Crypto KMS
    Preparing search index...

    Interface KmsProvider

    Unified interface for all key management providers.

    Adapts cloud KMS services (AWS, GCP, Azure, Vault) and local key stores to a single API surface, enabling provider-agnostic key operations.

    async function encryptData(provider: KmsProvider, keyId: string, data: Uint8Array) {
      const { ciphertext } = await provider.encrypt(keyId, data);
      const { plaintext } = await provider.decrypt(keyId, ciphertext);
      return plaintext;
    }
    interface KmsProvider {
        name: string;
        listKeys(
            filters?: { usage?: string; enabled?: boolean },
        ): Promise<KmsKeyMetadata[]>;
        getKey(keyId: string): Promise<KmsKeyMetadata>;
        createKey(
            algorithm: string,
            usage: "encrypt" | "sign" | "wrap",
            metadata?: Record<string, string>,
        ): Promise<KmsKeyMetadata>;
        enableKey(keyId: string): Promise<void>;
        disableKey(keyId: string): Promise<void>;
        scheduleKeyDeletion(
            keyId: string,
            pendingWindowDays?: number,
        ): Promise<void>;
        encrypt(
            keyId: string,
            plaintext: Uint8Array,
            context?: Record<string, string>,
        ): Promise<KmsEncryptResult>;
        decrypt(
            keyId: string,
            ciphertext: string,
            context?: Record<string, string>,
        ): Promise<KmsDecryptResult>;
        sign(
            keyId: string,
            data: Uint8Array,
            algorithm?: string,
        ): Promise<KmsSignResult>;
        verify(
            keyId: string,
            data: Uint8Array,
            signature: string,
            algorithm?: string,
        ): Promise<boolean>;
        rotateKey(keyId: string): Promise<KmsKeyMetadata>;
        generateDataKey(
            keyId: string,
            keySpec?: string,
        ): Promise<{ plaintext: Uint8Array; ciphertext: string }>;
    }

    Implemented by

    Index
    name
    listKeys getKey createKey enableKey disableKey scheduleKeyDeletion encrypt decrypt sign verify rotateKey generateDataKey
    name: string

    Provider name identifier.

    • List all managed keys matching optional filters.

      Parameters

      • Optionalfilters: { usage?: string; enabled?: boolean }

      Returns Promise<KmsKeyMetadata[]>

    • Create a new managed key.

      Parameters

      • algorithm: string
      • usage: "encrypt" | "sign" | "wrap"
      • Optionalmetadata: Record<string, string>

      Returns Promise<KmsKeyMetadata>

    • Enable a disabled key.

      Parameters

      • keyId: string

      Returns Promise<void>

    • Disable a key (soft delete).

      Parameters

      • keyId: string

      Returns Promise<void>

    • Schedule a key for deletion.

      Parameters

      • keyId: string
      • OptionalpendingWindowDays: number

      Returns Promise<void>

    • Encrypt plaintext with a managed key.

      Parameters

      • keyId: string
      • plaintext: Uint8Array
      • Optionalcontext: Record<string, string>

      Returns Promise<KmsEncryptResult>

    • Decrypt ciphertext with a managed key.

      Parameters

      • keyId: string
      • ciphertext: string
      • Optionalcontext: Record<string, string>

      Returns Promise<KmsDecryptResult>

    • Sign data with a managed signing key.

      Parameters

      • keyId: string
      • data: Uint8Array
      • Optionalalgorithm: string

      Returns Promise<KmsSignResult>

    • Verify a signature against data.

      Parameters

      • keyId: string
      • data: Uint8Array
      • signature: string
      • Optionalalgorithm: string

      Returns Promise<boolean>

    • Generate a data encryption key (DEK) wrapped by the managed key.

      Parameters

      • keyId: string
      • OptionalkeySpec: string

      Returns Promise<{ plaintext: Uint8Array; ciphertext: string }>

    Settings
    Member Visibility

    On This Page
    Properties
    Methods