@pcircle/footprint 1.1.1 → 1.2.1

package/dist/src/index.js

@@ -0,0 +1,243 @@
+#!/usr/bin/env node
+import { McpServer, ResourceTemplate, } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { EvidenceDatabase, storeSalt, retrieveSalt, } from "./lib/storage/index.js";
+import { deriveKey, rederiveKey } from "./lib/crypto/index.js";
+import { registerUIResources } from "./ui/register.js";
+import { getErrorMessage } from "./lib/tool-wrapper.js";
+import { decrypt } from "./lib/crypto/index.js";
+// Import all tool handlers
+import { captureFootprintSchema, captureFootprintMetadata, createCaptureFootprintHandler, listFootprintsSchema, listFootprintsMetadata, createListFootprintsHandler, exportFootprintsSchema, exportFootprintsMetadata, createExportFootprintsHandler, getFootprintSchema, getFootprintMetadata, createGetFootprintHandler, searchFootprintsSchema, searchFootprintsMetadata, createSearchFootprintsHandler, verifyFootprintSchema, verifyFootprintMetadata, createVerifyFootprintHandler, suggestCaptureSchema, suggestCaptureMetadata, createSuggestCaptureHandler, deleteFootprintsSchema, deleteFootprintsMetadata, createDeleteFootprintsHandler, renameTagSchema, renameTagMetadata, createRenameTagHandler, removeTagSchema, removeTagMetadata, createRemoveTagHandler, getTagStatsSchema, getTagStatsMetadata, createGetTagStatsHandler, } from "./tools/index.js";
+/**
+ * Footprint Server - Captures LLM conversations as encrypted evidence
+ * with Git timestamps and export capabilities.
+ */
+export class FootprintServer {
+    server;
+    config;
+    db;
+    derivedKey = null;
+    keyDerivationPromise = null;
+    constructor(config) {
+        this.config = config;
+        try {
+            this.db = new EvidenceDatabase(config.dbPath);
+        }
+        catch (error) {
+            throw new Error(`Failed to initialize database: ${getErrorMessage(error)}`);
+        }
+        this.server = new McpServer({
+            name: config.name || "traceguard-mcp",
+            version: config.version || "0.1.0",
+        });
+        // Register UI resources for MCP Apps
+        registerUIResources(this.server);
+        this.registerTools();
+        this.registerResources();
+    }
+    /**
+     * Get or derive encryption key using stored salt (thread-safe)
+     * Caches key in memory for performance, with cleanup on shutdown
+     * Handles concurrent calls by ensuring only one derivation happens at a time
+     *
+     * @returns 32-byte encryption key
+     * @throws Error if salt storage fails
+     */
+    async getDerivedKey() {
+        // Fast path: key already derived
+        if (this.derivedKey) {
+            return this.derivedKey;
+        }
+        // If derivation is in progress, wait for it to complete
+        if (this.keyDerivationPromise) {
+            return this.keyDerivationPromise;
+        }
+        // Start derivation (only one caller proceeds here)
+        this.keyDerivationPromise = (async () => {
+            try {
+                // Check if salt exists in database
+                const existingSalt = retrieveSalt(this.db.getDb());
+                let result;
+                if (existingSalt) {
+                    // Re-derive key using stored salt
+                    result = await rederiveKey(this.config.password, existingSalt);
+                }
+                else {
+                    // First-time: generate new key and store salt
+                    result = await deriveKey(this.config.password);
+                    storeSalt(this.db.getDb(), result.salt);
+                }
+                this.derivedKey = result.key;
+                return result.key;
+            }
+            finally {
+                // Clear promise after derivation completes (success or failure)
+                this.keyDerivationPromise = null;
+            }
+        })();
+        return this.keyDerivationPromise;
+    }
+    /**
+     * Securely clear derived key from memory
+     * Should be called on server shutdown
+     */
+    clearDerivedKey() {
+        if (this.derivedKey) {
+            // Zero out key in memory
+            this.derivedKey.fill(0);
+            this.derivedKey = null;
+        }
+    }
+    registerTools() {
+        // Capture footprint tool
+        this.server.registerTool("capture-footprint", {
+            ...captureFootprintMetadata,
+            inputSchema: captureFootprintSchema.inputSchema,
+            outputSchema: captureFootprintSchema.outputSchema,
+        }, createCaptureFootprintHandler(this.db, this.getDerivedKey.bind(this)));
+        // List footprints tool
+        this.server.registerTool("list-footprints", {
+            ...listFootprintsMetadata,
+            inputSchema: listFootprintsSchema.inputSchema,
+            outputSchema: listFootprintsSchema.outputSchema,
+        }, createListFootprintsHandler(this.db));
+        // Export footprints tool
+        this.server.registerTool("export-footprints", {
+            ...exportFootprintsMetadata,
+            inputSchema: exportFootprintsSchema.inputSchema,
+            outputSchema: exportFootprintsSchema.outputSchema,
+        }, createExportFootprintsHandler(this.db));
+        // Get footprint tool
+        this.server.registerTool("get-footprint", {
