@workit-poa/hedera-kms-wallet 0.1.0

package/dist/kmsSigner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"kmsSigner.d.ts","sourceRoot":"","sources":["../src/kmsSigner.ts"],"names":[],"mappings":"AAAA,OAAO,EAAe,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAG3C,OAAO,EAAqB,KAAK,cAAc,EAAkC,MAAM,iBAAiB,CAAC;AAEzG,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,EAAE,SAAS,CAAC;IAC3B,qBAAqB,EAAE,MAAM,CAAC;IAC9B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,IAAI,EAAE,CAAC,OAAO,EAAE,UAAU,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;CACpD;AAED,MAAM,WAAW,2BAA2B;IAC1C,GAAG,EAAE,SAAS,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,cAAc,CAAC;CAC9B;AAED,wBAAsB,qBAAqB,CAAC,MAAM,EAAE,2BAA2B,GAAG,OAAO,CAAC,eAAe,CAAC,CAqEzG"}

package/dist/kmsSigner.js

@@ -0,0 +1,71 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createKmsHederaSigner = createKmsHederaSigner;
+const client_kms_1 = require("@aws-sdk/client-kms");
+const sdk_1 = require("@hashgraph/sdk");
+const sha3_1 = require("@noble/hashes/sha3");
+const hederaKeyCodec_1 = require("./hederaKeyCodec");
+const kmsKeyManager_1 = require("./kmsKeyManager");
+async function createKmsHederaSigner(params) {
+    const { kms, keyId, auditLogger } = params;
+    const normalizedKeyId = keyId.trim();
+    if (!normalizedKeyId) {
+        throw new Error("keyId is required");
+    }
+    const validatedKey = await (0, kmsKeyManager_1.validateKmsSecp256k1SigningKey)(kms, normalizedKeyId, auditLogger);
+    const spkiBytes = await (0, kmsKeyManager_1.getPublicKeyBytes)(kms, normalizedKeyId, auditLogger);
+    const uncompressedPublicKey = (0, hederaKeyCodec_1.spkiToUncompressedPublicKey)(spkiBytes);
+    const compressedPublicKey = (0, hederaKeyCodec_1.compressPublicKey)(uncompressedPublicKey);
+    const hederaPublicKey = sdk_1.PublicKey.fromBytesECDSA(compressedPublicKey);
+    const sign = async (message) => {
+        // Hedera secp256k1 signatures are verified against keccak256(message).
+        // KMS can't do keccak internally, so we provide the digest directly.
+        const digest = Buffer.from((0, sha3_1.keccak_256)(message));
+        const response = await kms
+            .send(new client_kms_1.SignCommand({
+            KeyId: normalizedKeyId,
+            Message: digest,
+            MessageType: "DIGEST",
+            SigningAlgorithm: "ECDSA_SHA_256"
+        }))
+            .catch(error => {
+            auditLogger?.({
+                operation: "Sign",
+                status: "failure",
+                timestamp: new Date().toISOString(),
+                keyId: normalizedKeyId,
+                keyArn: validatedKey.keyArn,
+                detail: error instanceof Error ? error.message : String(error)
+            });
+            throw error;
+        });
+        if (!response.Signature) {
+            auditLogger?.({
+                operation: "Sign",
+                status: "failure",
+                timestamp: new Date().toISOString(),
+                keyId: normalizedKeyId,
+                keyArn: validatedKey.keyArn,
+                detail: "KMS Sign did not return signature bytes"
+            });
+            throw new Error("KMS Sign did not return signature bytes");
+        }
+        auditLogger?.({
+            operation: "Sign",
+            status: "success",
+            timestamp: new Date().toISOString(),
+            keyId: normalizedKeyId,
+            keyArn: validatedKey.keyArn
+        });
+        return (0, hederaKeyCodec_1.kmsDerSignatureToHederaRaw64)(response.Signature);
+    };
+    return {
+        keyId: normalizedKeyId,
+        keyArn: validatedKey.keyArn,
+        hederaPublicKey,
+        uncompressedPublicKey,
+        compressedPublicKey,
+        sign
+    };
+}
+//# sourceMappingURL=kmsSigner.js.map

