@sebastienrousseau/crypto-mcp 0.0.8 → 0.0.24

package/dist/tools/kem.js

@@ -0,0 +1,156 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.hybridKemMultiDecapsulateHandler = exports.hybridKemMultiEncapsulateHandler = exports.hybridKemDecapsulateHandler = exports.hybridKemEncapsulateHandler = exports.kemDecapsulate = exports.kemEncapsulate = void 0;
+const node_crypto_1 = __importDefault(require("node:crypto"));
+const crypto_lib_1 = require("@sebastienrousseau/crypto-lib");
+const keystore_1 = require("./keystore");
+const result_1 = require("./result");
+function resolveKemLevel(levelArg, defaultLevel = 768) {
+    const num = Number(levelArg);
+    if (num === 512 || num === 768 || num === 1024) {
+        return num;
+    }
+    return defaultLevel;
+}
+function inferLevelFromKey(keyKind) {
+    if (keyKind === "ml-kem-512")
+        return 512;
+    if (keyKind === "ml-kem-1024")
+        return 1024;
+    return 768;
+}
+const kemEncapsulate = async (args) => {
+    const level = resolveKemLevel(args.level, 768);
+    const { ciphertext, sharedSecret, algorithm } = (0, crypto_lib_1.mlKemEncap)(level, String(args.publicKey));
+    const keyHandle = keystore_1.keyStore.add((0, keystore_1.symmetricKey)(Buffer.from(sharedSecret, "hex"), `${algorithm} encapsulation`));
+    return (0, result_1.jsonResult)({ algorithm, ciphertext, keyHandle });
+};
+exports.kemEncapsulate = kemEncapsulate;
+const kemDecapsulate = async (args) => {
+    const key = keystore_1.keyStore.use(String(args.keyHandle), [
+        "ml-kem-512",
+        "ml-kem-768",
+        "ml-kem-1024",
+    ]);
+    const defaultLevel = inferLevelFromKey(key.kind);
+    const level = resolveKemLevel(args.level, defaultLevel);
+    const { sharedSecret, algorithm } = (0, crypto_lib_1.mlKemDecap)(level, key.secret.toString("hex"), String(args.ciphertext));
+    const keyHandle = keystore_1.keyStore.add((0, keystore_1.symmetricKey)(Buffer.from(sharedSecret, "hex"), `${algorithm} decapsulation`));
+    return (0, result_1.jsonResult)({ algorithm, keyHandle });
+};
+exports.kemDecapsulate = kemDecapsulate;
+const hybridKemEncapsulateHandler = async (args) => {
+    const level = resolveKemLevel(args.level, 768);
+    const { x25519EphemeralPublic, mlKemCiphertext, sharedSecret, algorithm } = (0, crypto_lib_1.hybridKemEncapsulate)(level, String(args.x25519PublicKey), String(args.mlKemPublicKey));
+    const keyHandle = keystore_1.keyStore.add((0, keystore_1.symmetricKey)(Buffer.from(sharedSecret, "hex"), `${algorithm} encapsulation`));
+    return (0, result_1.jsonResult)({
+        algorithm,
+        x25519EphemeralPublic,
+        mlKemCiphertext,
+        keyHandle,
+    });
+};
+exports.hybridKemEncapsulateHandler = hybridKemEncapsulateHandler;
+const hybridKemDecapsulateHandler = async (args) => {
+    const xKey = keystore_1.keyStore.use(String(args.x25519KeyHandle), ["x25519"]);
+    const kemKey = keystore_1.keyStore.use(String(args.mlKemKeyHandle), [
+        "ml-kem-512",
+        "ml-kem-768",
+        "ml-kem-1024",
+    ]);
+    const defaultLevel = inferLevelFromKey(kemKey.kind);
+    const level = resolveKemLevel(args.level, defaultLevel);
+    const { sharedSecret, algorithm } = (0, crypto_lib_1.hybridKemDecapsulate)(level, xKey.secret.toString("hex"), kemKey.secret.toString("hex"), String(args.x25519EphemeralPublic), String(args.mlKemCiphertext));
+    const keyHandle = keystore_1.keyStore.add((0, keystore_1.symmetricKey)(Buffer.from(sharedSecret, "hex"), `${algorithm} decapsulation`));
+    return (0, result_1.jsonResult)({ algorithm, keyHandle });
+};
+exports.hybridKemDecapsulateHandler = hybridKemDecapsulateHandler;
+function parseHybridRecipients(raw) {