+            ...getFootprintMetadata,
+            inputSchema: getFootprintSchema.inputSchema,
+            outputSchema: getFootprintSchema.outputSchema,
+        }, createGetFootprintHandler(this.db, this.getDerivedKey.bind(this)));
+        // Search footprints tool
+        this.server.registerTool("search-footprints", {
+            ...searchFootprintsMetadata,
+            inputSchema: searchFootprintsSchema.inputSchema,
+            outputSchema: searchFootprintsSchema.outputSchema,
+        }, createSearchFootprintsHandler(this.db));
+        // Verify footprint tool
+        this.server.registerTool("verify-footprint", {
+            ...verifyFootprintMetadata,
+            inputSchema: verifyFootprintSchema.inputSchema,
+            outputSchema: verifyFootprintSchema.outputSchema,
+        }, createVerifyFootprintHandler(this.db, this.getDerivedKey.bind(this)));
+        // Suggest capture tool
+        this.server.registerTool("suggest-capture", {
+            ...suggestCaptureMetadata,
+            inputSchema: suggestCaptureSchema.inputSchema,
+            outputSchema: suggestCaptureSchema.outputSchema,
+        }, createSuggestCaptureHandler());
+        // Delete footprints tool
+        this.server.registerTool("delete-footprints", {
+            ...deleteFootprintsMetadata,
+            inputSchema: deleteFootprintsSchema.inputSchema,
+            outputSchema: deleteFootprintsSchema.outputSchema,
+        }, createDeleteFootprintsHandler(this.db));
+        // Rename tag tool
+        this.server.registerTool("rename-tag", {
+            ...renameTagMetadata,
+            inputSchema: renameTagSchema.inputSchema,
+            outputSchema: renameTagSchema.outputSchema,
+        }, createRenameTagHandler(this.db));
+        // Remove tag tool
+        this.server.registerTool("remove-tag", {
+            ...removeTagMetadata,
+            inputSchema: removeTagSchema.inputSchema,
+            outputSchema: removeTagSchema.outputSchema,
+        }, createRemoveTagHandler(this.db));
+        // Get tag statistics tool
+        this.server.registerTool("get-tag-stats", {
+            ...getTagStatsMetadata,
+            inputSchema: getTagStatsSchema.inputSchema,
+            outputSchema: getTagStatsSchema.outputSchema,
+        }, createGetTagStatsHandler(this.db));
+    }
+    registerResources() {
+        this.server.registerResource("evidence", new ResourceTemplate("evidence://{id}", { list: undefined }), {
+            title: "Evidence Content",
+            description: "Access encrypted footprint record by ID",
+            mimeType: "text/plain",
+        }, async (uri, { id }) => {
+            try {
+                const evidence = this.db.findById(id);
+                if (!evidence) {
+                    throw new Error(`Evidence with ID ${id} not found`);
+                }
+                const key = await this.getDerivedKey();
+                const decrypted = decrypt(evidence.encryptedContent, evidence.nonce, key);
+                return {
+                    contents: [
+                        { uri: uri.href, mimeType: "text/plain", text: decrypted },
+                    ],
+                };
+            }
+            catch (error) {
+                throw new Error(`Failed to access evidence resource: ${getErrorMessage(error)}`);
+            }
+        });
+    }
+    async start() {
+        const transport = new StdioServerTransport();
+        await this.server.connect(transport);
+    }
+    /**
+     * Cleanup server resources
+     * Clears derived key from memory and closes database
+     */
+    close() {
+        this.clearDerivedKey();
+        this.db.close();
+    }
+}
+async function main() {
+    const config = {
+        dbPath: process.env.FOOTPRINT_DB_PATH || "./evidence.db",
+        password: process.env.FOOTPRINT_PASSWORD || "",
+    };
+    if (!config.password) {
+        console.error("Error: FOOTPRINT_PASSWORD environment variable required");
+        process.exit(1);
+    }
+    const server = new FootprintServer(config);
+    // Setup cleanup handlers for graceful shutdown
+    const cleanup = () => {
+        server.close();
+    };
+    // Handle uncaught exceptions and promise rejections
+    process.on("uncaughtException", (error) => {
+        console.error("Uncaught exception:", error);
+        cleanup();
+        process.exit(1);
+    });
+    process.on("unhandledRejection", (reason) => {
+        console.error("Unhandled rejection:", reason);
+        cleanup();
+        process.exit(1);
+    });
+    process.on("SIGINT", () => {
+        cleanup();
+        process.exit(0);
+    });
+    process.on("SIGTERM", () => {
+        cleanup();
+        process.exit(0);
+    });
+    process.on("exit", cleanup);
+    await server.start();
+}
+// Handle both direct execution and symlink execution
+const isMainModule = import.meta.url === `file://${process.argv[1]}` ||
+    process.argv[1]?.endsWith("/footprint") ||
+    process.argv[1]?.endsWith("/dist/index.js");
+if (isMainModule) {
+    main().catch((error) => {
+        console.error("Server error:", error);
+        process.exit(1);
+    });
+}
+export { FootprintTestHelpers } from "./test-helpers.js";
+//# sourceMappingURL=index.js.map