package/dist/kmsSigner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"kmsSigner.js","sourceRoot":"","sources":["../src/kmsSigner.ts"],"names":[],"mappings":";;AAqBA,sDAqEC;AA1FD,oDAA6D;AAC7D,wCAA2C;AAC3C,6CAAgD;AAChD,qDAAgH;AAChH,mDAAyG;AAiBlG,KAAK,UAAU,qBAAqB,CAAC,MAAmC;IAC7E,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,WAAW,EAAE,GAAG,MAAM,CAAC;IAC3C,MAAM,eAAe,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IACrC,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;IACvC,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,IAAA,8CAA8B,EAAC,GAAG,EAAE,eAAe,EAAE,WAAW,CAAC,CAAC;IAC7F,MAAM,SAAS,GAAG,MAAM,IAAA,iCAAiB,EAAC,GAAG,EAAE,eAAe,EAAE,WAAW,CAAC,CAAC;IAC7E,MAAM,qBAAqB,GAAG,IAAA,4CAA2B,EAAC,SAAS,CAAC,CAAC;IACrE,MAAM,mBAAmB,GAAG,IAAA,kCAAiB,EAAC,qBAAqB,CAAC,CAAC;IACrE,MAAM,eAAe,GAAG,eAAS,CAAC,cAAc,CAAC,mBAAmB,CAAC,CAAC;IAEtE,MAAM,IAAI,GAAG,KAAK,EAAE,OAAmB,EAAuB,EAAE;QAC9D,uEAAuE;QACvE,qEAAqE;QACrE,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,IAAA,iBAAU,EAAC,OAAO,CAAC,CAAC,CAAC;QAEhD,MAAM,QAAQ,GAAG,MAAM,GAAG;aACvB,IAAI,CACH,IAAI,wBAAW,CAAC;YACd,KAAK,EAAE,eAAe;YACtB,OAAO,EAAE,MAAM;YACf,WAAW,EAAE,QAAQ;YACrB,gBAAgB,EAAE,eAAe;SAClC,CAAC,CACH;aACA,KAAK,CAAC,KAAK,CAAC,EAAE;YACb,WAAW,EAAE,CAAC;gBACZ,SAAS,EAAE,MAAM;gBACjB,MAAM,EAAE,SAAS;gBACjB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACnC,KAAK,EAAE,eAAe;gBACtB,MAAM,EAAE,YAAY,CAAC,MAAM;gBAC3B,MAAM,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC/D,CAAC,CAAC;YACH,MAAM,KAAK,CAAC;QACd,CAAC,CAAC,CAAC;QAEL,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC;YACxB,WAAW,EAAE,CAAC;gBACZ,SAAS,EAAE,MAAM;gBACjB,MAAM,EAAE,SAAS;gBACjB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBACnC,KAAK,EAAE,eAAe;gBACtB,MAAM,EAAE,YAAY,CAAC,MAAM;gBAC3B,MAAM,EAAE,yCAAyC;aAClD,CAAC,CAAC;YACH,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAC7D,CAAC;QACD,WAAW,EAAE,CAAC;YACZ,SAAS,EAAE,MAAM;YACjB,MAAM,EAAE,SAAS;YACjB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,KAAK,EAAE,eAAe;YACtB,MAAM,EAAE,YAAY,CAAC,MAAM;SAC5B,CAAC,CAAC;QAEH,OAAO,IAAA,6CAA4B,EAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IAC1D,CAAC,CAAC;IAEF,OAAO;QACL,KAAK,EAAE,eAAe;QACtB,MAAM,EAAE,YAAY,CAAC,MAAM;QAC3B,eAAe;QACf,qBAAqB;QACrB,mBAAmB;QACnB,IAAI;KACL,CAAC;AACJ,CAAC"}

package/dist/walletProvisioning.d.ts

@@ -0,0 +1,66 @@
+import { type KmsAuditLogger, type KmsKeyPolicyBindings } from "./kmsKeyManager";
+import { type HederaNetwork } from "./hederaClient";
+export interface ProvisionHederaAccountForUserParams {
+    userId: string;
+    awsRegion?: string;
+    hederaNetwork?: HederaNetwork;
+    operatorId?: string;
+    operatorKey?: string;
+    initialHbar?: number;
+    aliasPrefix?: string;
+    keyDescriptionPrefix?: string;
+    existingKeyId?: string;
+    allowKeyCreation?: boolean;
+    keyPolicy?: Record<string, unknown>;
+    policyBindings?: KmsKeyPolicyBindings;
+    allowUnsafeDefaultKeyPolicy?: boolean;
+    auditLogger?: KmsAuditLogger;
+}
+export interface ProvisionedHederaWallet {
+    accountId: string;
+    keyId: string;
+    keyArn?: string;
+    aliasName?: string;
+    publicKeyCompressedHex: string;
+    publicKeyUncompressedHex: string;
+    publicKeyFingerprint: string;
+    rotationEnabled: boolean;
+    rotationNote?: string;
+}
+export interface RotateHederaAccountKmsKeyParams {
+    userId: string;
+    accountId: string;
+    currentKeyId: string;
+    replacementKeyId?: string;
+    awsRegion?: string;
+    hederaNetwork?: HederaNetwork;
+    operatorId?: string;
+    operatorKey?: string;
+    aliasPrefix?: string;
+    keyDescriptionPrefix?: string;
+    keyPolicy?: Record<string, unknown>;
+    policyBindings?: KmsKeyPolicyBindings;
+    allowUnsafeDefaultKeyPolicy?: boolean;
+    auditLogger?: KmsAuditLogger;
+}
+export interface RotatedHederaWalletKey {
+    accountId: string;
+    previousKeyId: string;
+    previousKeyArn: string;
+    previousPublicKeyCompressedHex: string;
+    previousPublicKeyFingerprint: string;
+    keyId: string;
+    keyArn?: string;
+    aliasName?: string;
+    publicKeyCompressedHex: string;
+    publicKeyUncompressedHex: string;
+    publicKeyFingerprint: string;
+    rotationEnabled: boolean;
+    rotationNote?: string;
+    transactionId: string;
+    receiptStatus: string;
+    mirrorLink: string;
+}
+export declare function provisionHederaAccountForUser(params: ProvisionHederaAccountForUserParams): Promise<ProvisionedHederaWallet>;
+export declare function rotateHederaAccountKmsKey(params: RotateHederaAccountKmsKeyParams): Promise<RotatedHederaWalletKey>;
+//# sourceMappingURL=walletProvisioning.d.ts.map

