@sebastienrousseau/crypto-mcp 0.0.8 → 0.0.24

package/dist/tools/definitions.js

@@ -1,9 +1,31 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.TOOLS = exports.HASH_ALGORITHMS = exports.EC_CURVES = exports.RSA_MODULUS_LENGTHS = exports.KEY_TYPES = void 0;
-exports.KEY_TYPES = ["rsa", "ecc", "ed25519", "ml-kem-768"];
+exports.TOOLS = exports.HASH_ALGORITHMS = exports.MAX_KEY_FILE_BYTES = exports.KEY_DIR_ENV = exports.EC_CURVES = exports.RSA_MODULUS_LENGTHS = exports.ML_KEM_LEVELS = exports.KEY_TYPES = void 0;
+const keystore_1 = require("./keystore");
+const annotations_1 = require("./annotations");
+const stream_definitions_1 = require("./stream-definitions");
+const schema_helpers_1 = require("./schema-helpers");
+exports.KEY_TYPES = [
+    "rsa",
+    "ecc",
+    "ed25519",
+    "x25519",
+    "ml-kem-512",
+    "ml-kem-768",
+    "ml-kem-1024",
+    "ml-dsa-44",
+    "ml-dsa-65",
+    "ml-dsa-87",
+    "symmetric-256",
+    "hmac-sha256",
+];
+exports.ML_KEM_LEVELS = [512, 768, 1024];
 exports.RSA_MODULUS_LENGTHS = [2048, 3072, 4096];
 exports.EC_CURVES = ["prime256v1", "secp384r1", "secp256k1"];
+exports.KEY_DIR_ENV = "CRYPTO_MCP_KEY_DIR";
+exports.MAX_KEY_FILE_BYTES = 65_536;
+const MAX_KEY_PATH_LENGTH = 512;
+const RAW_KEY_KINDS = ["symmetric-256", "hmac-sha256"];
 exports.HASH_ALGORITHMS = [
     "sha256",
     "sha384",
@@ -11,133 +33,230 @@ exports.HASH_ALGORITHMS = [
     "sha3-256",
     "blake2b512",
 ];
-exports.TOOLS = [
+const AEAD_ALGORITHMS = ["aes-256-gcm", "chacha20-poly1305"];
+const KMS_PROVIDERS = ["aws", "gcp", "azure", "vault", "local"];
+const KMS_PROVIDER = (0, schema_helpers_1.oneOf)("KMS provider ('aws', 'gcp', 'azure', 'vault', or 'local'). Only 'local' (random, in-process key material that does not survive a restart) is configured; the others return an error.", KMS_PROVIDERS);
+const KEK_LABEL = {
+    type: "string",
+    description: "Label of the Key Encryption Key (KEK). It names the key; it is never used to derive it.",
+    minLength: 1,
+    maxLength: 256,
+};
+const KEY_TOOLS = [
     {
         name: "crypto_generate_key",
-        description: "Generate cryptographic keypairs for classical (RSA, ECC, Ed25519) or post-quantum (ML-KEM-768, FIPS 203) algorithms.",
+        description: `Generate a key inside the server: a classical (RSA, ECC, Ed25519) or post-quantum (ML-KEM 512/768/1024 FIPS 203, ML-DSA 44/65/87 FIPS 204) keypair, a 256-bit symmetric key, or an HMAC-SHA256 key. Returns a keyHandle and, for keypairs, the public key. ${schema_helpers_1.HANDLE_NOTE}`,
         inputSchema: {
             type: "object",
+            additionalProperties: false,
             properties: {
-                type: {
-                    type: "string",
-                    description: "Key algorithm: 'rsa', 'ecc', 'ed25519', or 'ml-kem-768'.",
-                    enum: exports.KEY_TYPES,
-                },
+                type: (0, schema_helpers_1.oneOf)("Key type: 'rsa', 'ecc', 'ed25519', 'x25519', 'ml-kem-512', 'ml-kem-768', 'ml-kem-1024', 'ml-dsa-44', 'ml-dsa-65', 'ml-dsa-87', 'symmetric-256', or 'hmac-sha256'.", exports.KEY_TYPES),
                 modulusLength: {
-                    type: "number",
+                    type: "integer",
                     description: "Modulus length for RSA (2048, 3072, 4096). Default is 2048.",
+                    enum: exports.RSA_MODULUS_LENGTHS,
                 },
-                curve: {
-                    type: "string",
-                    description: "Elliptic curve: 'prime256v1' (P-256), 'secp384r1' (P-384), or 'secp256k1'.",
-                    enum: exports.EC_CURVES,
-                },
+                curve: (0, schema_helpers_1.oneOf)("Elliptic curve for 'ecc': 'prime256v1' (P-256), 'secp384r1' (P-384), or 'secp256k1'. Default is 'prime256v1'.", exports.EC_CURVES),
             },
             required: ["type"],
         },
     },
     {
-        name: "crypto_encrypt",
