,EAAE,4BAA4B;oBACjC,MAAM,EAAE,OAAO;oBACf,MAAM,EAAE,CAAC,iBAAiB,EAAE,iBAAiB,EAAE,iBAAiB,CAAC;oBACjE,QAAQ,EAAE,QAAQ;iBACnB;gBACD;oBACE,GAAG,EAAE,mCAAmC;oBACxC,MAAM,EAAE,OAAO;oBACf,MAAM,EAAE;wBACN,iBAAiB;wBACjB,mBAAmB;wBACnB,iBAAiB;wBACjB,sBAAsB;wBACtB,kBAAkB;wBAClB,kBAAkB;wBAClB,eAAe;wBACf,gBAAgB;wBAChB,yBAAyB;wBACzB,uBAAuB;qBACxB;oBACD,QAAQ,EAAE,MAAM;iBACjB;aACF;SACF;KACF,CAAC;AACJ,CAAC"}

package/dist/kmsSigner.d.ts

@@ -0,0 +1,18 @@
+import { KMSClient } from "@aws-sdk/client-kms";
+import { PublicKey } from "@hashgraph/sdk";
+import { type KmsAuditLogger } from "./kmsKeyManager";
+export interface KmsHederaSigner {
+    keyId: string;
+    keyArn: string;
+    hederaPublicKey: PublicKey;
+    uncompressedPublicKey: Buffer;
+    compressedPublicKey: Buffer;
+    sign: (message: Uint8Array) => Promise<Uint8Array>;
+}
+export interface CreateKmsHederaSignerParams {
+    kms: KMSClient;
+    keyId: string;
+    auditLogger?: KmsAuditLogger;
+}
+export declare function createKmsHederaSigner(params: CreateKmsHederaSignerParams): Promise<KmsHederaSigner>;
+//# sourceMappingURL=kmsSigner.d.ts.map