package/dist/walletProvisioning.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"walletProvisioning.d.ts","sourceRoot":"","sources":["../src/walletProvisioning.ts"],"names":[],"mappings":"AAGA,OAAO,EAIL,KAAK,cAAc,EACnB,KAAK,oBAAoB,EAC1B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAKL,KAAK,aAAa,EACnB,MAAM,gBAAgB,CAAC;AAGxB,MAAM,WAAW,mCAAmC;IAClD,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpC,cAAc,CAAC,EAAE,oBAAoB,CAAC;IACtC,2BAA2B,CAAC,EAAE,OAAO,CAAC;IACtC,WAAW,CAAC,EAAE,cAAc,CAAC;CAC9B;AAED,MAAM,WAAW,uBAAuB;IACtC,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,sBAAsB,EAAE,MAAM,CAAC;IAC/B,wBAAwB,EAAE,MAAM,CAAC;IACjC,oBAAoB,EAAE,MAAM,CAAC;IAC7B,eAAe,EAAE,OAAO,CAAC;IACzB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,+BAA+B;IAC9C,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpC,cAAc,CAAC,EAAE,oBAAoB,CAAC;IACtC,2BAA2B,CAAC,EAAE,OAAO,CAAC;IACtC,WAAW,CAAC,EAAE,cAAc,CAAC;CAC9B;AAED,MAAM,WAAW,sBAAsB;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,MAAM,CAAC;IACvB,8BAA8B,EAAE,MAAM,CAAC;IACvC,4BAA4B,EAAE,MAAM,CAAC;IACrC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,sBAAsB,EAAE,MAAM,CAAC;IAC/B,wBAAwB,EAAE,MAAM,CAAC;IACjC,oBAAoB,EAAE,MAAM,CAAC;IAC7B,eAAe,EAAE,OAAO,CAAC;IACzB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;CACpB;AAoBD,wBAAsB,6BAA6B,CACjD,MAAM,EAAE,mCAAmC,GAC1C,OAAO,CAAC,uBAAuB,CAAC,CA4IlC;AAED,wBAAsB,yBAAyB,CAC7C,MAAM,EAAE,+BAA+B,GACtC,OAAO,CAAC,sBAAsB,CAAC,CA+JjC"}

package/dist/walletProvisioning.js

@@ -0,0 +1,276 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.provisionHederaAccountForUser = provisionHederaAccountForUser;
+exports.rotateHederaAccountKmsKey = rotateHederaAccountKmsKey;
+const node_crypto_1 = require("node:crypto");
+const client_kms_1 = require("@aws-sdk/client-kms");
+const sdk_1 = require("@hashgraph/sdk");
+const kmsKeyManager_1 = require("./kmsKeyManager");
+const hederaClient_1 = require("./hederaClient");
+const kmsSigner_1 = require("./kmsSigner");
+function fingerprintFromPublicKey(publicKeyCompressed) {
+    return (0, node_crypto_1.createHash)("sha256").update(publicKeyCompressed).digest("hex");
+}
+function emitWalletAuditEvent(auditLogger, event) {
+    if (!auditLogger) {
+        return;
+    }
+    auditLogger({
+        ...event,
+        timestamp: new Date().toISOString()
+    });
+}
+async function provisionHederaAccountForUser(params) {
+    const { userId, awsRegion = process.env.AWS_REGION, hederaNetwork = process.env.HEDERA_NETWORK ?? "testnet", operatorId = process.env.OPERATOR_ID || process.env.HEDERA_OPERATOR_ID, operatorKey = process.env.OPERATOR_KEY || process.env.HEDERA_OPERATOR_KEY, initialHbar, aliasPrefix = process.env.HEDERA_KMS_ALIAS_PREFIX || "alias/workit-user", keyDescriptionPrefix = process.env.HEDERA_KMS_KEY_DESCRIPTION_PREFIX || "Workit Hedera key for user", existingKeyId, allowKeyCreation = false, keyPolicy, policyBindings, allowUnsafeDefaultKeyPolicy = false, auditLogger } = params;
+    const normalizedUserId = userId.trim();
+    if (!normalizedUserId) {
+        throw new Error("userId is required");
+    }
+    if (!awsRegion)
+        throw new Error("Missing AWS_REGION");
+    if (!operatorId || !operatorKey) {
+        throw new Error("Missing operator credentials: OPERATOR_ID/OPERATOR_KEY (or HEDERA_OPERATOR_ID/HEDERA_OPERATOR_KEY)");
+    }
+    if (initialHbar !== undefined && (!Number.isFinite(initialHbar) || initialHbar < 0)) {
+        throw new Error("initialHbar must be a non-negative number when provided");
+    }
+    const normalizedExistingKeyId = existingKeyId?.trim();
+    if (!normalizedExistingKeyId && !allowKeyCreation) {
+        throw new Error("existingKeyId is required unless allowKeyCreation=true. " +
+            "Provision keys in an admin workflow and pass existingKeyId for runtime flows.");
+    }
+    if (!normalizedExistingKeyId && !policyBindings) {
+        throw new Error("policyBindings is required when creating a new key.");
+    }
+    if (keyPolicy) {
+        throw new Error("keyPolicy is no longer supported. Use policyBindings.");
+    }
+    if (allowUnsafeDefaultKeyPolicy) {
+        throw new Error("allowUnsafeDefaultKeyPolicy is no longer supported. Use policyBindings.");
+    }
+    const kms = new client_kms_1.KMSClient({ region: awsRegion });
+    let hederaClient;
+    let selectedKeyId;
+    let selectedKeyArn;
+    try {
+        const createdKey = normalizedExistingKeyId
+            ? {
+                keyId: normalizedExistingKeyId,
+                keyArn: undefined,
+                aliasName: undefined,
+                rotationEnabled: false,
+                rotationNote: "Existing key id was provided; rotation state should be managed externally."
