vaspera 2.5.0

package/dist/enterprise/signing/kms.js

@@ -0,0 +1,480 @@
+/**
+ * KMS-backed Signing
+ *
+ * Alternative to Sigstore for air-gapped deployments.
+ * Supports AWS KMS, GCP KMS, and HashiCorp Vault.
+ *
+ * @module enterprise/signing/kms
+ */
+import { createHash, createSign, createVerify } from "crypto";
+// ============================================================================
+// AWS KMS Client
+// ============================================================================
+/**
+ * AWS KMS signing client
+ */
+export class AWSKMSClient {
+    config;
+    constructor(config) {
+        if (config.provider !== "aws") {
+            throw new Error("AWSKMSClient requires provider: 'aws'");
+        }
+        this.config = config;
+    }
+    /**
+     * Sign content using AWS KMS
+     */
+    async sign(content) {
+        const digest = createHash("sha256").update(content).digest();
+        const digestBase64 = digest.toString("base64");
+        // Build AWS Signature Version 4 request
+        const body = JSON.stringify({
+            KeyId: this.config.keyId,
+            Message: digestBase64,
+            MessageType: "DIGEST",
+            SigningAlgorithm: "RSASSA_PKCS1_V1_5_SHA_256",
+        });
+        const response = await this.kmsRequest("Sign", body);
+        const data = (await response.json());
+        return {
+            content,
+            digest: digest.toString("hex"),
+            signature: data.Signature,
+            provider: "aws",
+            keyId: data.KeyId,
+            signedAt: new Date().toISOString(),
+            algorithm: "RSASSA_PKCS1_V1_5_SHA_256",
+        };
+    }
+    /**
+     * Verify signature using AWS KMS
+     */
+    async verify(artifact) {
+        const digest = createHash("sha256").update(artifact.content).digest();
+        const digestBase64 = digest.toString("base64");
+        const body = JSON.stringify({
+            KeyId: this.config.keyId,
+            Message: digestBase64,
+            MessageType: "DIGEST",
+            Signature: artifact.signature,
+            SigningAlgorithm: artifact.algorithm,
+        });
+        try {
+            const response = await this.kmsRequest("Verify", body);
+            const data = (await response.json());
+            return {
+                valid: data.SignatureValid,
+                keyId: this.config.keyId,
+                verifiedAt: new Date().toISOString(),
+            };
+        }
+        catch (error) {
+            return {
+                valid: false,
+                keyId: this.config.keyId,
+                error: error instanceof Error ? error.message : String(error),
+                verifiedAt: new Date().toISOString(),
+            };
+        }
+    }
+    /**
+     * Make AWS KMS API request
+     */
+    async kmsRequest(action, body) {
+        const { region, accessKeyId, secretAccessKey, sessionToken } = this.config.aws || {};
+        if (!region) {
+            throw new Error("AWS region required");
+        }
+        const url = `https://kms.${region}.amazonaws.com/`;
+        const host = `kms.${region}.amazonaws.com`;
+        const date = new Date();
+        const amzDate = date.toISOString().replace(/[:-]|\.\d{3}/g, "");
+        const dateStamp = amzDate.slice(0, 8);
+        // Build headers
+        const headers = {
+            "Content-Type": "application/x-amz-json-1.1",
+            "X-Amz-Target": `TrentService.${action}`,
+            "X-Amz-Date": amzDate,
+            Host: host,
+        };
+        if (sessionToken) {
+            headers["X-Amz-Security-Token"] = sessionToken;
+        }
+        // Sign request with SigV4 (simplified - production would use full SigV4)
+        if (accessKeyId && secretAccessKey) {
+            const signature = this.signRequest("POST", "/", headers, body, accessKeyId, secretAccessKey, region, dateStamp);
+            headers["Authorization"] = signature;
+        }