-        description: "Encrypt plaintext using authenticated symmetric encryption (AES-256-GCM, ChaCha20-Poly1305) or asymmetric keys.",
+        name: "crypto_key_list",
+        description: `List the key handles this server holds, with each key's type and public metadata. At most ${keystore_1.MAX_KEYS} keys are held; beyond that the least recently used key is destroyed.`,
+        inputSchema: {
+            type: "object",
+            additionalProperties: false,
+            properties: {},
+        },
+    },
+    {
+        name: "crypto_key_destroy",
+        description: "Destroy a key: overwrite its secret bytes where the runtime allows and invalidate its handle.",
+        inputSchema: {
+            type: "object",
+            additionalProperties: false,
+            properties: { keyHandle: (0, schema_helpers_1.keyHandle)("Handle of the key to destroy.") },
+            required: ["keyHandle"],
+        },
+    },
+    {
+        name: "crypto_key_import",
+        description: `Import an existing key from a file in the directory the server operator set in ${exports.KEY_DIR_ENV} (disabled when it is unset). Reads an unencrypted PKCS#8 PEM private key (Ed25519, RSA 2048/3072/4096, ECDSA P-256/P-384/secp256k1; the type comes from the key) or a raw 32-byte key, as 32 binary bytes or 64 hex digits, imported as 'symmetric-256' (default) or 'hmac-sha256'. Files over ${exports.MAX_KEY_FILE_BYTES} bytes are refused. The key bytes never pass through the conversation. ${schema_helpers_1.HANDLE_NOTE}`,
         inputSchema: {
             type: "object",
+            additionalProperties: false,
             properties: {
-                plaintext: {
-                    type: "string",
-                    description: "Plaintext string to encrypt.",
-                },
-                algorithm: {
+                path: {
                     type: "string",
-                    description: "Encryption algorithm ('aes-256-gcm' or 'chacha20-poly1305'). Default is 'aes-256-gcm'.",
-                    enum: ["aes-256-gcm", "chacha20-poly1305"],
+                    description: `Path of the key file, relative to ${exports.KEY_DIR_ENV}. Absolute paths, '..' segments and symlinks that lead outside the directory are refused.`,
+                    minLength: 1,
+                    maxLength: MAX_KEY_PATH_LENGTH,
                 },
-                key: {
+                kind: (0, schema_helpers_1.oneOf)("For a raw 32-byte key only: 'symmetric-256' (crypto_encrypt, crypto_decrypt, crypto_kms_wrap; default) or 'hmac-sha256' (crypto_sign, crypto_verify).", RAW_KEY_KINDS),
+            },
+            required: ["path"],
+        },
+    },
+    {
+        name: "crypto_inspect_key",
+        description: "Inspect and parse PEM certificate, public key, or OpenPGP armored block.",
+        inputSchema: {
+            type: "object",
+            additionalProperties: false,
+            properties: {
+                keyData: {
                     type: "string",
-                    description: "Hex-encoded 256-bit key (64 hex characters). If omitted, a secure 256-bit key is generated and returned.",
+                    description: "PEM or armored key string.",
+                    maxLength: schema_helpers_1.MAX_KEY_LENGTH,
                 },
             },
+            required: ["keyData"],
+        },
+    },
+];
+const CIPHER_TOOLS = [
+    {
+        name: "crypto_encrypt",
+        description: `Encrypt plaintext with authenticated encryption (AES-256-GCM or ChaCha20-Poly1305) under a symmetric-256 key handle. Without keyHandle, a new key is generated and its handle returned. ${schema_helpers_1.HANDLE_NOTE}`,
+        inputSchema: {
+            type: "object",
+            additionalProperties: false,
+            properties: {
+                plaintext: (0, schema_helpers_1.text)("Plaintext string to encrypt."),
+                algorithm: (0, schema_helpers_1.oneOf)("Encryption algorithm ('aes-256-gcm' or 'chacha20-poly1305'). Default is 'aes-256-gcm'.", AEAD_ALGORITHMS),