+            }
+            : await (0, kmsKeyManager_1.createUserKmsKey)({
+                kms,
+                userId: normalizedUserId,
+                descriptionPrefix: keyDescriptionPrefix,
+                aliasPrefix,
+                policyBindings,
+                auditLogger
+            });
+        selectedKeyId = createdKey.keyId;
+        selectedKeyArn = createdKey.keyArn;
+        await (0, kmsKeyManager_1.assertKmsKeyOwnershipForUser)({
+            kms,
+            keyId: createdKey.keyId,
+            userId: normalizedUserId,
+            auditLogger
+        });
+        const signer = await (0, kmsSigner_1.createKmsHederaSigner)({
+            kms,
+            keyId: createdKey.keyId,
+            auditLogger
+        });
+        hederaClient = (0, hederaClient_1.createHederaClient)({
+            network: hederaNetwork,
+            operatorId,
+            operatorKey
+        });
+        let accountCreateTx = new sdk_1.AccountCreateTransaction().setKey(signer.hederaPublicKey);
+        if (initialHbar !== undefined && initialHbar > 0) {
+            accountCreateTx = accountCreateTx.setInitialBalance(new sdk_1.Hbar(initialHbar));
+        }
+        accountCreateTx = await accountCreateTx.freezeWith(hederaClient);
+        await (0, hederaClient_1.addKmsSignatureToFrozenTransaction)(accountCreateTx, signer);
+        const { receipt } = await (0, hederaClient_1.executeSignedTransaction)(hederaClient, accountCreateTx);
+        const accountId = receipt.accountId?.toString();
+        if (!accountId) {
+            throw new Error("Hedera account creation did not return an account id");
+        }
+        const result = {
+            accountId,
+            keyId: createdKey.keyId,
+            keyArn: createdKey.keyArn ?? signer.keyArn,
+            aliasName: createdKey.aliasName,
+            publicKeyCompressedHex: signer.compressedPublicKey.toString("hex"),
+            publicKeyUncompressedHex: signer.uncompressedPublicKey.toString("hex"),
+            publicKeyFingerprint: fingerprintFromPublicKey(signer.compressedPublicKey),
+            rotationEnabled: createdKey.rotationEnabled,
+            rotationNote: createdKey.rotationNote
+        };
+        emitWalletAuditEvent(auditLogger, {
+            operation: "ProvisionAccount",
+            status: "success",
+            userId: normalizedUserId,
+            accountId,
+            keyId: result.keyId,
+            keyArn: result.keyArn,
+            network: hederaNetwork
+        });
+        return result;
+    }
+    catch (error) {
+        emitWalletAuditEvent(auditLogger, {
+            operation: "ProvisionAccount",
+            status: "failure",
+            userId: normalizedUserId,
+            keyId: selectedKeyId,
+            keyArn: selectedKeyArn,
+            network: hederaNetwork,
+            detail: error instanceof Error ? error.message : String(error)
+        });
+        throw error;
+    }
+    finally {
+        kms.destroy();
+        hederaClient?.close();
+    }
+}
+async function rotateHederaAccountKmsKey(params) {
+    const { userId, accountId, currentKeyId, replacementKeyId, awsRegion = process.env.AWS_REGION, hederaNetwork = process.env.HEDERA_NETWORK ?? "testnet", operatorId = process.env.OPERATOR_ID || process.env.HEDERA_OPERATOR_ID, operatorKey = process.env.OPERATOR_KEY || process.env.HEDERA_OPERATOR_KEY, aliasPrefix = process.env.HEDERA_KMS_ALIAS_PREFIX || "alias/workit-user", keyDescriptionPrefix = process.env.HEDERA_KMS_KEY_DESCRIPTION_PREFIX || "Workit Hedera key for user", keyPolicy, policyBindings, allowUnsafeDefaultKeyPolicy = false, auditLogger } = params;
+    const normalizedUserId = userId.trim();
+    if (!normalizedUserId) {
+        throw new Error("userId is required");
+    }
+    const normalizedAccountId = accountId.trim();
+    if (!normalizedAccountId) {
+        throw new Error("accountId is required");
+    }
+    const normalizedCurrentKeyId = currentKeyId.trim();
+    if (!normalizedCurrentKeyId) {
+        throw new Error("currentKeyId is required");
+    }
+    if (!awsRegion)
+        throw new Error("Missing AWS_REGION");
+    if (!operatorId || !operatorKey) {
+        throw new Error("Missing operator credentials: OPERATOR_ID/OPERATOR_KEY (or HEDERA_OPERATOR_ID/HEDERA_OPERATOR_KEY)");
+    }
+    const normalizedReplacementKeyId = replacementKeyId?.trim();
+    if (!normalizedReplacementKeyId && !policyBindings) {
+        throw new Error("policyBindings is required when creating a replacement key.");
+    }
+    if (keyPolicy) {
+        throw new Error("keyPolicy is no longer supported. Use policyBindings.");
+    }
+    if (allowUnsafeDefaultKeyPolicy) {
+        throw new Error("allowUnsafeDefaultKeyPolicy is no longer supported. Use policyBindings.");
+    }
+    const kms = new client_kms_1.KMSClient({ region: awsRegion });
+    let hederaClient;
+    let nextKeyId;
+    let nextKeyArn;
+    try {
+        const replacementKey = normalizedReplacementKeyId
+            ? {
+                keyId: normalizedReplacementKeyId,
+                keyArn: undefined,
+                aliasName: undefined,
+                rotationEnabled: false,
+                rotationNote: "Replacement key id was provided; key lifecycle and policy controls are managed externally."