+        const response = await fetch(url, {
+            method: "POST",
+            headers,
+            body,
+        });
+        if (!response.ok) {
+            const error = await response.text();
+            throw new Error(`AWS KMS error: ${error}`);
+        }
+        return response;
+    }
+    /**
+     * Sign AWS request (simplified SigV4)
+     */
+    signRequest(_method, _path, headers, _body, accessKeyId, _secretAccessKey, _region, _dateStamp) {
+        // Note: This is a simplified version - production would implement full SigV4
+        // For real implementation, use @aws-sdk/signature-v4
+        const credential = `${accessKeyId}/${headers["X-Amz-Date"]?.slice(0, 8)}/us-east-1/kms/aws4_request`;
+        return `AWS4-HMAC-SHA256 Credential=${credential}, SignedHeaders=content-type;host;x-amz-date;x-amz-target, Signature=PLACEHOLDER`;
+    }
+}
+// ============================================================================
+// GCP KMS Client
+// ============================================================================
+/**
+ * GCP KMS signing client
+ */
+export class GCPKMSClient {
+    config;
+    accessToken = null;
+    constructor(config) {
+        if (config.provider !== "gcp") {
+            throw new Error("GCPKMSClient requires provider: 'gcp'");
+        }
+        this.config = config;
+    }
+    /**
+     * Sign content using GCP KMS
+     */
+    async sign(content) {
+        const digest = createHash("sha256").update(content).digest("base64");
+        const { projectId, locationId, keyRingId } = this.config.gcp || {};
+        const keyName = `projects/${projectId}/locations/${locationId}/keyRings/${keyRingId}/cryptoKeys/${this.config.keyId}/cryptoKeyVersions/1`;
+        const response = await this.kmsRequest(`${keyName}:asymmetricSign`, {
+            digest: { sha256: digest },
+        });
+        const data = (await response.json());
+        return {
+            content,
+            digest: createHash("sha256").update(content).digest("hex"),
+            signature: data.signature,
+            provider: "gcp",
+            keyId: keyName,
+            signedAt: new Date().toISOString(),
+            algorithm: "RSA_SIGN_PKCS1_256",
+        };
+    }
+    /**
+     * Verify signature using GCP KMS
+     */
+    async verify(artifact) {
+        const digest = createHash("sha256").update(artifact.content).digest("base64");
+        try {
+            const response = await this.kmsRequest(`${artifact.keyId}:asymmetricVerify`, {
+                digest: { sha256: digest },
+                signature: artifact.signature,
+            });
+            const data = (await response.json());
+            return {
+                valid: data.success,
+                keyId: artifact.keyId,
+                verifiedAt: new Date().toISOString(),
+            };
+        }
+        catch (error) {
+            return {
+                valid: false,
+                keyId: artifact.keyId,
+                error: error instanceof Error ? error.message : String(error),
+                verifiedAt: new Date().toISOString(),
+            };
+        }
+    }
+    /**
+     * Make GCP KMS API request
+     */
+    async kmsRequest(path, body) {
+        const token = await this.getAccessToken();
+        const response = await fetch(`https://cloudkms.googleapis.com/v1/${path}`, {
+            method: "POST",
+            headers: {
+                Authorization: `Bearer ${token}`,
+                "Content-Type": "application/json",
+            },
+            body: JSON.stringify(body),
+        });
+        if (!response.ok) {
+            const error = await response.text();
+            throw new Error(`GCP KMS error: ${error}`);
+        }
+        return response;
+    }
+    /**
+     * Get GCP access token
+     */
+    async getAccessToken() {
+        if (this.accessToken) {
+            return this.accessToken;
+        }
+        // Try metadata server (for GCE/Cloud Run/etc.)