package/dist/src/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";AAEA,OAAO,EACL,SAAS,EACT,gBAAgB,GACjB,MAAM,yCAAyC,CAAC;AACjD,OAAO,EAAE,oBAAoB,EAAE,MAAM,2CAA2C,CAAC;AACjF,OAAO,EACL,gBAAgB,EAChB,SAAS,EACT,YAAY,GACb,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,SAAS,EAAE,WAAW,EAAmB,MAAM,uBAAuB,CAAC;AAChF,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAGhD,2BAA2B;AAC3B,OAAO,EACL,sBAAsB,EACtB,wBAAwB,EACxB,6BAA6B,EAC7B,oBAAoB,EACpB,sBAAsB,EACtB,2BAA2B,EAC3B,sBAAsB,EACtB,wBAAwB,EACxB,6BAA6B,EAC7B,kBAAkB,EAClB,oBAAoB,EACpB,yBAAyB,EACzB,sBAAsB,EACtB,wBAAwB,EACxB,6BAA6B,EAC7B,qBAAqB,EACrB,uBAAuB,EACvB,4BAA4B,EAC5B,oBAAoB,EACpB,sBAAsB,EACtB,2BAA2B,EAC3B,sBAAsB,EACtB,wBAAwB,EACxB,6BAA6B,EAC7B,eAAe,EACf,iBAAiB,EACjB,sBAAsB,EACtB,eAAe,EACf,iBAAiB,EACjB,sBAAsB,EACtB,iBAAiB,EACjB,mBAAmB,EACnB,wBAAwB,GACzB,MAAM,kBAAkB,CAAC;AAE1B;;;GAGG;AACH,MAAM,OAAO,eAAe;IAClB,MAAM,CAAY;IAClB,MAAM,CAAe;IACrB,EAAE,CAAmB;IACrB,UAAU,GAAsB,IAAI,CAAC;IACrC,oBAAoB,GAA+B,IAAI,CAAC;IAEhE,YAAY,MAAoB;QAC9B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QAErB,IAAI,CAAC;YACH,IAAI,CAAC,EAAE,GAAG,IAAI,gBAAgB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAChD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACb,kCAAkC,eAAe,CAAC,KAAK,CAAC,EAAE,CAC3D,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,MAAM,GAAG,IAAI,SAAS,CAAC;YAC1B,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,gBAAgB;YACrC,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,OAAO;SACnC,CAAC,CAAC;QAEH,qCAAqC;QACrC,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAEjC,IAAI,CAAC,aAAa,EAAE,CAAC;QACrB,IAAI,CAAC,iBAAiB,EAAE,CAAC;IAC3B,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,aAAa;QACzB,iCAAiC;QACjC,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,OAAO,IAAI,CAAC,UAAU,CAAC;QACzB,CAAC;QAED,wDAAwD;QACxD,IAAI,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAC9B,OAAO,IAAI,CAAC,oBAAoB,CAAC;QACnC,CAAC;QAED,mDAAmD;QACnD,IAAI,CAAC,oBAAoB,GAAG,CAAC,KAAK,IAAI,EAAE;YACtC,IAAI,CAAC;gBACH,mCAAmC;gBACnC,MAAM,YAAY,GAAG,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC;gBACnD,IAAI,MAAkB,CAAC;gBAEvB,IAAI,YAAY,EAAE,CAAC;oBACjB,kCAAkC;oBAClC,MAAM,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;gBACjE,CAAC;qBAAM,CAAC;oBACN,8CAA8C;oBAC9C,MAAM,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;oBAC/C,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;gBAC1C,CAAC;gBAED,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC;gBAC7B,OAAO,MAAM,CAAC,GAAG,CAAC;YACpB,CAAC;oBAAS,CAAC;gBACT,gEAAgE;gBAChE,IAAI,CAAC,oBAAoB,GAAG,IAAI,CAAC;YACnC,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;QAEL,OAAO,IAAI,CAAC,oBAAoB,CAAC;IACnC,CAAC;IAED;;;OAGG;IACK,eAAe;QACrB,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,yBAAyB;YACzB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACxB,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;QACzB,CAAC;IACH,CAAC;IAEO,aAAa;QACnB,yBAAyB;QACzB,IAAI,CAAC,MAAM,CAAC,YAAY,CACtB,mBAAmB,EACnB;YACE,GAAG,wBAAwB;YAC3B,WAAW,EAAE,sBAAsB,CAAC,WAAW;YAC/C,YAAY,EAAE,sBAAsB,CAAC,YAAY;SAClD,EACD,6BAA6B,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CACtE,CAAC;QAEF,uBAAuB;QACvB,IAAI,CAAC,MAAM,CAAC,YAAY,CACtB,iBAAiB,EACjB;YACE,GAAG,sBAAsB;YACzB,WAAW,EAAE,oBAAoB,CAAC,WAAW;YAC7C,YAAY,EAAE,oBAAoB,CAAC,YAAY;SAChD,EACD,2BAA2B,CAAC,IAAI,CAAC,EAAE,CAAC,CACrC,CAAC;QAEF,yBAAyB;QACzB,IAAI,CAAC,MAAM,CAAC,YAAY,CACtB,mBAAmB,EACnB;YACE,GAAG,wBAAwB;YAC3B,WAAW,EAAE,sBAAsB,CAAC,WAAW;YAC/C,YAAY,EAAE,sBAAsB,CAAC,YAAY;SAClD,EACD,6BAA6B,CAAC,IAAI,CAAC,EAAE,CAAC,CACvC,CAAC;QAEF,qBAAqB;QACrB,IAAI,CAAC,MAAM,CAAC,YAAY,CACtB,eAAe,EACf;YACE,GAAG,oBAAoB;YACvB,WAAW,EAAE,kBAAkB,CAAC,WAAW;YAC3C,YAAY,EAAE,kBAAkB,CAAC,YAAY;SAC9C,EACD,yBAAyB,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAClE,CAAC;QAEF,yBAAyB;QACzB,IAAI,CAAC,MAAM,CAAC,YAAY,CACtB,mBAAmB,EACnB;YACE,GAAG,wBAAwB;YAC3B,WAAW,EAAE,sBAAsB,CAAC,WAAW;YAC/C,YAAY,EAAE,sBAAsB,CAAC,YAAY;SAClD,EACD,6BAA6B,CAAC,IAAI,CAAC,EAAE,CAAC,CACvC,CAAC;QAEF,wBAAwB;QACxB,IAAI,CAAC,MAAM,CAAC,YAAY,CACtB,kBAAkB,EAClB;YACE,GAAG,uBAAuB;YAC1B,WAAW,EAAE,qBAAqB,CAAC,WAAW;YAC9C,YAAY,EAAE,qBAAqB,CAAC,YAAY;SACjD,EACD,4BAA4B,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CACrE,CAAC;QAEF,uBAAuB;QACvB,IAAI,CAAC,MAAM,CAAC,YAAY,CACtB,iBAAiB,EACjB;YACE,GAAG,sBAAsB;YACzB,WAAW,EAAE,oBAAoB,CAAC,WAAW;YAC7C,YAAY,EAAE,oBAAoB,CAAC,YAAY;SAChD,EACD,2BAA2B,EAAE,CAC9B,CAAC;QAEF,yBAAyB;QACzB,IAAI,CAAC,MAAM,CAAC,YAAY,CACtB,mBAAmB,EACnB;YACE,GAAG,wBAAwB;YAC3B,WAAW,EAAE,sBAAsB,CAAC,WAAW;YAC/C,YAAY,EAAE,sBAAsB,CAAC,YAAY;SAClD,EACD,6BAA6B,CAAC,IAAI,CAAC,EAAE,CAAC,CACvC,CAAC;QAEF,kBAAkB;QAClB,IAAI,CAAC,MAAM,CAAC,YAAY,CACtB,YAAY,EACZ;YACE,GAAG,iBAAiB;YACpB,WAAW,EAAE,eAAe,CAAC,WAAW;YACxC,YAAY,EAAE,eAAe,CAAC,YAAY;SAC3C,EACD,sBAAsB,CAAC,IAAI,CAAC,EAAE,CAAC,CAChC,CAAC;QAEF,kBAAkB;QAClB,IAAI,CAAC,MAAM,CAAC,YAAY,CACtB,YAAY,EACZ;YACE,GAAG,iBAAiB;YACpB,WAAW,EAAE,eAAe,CAAC,WAAW;YACxC,YAAY,EAAE,eAAe,CAAC,YAAY;SAC3C,EACD,sBAAsB,CAAC,IAAI,CAAC,EAAE,CAAC,CAChC,CAAC;QAEF,0BAA0B;QAC1B,IAAI,CAAC,MAAM,CAAC,YAAY,CACtB,eAAe,EACf;YACE,GAAG,mBAAmB;YACtB,WAAW,EAAE,iBAAiB,CAAC,WAAW;YAC1C,YAAY,EAAE,iBAAiB,CAAC,YAAY;SAC7C,EACD,wBAAwB,CAAC,IAAI,CAAC,EAAE,CAAC,CAClC,CAAC;IACJ,CAAC;IAEO,iBAAiB;QACvB,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAC1B,UAAU,EACV,IAAI,gBAAgB,CAAC,iBAAiB,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAC5D;YACE,KAAK,EAAE,kBAAkB;YACzB,WAAW,EAAE,yCAAyC;YACtD,QAAQ,EAAE,YAAY;SACvB,EACD,KAAK,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE;YACpB,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAY,CAAC,CAAC;gBAChD,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,MAAM,IAAI,KAAK,CAAC,oBAAoB,EAAE,YAAY,CAAC,CAAC;gBACtD,CAAC;gBAED,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;gBACvC,MAAM,SAAS,GAAG,OAAO,CACvB,QAAQ,CAAC,gBAAgB,EACzB,QAAQ,CAAC,KAAK,EACd,GAAG,CACJ,CAAC;gBAEF,OAAO;oBACL,QAAQ,EAAE;wBACR,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,SAAS,EAAE;qBAC3D;iBACF,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,IAAI,KAAK,CACb,uCAAuC,eAAe,CAAC,KAAK,CAAC,EAAE,CAChE,CAAC;YACJ,CAAC;QACH,CAAC,CACF,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,KAAK;QACT,MAAM,SAAS,GAAG,IAAI,oBAAoB,EAAE,CAAC;QAC7C,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACvC,CAAC;IAED;;;OAGG;IACH,KAAK;QACH,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;IAClB,CAAC;CACF;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,MAAM,GAAiB;QAC3B,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,eAAe;QACxD,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,EAAE;KAC/C,CAAC;IAEF,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QACrB,OAAO,CAAC,KAAK,CAAC,yDAAyD,CAAC,CAAC;QACzE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,CAAC;IAE3C,+CAA+C;IAC/C,MAAM,OAAO,GAAG,GAAG,EAAE;QACnB,MAAM,CAAC,KAAK,EAAE,CAAC;IACjB,CAAC,CAAC;IAEF,oDAAoD;IACpD,OAAO,CAAC,EAAE,CAAC,mBAAmB,EAAE,CAAC,KAAK,EAAE,EAAE;QACxC,OAAO,CAAC,KAAK,CAAC,qBAAqB,EAAE,KAAK,CAAC,CAAC;QAC5C,OAAO,EAAE,CAAC;QACV,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;IAEH,OAAO,CAAC,EAAE,CAAC,oBAAoB,EAAE,CAAC,MAAM,EAAE,EAAE;QAC1C,OAAO,CAAC,KAAK,CAAC,sBAAsB,EAAE,MAAM,CAAC,CAAC;QAC9C,OAAO,EAAE,CAAC;QACV,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;IAEH,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE;QACxB,OAAO,EAAE,CAAC;QACV,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;IAEH,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE;QACzB,OAAO,EAAE,CAAC;QACV,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;IAEH,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAE5B,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;AACvB,CAAC;AAED,qDAAqD;AACrD,MAAM,YAAY,GAChB,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,UAAU,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;IAC/C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,YAAY,CAAC;IACvC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,gBAAgB,CAAC,CAAC;AAE9C,IAAI,YAAY,EAAE,CAAC;IACjB,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;QACrB,OAAO,CAAC,KAAK,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;QACtC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC"}