+            }
+            : await (0, kmsKeyManager_1.createUserKmsKey)({
+                kms,
+                userId: normalizedUserId,
+                descriptionPrefix: keyDescriptionPrefix,
+                aliasPrefix,
+                policyBindings,
+                auditLogger
+            });
+        nextKeyId = replacementKey.keyId;
+        nextKeyArn = replacementKey.keyArn;
+        await (0, kmsKeyManager_1.assertKmsKeyOwnershipForUser)({
+            kms,
+            keyId: normalizedCurrentKeyId,
+            userId: normalizedUserId,
+            auditLogger
+        });
+        await (0, kmsKeyManager_1.assertKmsKeyOwnershipForUser)({
+            kms,
+            keyId: replacementKey.keyId,
+            userId: normalizedUserId,
+            auditLogger
+        });
+        const currentSigner = await (0, kmsSigner_1.createKmsHederaSigner)({
+            kms,
+            keyId: normalizedCurrentKeyId,
+            auditLogger
+        });
+        const replacementSigner = await (0, kmsSigner_1.createKmsHederaSigner)({
+            kms,
+            keyId: replacementKey.keyId,
+            auditLogger
+        });
+        hederaClient = (0, hederaClient_1.createHederaClient)({
+            network: hederaNetwork,
+            operatorId,
+            operatorKey
+        });
+        let accountUpdateTx = new sdk_1.AccountUpdateTransaction()
+            .setAccountId(sdk_1.AccountId.fromString(normalizedAccountId))
+            .setKey(replacementSigner.hederaPublicKey);
+        accountUpdateTx = await accountUpdateTx.freezeWith(hederaClient);
+        // Hedera key updates are explicitly co-signed by both the current and replacement keys.
+        await (0, hederaClient_1.addKmsSignatureToFrozenTransaction)(accountUpdateTx, currentSigner);
+        await (0, hederaClient_1.addKmsSignatureToFrozenTransaction)(accountUpdateTx, replacementSigner);
+        const { response, receipt } = await (0, hederaClient_1.executeSignedTransaction)(hederaClient, accountUpdateTx);
+        const transactionId = response.transactionId.toString();
+        const result = {
+            accountId: normalizedAccountId,
+            previousKeyId: currentSigner.keyId,
+            previousKeyArn: currentSigner.keyArn,
+            previousPublicKeyCompressedHex: currentSigner.compressedPublicKey.toString("hex"),
+            previousPublicKeyFingerprint: fingerprintFromPublicKey(currentSigner.compressedPublicKey),
+            keyId: replacementKey.keyId,
+            keyArn: replacementKey.keyArn ?? replacementSigner.keyArn,
+            aliasName: replacementKey.aliasName,
+            publicKeyCompressedHex: replacementSigner.compressedPublicKey.toString("hex"),
+            publicKeyUncompressedHex: replacementSigner.uncompressedPublicKey.toString("hex"),
+            publicKeyFingerprint: fingerprintFromPublicKey(replacementSigner.compressedPublicKey),
+            rotationEnabled: replacementKey.rotationEnabled,
+            rotationNote: replacementKey.rotationNote,
+            transactionId,
+            receiptStatus: receipt.status.toString(),
+            mirrorLink: (0, hederaClient_1.mirrorLinkForTransaction)(hederaNetwork, transactionId)
+        };
+        emitWalletAuditEvent(auditLogger, {
+            operation: "RotateAccountKey",
+            status: "success",
+            userId: normalizedUserId,
+            accountId: normalizedAccountId,
+            keyId: result.keyId,
+            keyArn: result.keyArn,
+            transactionId: result.transactionId,
+            network: hederaNetwork
+        });
+        return result;