+                keyHandle: (0, schema_helpers_1.keyHandle)("Handle of a symmetric-256 key. If omitted, a new key is generated."),
+            },
             required: ["plaintext"],
         },
     },
     {
         name: "crypto_decrypt",
-        description: "Decrypt ciphertext encrypted with authenticated AES-256-GCM or ChaCha20-Poly1305.",
+        description: "Decrypt and authenticate an AES-256-GCM or ChaCha20-Poly1305 ciphertext with a symmetric-256 key handle.",
         inputSchema: {
             type: "object",
+            additionalProperties: false,
             properties: {
-                ciphertext: {
-                    type: "string",
-                    description: "Hex-encoded or base64-encoded ciphertext payload.",
-                },
-                algorithm: {
-                    type: "string",
-                    description: "Algorithm used for encryption ('aes-256-gcm' or 'chacha20-poly1305').",
-                    enum: ["aes-256-gcm", "chacha20-poly1305"],
+                ciphertext: (0, schema_helpers_1.hex)("Hex-encoded ciphertext.", 2 * schema_helpers_1.MAX_TEXT_LENGTH, true),
+                algorithm: (0, schema_helpers_1.oneOf)("Algorithm used for encryption ('aes-256-gcm' or 'chacha20-poly1305'). Default is 'aes-256-gcm'.", AEAD_ALGORITHMS),
+                keyHandle: (0, schema_helpers_1.keyHandle)("Handle of the symmetric-256 key."),
+                iv: (0, schema_helpers_1.hex)("Hex-encoded 96-bit nonce (24 hex characters).", 24),
+                authTag: (0, schema_helpers_1.hex)("Hex-encoded 128-bit authentication tag.", 32),
+            },
+            required: ["ciphertext", "keyHandle", "iv", "authTag"],
+        },
+    },
+    {
+        name: "crypto_kem_encapsulate",
+        description: `Encapsulate a shared secret to an ML-KEM (FIPS 203) public key (512, 768, 1024). Returns the KEM ciphertext for the recipient and a symmetric-256 keyHandle for the shared secret, usable with crypto_encrypt. ${schema_helpers_1.HANDLE_NOTE}`,
+        inputSchema: {
+            type: "object",
+            additionalProperties: false,
+            properties: {
+                publicKey: (0, schema_helpers_1.hex)("Hex-encoded ML-KEM public key (1600, 2368, or 3136 hex characters).", 3136, true),
+                level: {
+                    type: "integer",
+                    description: "ML-KEM security level (512, 768, or 1024). Default is 768.",
+                    enum: exports.ML_KEM_LEVELS,
                 },
-                key: {
-                    type: "string",
-                    description: "Hex-encoded 256-bit key (64 hex characters).",
+            },
+            required: ["publicKey"],
+        },
+    },
+    {
+        name: "crypto_kem_decapsulate",
+        description: `Recover an ML-KEM shared secret with an ml-kem key handle (512, 768, 1024). Returns a symmetric-256 keyHandle for the shared secret. ${schema_helpers_1.HANDLE_NOTE}`,
+        inputSchema: {
+            type: "object",
+            additionalProperties: false,
+            properties: {
+                keyHandle: (0, schema_helpers_1.keyHandle)("Handle of the ml-kem key."),
+                ciphertext: (0, schema_helpers_1.hex)("Hex-encoded ML-KEM ciphertext (1536, 2176, or 3136 hex characters).", 3136, true),
+                level: {
+                    type: "integer",
+                    description: "ML-KEM security level (512, 768, or 1024). Default is inferred from key or 768.",
+                    enum: exports.ML_KEM_LEVELS,
                 },
-                iv: {
-                    type: "string",
-                    description: "Hex-encoded initialization vector / nonce.",
+            },
+            required: ["keyHandle", "ciphertext"],
+        },
+    },
+    {
+        name: "crypto_hybrid_kem_encapsulate",