package/dist/src/lib/crypto/decrypt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"decrypt.d.ts","sourceRoot":"","sources":["../../../../src/lib/crypto/decrypt.ts"],"names":[],"mappings":"AAEA;;;;;;;;GAQG;AACH,wBAAgB,OAAO,CACrB,UAAU,EAAE,UAAU,EACtB,KAAK,EAAE,UAAU,EACjB,GAAG,EAAE,UAAU,GACd,MAAM,CA0BR"}

package/dist/{lib → src/lib}/crypto/decrypt.js

@@ -24,6 +24,10 @@ export function decrypt(ciphertext, nonce, key) {
         return new TextDecoder().decode(plaintextBytes);
     }
     catch (error) {
+        // Log detailed error for debugging (server-side only, never exposed to client)
+        const originalError = error instanceof Error ? error.message : String(error);
+        console.error('[Decrypt] Decryption failed:', originalError);
+        // User-facing error remains generic (security best practice)
         throw new Error('Decryption failed: invalid key or tampered data');
     }
 }

package/dist/src/lib/crypto/decrypt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"decrypt.js","sourceRoot":"","sources":["../../../../src/lib/crypto/decrypt.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAE1D;;;;;;;;GAQG;AACH,MAAM,UAAU,OAAO,CACrB,UAAsB,EACtB,KAAiB,EACjB,GAAe;IAEf,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IAC1C,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC5C,CAAC;IAED,yBAAyB;IACzB,MAAM,MAAM,GAAG,iBAAiB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAE7C,IAAI,CAAC;QACH,wCAAwC;QACxC,MAAM,cAAc,GAAG,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAElD,+BAA+B;QAC/B,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IAClD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,+EAA+E;QAC/E,MAAM,aAAa,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC7E,OAAO,CAAC,KAAK,CAAC,8BAA8B,EAAE,aAAa,CAAC,CAAC;QAE7D,6DAA6D;QAC7D,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;AACH,CAAC"}

package/dist/src/lib/crypto/encrypt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"encrypt.d.ts","sourceRoot":"","sources":["../../../../src/lib/crypto/encrypt.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,UAAU,CAAC;IACvB,KAAK,EAAE,UAAU,CAAC;CACnB;AAED;;;;;;GAMG;AACH,wBAAgB,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,GAAG,aAAa,CAkBzE"}

package/dist/src/lib/crypto/encrypt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"encrypt.js","sourceRoot":"","sources":["../../../../src/lib/crypto/encrypt.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAOlD;;;;;;GAMG;AACH,MAAM,UAAU,OAAO,CAAC,SAAiB,EAAE,GAAe;IACxD,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IAC1C,CAAC;IAED,2DAA2D;IAC3D,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAE9B,6BAA6B;IAC7B,MAAM,cAAc,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAE3D,yBAAyB;IACzB,MAAM,MAAM,GAAG,iBAAiB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAE7C,8BAA8B;IAC9B,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IAElD,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;AAC/B,CAAC"}

package/dist/{lib → src/lib}/crypto/index.d.ts

@@ -1,4 +1,4 @@
-export { deriveKey, verifyKey } from './key-derivation.js';
+export { deriveKey, rederiveKey, verifyKey } from './key-derivation.js';
 export { encrypt } from './encrypt.js';
 export { decrypt } from './decrypt.js';
 export type { DerivedKey, KeyDerivationParams, EncryptedData } from './types.js';

package/dist/src/lib/crypto/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/lib/crypto/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AACxE,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,YAAY,EAAE,UAAU,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AACjF,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC"}

package/dist/{lib → src/lib}/crypto/index.js

@@ -1,4 +1,4 @@
-export { deriveKey, verifyKey } from './key-derivation.js';
+export { deriveKey, rederiveKey, verifyKey } from './key-derivation.js';
 export { encrypt } from './encrypt.js';
 export { decrypt } from './decrypt.js';
 export { DEFAULT_KDF_PARAMS } from './types.js';

package/dist/src/lib/crypto/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/lib/crypto/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AACxE,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAEvC,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC"}

package/dist/{lib → src/lib}/crypto/key-derivation.d.ts

@@ -19,12 +19,26 @@ import type { DerivedKey, KeyDerivationParams } from './types.js';
  */
 export declare function deriveKey(password: string, params?: Partial<KeyDerivationParams>): Promise<DerivedKey>;
 /**
- * Re-derive key from password and existing salt (for verification)
+ * Re-derive key from password and existing salt
+ * Use this for subsequent encryptions/decryptions with stored salt
  *
  * @param password - User password
- * @param salt - Existing salt (from previous derivation)
+ * @param salt - Existing salt (from database)
  * @param params - Optional KDF parameters
  * @returns Derived key with same salt
  */
-export declare function verifyKey(password: string, salt: Uint8Array, params?: Partial<KeyDerivationParams>): Promise<DerivedKey>;
+export declare function rederiveKey(password: string, salt: Uint8Array, params?: Partial<KeyDerivationParams>): Promise<DerivedKey>;
+/**
+ * Verify password by comparing derived key with expected key
+ * Uses constant-time comparison to prevent timing attacks
+ *
+ * @param password - User password to verify
+ * @param salt - Existing salt (from database)
+ * @param expectedKey - Expected key (from previous derivation)
+ * @param params - Optional KDF parameters
+ * @returns true if password is correct, false otherwise
+ *
+ * @security Uses timingSafeEqual to prevent timing attacks
+ */
+export declare function verifyKey(password: string, salt: Uint8Array, expectedKey: Uint8Array, params?: Partial<KeyDerivationParams>): Promise<boolean>;
 //# sourceMappingURL=key-derivation.d.ts.map

package/dist/src/lib/crypto/key-derivation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"key-derivation.d.ts","sourceRoot":"","sources":["../../../../src/lib/crypto/key-derivation.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAGlE;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,SAAS,CAC7B,QAAQ,EAAE,MAAM,EAChB,MAAM,GAAE,OAAO,CAAC,mBAAmB,CAAM,GACxC,OAAO,CAAC,UAAU,CAAC,CAuBrB;AAED;;;;;;;;GAQG;AACH,wBAAsB,WAAW,CAC/B,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,UAAU,EAChB,MAAM,GAAE,OAAO,CAAC,mBAAmB,CAAM,GACxC,OAAO,CAAC,UAAU,CAAC,CAwBrB;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,SAAS,CAC7B,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,UAAU,EAChB,WAAW,EAAE,UAAU,EACvB,MAAM,GAAE,OAAO,CAAC,mBAAmB,CAAM,GACxC,OAAO,CAAC,OAAO,CAAC,CAkClB"}