+    }
+    catch (error) {
+        emitWalletAuditEvent(auditLogger, {
+            operation: "RotateAccountKey",
+            status: "failure",
+            userId: normalizedUserId,
+            accountId: normalizedAccountId,
+            keyId: nextKeyId ?? normalizedCurrentKeyId,
+            keyArn: nextKeyArn,
+            network: hederaNetwork,
+            detail: error instanceof Error ? error.message : String(error)
+        });
+        throw error;
+    }
+    finally {
+        kms.destroy();
+        hederaClient?.close();
+    }
+}
+//# sourceMappingURL=walletProvisioning.js.map

package/dist/walletProvisioning.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"walletProvisioning.js","sourceRoot":"","sources":["../src/walletProvisioning.ts"],"names":[],"mappings":";;AAsGA,sEA8IC;AAED,8DAiKC;AAvZD,6CAAyC;AACzC,oDAAgD;AAChD,wCAAqG;AACrG,mDAMyB;AACzB,iDAMwB;AACxB,2CAAoD;AAmEpD,SAAS,wBAAwB,CAAC,mBAA+B;IAC/D,OAAO,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACxE,CAAC;AAED,SAAS,oBAAoB,CAC3B,WAAuC,EACvC,KAAuC;IAEvC,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO;IACT,CAAC;IAED,WAAW,CAAC;QACV,GAAG,KAAK;QACR,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC,CAAC;AACL,CAAC;AAEM,KAAK,UAAU,6BAA6B,CACjD,MAA2C;IAE3C,MAAM,EACJ,MAAM,EACN,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,EAClC,aAAa,GAAI,OAAO,CAAC,GAAG,CAAC,cAA4C,IAAI,SAAS,EACtF,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,EACtE,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,EACzE,WAAW,EACX,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,IAAI,mBAAmB,EACxE,oBAAoB,GAAG,OAAO,CAAC,GAAG,CAAC,iCAAiC,IAAI,4BAA4B,EACpG,aAAa,EACb,gBAAgB,GAAG,KAAK,EACxB,SAAS,EACT,cAAc,EACd,2BAA2B,GAAG,KAAK,EACnC,WAAW,EACZ,GAAG,MAAM,CAAC;IACX,MAAM,gBAAgB,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IACvC,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;IACxC,CAAC;IAED,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;IACtD,IAAI,CAAC,UAAU,IAAI,CAAC,WAAW,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,oGAAoG,CAAC,CAAC;IACxH,CAAC;IACD,IAAI,WAAW,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,WAAW,GAAG,CAAC,CAAC,EAAE,CAAC;QACpF,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IAED,MAAM,uBAAuB,GAAG,aAAa,EAAE,IAAI,EAAE,CAAC;IACtD,IAAI,CAAC,uBAAuB,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CACb,0DAA0D;YACxD,+EAA+E,CAClF,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,uBAAuB,IAAI,CAAC,cAAc,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,2BAA2B,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,yEAAyE,CAAC,CAAC;IAC7F,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,sBAAS,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;IACjD,IAAI,YAA+D,CAAC;IACpE,IAAI,aAAiC,CAAC;IACtC,IAAI,cAAkC,CAAC;IAEvC,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,uBAAuB;YACxC,CAAC,CAAC;gBACE,KAAK,EAAE,uBAAuB;gBAC9B,MAAM,EAAE,SAAS;gBACjB,SAAS,EAAE,SAAS;gBACpB,eAAe,EAAE,KAAK;gBACtB,YAAY,EAAE,4EAA4E;aAC3F;YACH,CAAC,CAAC,MAAM,IAAA,gCAAgB,EAAC;gBACrB,GAAG;gBACH,MAAM,EAAE,gBAAgB;gBACxB,iBAAiB,EAAE,oBAAoB;gBACvC,WAAW;gBACX,cAAc;gBACd,WAAW;aACZ,CAAC,CAAC;QACP,aAAa,GAAG,UAAU,CAAC,KAAK,CAAC;QACjC,cAAc,GAAG,UAAU,CAAC,MAAM,CAAC;QAEnC,MAAM,IAAA,4CAA4B,EAAC;YACjC,GAAG;YACH,KAAK,EAAE,UAAU,CAAC,KAAK;YACvB,MAAM,EAAE,gBAAgB;YACxB,WAAW;SACZ,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,MAAM,IAAA,iCAAqB,EAAC;YACzC,GAAG;YACH,KAAK,EAAE,UAAU,CAAC,KAAK;YACvB,WAAW;SACZ,CAAC,CAAC;QACH,YAAY,GAAG,IAAA,iCAAkB,EAAC;YAChC,OAAO,EAAE,aAAa;YACtB,UAAU;YACV,WAAW;SACZ,CAAC,CAAC;QAEH,IAAI,eAAe,GAAG,IAAI,8BAAwB,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QACpF,