+        try {
+            const response = await fetch("http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token", {
+                headers: { "Metadata-Flavor": "Google" },
+            });
+            if (response.ok) {
+                const data = (await response.json());
+                this.accessToken = data.access_token;
+                return this.accessToken;
+            }
+        }
+        catch {
+            // Fall through to other methods
+        }
+        // Try application default credentials
+        const gcloudToken = process.env.GOOGLE_APPLICATION_CREDENTIALS;
+        if (gcloudToken) {
+            // Would parse service account and generate JWT - simplified here
+            throw new Error("Service account authentication not implemented - use metadata server");
+        }
+        throw new Error("No GCP credentials available");
+    }
+}
+// ============================================================================
+// HashiCorp Vault Client
+// ============================================================================
+/**
+ * HashiCorp Vault signing client
+ */
+export class VaultClient {
+    config;
+    constructor(config) {
+        if (config.provider !== "vault") {
+            throw new Error("VaultClient requires provider: 'vault'");
+        }
+        this.config = config;
+    }
+    /**
+     * Sign content using Vault Transit
+     */
+    async sign(content) {
+        const { address, token, namespace, mountPath = "transit" } = this.config.vault || {};
+        const digest = createHash("sha256").update(content).digest("base64");
+        const response = await fetch(`${address}/v1/${mountPath}/sign/${this.config.keyId}/sha2-256`, {
+            method: "POST",
+            headers: {
+                "X-Vault-Token": token,
+                "X-Vault-Namespace": namespace,
+                "Content-Type": "application/json",
+            },
+            body: JSON.stringify({ input: digest }),
+        });
+        if (!response.ok) {
+            const error = await response.text();
+            throw new Error(`Vault error: ${error}`);
+        }
+        const data = (await response.json());
+        return {
+            content,
+            digest: createHash("sha256").update(content).digest("hex"),
+            signature: data.data.signature,
+            provider: "vault",
+            keyId: this.config.keyId,
+            signedAt: new Date().toISOString(),
+            algorithm: "sha2-256",
+            keyVersion: String(data.data.key_version),
+        };
+    }
+    /**
+     * Verify signature using Vault Transit
+     */
+    async verify(artifact) {
+        const { address, token, namespace, mountPath = "transit" } = this.config.vault || {};
+        const digest = createHash("sha256").update(artifact.content).digest("base64");
+        try {
+            const response = await fetch(`${address}/v1/${mountPath}/verify/${artifact.keyId}/sha2-256`, {
+                method: "POST",
+                headers: {
+                    "X-Vault-Token": token,
+                    "X-Vault-Namespace": namespace,
+                    "Content-Type": "application/json",
+                },
+                body: JSON.stringify({
+                    input: digest,
+                    signature: artifact.signature,
+                }),
+            });
+            if (!response.ok) {
+                throw new Error("Verification failed");
+            }
+            const data = (await response.json());
+            return {
+                valid: data.data.valid,
+                keyId: artifact.keyId,
+                verifiedAt: new Date().toISOString(),
+            };
+        }
+        catch (error) {
+            return {
+                valid: false,
+                keyId: artifact.keyId,
+                error: error instanceof Error ? error.message : String(error),
+                verifiedAt: new Date().toISOString(),
+            };
+        }
+    }
+}
+// ============================================================================
+// Local Key Client (for testing)
+// ============================================================================
+/**
+ * Local key signing client (for testing/development)
+ */