+        description: `Encapsulate a shared secret using Post-Quantum Hybrid KEM (X25519 + ML-KEM, RFC 9180/10024). Returns the classical ephemeral public key, ML-KEM ciphertext, and a symmetric-256 keyHandle for the combined shared secret. ${schema_helpers_1.HANDLE_NOTE}`,
+        inputSchema: {
+            type: "object",
+            additionalProperties: false,
+            properties: {
+                x25519PublicKey: (0, schema_helpers_1.hex)("Hex-encoded recipient X25519 public key (64 hex characters).", schema_helpers_1.X25519_PUBLIC_KEY_HEX),
+                mlKemPublicKey: (0, schema_helpers_1.hex)("Hex-encoded recipient ML-KEM public key (1600, 2368, or 3136 hex characters).", 3136, true),
+                level: {
+                    type: "integer",
+                    description: "ML-KEM security level (512, 768, or 1024). Default is 768.",
+                    enum: exports.ML_KEM_LEVELS,
                 },
-                authTag: {
-                    type: "string",
-                    description: "Hex-encoded 128-bit authentication tag.",
+            },
+            required: ["x25519PublicKey", "mlKemPublicKey"],
+        },
+    },
+    {
+        name: "crypto_hybrid_kem_decapsulate",
+        description: `Recover a Post-Quantum Hybrid KEM shared secret (X25519 + ML-KEM) using server-held x25519 and ml-kem key handles. Returns a symmetric-256 keyHandle for the combined shared secret. ${schema_helpers_1.HANDLE_NOTE}`,
+        inputSchema: {
+            type: "object",
+            additionalProperties: false,
+            properties: {
+                x25519KeyHandle: (0, schema_helpers_1.keyHandle)("Handle of the recipient X25519 key."),
+                mlKemKeyHandle: (0, schema_helpers_1.keyHandle)("Handle of the recipient ML-KEM key."),
+                x25519EphemeralPublic: (0, schema_helpers_1.hex)("Hex-encoded sender ephemeral X25519 public key (64 hex characters).", schema_helpers_1.X25519_PUBLIC_KEY_HEX),
+                mlKemCiphertext: (0, schema_helpers_1.hex)("Hex-encoded ML-KEM ciphertext (1536, 2176, or 3136 hex characters).", 3136, true),
+                level: {
+                    type: "integer",
+                    description: "ML-KEM security level (512, 768, or 1024). Default is inferred from key or 768.",
+                    enum: exports.ML_KEM_LEVELS,
                 },
             },
-            required: ["ciphertext", "key", "iv", "authTag"],
+            required: [
+                "x25519KeyHandle",
+                "mlKemKeyHandle",
+                "x25519EphemeralPublic",
+                "mlKemCiphertext",
+            ],
         },
     },
+];
+const SIGNATURE_TOOLS = [
     {
         name: "crypto_sign",
-        description: "Digitally sign data using Ed25519, RSA-PSS, or HMAC.",
+        description: "Sign data with a key handle. The algorithm follows the key: Ed25519, RSASSA-PSS (SHA-256), ECDSA (SHA-256; SHA-384 on P-384), ML-DSA (44, 65, 87, FIPS 204), or HMAC-SHA256.",
         inputSchema: {
             type: "object",
+            additionalProperties: false,
             properties: {
-                data: {
-                    type: "string",
-                    description: "Data string to sign.",
-                },
-                algorithm: {
-                    type: "string",
-                    description: "Signing algorithm ('ed25519', 'rsa-pss', or 'hmac-sha256').",
-                    enum: ["ed25519", "rsa-pss", "hmac-sha256"],
-                },
-                privateKey: {
-                    type: "string",
-                    description: "Private key in PEM format or secret key for HMAC.",
-                },
+                data: (0, schema_helpers_1.text)("Data string to sign."),
+                keyHandle: (0, schema_helpers_1.keyHandle)("Handle of an ed25519, rsa, ecc, ml-dsa, or hmac-sha256 key."),
             },
-            required: ["data", "algorithm", "privateKey"],
+            required: ["data", "keyHandle"],
         },
     },
     {
         name: "crypto_verify",
-        description: "Verify digital signature against original data and public key.",
+        description: "Verify a signature against a public key (SPKI PEM or ML-DSA hex) or a key handle (also HMAC-SHA256). Pass exactly one of publicKey or keyHandle.",
         inputSchema: {
             type: "object",
+            additionalProperties: false,
             properties: {
-                data: {
-                    type: "string",
-                    description: "Original data string.",
-                },
-                signature: {
-                    type: "string",
-                    description: "Hex-encoded signature.",
-                },
-                algorithm: {
-                    type: "string",
-                    description: "Signing algorithm ('ed25519', 'rsa-pss', or 'hmac-sha256').",
-                    enum: ["ed25519", "rsa-pss", "hmac-sha256"],
-                },
+                data: (0, schema_helpers_1.text)("Original data string."),
+                signature: (0, schema_helpers_1.hex)("Hex-encoded signature.", schema_helpers_1.MAX_KEY_LENGTH, true),
                 publicKey: {
                     type: "string",
-                    description: "Public key in PEM format or secret key for HMAC.",
+                    description: "Public key in SPKI PEM format or ML-DSA hex format. Private keys are refused.",
+                    minLength: 1,
+                    maxLength: schema_helpers_1.MAX_KEY_LENGTH,
                 },
+                keyHandle: (0, schema_helpers_1.keyHandle)("Handle of an ed25519, rsa, ecc, ml-dsa, or hmac-sha256 key."),
             },
-            required: ["data", "signature", "algorithm", "publicKey"],
+            required: ["data", "signature"],
         },
     },
     {
@@ -145,93 +264,66 @@ exports.TOOLS = [
         description: "Compute cryptographic digest (SHA-256, SHA-384, SHA-512, SHA3-256, BLAKE2b512).",
         inputSchema: {
             type: "object",
+            additionalProperties: false,
             properties: {
-                data: {
-                    type: "string",
-                    description: "Data string to hash.",
-                },
-                algorithm: {
-                    type: "string",
-                    description: "Hash algorithm.",
-                    enum: exports.HASH_ALGORITHMS,
-                },
+                data: (0, schema_helpers_1.text)("Data string to hash."),
+                algorithm: (0, schema_helpers_1.oneOf)("Hash algorithm.", exports.HASH_ALGORITHMS),
             },
             required: ["data"],
         },
     },
+];
+const KMS_AND_AUDIT_TOOLS = [
     {
         name: "crypto_kms_wrap",
-        description: "Wrap a Data Encryption Key (DEK) under a Key Encryption Key held by a KMS provider. Only the 'local' provider (random, in-process key material that does not survive a restart) is configured.",
+        description: "Wrap the Data Encryption Key (DEK) a symmetric-256 key handle refers to under a Key Encryption Key held by a KMS provider. Only the 'local' provider is configured.",
         inputSchema: {
             type: "object",
+            additionalProperties: false,
             properties: {
-                provider: {
-                    type: "string",
-                    description: "KMS provider ('aws', 'gcp', 'azure', 'vault', or 'local'). Only 'local' is configured; the others return an error.",
-                    enum: ["aws", "gcp", "azure", "vault", "local"],
-                },
-                keyId: {
-                    type: "string",
-                    description: "Label of the Key Encryption Key (KEK). It names the key; it is never used to derive it.",
-                },
-                dek: {
-                    type: "string",
-                    description: "Hex-encoded 256-bit Data Encryption Key to wrap.",
-                },
+                provider: KMS_PROVIDER,
+                keyId: KEK_LABEL,
+                keyHandle: (0, schema_helpers_1.keyHandle)("Handle of the symmetric-256 DEK to wrap."),
