part #2

src/__Libraries/StellaOps.Cryptography.Kms/FileKmsClient.Metadata.cs

@@ -0,0 +1,58 @@
+using System;
+using System.Threading;
+using System.Threading.Tasks;
+
+namespace StellaOps.Cryptography.Kms;
+
+public sealed partial class FileKmsClient
+{
+    public async Task<KmsKeyMetadata> GetMetadataAsync(string keyId, CancellationToken cancellationToken = default)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(keyId);
+
+        await _mutex.WaitAsync(cancellationToken).ConfigureAwait(false);
+        try
+        {
+            var record = await LoadOrCreateMetadataAsync(keyId, cancellationToken, createIfMissing: false).ConfigureAwait(false)
+                ?? throw new InvalidOperationException($"Key '{keyId}' does not exist.");
+            return ToMetadata(record);
+        }
+        finally
+        {
+            _mutex.Release();
+        }
+    }
+
+    public async Task<KmsKeyMaterial> ExportAsync(string keyId, string? keyVersion, CancellationToken cancellationToken = default)
+    {
+        ArgumentException.ThrowIfNullOrWhiteSpace(keyId);
+
+        await _mutex.WaitAsync(cancellationToken).ConfigureAwait(false);
+        try
+        {
+            var record = await LoadOrCreateMetadataAsync(keyId, cancellationToken, createIfMissing: false).ConfigureAwait(false)
+                ?? throw new InvalidOperationException($"Key '{keyId}' does not exist.");
+
+            var version = ResolveVersion(record, keyVersion);
+            if (string.IsNullOrWhiteSpace(version.PublicKey))
+            {
+                throw new InvalidOperationException($"Key '{keyId}' version '{version.VersionId}' does not have public key material.");
+            }
+
+            var privateKey = await LoadPrivateKeyAsync(record, version, cancellationToken).ConfigureAwait(false);
+            return new KmsKeyMaterial(
+                record.KeyId,
+                version.VersionId,
+                record.Algorithm,
+                version.CurveName,
+                Convert.FromBase64String(privateKey.D),
+                Convert.FromBase64String(privateKey.Qx),
+                Convert.FromBase64String(privateKey.Qy),
+                version.CreatedAt);
+        }
+        finally
+        {
+            _mutex.Release();
+        }
+    }
+}