+export class LocalKeyClient {
+    config;
+    constructor(config) {
+        if (config.provider !== "local") {
+            throw new Error("LocalKeyClient requires provider: 'local'");
+        }
+        if (!config.local?.privateKeyPem || !config.local?.publicKeyPem) {
+            throw new Error("LocalKeyClient requires privateKeyPem and publicKeyPem");
+        }
+        this.config = config;
+    }
+    /**
+     * Sign content using local private key
+     */
+    async sign(content) {
+        const sign = createSign("SHA256");
+        sign.update(content);
+        sign.end();
+        const signature = sign.sign(this.config.local.privateKeyPem, "base64");
+        return {
+            content,
+            digest: createHash("sha256").update(content).digest("hex"),
+            signature,
+            provider: "local",
+            keyId: this.config.keyId,
+            signedAt: new Date().toISOString(),
+            algorithm: "RSA-SHA256",
+        };
+    }
+    /**
+     * Verify signature using local public key
+     */
+    async verify(artifact) {
+        try {
+            const verify = createVerify("SHA256");
+            verify.update(artifact.content);
+            verify.end();
+            const valid = verify.verify(this.config.local.publicKeyPem, artifact.signature, "base64");
+            return {
+                valid,
+                keyId: artifact.keyId,
+                verifiedAt: new Date().toISOString(),
+            };
+        }
+        catch (error) {
+            return {
+                valid: false,
+                keyId: artifact.keyId,
+                error: error instanceof Error ? error.message : String(error),
+                verifiedAt: new Date().toISOString(),
+            };
+        }
+    }
+}
+// ============================================================================
+// Unified KMS Client
+// ============================================================================
+/**
+ * Unified KMS client
+ */
+export class KMSClient {
+    client;
+    provider;
+    constructor(config) {
+        this.provider = config.provider;
+        switch (config.provider) {
+            case "aws":
+                this.client = new AWSKMSClient(config);
+                break;
+            case "gcp":
+                this.client = new GCPKMSClient(config);
+                break;
+            case "vault":
+                this.client = new VaultClient(config);
+                break;
+            case "local":
+                this.client = new LocalKeyClient(config);
+                break;
+            default:
+                throw new Error(`Unsupported KMS provider: ${config.provider}`);
+        }
+    }
+    /**
+     * Sign content
+     */
+    async sign(content) {
+        return this.client.sign(content);
+    }
+    /**
+     * Verify signature
+     */
+    async verify(artifact) {
+        return this.client.verify(artifact);
+    }
+    /**
+     * Get provider name
+     */
+    getProvider() {
+        return this.provider;
+    }
+}
+// ============================================================================
+// Factory Functions
+// ============================================================================
+/**
+ * Create KMS client
+ */
+export function createKMSClient(config) {
+    return new KMSClient(config);
+}
+/**
+ * Create AWS KMS client
+ */
+export function createAWSKMSClient(keyId, options) {
+    return new AWSKMSClient({
+        provider: "aws",
+        keyId,
+        aws: options,
+    });
+}
+/**
+ * Create GCP KMS client
+ */
+export function createGCPKMSClient(keyId, options) {
+    return new GCPKMSClient({
+        provider: "gcp",
+        keyId,
+        gcp: options,
+    });
+}
+/**
+ * Create Vault client
+ */
+export function createVaultClient(keyId, options) {
+    return new VaultClient({
+        provider: "vault",
+        keyId,
+        vault: options,
+    });
+}
+/**
+ * Create local key client (for testing)
+ */
+export function createLocalKeyClient(keyId, privateKeyPem, publicKeyPem) {
+    return new LocalKeyClient({
+        provider: "local",
+        keyId,
+        local: { privateKeyPem, publicKeyPem },
+    });
+}
+//# sourceMappingURL=kms.js.map