             },
-            required: ["provider", "keyId", "dek"],
+            required: ["provider", "keyId", "keyHandle"],
         },
     },
     {
         name: "crypto_kms_unwrap",
-        description: "Unwrap a Data Encryption Key (DEK) previously wrapped by crypto_kms_wrap in this server process. Only the 'local' provider is configured.",
+        description: `Unwrap a DEK previously wrapped by crypto_kms_wrap in this server process into a symmetric-256 key handle. Only the 'local' provider is configured. ${schema_helpers_1.HANDLE_NOTE}`,
         inputSchema: {
             type: "object",
+            additionalProperties: false,
             properties: {
-                provider: {
-                    type: "string",
-                    description: "KMS provider ('aws', 'gcp', 'azure', 'vault', or 'local'). Only 'local' is configured; the others return an error.",
-                    enum: ["aws", "gcp", "azure", "vault", "local"],
-                },
-                keyId: {
-                    type: "string",
-                    description: "Key Encryption Key (KEK) identifier.",
-                },
-                wrappedKey: {
-                    type: "string",
-                    description: "Hex-encoded wrapped key payload.",
-                },
+                provider: KMS_PROVIDER,
+                keyId: KEK_LABEL,
+                wrappedKey: (0, schema_helpers_1.hex)("Hex-encoded wrapped key payload.", 1024, true),
             },
             required: ["provider", "keyId", "wrappedKey"],
         },
     },
-    {
-        name: "crypto_inspect_key",
-        description: "Inspect and parse PEM certificate, public key, or OpenPGP armored block.",
-        inputSchema: {
-            type: "object",
-            properties: {
-                keyData: {
-                    type: "string",
-                    description: "PEM or armored key string.",
-                },
-            },
-            required: ["keyData"],
-        },
-    },
     {
         name: "crypto_audit_cbom",
         description: "Generate a Cryptographic Bill of Materials (CBOM) inventory from cryptographic identifiers.",
         inputSchema: {
             type: "object",
+            additionalProperties: false,
             properties: {
                 algorithms: {
                     type: "string",
                     description: "Comma-separated list of algorithm names to evaluate (e.g. 'RSA-2048,AES-256-GCM,ML-KEM-768,SHA-1').",
+                    maxLength: 4096,
                 },
             },
             required: ["algorithms"],
         },
     },
 ];
+exports.TOOLS = [
+    ...KEY_TOOLS,
+    ...CIPHER_TOOLS,
+    ...stream_definitions_1.STREAM_TOOLS,
+    ...SIGNATURE_TOOLS,
+    ...KMS_AND_AUDIT_TOOLS,
+].map((tool) => ({ ...tool, ...(0, annotations_1.annotationsFor)(tool.name) }));
 //# sourceMappingURL=definitions.js.map

package/dist/tools/index.d.ts

@@ -1,4 +1,5 @@
 import { MCPCallToolResult } from "../types";
 export { TOOLS } from "./definitions";
+export { validateArguments } from "./validate";
 export declare function executeTool(name: string, args?: Record<string, unknown>): Promise<MCPCallToolResult>;
 //# sourceMappingURL=index.d.ts.map

package/dist/tools/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/tools/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAQ7C,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAmBtC,wBAAsB,WAAW,CAC/B,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GACjC,OAAO,CAAC,iBAAiB,CAAC,CAQ5B"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/tools/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,iBAAiB,EAAsB,MAAM,UAAU,CAAC;AAyBjE,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AACtC,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAgD/C,wBAAsB,WAAW,CAC/B,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GACjC,OAAO,CAAC,iBAAiB,CAAC,CAU5B"}

package/dist/tools/index.js