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,GAAG,CAAC,EAAE,CAAC;YACjD,eAAe,GAAG,eAAe,CAAC,iBAAiB,CAAC,IAAI,UAAI,CAAC,WAAW,CAAC,CAAC,CAAC;QAC7E,CAAC;QACD,eAAe,GAAG,MAAM,eAAe,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;QAEjE,MAAM,IAAA,iDAAkC,EAAC,eAAe,EAAE,MAAM,CAAC,CAAC;QAClE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAA,uCAAwB,EAAC,YAAY,EAAE,eAAe,CAAC,CAAC;QAClF,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,EAAE,QAAQ,EAAE,CAAC;QAEhD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;QAC1E,CAAC;QAED,MAAM,MAAM,GAAG;YACb,SAAS;YACT,KAAK,EAAE,UAAU,CAAC,KAAK;YACvB,MAAM,EAAE,UAAU,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM;YAC1C,SAAS,EAAE,UAAU,CAAC,SAAS;YAC/B,sBAAsB,EAAE,MAAM,CAAC,mBAAmB,CAAC,QAAQ,CAAC,KAAK,CAAC;YAClE,wBAAwB,EAAE,MAAM,CAAC,qBAAqB,CAAC,QAAQ,CAAC,KAAK,CAAC;YACtE,oBAAoB,EAAE,wBAAwB,CAAC,MAAM,CAAC,mBAAmB,CAAC;YAC1E,eAAe,EAAE,UAAU,CAAC,eAAe;YAC3C,YAAY,EAAE,UAAU,CAAC,YAAY;SACtC,CAAC;QACF,oBAAoB,CAAC,WAAW,EAAE;YAChC,SAAS,EAAE,kBAAkB;YAC7B,MAAM,EAAE,SAAS;YACjB,MAAM,EAAE,gBAAgB;YACxB,SAAS;YACT,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,OAAO,EAAE,aAAa;SACvB,CAAC,CAAC;QACH,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,oBAAoB,CAAC,WAAW,EAAE;YAChC,SAAS,EAAE,kBAAkB;YAC7B,MAAM,EAAE,SAAS;YACjB,MAAM,EAAE,gBAAgB;YACxB,KAAK,EAAE,aAAa;YACpB,MAAM,EAAE,cAAc;YACtB,OAAO,EAAE,aAAa;YACtB,MAAM,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC/D,CAAC,CAAC;QACH,MAAM,KAAK,CAAC;IACd,CAAC;YAAS,CAAC;QACT,GAAG,CAAC,OAAO,EAAE,CAAC;QACd,YAAY,EAAE,KAAK,EAAE,CAAC;IACxB,CAAC;AACH,CAAC;AAEM,KAAK,UAAU,yBAAyB,CAC7C,MAAuC;IAEvC,MAAM,EACJ,MAAM,EACN,SAAS,EACT,YAAY,EACZ,gBAAgB,EAChB,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,EAClC,aAAa,GAAI,OAAO,CAAC,GAAG,CAAC,cAA4C,IAAI,SAAS,EACtF,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,EACtE,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,EACzE,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,IAAI,mBAAmB,EACxE,oBAAoB,GAAG,OAAO,CAAC,GAAG,CAAC,iCAAiC,IAAI,4BAA4B,EACpG,SAAS,EACT,cAAc,EACd,2BAA2B,GAAG,KAAK,EACnC,WAAW,EACZ,GAAG,MAAM,CAAC;IAEX,MAAM,gBAAgB,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IACvC,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;IACxC,CAAC;IACD,MAAM,mBAAmB,GAAG,SAAS,CAAC,IAAI,EAAE,CAAC;IAC7C,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC3C,CAAC;IACD,MAAM,sBAAsB,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC;IACnD,IAAI,CAAC,sBAAsB,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAC9C,CAAC;IAED,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;IACtD,IAAI,CAAC,UAAU,IAAI,CAAC,WAAW,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,oGAAoG,CAAC,CAAC;IACxH,CAAC;IAED,MAAM,0BAA0B,GAAG,gBAAgB,EAAE,IAAI,EAAE,CAAC;IAC5D,IAAI,CAAC,0BAA0B,IAAI,CAAC,cAAc,EAAE,CAAC;QACnD,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;IACjF,CAAC;IACD,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,2BAA2B,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,yEAAyE,CAAC,CAAC;IAC7F,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,sBAAS,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;IACjD,IAAI,YAA+D,CAAC;IACpE,IAAI,SAA6B,CAAC;IAClC,IAAI,UAA8B,CAAC;IAEnC,IAAI,CAAC;QACH,MAAM,cAAc,GAAG,0BAA0B;YAC/C,CAAC,CAAC;gBACE,KAAK,EAAE,0BAA0B;gBACjC,MAAM,EAAE,SAAS;gBACjB,SAAS,EAAE,SAAS;gBACpB,eAAe,EAAE,KAAK;gBACtB,YAAY,EAAE,4FAA4F;aAC3G;YACH,CAAC,CAAC,MAAM,IAAA,gCAAgB,EAAC;gBACrB,GAAG;gBACH,MAAM,EAAE,gBAAgB;gBACxB,iBAAiB,EAAE,oBAAoB;gBACvC,WAAW;gBACX,cAAc;gBACd,WAAW;aACZ,CAAC,CAAC;QACP,SAAS,GAAG,cAAc,CAAC,KAAK,CAAC;QACjC,UAAU,GAAG,cAAc,CAAC,MAAM,CAAC;QAEnC,MAAM,IAAA,4CAA4B,EAAC;YACjC,GAAG;YACH,KAAK,EAAE,sBAAsB;YAC7B,MAAM,EAAE,gBAAgB