Class LocalKmsProvider

Local in-memory KMS provider.

Uses Node.js crypto for AES-256-GCM symmetric operations and @sebastienrousseau/crypto-lib Ed25519 for signing operations. Keys are stored in memory and do not persist across restarts.

Example

const provider = new LocalKmsProvider();
const key = await provider.createKey("aes-256-gcm", "encrypt");
const enc = await provider.encrypt(key.keyId, new TextEncoder().encode("hello"));
const dec = await provider.decrypt(key.keyId, enc.ciphertext);
console.log(new TextDecoder().decode(dec.plaintext)); // "hello"

Implements

KmsProvider

Index

Constructors

constructor

new LocalKmsProvider(): LocalKmsProvider

Returns LocalKmsProvider

Properties

`Readonly`name

name: "local"

Provider identifier.

Methods

listKeys

listKeys(
filters?: { usage?: string; enabled?: boolean },
): Promise<KmsKeyMetadata[]>
List all keys, optionally filtered by usage or enabled state.
Parameters
- Optionalfilters: { usage?: string; enabled?: boolean }
Returns Promise<KmsKeyMetadata[]>
Implementation of KmsProvider.listKeys
- Defined in providers/local.ts:70

getKey

getKey(keyId: string): Promise<KmsKeyMetadata>
Retrieve metadata for a specific key by ID.
Parameters
- keyId: string
Returns Promise<KmsKeyMetadata>
Implementation of KmsProvider.getKey
- Defined in providers/local.ts:90

createKey

createKey(
    algorithm: string,
    usage: "encrypt" | "sign" | "wrap",
    _metadata?: Record<string, string>,
): Promise<KmsKeyMetadata>
Create a new key with the given algorithm and usage.
Parameters
- algorithm: string
- usage: "encrypt" | "sign" | "wrap"
- Optional_metadata: Record<string, string>
Returns Promise<KmsKeyMetadata>
Implementation of KmsProvider.createKey
- Defined in providers/local.ts:97

enableKey

enableKey(keyId: string): Promise<void>
Enable a previously disabled key.
Parameters
- keyId: string
Returns Promise<void>
Implementation of KmsProvider.enableKey
- Defined in providers/local.ts:137

disableKey

disableKey(keyId: string): Promise<void>
Disable a key so it cannot be used for operations.
Parameters
- keyId: string
Returns Promise<void>
Implementation of KmsProvider.disableKey
- Defined in providers/local.ts:145

scheduleKeyDeletion

scheduleKeyDeletion(keyId: string, pendingWindowDays?: number): Promise<void>
Schedule a key for deletion after a pending window.
Parameters
- keyId: string
- pendingWindowDays: number = 30
Returns Promise<void>
Implementation of KmsProvider.scheduleKeyDeletion
- Defined in providers/local.ts:153

encrypt

encrypt(
    keyId: string,
    plaintext: Uint8Array,
    context?: Record<string, string>,
): Promise<KmsEncryptResult>
Encrypt plaintext with AES-256-GCM using the managed key.
Parameters
- keyId: string
- plaintext: Uint8Array
- Optionalcontext: Record<string, string>
Returns Promise<KmsEncryptResult>
Implementation of KmsProvider.encrypt
- Defined in providers/local.ts:165

decrypt

decrypt(
    keyId: string,
    ciphertext: string,
    context?: Record<string, string>,
): Promise<KmsDecryptResult>
Decrypt AES-256-GCM ciphertext using the managed key.
Parameters
- keyId: string
- ciphertext: string
- Optionalcontext: Record<string, string>
Returns Promise<KmsDecryptResult>
Implementation of KmsProvider.decrypt
- Defined in providers/local.ts:201

sign

sign(
    keyId: string,
    data: Uint8Array,
    _algorithm?: string,
): Promise<KmsSignResult>
Sign data using the Ed25519 signing key.
Parameters
- keyId: string
- data: Uint8Array
- Optional_algorithm: string
Returns Promise<KmsSignResult>
Implementation of KmsProvider.sign
- Defined in providers/local.ts:236

verify

verify(
    keyId: string,
    data: Uint8Array,
    signature: string,
    _algorithm?: string,
): Promise<boolean>
Verify an Ed25519 signature against data.
Parameters
- keyId: string
- data: Uint8Array
- signature: string
- Optional_algorithm: string
Returns Promise<boolean>
Implementation of KmsProvider.verify
- Defined in providers/local.ts:258

rotateKey

rotateKey(keyId: string): Promise<KmsKeyMetadata>
Rotate key material while preserving the key ID and metadata.
Parameters
- keyId: string
Returns Promise<KmsKeyMetadata>
Implementation of KmsProvider.rotateKey
- Defined in providers/local.ts:281

generateDataKey

generateDataKey(
keyId: string,
_keySpec?: string,
): Promise<{ plaintext: Uint8Array; ciphertext: string }>
Generate a data encryption key (DEK) wrapped by the managed key.
Parameters
- keyId: string
- Optional_keySpec: string
Returns Promise<{ plaintext: Uint8Array; ciphertext: string }>
Implementation of KmsProvider.generateDataKey
- Defined in providers/local.ts:299

Class LocalKmsProvider

Example

Implements

Index

Constructors

Properties

Methods

Constructors

constructor

Returns LocalKmsProvider

Properties

Readonlyname

Methods

listKeys

Parameters

Returns Promise<KmsKeyMetadata[]>

getKey

Parameters

Returns Promise<KmsKeyMetadata>

createKey

Parameters

Returns Promise<KmsKeyMetadata>

enableKey

Parameters

Returns Promise<void>

disableKey

Parameters

Returns Promise<void>

scheduleKeyDeletion

Parameters

Returns Promise<void>

encrypt

Parameters

Returns Promise<KmsEncryptResult>

decrypt

Parameters

Returns Promise<KmsDecryptResult>

sign

Parameters

Returns Promise<KmsSignResult>

verify

Parameters

Returns Promise<boolean>

rotateKey

Parameters

Returns Promise<KmsKeyMetadata>

generateDataKey

Parameters

Returns Promise<{ plaintext: Uint8Array; ciphertext: string }>

Settings

On This Page

`Readonly`name