+    const parsed = JSON.parse(String(raw));
+    if (!Array.isArray(parsed) || parsed.length === 0) {
+        throw new Error("recipients must be a non-empty array of recipient objects");
+    }
+    return parsed;
+}
+const hybridKemMultiEncapsulateHandler = async (args) => {
+    const recipients = parseHybridRecipients(args.recipients);
+    let dek;
+    let keyHandle;
+    if (args.keyHandle !== undefined && args.keyHandle !== null) {
+        keyHandle = String(args.keyHandle);
+        const stored = keystore_1.keyStore.use(keyHandle, ["symmetric-256"]);
+        dek = Buffer.from(stored.secret);
+    }
+    else {
+        dek = node_crypto_1.default.randomBytes(32);
+        keyHandle = keystore_1.keyStore.add((0, keystore_1.symmetricKey)(dek, "multi-recipient hybrid KEM DEK"));
+    }
+    const encryptedRecipients = recipients.map((r) => {
+        const wrapped = (0, crypto_lib_1.wrapDekHybrid)(dek, String(r.x25519PublicKey), String(r.mlKemPublicKey));
+        return {
+            ...(r.id !== undefined ? { id: String(r.id) } : {}),
+            ephemeralPublicKey: wrapped.ephemeralPublicKey,
+            mlKemCiphertext: wrapped.mlKemCiphertext,
+            wrappedKey: wrapped.wrappedKey,
+            encryptedKey: wrapped.wrappedKey,
+        };
+    });
+    return (0, result_1.jsonResult)({
+        algorithm: "multi-hybrid-kem-768-aes-256-gcm",
+        keyHandle,
+        recipients: encryptedRecipients,
+    });
+};
+exports.hybridKemMultiEncapsulateHandler = hybridKemMultiEncapsulateHandler;
+function resolveDirectRecipient(args) {
+    const encKey = args.wrappedKey ?? args.encryptedKey;
+    if (!args.ephemeralPublicKey || !args.mlKemCiphertext || !encKey) {
+        return undefined;
+    }
+    return {
+        ephemeralPublicKey: String(args.ephemeralPublicKey),
+        mlKemCiphertext: String(args.mlKemCiphertext),
+        wrappedKey: String(encKey),
+    };
+}
+function resolveListRecipient(args) {
+    if (args.recipients === undefined)
+        return undefined;
+    const list = JSON.parse(String(args.recipients));
+    const item = args.recipientId !== undefined
+        ? list.find((e) => e.id === String(args.recipientId))
+        : list[args.recipientIndex !== undefined ? Number(args.recipientIndex) : 0];
+    if (!item)
+        return undefined;
+    const key = item.wrappedKey ?? item.encryptedKey;
+    if (!key)
+        return undefined;
+    return {
+        ephemeralPublicKey: item.ephemeralPublicKey,
+        mlKemCiphertext: item.mlKemCiphertext,
+        wrappedKey: String(key),
+    };
+}
+function resolveRecipientEntry(args) {
+    const resolved = resolveDirectRecipient(args) ?? resolveListRecipient(args);
+    if (!resolved) {
+        throw new Error("Missing recipient encryption details (ephemeralPublicKey, mlKemCiphertext, wrappedKey)");
+    }
+    return resolved;
+}
+const hybridKemMultiDecapsulateHandler = async (args) => {
+    const xKey = keystore_1.keyStore.use(String(args.x25519KeyHandle), ["x25519"]);
+    const kemKey = keystore_1.keyStore.use(String(args.mlKemKeyHandle), ["ml-kem-768"]);
+    const entry = resolveRecipientEntry(args);
+    const dek = (0, crypto_lib_1.unwrapDekHybrid)(xKey.secret, kemKey.secret, entry.ephemeralPublicKey, entry.mlKemCiphertext, entry.wrappedKey);
+    const keyHandle = keystore_1.keyStore.add((0, keystore_1.symmetricKey)(Buffer.from(dek), "multi-recipient hybrid KEM DEK"));
+    return (0, result_1.jsonResult)({
+        algorithm: "multi-hybrid-kem-768-aes-256-gcm",
+        keyHandle,
+    });
+};
+exports.hybridKemMultiDecapsulateHandler = hybridKemMultiDecapsulateHandler;
+//# sourceMappingURL=kem.js.map

