feat(signing): add region fallback for Cloud KMS signing in CloudKmsSigner (#769)

[therealbibson]

Overview

Adds configurable region fallback support to CloudKmsSigner so signing requests automatically retry through configured fallback regions upon encountering region-specific errors (e.g. 503, timeouts, network disconnects), emitting regionFallback events on each region switch while avoiding fallback on non-region errors.

Related Issue

Closes #769

Changes

Signing Key Vault Adapter

• [MODIFY] src/signing/adapters/CloudKmsSigner.ts
  • Added CloudKmsSignerOptions with region?: string and fallbackRegions?: string[]
  • Implemented CloudKmsSignerEventMap and extended TypedEventEmitter<CloudKmsSignerEventMap>
  • Added sequential region retry loop in sign()
  • Added isRegionError utility to classify region-specific vs non-region errors (e.g. 403 AccessDenied, ValidationException)
  • Emits regionFallback event with { from, to } on each region transition
• [MODIFY] src/index.ts
  • Exported CloudKmsSigner, isRegionError, CloudKmsSignerOptions, CloudKmsSignerEventMap, KmsClientSignOptions
• [MODIFY] test/signing.test.ts
  • Added unit tests for successful signing with region, single and multi-step fallback on 503/timeout/network errors, event emissions, exhaustion errors, non-region error avoidance, and error classification
• [MODIFY] test/sdkExports.test.ts
  • Added assertion verifying export of isRegionError

Verification Results

 RUN  v1.6.1 /Users/user/Documents/Projects/open_source/split-sdk

 ✓ test/signing.test.ts  (20 tests) 125ms
 ✓ test/sdkExports.test.ts  (2 tests) 1ms

 Test Files  2 passed (2)
      Tests  22 passed (22)

Acceptance Criteria	Status
CloudKmsSignerOptions gains fallbackRegions?: string[]	✅ Added fallbackRegions?: string[] to CloudKmsSignerOptions
On a region-specific error (e.g., 503 or timeout), the signer retries in each fallback region in order	✅ Retries across primary and fallback regions sequentially upon region-specific errors
A regionFallback event is emitted with { from, to } on each region switch	✅ Emits typed regionFallback event on each region transition
Non-region errors (e.g., permission denied) should not trigger region fallback	✅ 403, AccessDenied, ValidationException, and similar errors bypass fallback and throw immediately
Unit tests pass	✅ All unit tests pass

[drips-wave]

@therealbibson Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits