@glideco/kms-signer

npm install @glideco/kms-signer

interface KmsSigner {
  readonly backend: 'aws' | 'gcp' | 'vault' | 'env-key';
  readonly algorithm: 'ed25519' | 'es256' | 'es384' | 'rsa256';
  readonly keyId: string; // ARN / Vault path / alias / env-key-<alg>
  sign(request: KmsSignRequest): Promise<KmsSignResult>;
  getPublicKeyPem(): Promise<string>;
}

import { buildEnvKeySigner } from '@glideco/kms-signer';

const signer = buildEnvKeySigner({
  privateKeyPem: process.env.ISSUER_KEY_PEM!,
  algorithm: 'ed25519',
  nodeEnv: process.env.NODE_ENV, // throws if 'production'
});

const result = await signer.sign({
  payload: Buffer.from('hello').toString('base64url'),
  algorithm: 'ed25519',
  keyId: signer.keyId,
});
// result.signature → base64url-encoded 64-byte Ed25519 sig

import { buildKmsSigner, type KmsSigner } from '@glideco/kms-signer';
import { KMSClient, SignCommand } from '@aws-sdk/client-kms';

const kmsClient = new KMSClient({ region: 'us-east-1' });
const keyId = 'arn:aws:kms:us-east-1:123456789012:key/abc-def';

const signer = buildKmsSigner({
  backend: 'aws',
  algorithm: 'ed25519',
  keyId,
  impl: {
    async sign({ payload, algorithm, keyId }) {
      const res = await kmsClient.send(new SignCommand({
        KeyId: keyId,
        Message: Buffer.from(payload, 'base64url'),
        MessageType: 'RAW',
        SigningAlgorithm: 'ECDSA_SHA_256', // map algorithm → AWS enum
      }));
      return {
        signature: Buffer.from(res.Signature!).toString('base64url'),
        algorithm,
        keyId,
        signedAt: new Date().toISOString(),
      };
    },
    async getPublicKeyPem() {
      // fetch public key from AWS KMS GetPublicKey and convert to SPKI PEM
      return myFetchPublicKeyPem(kmsClient, keyId);
    },
  },
});

import { buildDidWebDocument } from '@glideco/kms-signer';

const pubKeyPem = await signer.getPublicKeyPem();
// Convert PEM to multibase or JWK as needed, then:
const didDoc = buildDidWebDocument({
  domain: 'glide.co',
  keyId: 'key-1',
  algorithm: 'ed25519',
  publicKeyMultibase: 'zABCDEF...', // multibase(pubkey bytes)
  serviceEndpoint: {
    issuerEndpoint: 'https://glide.co/credentials/issue',
    vcStatusListUrl: 'https://glide.co/credentials/status/1',
  },
});
// Serve `JSON.stringify(didDoc, null, 2)` at
// https://glide.co/.well-known/did.json