package/dist/{lib → src/lib}/crypto/key-derivation.js

@@ -1,5 +1,6 @@
 import { argon2id } from '@noble/hashes/argon2';
 import { randomBytes } from '@noble/hashes/utils';
+import { timingSafeEqual } from 'node:crypto';
 import { DEFAULT_KDF_PARAMS } from './types.js';
 /**
  * Derive encryption key from password using Argon2id
@@ -36,14 +37,15 @@ export async function deriveKey(password, params = {}) {
     return { key, salt };
 }
 /**
- * Re-derive key from password and existing salt (for verification)
+ * Re-derive key from password and existing salt
+ * Use this for subsequent encryptions/decryptions with stored salt
  *
  * @param password - User password
- * @param salt - Existing salt (from previous derivation)
+ * @param salt - Existing salt (from database)
  * @param params - Optional KDF parameters
  * @returns Derived key with same salt
  */
-export async function verifyKey(password, salt, params = {}) {
+export async function rederiveKey(password, salt, params = {}) {
     if (!password || password.length === 0) {
         throw new Error('Password cannot be empty');
     }
@@ -60,4 +62,43 @@ export async function verifyKey(password, salt, params = {}) {
     });
     return { key, salt };
 }
+/**
+ * Verify password by comparing derived key with expected key
+ * Uses constant-time comparison to prevent timing attacks
+ *
+ * @param password - User password to verify
+ * @param salt - Existing salt (from database)
+ * @param expectedKey - Expected key (from previous derivation)
+ * @param params - Optional KDF parameters
+ * @returns true if password is correct, false otherwise
+ *
+ * @security Uses timingSafeEqual to prevent timing attacks
+ */
+export async function verifyKey(password, salt, expectedKey, params = {}) {
+    if (!password || password.length === 0) {
+        throw new Error('Password cannot be empty');
+    }
+    if (salt.length !== 16) {
+        throw new Error('Salt must be 16 bytes');
+    }
+    if (expectedKey.length !== 32) {
+        throw new Error('Expected key must be 32 bytes');
+    }
+    const kdfParams = { ...DEFAULT_KDF_PARAMS, ...params };
+    // Re-derive key using same salt
+    const derivedKey = argon2id(password, salt, {
+        m: kdfParams.memory,
+        t: kdfParams.iterations,
+        p: kdfParams.parallelism,
+        dkLen: kdfParams.keyLength,
+    });
+    // Constant-time comparison to prevent timing attacks
+    try {
+        return timingSafeEqual(Buffer.from(derivedKey), Buffer.from(expectedKey));
+    }
+    catch {
+        // timingSafeEqual throws if lengths don't match
+        return false;
+    }
+}
 //# sourceMappingURL=key-derivation.js.map

package/dist/src/lib/crypto/key-derivation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"key-derivation.js","sourceRoot":"","sources":["../../../../src/lib/crypto/key-derivation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE9C,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAEhD;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,QAAgB,EAChB,SAAuC,EAAE;IAEzC,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAC9C,CAAC;IAED,MAAM,SAAS,GAAG,EAAE,GAAG,kBAAkB,EAAE,GAAG,MAAM,EAAE,CAAC;IAEvD,kCAAkC;IAClC,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAE7B,4BAA4B;IAC5B,MAAM,GAAG,GAAG,QAAQ,CAClB,QAAQ,EACR,IAAI,EACJ;QACE,CAAC,EAAE,SAAS,CAAC,MAAM;QACnB,CAAC,EAAE,SAAS,CAAC,UAAU;QACvB,CAAC,EAAE,SAAS,CAAC,WAAW;QACxB,KAAK,EAAE,SAAS,CAAC,SAAS;KAC3B,CACF,CAAC;IAEF,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;AACvB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,QAAgB,EAChB,IAAgB,EAChB,SAAuC,EAAE;IAEzC,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAC9C,CAAC;IAED,MAAM,SAAS,GAAG,EAAE,GAAG,kBAAkB,EAAE,GAAG,MAAM,EAAE,CAAC;IAEvD,IAAI,IAAI,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC3C,CAAC;IAED,gCAAgC;IAChC,MAAM,GAAG,GAAG,QAAQ,CAClB,QAAQ,EACR,IAAI,EACJ;QACE,CAAC,EAAE,SAAS,CAAC,MAAM;QACnB,CAAC,EAAE,SAAS,CAAC,UAAU;QACvB,CAAC,EAAE,SAAS,CAAC,WAAW;QACxB,KAAK,EAAE,SAAS,CAAC,SAAS;KAC3B,CACF,CAAC;IAEF,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;AACvB,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,QAAgB,EAChB,IAAgB,EAChB,WAAuB,EACvB,SAAuC,EAAE;IAEzC,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;IAC9C,CAAC;IAED,IAAI,IAAI,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC3C,CAAC;IAED,IAAI,WAAW,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACnD,CAAC;IAED,MAAM,SAAS,GAAG,EAAE,GAAG,kBAAkB,EAAE,GAAG,MAAM,EAAE,CAAC;IAEvD,gCAAgC;IAChC,MAAM,UAAU,GAAG,QAAQ,CACzB,QAAQ,EACR,IAAI,EACJ;QACE,CAAC,EAAE,SAAS,CAAC,MAAM;QACnB,CAAC,EAAE,SAAS,CAAC,UAAU;QACvB,CAAC,EAAE,SAAS,CAAC,WAAW;QACxB,KAAK,EAAE,SAAS,CAAC,SAAS;KAC3B,CACF,CAAC;IAEF,qDAAqD;IACrD,IAAI,CAAC;QACH,OAAO,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;IAC5E,CAAC;IAAC,MAAM,CAAC;QACP,gDAAgD;QAChD,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/src/lib/crypto/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/lib/crypto/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,UAAU,CAAC;IAChB,IAAI,EAAE,UAAU,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,eAAO,MAAM,kBAAkB,EAAE,mBAKhC,CAAC;AAEF,YAAY,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC"}