package/dist/tools/keyimport.d.ts

@@ -0,0 +1,5 @@
+import fs from "node:fs";
+import { ToolHandler } from "./result";
+export declare function readAtMost(handle: Pick<fs.promises.FileHandle, "read">, max: number): Promise<Buffer>;
+export declare const importKey: ToolHandler;
+//# sourceMappingURL=keyimport.d.ts.map

package/dist/tools/keyimport.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keyimport.d.ts","sourceRoot":"","sources":["../../src/tools/keyimport.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,MAAM,SAAS,CAAC;AAUzB,OAAO,EAAY,WAAW,EAAc,MAAM,UAAU,CAAC;AA4F7D,wBAAsB,UAAU,CAC9B,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,EAC5C,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,CAajB;AAuKD,eAAO,MAAM,SAAS,EAAE,WAUvB,CAAC"}

package/dist/tools/keyimport.js

@@ -0,0 +1,207 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.importKey = void 0;
+exports.readAtMost = readAtMost;
+const node_crypto_1 = __importDefault(require("node:crypto"));
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_path_1 = __importDefault(require("node:path"));
+const definitions_1 = require("./definitions");
+const keys_1 = require("./keys");
+const keystore_1 = require("./keystore");
+const result_1 = require("./result");
+const crypto_lib_1 = require("@sebastienrousseau/crypto-lib");
+const RAW_KEY_BYTES = 32;
+const SOURCE = "crypto_key_import";
+const UNREADABLE = `Key file not found or not readable in ${definitions_1.KEY_DIR_ENV}`;
+const OPEN_FLAGS = node_fs_1.default.constants.O_RDONLY | (node_fs_1.default.constants.O_NOFOLLOW | 0);
+async function keyDirectory() {
+    const dir = process.env[definitions_1.KEY_DIR_ENV];
+    if (!dir) {
+        throw new Error(`Key import is disabled: set ${definitions_1.KEY_DIR_ENV} to the directory holding the key files`);
+    }
+    try {
+        return await node_fs_1.default.promises.realpath(dir);
+    }
+    catch {
+        throw new Error(`${definitions_1.KEY_DIR_ENV} does not exist or cannot be read`);
+    }
+}
+function checkRelative(file) {
+    if (node_path_1.default.isAbsolute(file)) {
+        throw new Error(`path must be relative to ${definitions_1.KEY_DIR_ENV}`);
+    }
+    if (Array.from(file).some((char) => char < " ")) {
+        throw new Error("path must not contain control characters");
+    }
+    if (file.split(/[\\/]/).includes("..")) {
+        throw new Error("path must not contain '..' segments");
+    }
+}
+async function resolveKeyFile(dir, file) {
+    checkRelative(file);
+    const resolved = await fsStep(node_fs_1.default.promises.realpath(node_path_1.default.resolve(dir, file)));
+    if (!resolved.startsWith(dir + node_path_1.default.sep)) {
+        throw new Error(`path resolves outside ${definitions_1.KEY_DIR_ENV}`);
+    }
+    return resolved;
+}
+async function fsStep(operation) {
+    try {
+        return await operation;
+    }
+    catch {
+        throw new Error(UNREADABLE);
+    }
+}
+function checkFile(stats) {
+    if (!stats.isFile())
+        throw new Error("path is not a regular file");
+    if (stats.size > definitions_1.MAX_KEY_FILE_BYTES) {
+        throw new Error(`Key file is larger than ${definitions_1.MAX_KEY_FILE_BYTES} bytes`);
+    }
+}
+async function readAtMost(handle, max) {
+    const buf = Buffer.alloc(max + 1);
+    let length = 0;
+    for (;;) {
+        const { bytesRead } = await handle.read(buf, length, buf.length - length);
+        if (bytesRead === 0)
+            break;
+        length += bytesRead;
+        if (length > max) {
+            buf.fill(0);
+            throw new Error(`Key file is larger than ${max} bytes`);
+        }
+    }
+    return buf.subarray(0, length);
+}
+async function readKeyFile(file) {
+    checkFile(await fsStep(node_fs_1.default.promises.stat(file)));
+    const handle = await fsStep(node_fs_1.default.promises.open(file, OPEN_FLAGS));
+    try {
+        checkFile(await fsStep(handle.stat()));
+        return await readAtMost(handle, definitions_1.MAX_KEY_FILE_BYTES);
+    }
+    finally {
+        await handle.close();
+    }
+}
+function hexDigit(byte) {
+    if (byte >= 0x30 && byte <= 0x39)
+        return byte - 0x30;
+    const lower = byte | 0x20;
+    if (lower >= 0x61 && lower <= 0x66)
+        return lower - 0x57;
+    return -1;
