Class VaultKmsProvider

constructor

• new VaultKmsProvider(options: VaultKmsOptions): VaultKmsProvider

  Create a Vault Transit provider with the given options.

  Parameters

  • options: VaultKmsOptions

  Returns VaultKmsProvider

Readonlyname

buildUrl

• buildUrl(path: string): string

  Build a Vault API URL for the transit engine.

  Parameters

  • path: string

  Returns string

buildHeaders

• buildHeaders(): Record<string, string>

  Common headers for Vault API requests.

  Returns Record<string, string>

listKeys

• listKeys(
      _filters?: { usage?: string; enabled?: boolean },
  ): Promise<KmsKeyMetadata[]>

  List all keys, optionally filtered by usage or enabled state.

  Parameters

  • Optional_filters: { usage?: string; enabled?: boolean }

  Returns Promise<KmsKeyMetadata[]>

getKey

• getKey(_keyId: string): Promise<KmsKeyMetadata>

  Retrieve metadata for a specific key by ID.

  Parameters

  • _keyId: string

  Returns Promise<KmsKeyMetadata>

createKey

• createKey(
      _algorithm: string,
      _usage: "encrypt" | "sign" | "wrap",
      _metadata?: Record<string, string>,
  ): Promise<KmsKeyMetadata>

  Create a new key with the given algorithm and usage.

  Parameters

  • _algorithm: string
  • _usage: "encrypt" | "sign" | "wrap"
  • Optional_metadata: Record<string, string>

  Returns Promise<KmsKeyMetadata>

enableKey

• enableKey(_keyId: string): Promise<void>

  Enable a previously disabled key.

  Parameters

  • _keyId: string

  Returns Promise<void>

disableKey

• disableKey(_keyId: string): Promise<void>

  Disable a key so it cannot be used for operations.

  Parameters

  • _keyId: string

  Returns Promise<void>

scheduleKeyDeletion

• scheduleKeyDeletion(_keyId: string, _pendingWindowDays?: number): Promise<void>

  Schedule a key for deletion after a pending window.

  Parameters

  • _keyId: string
  • Optional_pendingWindowDays: number

  Returns Promise<void>

encrypt

• encrypt(
      _keyId: string,
      _plaintext: Uint8Array,
      _context?: Record<string, string>,
  ): Promise<KmsEncryptResult>

  Encrypt plaintext using a managed key.

  Parameters

  • _keyId: string
  • _plaintext: Uint8Array
  • Optional_context: Record<string, string>

  Returns Promise<KmsEncryptResult>

decrypt

• decrypt(
      _keyId: string,
      _ciphertext: string,
      _context?: Record<string, string>,
  ): Promise<KmsDecryptResult>

  Decrypt ciphertext using a managed key.

  Parameters

  • _keyId: string
  • _ciphertext: string
  • Optional_context: Record<string, string>

  Returns Promise<KmsDecryptResult>

sign

• sign(
      _keyId: string,
      _data: Uint8Array,
      _algorithm?: string,
  ): Promise<KmsSignResult>

  Sign data using a managed signing key.

  Parameters

  • _keyId: string
  • _data: Uint8Array
  • Optional_algorithm: string

  Returns Promise<KmsSignResult>

verify

• verify(
      _keyId: string,
      _data: Uint8Array,
      _signature: string,
      _algorithm?: string,
  ): Promise<boolean>

  Verify a signature against data.

  Parameters

  • _keyId: string
  • _data: Uint8Array
  • _signature: string
  • Optional_algorithm: string

  Returns Promise<boolean>

rotateKey

• rotateKey(_keyId: string): Promise<KmsKeyMetadata>

  Rotate a key to a new version.

  Parameters

  • _keyId: string

  Returns Promise<KmsKeyMetadata>

generateDataKey

• generateDataKey(
      _keyId: string,
      _keySpec?: string,
  ): Promise<{ plaintext: Uint8Array; ciphertext: string }>

  Generate a data encryption key (DEK) wrapped by the managed key.

  Parameters

  • _keyId: string
  • Optional_keySpec: string

  Returns Promise<{ plaintext: Uint8Array; ciphertext: string }>