;YACxB,WAAW;SACZ,CAAC,CAAC;QACH,MAAM,IAAA,4CAA4B,EAAC;YACjC,GAAG;YACH,KAAK,EAAE,cAAc,CAAC,KAAK;YAC3B,MAAM,EAAE,gBAAgB;YACxB,WAAW;SACZ,CAAC,CAAC;QAEH,MAAM,aAAa,GAAG,MAAM,IAAA,iCAAqB,EAAC;YAChD,GAAG;YACH,KAAK,EAAE,sBAAsB;YAC7B,WAAW;SACZ,CAAC,CAAC;QACH,MAAM,iBAAiB,GAAG,MAAM,IAAA,iCAAqB,EAAC;YACpD,GAAG;YACH,KAAK,EAAE,cAAc,CAAC,KAAK;YAC3B,WAAW;SACZ,CAAC,CAAC;QAEH,YAAY,GAAG,IAAA,iCAAkB,EAAC;YAChC,OAAO,EAAE,aAAa;YACtB,UAAU;YACV,WAAW;SACZ,CAAC,CAAC;QAEH,IAAI,eAAe,GAAG,IAAI,8BAAwB,EAAE;aACjD,YAAY,CAAC,eAAS,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC;aACvD,MAAM,CAAC,iBAAiB,CAAC,eAAe,CAAC,CAAC;QAC7C,eAAe,GAAG,MAAM,eAAe,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;QAEjE,wFAAwF;QACxF,MAAM,IAAA,iDAAkC,EAAC,eAAe,EAAE,aAAa,CAAC,CAAC;QACzE,MAAM,IAAA,iDAAkC,EAAC,eAAe,EAAE,iBAAiB,CAAC,CAAC;QAE7E,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,IAAA,uCAAwB,EAAC,YAAY,EAAE,eAAe,CAAC,CAAC;QAC5F,MAAM,aAAa,GAAG,QAAQ,CAAC,aAAa,CAAC,QAAQ,EAAE,CAAC;QAExD,MAAM,MAAM,GAAG;YACb,SAAS,EAAE,mBAAmB;YAC9B,aAAa,EAAE,aAAa,CAAC,KAAK;YAClC,cAAc,EAAE,aAAa,CAAC,MAAM;YACpC,8BAA8B,EAAE,aAAa,CAAC,mBAAmB,CAAC,QAAQ,CAAC,KAAK,CAAC;YACjF,4BAA4B,EAAE,wBAAwB,CAAC,aAAa,CAAC,mBAAmB,CAAC;YACzF,KAAK,EAAE,cAAc,CAAC,KAAK;YAC3B,MAAM,EAAE,cAAc,CAAC,MAAM,IAAI,iBAAiB,CAAC,MAAM;YACzD,SAAS,EAAE,cAAc,CAAC,SAAS;YACnC,sBAAsB,EAAE,iBAAiB,CAAC,mBAAmB,CAAC,QAAQ,CAAC,KAAK,CAAC;YAC7E,wBAAwB,EAAE,iBAAiB,CAAC,qBAAqB,CAAC,QAAQ,CAAC,KAAK,CAAC;YACjF,oBAAoB,EAAE,wBAAwB,CAAC,iBAAiB,CAAC,mBAAmB,CAAC;YACrF,eAAe,EAAE,cAAc,CAAC,eAAe;YAC/C,YAAY,EAAE,cAAc,CAAC,YAAY;YACzC,aAAa;YACb,aAAa,EAAE,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE;YACxC,UAAU,EAAE,IAAA,uCAAwB,EAAC,aAAa,EAAE,aAAa,CAAC;SACnE,CAAC;QACF,oBAAoB,CAAC,WAAW,EAAE;YAChC,SAAS,EAAE,kBAAkB;YAC7B,MAAM,EAAE,SAAS;YACjB,MAAM,EAAE,gBAAgB;YACxB,SAAS,EAAE,mBAAmB;YAC9B,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,OAAO,EAAE,aAAa;SACvB,CAAC,CAAC;QACH,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,oBAAoB,CAAC,WAAW,EAAE;YAChC,SAAS,EAAE,kBAAkB;YAC7B,MAAM,EAAE,SAAS;YACjB,MAAM,EAAE,gBAAgB;YACxB,SAAS,EAAE,mBAAmB;YAC9B,KAAK,EAAE,SAAS,IAAI,sBAAsB;YAC1C,MAAM,EAAE,UAAU;YAClB,OAAO,EAAE,aAAa;YACtB,MAAM,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC/D,CAAC,CAAC;QACH,MAAM,KAAK,CAAC;IACd,CAAC;YAAS,CAAC;QACT,GAAG,CAAC,OAAO,EAAE,CAAC;QACd,YAAY,EAAE,KAAK,EAAE,CAAC;IACxB,CAAC;AACH,CAAC"}

package/package.json

@@ -0,0 +1,62 @@
+{
+  "name": "@workit-poa/hedera-kms-wallet",
+  "version": "0.1.0",
+  "description": "AWS KMS-backed Hedera wallet provisioning and signing utilities.",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/workit-poa/workit.git",
+    "directory": "libs/hedera-kms-wallet"
+  },
+  "homepage": "https://github.com/workit-poa/workit/tree/main/libs/hedera-kms-wallet#readme",
+  "bugs": {
+    "url": "https://github.com/workit-poa/workit/issues"
+  },
+  "private": false,
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md",
+    ".env.example",
+    "LICENSE"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "sideEffects": false,
+  "engines": {
+    "node": ">=18"
+  },
+  "keywords": [
+    "hedera",
+    "hashgraph",
+    "aws-kms",
+    "kms",
+    "wallet",
+    "signer"
+  ],
+  "devDependencies": {
+    "@vitest/coverage-v8": "^3.2.4",
+    "dotenv": "^16.4.5",
+    "vitest": "^3.2.4"
+  },
+  "dependencies": {
+    "@noble/hashes": "^1.7.1",
+    "@aws-sdk/client-kms": "^3.900.0",
+    "@hashgraph/sdk": "^2.62.0"
+  },
+  "scripts": {
+    "clean": "rm -rf dist",
+    "build": "tsc -p tsconfig.build.json",
+    "lint": "tsc --noEmit -p tsconfig.json",
+    "test": "vitest run",
+    "test:coverage": "vitest run --coverage"
+  }
+}