feat(sdk): require kid for ML-KEM key access (DSPX-3229)

ML-KEM wrapped key access objects must carry a kid so the KAS can identify
which encapsulation key to unwrap with; unlike RSA/EC there is no way to
recover the key without it. Previously MlKemWrapped accepted an optional kid
and only emitted it when truthy, silently producing an unusable KAO.

- MlKemWrapped now requires kid: string, rejects missing/blank values with a
  ConfigurationError, and always emits kid in the KAO.
- buildKeyAccess guards the ML-KEM branch so callers get a clear
  ConfigurationError before constructing MlKemWrapped.
- RSA (Wrapped) and EC (ECWrapped) keep kid optional, unchanged.

Signed-off-by: Dave Mihalcik <dmihalcik@virtru.com>

Author: dmihalcik-virtru

lib/tdf3/src/models/key-access.ts

@@ -1,4 +1,5 @@
 import { base64, hex } from '../../../src/encodings/index.js';
+import { ConfigurationError } from '../../../src/errors.js';
 import { Binary } from '../binary.js';
 import type { CryptoService, KeyPair, SymmetricKey } from '../crypto/declarations.js';
 import { getZtdfSalt } from '../crypto/salt.js';
@@ -160,13 +161,16 @@ export class MlKemWrapped {
 
   constructor(
     public readonly url: string,
-    public readonly kid: string | undefined,
+    public readonly kid: string,
     public readonly publicKey: string,
     public readonly metadata: unknown,
     public readonly cryptoService: CryptoService,
     public readonly sid: string | undefined,
     public readonly alg: 'mlkem:512' | 'mlkem:768' | 'mlkem:1024'
   ) {
+    if (!kid?.trim()) {
+      throw new ConfigurationError('MlKemWrapped requires a non-empty kid');
+    }
     this.level = parseInt(alg.split(':')[1], 10) as 512 | 768 | 1024;
   }
 
@@ -230,9 +234,7 @@ export class MlKemWrapped {
       },
       schemaVersion,
     };
-    if (this.kid) {
-      kao.kid = this.kid;
-    }
+    kao.kid = this.kid;
     if (this.sid?.length) {
       kao.sid = this.sid;
     }

lib/tdf3/src/tdf.ts

@@ -283,6 +283,11 @@ export async function buildKeyAccess({
   switch (type) {
     case 'wrapped':
       if (alg === 'mlkem:512' || alg === 'mlkem:768' || alg === 'mlkem:1024') {
+        if (!kid?.trim()) {
+          throw new ConfigurationError(
+            `buildKeyAccess: kid is required for ML-KEM algorithm [${alg}]`
+          );
+        }
         return new MlKemWrapped(url, kid, pubKey, metadata, cryptoService, sid, alg);
       }
       return new Wrapped(url, kid, pubKey, metadata, cryptoService, sid);