+}
+function decodeHex(text) {
+    const out = Buffer.alloc(text.length / 2);
+    for (let i = 0; i < out.length; i++) {
+        const high = hexDigit(text[2 * i]);
+        const low = hexDigit(text[2 * i + 1]);
+        if (high < 0 || low < 0) {
+            (0, crypto_lib_1.wipeMemory)(out);
+            return undefined;
+        }
+        out[i] = high * 16 + low;
+    }
+    return out;
+}
+function trimEnd(bytes) {
+    let end = bytes.length;
+    while (end > 0 && " \t\r\n".includes(String.fromCharCode(bytes[end - 1]))) {
+        end--;
+    }
+    return bytes.subarray(0, end);
+}
+function rawSecret(bytes) {
+    if (bytes.length === RAW_KEY_BYTES)
+        return Buffer.from(bytes);
+    const text = trimEnd(bytes);
+    const secret = text.length === 2 * RAW_KEY_BYTES ? decodeHex(text) : undefined;
+    if (!secret) {
+        throw new Error("Unrecognised key file: expected a PKCS#8 PEM private key, 32 raw bytes, or 64 hex digits");
+    }
+    return secret;
+}
+function rawKey(bytes, kind) {
+    const secret = rawSecret(bytes);
+    if (kind === "hmac-sha256") {
+        return {
+            kind: "hmac-sha256",
+            secret,
+            info: { bits: 256, source: SOURCE, usage: "crypto_sign, crypto_verify" },
+        };
+    }
+    return (0, keystore_1.symmetricKey)(secret, SOURCE);
+}
+function privateKeyKind(key) {
+    const details = key.asymmetricKeyDetails;
+    switch (key.asymmetricKeyType) {
+        case "ed25519":
+            return { kind: "ed25519", info: {} };
+        case "rsa":
+            if (!definitions_1.RSA_MODULUS_LENGTHS.includes(Number(details.modulusLength))) {
+                throw new Error(`Unsupported RSA modulus length (allowed: ${definitions_1.RSA_MODULUS_LENGTHS.join(", ")})`);
+            }
+            return { kind: "rsa", info: { bits: details.modulusLength } };
+        case "ec":
+            if (!definitions_1.EC_CURVES.includes(String(details.namedCurve))) {
+                throw new Error(`Unsupported EC curve (allowed: ${definitions_1.EC_CURVES.join(", ")})`);
+            }
+            return { kind: "ecc", info: { curve: details.namedCurve } };
+        default:
+            throw new Error(`Unsupported private key type: ${key.asymmetricKeyType} (allowed: ed25519, rsa, ec)`);
+    }
+}
+function parsePrivateKey(bytes) {
+    try {
+        return node_crypto_1.default.createPrivateKey({ key: bytes, format: "pem" });
+    }
+    catch {
+        throw new Error("Key file is not a valid PKCS#8 PEM private key");
+    }
+}
+function pkcs8Key(bytes) {
+    const privateKey = parsePrivateKey(bytes);
+    const { kind, info } = privateKeyKind(privateKey);
+    const publicKey = node_crypto_1.default.createPublicKey(privateKey);
+    return (0, keys_1.asymmetric)(kind, { privateKey, publicKey }, { ...info, source: SOURCE });
+}
+function pemKey(bytes, kind) {
+    if (kind !== undefined) {
+        throw new Error("kind applies only to raw keys; a PEM key's type comes from the key");
+    }
+    if (bytes.includes("-----BEGIN ENCRYPTED PRIVATE KEY-----")) {
+        throw new Error("Encrypted PKCS#8 keys are not supported: decrypt the key file first (openssl pkcs8 -nocrypt)");
+    }
+    if (bytes.includes("-----BEGIN PRIVATE KEY-----"))
+        return pkcs8Key(bytes);
+    if (bytes.includes("PUBLIC KEY-----")) {
+        throw new Error("Public keys are not imported: pass the PEM to crypto_verify as publicKey instead");
+    }
+    throw new Error("Unsupported PEM block: only unencrypted PKCS#8 private keys ('BEGIN PRIVATE KEY') are imported");
+}
+function parseKey(bytes, kind) {
+    if (bytes.length !== RAW_KEY_BYTES && bytes.includes("-----BEGIN ")) {
+        return pemKey(bytes, kind);
+    }
+    return rawKey(bytes, kind);
+}
+const importKey = async (args) => {
+    const dir = await keyDirectory();
+    const file = await resolveKeyFile(dir, String(args.path));
+    const bytes = await readKeyFile(file);
+    try {
+        const material = parseKey(bytes, args.kind);
+        return (0, result_1.jsonResult)(keystore_1.keyStore.describe(keystore_1.keyStore.add(material)));
+    }
+    finally {
+        (0, crypto_lib_1.wipeMemory)(bytes);
+    }
+};
+exports.importKey = importKey;
+//# sourceMappingURL=keyimport.js.map