@@ -1,19 +1,39 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.TOOLS = void 0;
+exports.validateArguments = exports.TOOLS = void 0;
 exports.executeTool = executeTool;
 const cbom_1 = require("./cbom");
+const definitions_1 = require("./definitions");
+const keyimport_1 = require("./keyimport");
+const kem_1 = require("./kem");
 const keys_1 = require("./keys");
 const kms_1 = require("./kms");
 const result_1 = require("./result");
 const signing_1 = require("./signing");
+const stream_1 = require("./stream");
 const symmetric_1 = require("./symmetric");
-var definitions_1 = require("./definitions");
-Object.defineProperty(exports, "TOOLS", { enumerable: true, get: function () { return definitions_1.TOOLS; } });
+const validate_1 = require("./validate");
+var definitions_2 = require("./definitions");
+Object.defineProperty(exports, "TOOLS", { enumerable: true, get: function () { return definitions_2.TOOLS; } });
+var validate_2 = require("./validate");
+Object.defineProperty(exports, "validateArguments", { enumerable: true, get: function () { return validate_2.validateArguments; } });
 const HANDLERS = {
     crypto_generate_key: keys_1.generateKey,
+    crypto_key_list: keys_1.listKeys,
+    crypto_key_destroy: keys_1.destroyKey,
+    crypto_key_import: keyimport_1.importKey,
+    crypto_kem_encapsulate: kem_1.kemEncapsulate,
+    crypto_kem_decapsulate: kem_1.kemDecapsulate,
+    crypto_hybrid_kem_encapsulate: kem_1.hybridKemEncapsulateHandler,
+    crypto_hybrid_kem_decapsulate: kem_1.hybridKemDecapsulateHandler,
+    crypto_hybrid_kem_multi_encapsulate: kem_1.hybridKemMultiEncapsulateHandler,
+    crypto_hybrid_kem_multi_decapsulate: kem_1.hybridKemMultiDecapsulateHandler,
     crypto_encrypt: symmetric_1.encrypt,
     crypto_decrypt: symmetric_1.decrypt,
+    crypto_stream_encrypt: stream_1.streamEncrypt,
+    crypto_stream_decrypt: stream_1.streamDecrypt,
+    crypto_stream_multi_encrypt: stream_1.streamMultiEncrypt,
+    crypto_stream_multi_decrypt: stream_1.streamMultiDecrypt,
     crypto_sign: signing_1.sign,
     crypto_verify: signing_1.verify,
     crypto_hash: signing_1.hash,
@@ -22,12 +42,19 @@ const HANDLERS = {
     crypto_inspect_key: keys_1.inspectKey,
     crypto_audit_cbom: cbom_1.auditCbom,
 };
+const REGISTRY = new Map(definitions_1.TOOLS.map((tool) => [
+    tool.name,
+    { schema: tool.inputSchema, handler: HANDLERS[tool.name] },
+]));
 async function executeTool(name, args = {}) {
-    const handler = Object.hasOwn(HANDLERS, name) ? HANDLERS[name] : undefined;
-    if (!handler)
+    const tool = REGISTRY.get(name);
+    if (!tool)
         return (0, result_1.errorResult)(`Unknown tool name: ${name}`);
+    const problem = (0, validate_1.validateArguments)(tool.schema, args);
+    if (problem)
+        return (0, result_1.errorResult)(`Invalid arguments for ${name}: ${problem}`);
     try {
-        return await handler(args);
+        return await tool.handler(args);
     }
     catch (err) {
         return (0, result_1.errorResult)(`Tool error (${name}): ${err.message}`);

package/dist/tools/kem.d.ts

@@ -0,0 +1,8 @@
+import { ToolHandler } from "./result";
+export declare const kemEncapsulate: ToolHandler;
+export declare const kemDecapsulate: ToolHandler;
+export declare const hybridKemEncapsulateHandler: ToolHandler;
+export declare const hybridKemDecapsulateHandler: ToolHandler;
+export declare const hybridKemMultiEncapsulateHandler: ToolHandler;
+export declare const hybridKemMultiDecapsulateHandler: ToolHandler;
+//# sourceMappingURL=kem.d.ts.map

package/dist/tools/kem.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"kem.d.ts","sourceRoot":"","sources":["../../src/tools/kem.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,WAAW,EAAc,MAAM,UAAU,CAAC;AA2BnD,eAAO,MAAM,cAAc,EAAE,WAa5B,CAAC;AAGF,eAAO,MAAM,cAAc,EAAE,WAoB5B,CAAC;AAGF,eAAO,MAAM,2BAA2B,EAAE,WAoBzC,CAAC;AAGF,eAAO,MAAM,2BAA2B,EAAE,WAuBzC,CAAC;AAmBF,eAAO,MAAM,gCAAgC,EAAE,WAoC9C,CAAC;AAgEF,eAAO,MAAM,gCAAgC,EAAE,WAqB9C,CAAC"}