part #2

src/__Libraries/StellaOps.Cryptography.Kms/GcpKmsClient.Resolve.cs

@@ -0,0 +1,30 @@
+using System;
+using System.Threading;
+using System.Threading.Tasks;
+
+namespace StellaOps.Cryptography.Kms;
+
+public sealed partial class GcpKmsClient
+{
+    private async Task<string> ResolveVersionAsync(string keyId, string? keyVersion, CancellationToken cancellationToken)
+    {
+        if (!string.IsNullOrWhiteSpace(keyVersion))
+        {
+            return keyVersion!;
+        }
+
+        var snapshot = await GetCachedMetadataAsync(keyId, cancellationToken).ConfigureAwait(false);
+        if (!string.IsNullOrWhiteSpace(snapshot.Metadata.PrimaryVersionName))
+        {
+            return snapshot.Metadata.PrimaryVersionName!;
+        }
+
+        var firstActive = snapshot.Versions.FirstOrDefault(v => v.State == GcpCryptoKeyVersionState.Enabled);
+        if (firstActive is not null)
+        {
+            return firstActive.VersionName;
+        }
+
+        throw new InvalidOperationException($"Crypto key '{keyId}' does not have an active primary version.");
+    }
+}