JavaScript GCP KMS Storage: document v1.1.0 behavior changes and fix README gaps (KSM-1536)

[stas-schaller]

Summary

JavaScript GCP KMS Storage: the shipped documentation didn't describe v1.1.0's behavior changes, presented the plaintext-autosave option with no warning, and disagreed with the source on required IAM roles.

Changes

Documentation

• CHANGELOG.md was excluded from the published npm tarball (missing from package.json's files array), so the only documentation of the v1.1.0 behavior changes never reached an npm consumer. Added it. (KSM-1536)
• Added a Behavior Notes section to the README: Node 20 floor, the config directory now needing write permission (not just the file), symlink/hard-link replacement instead of write-through, the zero-length-config hard error, and the 0600 file mode guarantee.
• Added an explicit warning to the Decrypt Config section: decryptConfig(true) writes the client ID, app key, and device private key to disk in plaintext, noted the real 0600 mitigation without overstating it, and documented the re-encrypt path (init() detects and re-encrypts a plaintext config automatically).
• Documented the KSM_CONFIG_FILE environment variable and its precedence against the constructor argument (verified against the actual fallback chain in GCPKeyValueStore.ts's constructor).
• Corrected the IAM role discrepancy between the README and GcpKeyConfig.ts's doc comment. Verified against two independent sources: (1) every GCP KMS API call this package actually makes (getCryptoKey, getPublicKey, encrypt, decrypt, asymmetricDecrypt — no key/keyring-management call anywhere), and (2) Google's own predefined-role permission tables. Removed roles/cloudkms.admin from GcpKeyConfig.ts — this package never calls anything that needs it. Added roles/cloudkms.viewer to both files — none of the other three listed roles include cloudkms.cryptoKeys.get, which getKeyDetails() calls via getCryptoKey(), and cloudkms.viewer is the minimal predefined role that has it.

Testing

cd sdk/javascript/packages/gcp
npm run build && npm run lint
npm pack --dry-run   # confirms CHANGELOG.md now appears in the tarball listing

Doc-only changes plus one comment-only edit in GcpKeyConfig.ts; both clean.

Breaking Changes

None.

Related Issues

• Jira: KSM-1536

[mgallego-keeper]

Summary

This PR adds CHANGELOG.md to the files array in package.json. It adds a Behavior Notes section and a plaintext-autosave warning to README.md. It also corrects the IAM role list in both README.md and src/GcpKeyConfig.ts.

Verification

I read src/GcpKmsClient.ts and src/utils.ts directly. This package only calls getCryptoKey, getPublicKey, encrypt, decrypt, and asymmetricDecrypt against the GCP KMS API. It never calls a key- or keyring-management operation. Removing roles/cloudkms.admin from the doc comment is correct.

I checked Google's own Cloud KMS permissions-and-roles reference. roles/cloudkms.viewer is the only one of the four listed roles that includes cloudkms.cryptoKeys.get. getKeyDetails() needs that permission through getCryptoKey(). Adding roles/cloudkms.viewer is correct and minimal. None of the other three roles need to change.

I checked the new Behavior Notes section, the decryptConfig(true) warning, and the KSM_CONFIG_FILE documentation against the actual source. Each one matches loadConfig()'s re-encryption branch and the constructor's fallback chain.

I merged this PR onto the release branch tip and ran npm ci and the full test suite. All 124 tests pass, as expected for a docs-and-comment change.

Merge order

See the note on #1189 for the overlap and merge order across #1196 to #1200. This PR and #1198 both add a line to CHANGELOG.md at the same point in the file. That produces a real merge conflict, confirmed by testing it directly. The fix is a one-line manual resolution: keep both new lines.