package/dist/enterprise/signing/kms.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"kms.js","sourceRoot":"","sources":["../../../src/enterprise/signing/kms.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAkG9D,+EAA+E;AAC/E,iBAAiB;AACjB,+EAA+E;AAE/E;;GAEG;AACH,MAAM,OAAO,YAAY;IACf,MAAM,CAAY;IAE1B,YAAY,MAAiB;QAC3B,IAAI,MAAM,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAC3D,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,IAAI,CAAC,OAAe;QACxB,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC;QAC7D,MAAM,YAAY,GAAG,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAE/C,wCAAwC;QACxC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC;YAC1B,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK;YACxB,OAAO,EAAE,YAAY;YACrB,WAAW,EAAE,QAAQ;YACrB,gBAAgB,EAAE,2BAA2B;SAC9C,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACrD,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAyC,CAAC;QAE7E,OAAO;YACL,OAAO;YACP,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;YAC9B,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,QAAQ,EAAE,KAAK;YACf,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAClC,SAAS,EAAE,2BAA2B;SACvC,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CAAC,QAA2B;QACtC,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC;QACtE,MAAM,YAAY,GAAG,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAE/C,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC;YAC1B,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK;YACxB,OAAO,EAAE,YAAY;YACrB,WAAW,EAAE,QAAQ;YACrB,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,gBAAgB,EAAE,QAAQ,CAAC,SAAS;SACrC,CAAC,CAAC;QAEH,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YACvD,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAgC,CAAC;YAEpE,OAAO;gBACL,KAAK,EAAE,IAAI,CAAC,cAAc;gBAC1B,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK;gBACxB,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACrC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK;gBACxB,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;gBAC7D,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACrC,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,UAAU,CAAC,MAAc,EAAE,IAAY;QACnD,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,eAAe,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC;QAErF,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QACzC,CAAC;QAED,MAAM,GAAG,GAAG,eAAe,MAAM,iBAAiB,CAAC;QACnD,MAAM,IAAI,GAAG,OAAO,MAAM,gBAAgB,CAAC;QAC3C,MAAM,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;QAChE,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAEtC,gBAAgB;QAChB,MAAM,OAAO,GAA2B;YACtC,cAAc,EAAE,4BAA4B;YAC5C,cAAc,EAAE,gBAAgB,MAAM,EAAE;YACxC,YAAY,EAAE,OAAO;YACrB,IAAI,EAAE,IAAI;SACX,CAAC;QAEF,IAAI,YAAY,EAAE,CAAC;YACjB,OAAO,CAAC,sBAAsB,CAAC,GAAG,YAAY,CAAC;QACjD,CAAC;QAED,yEAAyE;QACzE,IAAI,WAAW,IAAI,eAAe,EAAE,CAAC;YACnC,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAChC,MAAM,EACN,GAAG,EACH,OAAO,EACP,IAAI,EACJ,WAAW,EACX,eAAe,EACf,MAAM,EACN,SAAS,CACV,CAAC;YACF,OAAO,CAAC,eAAe,CAAC,GAAG,SAAS,CAAC;QACvC,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAChC,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI;SACL,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,kBAAkB,KAAK,EAAE,CAAC,CAAC;QAC7C,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;OAEG;IACK,WAAW,CACjB,OAAe,EACf,KAAa,EACb,OAA+B,EAC/B,KAAa,EACb,WAAmB,EACnB,gBAAwB,EACxB,OAAe,EACf,UAAkB;QAElB,6EAA6E;QAC7E,qDAAqD;QACrD,MAAM,UAAU,GAAG,GAAG,WAAW,IAAI,OAAO,CAAC,YAAY,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,6BAA6B,CAAC;QACrG,OAAO,+BAA+B,UAAU,kFAAkF,CAAC;IACrI,CAAC;CACF;AAED,+EAA+E;AAC/E,iBAAiB;AACjB,+EAA+E;AAE/E;;GAEG;AACH,MAAM,OAAO,YAAY;IACf,MAAM,CAAY;IAClB,WAAW,GAAkB,IAAI,CAAC;IAE1C,YAAY,MAAiB;QAC3B,IAAI,MAAM,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAC3D,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,IAAI,CAAC,OAAe;QACxB,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAErE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC;QACnE,MAAM,OAAO,GAAG,YAAY,SAAS,cAAc,UAAU,aAAa,SAAS,eAAe,IAAI,CAAC,MAAM,CAAC,KAAK,sBAAsB,CAAC;QAE1I,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CACpC,GAAG,OAAO,iBAAiB,EAC3B;YACE,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE;SAC3B,CACF,CAAC;QAEF,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA0B,CAAC;