package/dist/src/lib/crypto/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../src/lib/crypto/types.ts"],"names":[],"mappings":"AAkBA;;GAEG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAwB;IACrD,MAAM,EAAE,KAAK,EAAO,QAAQ;IAC5B,UAAU,EAAE,CAAC;IACb,WAAW,EAAE,CAAC;IACd,SAAS,EAAE,EAAE;CACd,CAAC"}

package/dist/src/lib/errors/base-error.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Base error class for all Footprint errors
+ * Provides structured error information with error codes and HTTP-like status codes
+ */
+export declare abstract class FootprintError extends Error {
+    readonly code: string;
+    readonly statusCode: number;
+    readonly context?: Record<string, unknown> | undefined;
+    constructor(message: string, code: string, statusCode: number, context?: Record<string, unknown> | undefined);
+    /**
+     * Convert error to JSON format for logging or API responses
+     */
+    toJSON(): Record<string, unknown>;
+}
+//# sourceMappingURL=base-error.d.ts.map

package/dist/src/lib/errors/base-error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"base-error.d.ts","sourceRoot":"","sources":["../../../../src/lib/errors/base-error.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,8BAAsB,cAAe,SAAQ,KAAK;aAG9B,IAAI,EAAE,MAAM;aACZ,UAAU,EAAE,MAAM;aAClB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;gBAHjD,OAAO,EAAE,MAAM,EACC,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,YAAA;IAWnD;;OAEG;IACH,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAUlC"}

package/dist/src/lib/errors/base-error.js

@@ -0,0 +1,34 @@
+/**
+ * Base error class for all Footprint errors
+ * Provides structured error information with error codes and HTTP-like status codes
+ */
+export class FootprintError extends Error {
+    code;
+    statusCode;
+    context;
+    constructor(message, code, statusCode, context) {
+        super(message);
+        this.code = code;
+        this.statusCode = statusCode;
+        this.context = context;
+        this.name = this.constructor.name;
+        // Maintains proper stack trace for where error was thrown (V8 only)
+        if (Error.captureStackTrace) {
+            Error.captureStackTrace(this, this.constructor);
+        }
+    }
+    /**
+     * Convert error to JSON format for logging or API responses
+     */
+    toJSON() {
+        return {
+            name: this.name,
+            message: this.message,
+            code: this.code,
+            statusCode: this.statusCode,
+            context: this.context,
+            stack: this.stack
+        };
+    }
+}
+//# sourceMappingURL=base-error.js.map

package/dist/src/lib/errors/base-error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"base-error.js","sourceRoot":"","sources":["../../../../src/lib/errors/base-error.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,OAAgB,cAAe,SAAQ,KAAK;IAG9B;IACA;IACA;IAJlB,YACE,OAAe,EACC,IAAY,EACZ,UAAkB,EAClB,OAAiC;QAEjD,KAAK,CAAC,OAAO,CAAC,CAAC;QAJC,SAAI,GAAJ,IAAI,CAAQ;QACZ,eAAU,GAAV,UAAU,CAAQ;QAClB,YAAO,GAAP,OAAO,CAA0B;QAGjD,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC;QAElC,oEAAoE;QACpE,IAAI,KAAK,CAAC,iBAAiB,EAAE,CAAC;YAC5B,KAAK,CAAC,iBAAiB,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IAED;;OAEG;IACH,MAAM;QACJ,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAC;IACJ,CAAC;CACF"}

package/dist/src/lib/errors/crypto-error.d.ts

@@ -0,0 +1,29 @@
+import { FootprintError } from './base-error.js';
+/**
+ * Cryptography error for encryption, decryption, and key operations
+ * HTTP status code: 500 (Internal Server Error)
+ */
+export declare class CryptoError extends FootprintError {
+    constructor(message: string, context?: Record<string, unknown>);
+    /**
+     * Create a crypto error for encryption failures
+     */
+    static encryptionFailed(originalError: Error): CryptoError;
+    /**
+     * Create a crypto error for decryption failures
+     */
+    static decryptionFailed(reason?: string): CryptoError;
+    /**
+     * Create a crypto error for key derivation failures
+     */
+    static keyDerivationFailed(originalError: Error): CryptoError;
+    /**
+     * Create a crypto error for invalid key
+     */
+    static invalidKey(reason: string): CryptoError;
+    /**
+     * Create a crypto error for invalid nonce
+     */
+    static invalidNonce(reason: string): CryptoError;
+}
+//# sourceMappingURL=crypto-error.d.ts.map

package/dist/src/lib/errors/crypto-error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto-error.d.ts","sourceRoot":"","sources":["../../../../src/lib/errors/crypto-error.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEjD;;;GAGG;AACH,qBAAa,WAAY,SAAQ,cAAc;gBACjC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAI9D;;OAEG;IACH,MAAM,CAAC,gBAAgB,CAAC,aAAa,EAAE,KAAK,GAAG,WAAW;IAO1D;;OAEG;IACH,MAAM,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,WAAW;IASrD;;OAEG;IACH,MAAM,CAAC,mBAAmB,CAAC,aAAa,EAAE,KAAK,GAAG,WAAW;IAO7D;;OAEG;IACH,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,WAAW;IAI9C;;OAEG;IACH,MAAM,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,WAAW;CAGjD"}

