Modules
Public facade for KMS encryption, identity, authorization, recovery, and WebAuthn APIs.
Minimal JSON API for KMS remote clients.
Optional Bandit HTTP server for the KMS API.
Small ECDH envelope helper.
Authorization checks against principal bindings.
Principal permission bindings.
Permission parser and wildcard expansion for KMS authorization.
Converts domain structs into authorization resource scopes.
Scope parser and wildcard expansion for KMS authorization.
Process-local ETS cache for short-lived KMS data.
Public KMS client facade.
Local/in-process KMS client backend.
HTTP KMS client backend.
Remote-safe authorization binding metadata.
Remote-safe fallback public key metadata.
Remote-safe KEK metadata.
Remote-safe KEK fallback metadata.
Remote-safe principal metadata.
Remote-safe principal factor metadata.
Remote-safe principal fallback metadata.
Remote session handle and metadata.
Small AES-GCM primitive module used by KMS and available for crypto-only mode.
Cryptography functions for encrypting and decrypting data using AES-CBC.
Recovery wrapping for KEKs and principal private keys.
Runtime health checks for KMS.
Cleanup retired KEKs after callers re-encrypt data with current KEK versions.
Generates human-friendly high-entropy passphrases for KMS passphrase workflows.
Principal CRUD and password helpers.
Issues authentication factor challenges.
Built-in high-entropy one-time code factor.
RFC 6238 TOTP factor provider for authenticator applications.
WebAuthn/passkey factor provider.
Root master key facade.
AWS KMS-backed RMK provider.
Google Cloud KMS-backed RMK provider.
File-backed local RMK provider for development and tests.
StackIT KMS-backed RMK provider.
Session creation and chained factor authentication.
RMK-backed caller-process signing-key management and digest signing.
RMK-wrapped asymmetric signing key metadata.
Vendor-neutral telemetry events and metric definitions for KMS.
Backwards-compatible passphrase generator module.
Server-side WebAuthn/passkey ceremony helpers.
Mix Tasks
Runs KMS/API tests with SQLite, then PostgreSQL.
Runs KMS/API tests with KMS_DATABASE_BACKEND=postgres.
Runs KMS/API tests with KMS_DATABASE_BACKEND=sqlite.