QAE9D,OAAO;YACL,OAAO;YACP,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;YAC1D,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,QAAQ,EAAE,KAAK;YACf,KAAK,EAAE,OAAO;YACd,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAClC,SAAS,EAAE,oBAAoB;SAChC,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CAAC,QAA2B;QACtC,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAE9E,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CACpC,GAAG,QAAQ,CAAC,KAAK,mBAAmB,EACpC;gBACE,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE;gBAC1B,SAAS,EAAE,QAAQ,CAAC,SAAS;aAC9B,CACF,CAAC;YAEF,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAyB,CAAC;YAE7D,OAAO;gBACL,KAAK,EAAE,IAAI,CAAC,OAAO;gBACnB,KAAK,EAAE,QAAQ,CAAC,KAAK;gBACrB,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACrC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,KAAK,EAAE,QAAQ,CAAC,KAAK;gBACrB,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;gBAC7D,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACrC,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,UAAU,CAAC,IAAY,EAAE,IAAa;QAClD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAE1C,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,sCAAsC,IAAI,EAAE,EAAE;YACzE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,KAAK,EAAE;gBAChC,cAAc,EAAE,kBAAkB;aACnC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC3B,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,kBAAkB,KAAK,EAAE,CAAC,CAAC;QAC7C,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,cAAc;QAC1B,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACrB,OAAO,IAAI,CAAC,WAAW,CAAC;QAC1B,CAAC;QAED,+CAA+C;QAC/C,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAC1B,4FAA4F,EAC5F;gBACE,OAAO,EAAE,EAAE,iBAAiB,EAAE,QAAQ,EAAE;aACzC,CACF,CAAC;YAEF,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;gBAChB,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA6B,CAAC;gBACjE,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,YAAY,CAAC;gBACrC,OAAO,IAAI,CAAC,WAAW,CAAC;YAC1B,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,gCAAgC;QAClC,CAAC;QAED,sCAAsC;QACtC,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC;QAC/D,IAAI,WAAW,EAAE,CAAC;YAChB,iEAAiE;YACjE,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;QAC1F,CAAC;QAED,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAClD,CAAC;CACF;AAED,+EAA+E;AAC/E,yBAAyB;AACzB,+EAA+E;AAE/E;;GAEG;AACH,MAAM,OAAO,WAAW;IACd,MAAM,CAAY;IAE1B,YAAY,MAAiB;QAC3B,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAC5D,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,IAAI,CAAC,OAAe;QACxB,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,GAAG,SAAS,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;QAErF,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAErE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAC1B,GAAG,OAAO,OAAO,SAAS,SAAS,IAAI,CAAC,MAAM,CAAC,KAAK,WAAW,EAC/D;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,eAAe,EAAE,KAAM;gBACvB,mBAAmB,EAAE,SAAS;gBAC9B,cAAc,EAAE,kBAAkB;aACT;YAC3B,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;SACxC,CACF,CAAC;QAEF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,gBAAgB,KAAK,EAAE,CAAC,CAAC;QAC3C,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAElC,CAAC;QAEF,OAAO;YACL,OAAO;YACP,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;YAC1D,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS;YAC9B,QAAQ,EAAE,OAAO;YACjB,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK;YACxB,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAClC,SAAS,EAAE,UAAU;YACrB,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC;SAC1C,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CAAC,QAA2B;QACtC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,GAAG,SAAS,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;QAErF,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAE9E,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAC1B,GAAG,OAAO,OAAO,SAAS,WAAW,QAAQ,CAAC,KAAK,WAAW,EAC9D;gBACE,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,eAAe,EAAE,KAAM;oBACvB,mBAAmB,EAAE,SAAS;oBAC9B,cAAc,EAAE,kBAAkB;iBACT;gBAC3B,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,KAAK,EAAE,MAAM;oBACb,SAAS,EAAE,QAAQ,CAAC,SAAS;iBAC9B,CAAC;aACH,CACF,CAAC;YAEF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;YACzC,CAAC;YAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAiC,CAAC;YAErE,OAAO;gBACL,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK;gBACtB,KAAK,EAAE,QAAQ,CAAC,KAAK;gBACrB,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACrC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,KAAK,EAAE,QAAQ,CAAC,KAAK;gBACrB,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;gBAC7D,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACrC,CAAC;QACJ,CAAC;IACH,CAAC;CACF;AAED,+EAA+E;AAC/E,iCAAiC;AACjC,+EAA+E;AAE/E;;GAEG;AACH,MAAM,OAAO,cAAc;IACjB,MAAM,CAAY;IAE1B,YAAY,MAAiB;QAC3B,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QAC/D,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,aAAa,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,YAAY,EAAE,CAAC;YAChE,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;QAC5E,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,IAAI,CAAC,OAAe;QACxB,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;QAClC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACrB,IAAI,CAAC,GAAG,EAAE,CAAC;QAEX,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAM,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;QAExE,OAAO;YACL,OAAO;YACP,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;YAC1D,SAAS;YACT,QAAQ,EAAE,OAAO;YACjB,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK;YACxB,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAClC,SAAS,EAAE,YAAY;SACxB,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CAAC,QAA2B;QACtC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;YACtC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YAChC,MAAM,CAAC,GAAG,EAAE,CAAC;YAEb,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CACzB,IAAI,CAAC,MAAM,CAAC,KAAM,CAAC,YAAY,EAC/B,QAAQ,CAAC,SAAS,EAClB,QAAQ,CACT,CAAC;YAEF,OAAO;gBACL,KAAK;gBACL,KAAK,EAAE,QAAQ,CAAC,KAAK;gBACrB,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACrC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,KAAK,EAAE,QAAQ,CAAC,KAAK;gBACrB,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;gBAC7D,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aACrC,CAAC;QACJ,CAAC;IACH,CAAC;CACF;AAED,+EAA+E;AAC/E,qBAAqB;AACrB,+EAA+E;AAE/E;;GAEG;AACH,MAAM,OAAO,SAAS;IACZ,MAAM,CAA6D;IACnE,QAAQ,CAAc;IAE9B,YAAY,MAAiB;QAC3B,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QAEhC,QAAQ,MAAM,CAAC,QAAQ,EAAE,CAAC;YACxB,KAAK,KAAK;gBACR,IAAI,CAAC,MAAM,GAAG,IAAI,YAAY,CAAC,MAAM,CAAC,CAAC;gBACvC,MAAM;YACR,KAAK,KAAK;gBACR,IAAI,CAAC,MAAM,GAAG,IAAI,YAAY,CAAC,MAAM,CAAC,CAAC;gBACvC,MAAM;YACR,KAAK,OAAO;gBACV,IAAI,CAAC,MAAM,GAAG,IAAI,WAAW,CAAC,MAAM,CAAC,CAAC;gBACtC,MAAM;YACR,KAAK,OAAO;gBACV,IAAI,CAAC,MAAM,GAAG,IAAI,cAAc,CAAC,MAAM,CAAC,CAAC;gBACzC,MAAM;YACR;gBACE,MAAM,IAAI,KAAK,CAAC,6BAA6B,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,IAAI,CAAC,OAAe;QACxB,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACnC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CAAC,QAA2B;QACtC,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACtC,CAAC;IAED;;OAEG;IACH,WAAW;QACT,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;CACF;AAED,+EAA+E;AAC/E,oBAAoB;AACpB,+EAA+E;AAE/E;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,MAAiB;IAC/C,OAAO,IAAI,SAAS,CAAC,MAAM,CAAC,CAAC;AAC/B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAChC,KAAa,EACb,OAA2E;IAE3E,OAAO,IAAI,YAAY,CAAC;QACtB,QAAQ,EAAE,KAAK;QACf,KAAK;QACL,GAAG,EAAE,OAAO;KACb,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAChC,KAAa,EACb,OAAqE;IAErE,OAAO,IAAI,YAAY,CAAC;QACtB,QAAQ,EAAE,KAAK;QACf,KAAK;QACL,GAAG,EAAE,OAAO;KACb,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAC/B,KAAa,EACb,OAA+D;IAE/D,OAAO,IAAI,WAAW,CAAC;QACrB,QAAQ,EAAE,OAAO;QACjB,KAAK;QACL,KAAK,EAAE,OAAO;KACf,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAClC,KAAa,EACb,aAAqB,EACrB,YAAoB;IAEpB,OAAO,IAAI,cAAc,CAAC;QACxB,QAAQ,EAAE,OAAO;QACjB,KAAK;QACL,KAAK,EAAE,EAAE,aAAa,EAAE,YAAY,EAAE;KACvC,CAAC,CAAC;AACL,CAAC"}

package/dist/enterprise/signing/kms.test.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Tests for KMS-backed Signing
+ */
+export {};
+//# sourceMappingURL=kms.test.d.ts.map

package/dist/enterprise/signing/kms.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"kms.test.d.ts","sourceRoot":"","sources":["../../../src/enterprise/signing/kms.test.ts"],"names":[],"mappings":"AAAA;;GAEG"}