package/dist/src/lib/errors/crypto-error.js

@@ -0,0 +1,43 @@
+import { FootprintError } from './base-error.js';
+/**
+ * Cryptography error for encryption, decryption, and key operations
+ * HTTP status code: 500 (Internal Server Error)
+ */
+export class CryptoError extends FootprintError {
+    constructor(message, context) {
+        super(message, 'CRYPTO_ERROR', 500, context);
+    }
+    /**
+     * Create a crypto error for encryption failures
+     */
+    static encryptionFailed(originalError) {
+        return new CryptoError(`Encryption failed: ${originalError.message}`, { originalError: originalError.message });
+    }
+    /**
+     * Create a crypto error for decryption failures
+     */
+    static decryptionFailed(reason) {
+        return new CryptoError(reason
+            ? `Decryption failed: ${reason}`
+            : 'Decryption failed: invalid key or tampered data', { reason });
+    }
+    /**
+     * Create a crypto error for key derivation failures
+     */
+    static keyDerivationFailed(originalError) {
+        return new CryptoError(`Key derivation failed: ${originalError.message}`, { originalError: originalError.message });
+    }
+    /**
+     * Create a crypto error for invalid key
+     */
+    static invalidKey(reason) {
+        return new CryptoError(`Invalid key: ${reason}`, { reason });
+    }
+    /**
+     * Create a crypto error for invalid nonce
+     */
+    static invalidNonce(reason) {
+        return new CryptoError(`Invalid nonce: ${reason}`, { reason });
+    }
+}
+//# sourceMappingURL=crypto-error.js.map

package/dist/src/lib/errors/crypto-error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto-error.js","sourceRoot":"","sources":["../../../../src/lib/errors/crypto-error.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEjD;;;GAGG;AACH,MAAM,OAAO,WAAY,SAAQ,cAAc;IAC7C,YAAY,OAAe,EAAE,OAAiC;QAC5D,KAAK,CAAC,OAAO,EAAE,cAAc,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IAC/C,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,gBAAgB,CAAC,aAAoB;QAC1C,OAAO,IAAI,WAAW,CACpB,sBAAsB,aAAa,CAAC,OAAO,EAAE,EAC7C,EAAE,aAAa,EAAE,aAAa,CAAC,OAAO,EAAE,CACzC,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,gBAAgB,CAAC,MAAe;QACrC,OAAO,IAAI,WAAW,CACpB,MAAM;YACJ,CAAC,CAAC,sBAAsB,MAAM,EAAE;YAChC,CAAC,CAAC,iDAAiD,EACrD,EAAE,MAAM,EAAE,CACX,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,mBAAmB,CAAC,aAAoB;QAC7C,OAAO,IAAI,WAAW,CACpB,0BAA0B,aAAa,CAAC,OAAO,EAAE,EACjD,EAAE,aAAa,EAAE,aAAa,CAAC,OAAO,EAAE,CACzC,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,UAAU,CAAC,MAAc;QAC9B,OAAO,IAAI,WAAW,CAAC,gBAAgB,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IAC/D,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,YAAY,CAAC,MAAc;QAChC,OAAO,IAAI,WAAW,CAAC,kBAAkB,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;IACjE,CAAC;CACF"}

package/dist/src/lib/errors/index.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Structured error hierarchy for Footprint MCP server
+ *
+ * Usage:
+ * ```typescript
+ * import { ValidationError, StorageError, CryptoError } from './lib/errors/index.js';
+ *
+ * // Validation errors (HTTP 400)
+ * throw ValidationError.required('conversationId');
+ * throw ValidationError.invalidFormat('tags', 'comma-separated string');
+ * throw new ValidationError('Content cannot be empty', { field: 'content' });
+ *
+ * // Storage errors (HTTP 500)
+ * throw StorageError.notFound('Evidence', id);
+ * throw StorageError.databaseOperation('insert', error);
+ *
+ * // Crypto errors (HTTP 500)
+ * throw CryptoError.decryptionFailed();
+ * throw CryptoError.invalidKey('Key must be 32 bytes');
+ * ```
+ */
+export { FootprintError } from './base-error.js';
+export { ValidationError } from './validation-error.js';
+export { StorageError } from './storage-error.js';
+export { CryptoError } from './crypto-error.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/src/lib/errors/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/lib/errors/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC"}

package/dist/src/lib/errors/index.js

@@ -0,0 +1,26 @@
+/**
+ * Structured error hierarchy for Footprint MCP server
+ *
+ * Usage:
+ * ```typescript
+ * import { ValidationError, StorageError, CryptoError } from './lib/errors/index.js';
+ *
+ * // Validation errors (HTTP 400)
+ * throw ValidationError.required('conversationId');
+ * throw ValidationError.invalidFormat('tags', 'comma-separated string');
+ * throw new ValidationError('Content cannot be empty', { field: 'content' });
+ *
+ * // Storage errors (HTTP 500)
+ * throw StorageError.notFound('Evidence', id);
+ * throw StorageError.databaseOperation('insert', error);
+ *
+ * // Crypto errors (HTTP 500)
+ * throw CryptoError.decryptionFailed();
+ * throw CryptoError.invalidKey('Key must be 32 bytes');
+ * ```
+ */
+export { FootprintError } from './base-error.js';
+export { ValidationError } from './validation-error.js';
+export { StorageError } from './storage-error.js';
+export { CryptoError } from './crypto-error.js';
+//# sourceMappingURL=index.js.map

package/dist/src/lib/errors/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/lib/errors/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC"}