package/dist/tools/keys.d.ts

@@ -1,4 +1,13 @@
+import crypto from "node:crypto";
+import { KeyMaterial } from "./keystore";
 import { ToolHandler } from "./result";
+export declare function publicPem(key: crypto.KeyObject): string;
+export declare function asymmetric(kind: KeyMaterial["kind"], pair: {
+    privateKey: crypto.KeyObject;
+    publicKey: crypto.KeyObject;
+}, info: Record<string, unknown>): KeyMaterial;
 export declare const generateKey: ToolHandler;
+export declare const listKeys: ToolHandler;
+export declare const destroyKey: ToolHandler;
 export declare const inspectKey: ToolHandler;
 //# sourceMappingURL=keys.d.ts.map

package/dist/tools/keys.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"keys.d.ts","sourceRoot":"","sources":["../../src/tools/keys.ts"],"names":[],"mappings":"AAKA,OAAO,EAAY,WAAW,EAA2B,MAAM,UAAU,CAAC;AA2E1E,eAAO,MAAM,WAAW,EAAE,WAOzB,CAAC;AAmBF,eAAO,MAAM,UAAU,EAAE,WAaxB,CAAC"}
+{"version":3,"file":"keys.d.ts","sourceRoot":"","sources":["../../src/tools/keys.ts"],"names":[],"mappings":"AAEA,OAAO,MAAM,MAAM,aAAa,CAAC;AAOjC,OAAO,EAAE,WAAW,EAA0B,MAAM,YAAY,CAAC;AACjE,OAAO,EAAY,WAAW,EAA2B,MAAM,UAAU,CAAC;AAG1E,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,SAAS,GAAG,MAAM,CAEvD;AAGD,wBAAgB,UAAU,CACxB,IAAI,EAAE,WAAW,CAAC,MAAM,CAAC,EACzB,IAAI,EAAE;IAAE,UAAU,EAAE,MAAM,CAAC,SAAS,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC,SAAS,CAAA;CAAE,EACnE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,WAAW,CAOb;AA2GD,eAAO,MAAM,WAAW,EAAE,WAOzB,CAAC;AAGF,eAAO,MAAM,QAAQ,EAAE,WAC6C,CAAC;AAGrE,eAAO,MAAM,UAAU,EAAE,WAMxB,CAAC;AAmBF,eAAO,MAAM,UAAU,EAAE,WAaxB,CAAC"}

package/dist/tools/keys.js

@@ -3,81 +3,131 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.inspectKey = exports.generateKey = void 0;
+exports.inspectKey = exports.destroyKey = exports.listKeys = exports.generateKey = void 0;
+exports.publicPem = publicPem;
+exports.asymmetric = asymmetric;
 const node_crypto_1 = __importDefault(require("node:crypto"));
 const crypto_lib_1 = require("@sebastienrousseau/crypto-lib");
 const definitions_1 = require("./definitions");
+const keystore_1 = require("./keystore");
 const result_1 = require("./result");
-const PEM = {
-    publicKeyEncoding: { type: "spki", format: "pem" },
-    privateKeyEncoding: { type: "pkcs8", format: "pem" },
-};
+function publicPem(key) {
+    return key.export({ type: "spki", format: "pem" });
+}
+function asymmetric(kind, pair, info) {
+    return {
+        kind,
+        privateKey: pair.privateKey,
+        publicKey: pair.publicKey,
+        info: { ...info, quantumSafe: false, publicKey: publicPem(pair.publicKey) },
+    };
+}
 function generateEd25519() {
-    const { publicKey, privateKey } = node_crypto_1.default.generateKeyPairSync("ed25519", PEM);
-    return { type: "ed25519", quantumSafe: false, publicKey, privateKey };
+    return asymmetric("ed25519", node_crypto_1.default.generateKeyPairSync("ed25519"), {});
 }
 function generateRsa(args) {
-    const modulusLength = Number(args.modulusLength) || 2048;
+    const modulusLength = Number(args.modulusLength ?? 2048);
     if (!definitions_1.RSA_MODULUS_LENGTHS.includes(modulusLength)) {
         throw new Error(`Unsupported RSA modulus length: ${modulusLength} (allowed: ${definitions_1.RSA_MODULUS_LENGTHS.join(", ")})`);
     }
-    const { publicKey, privateKey } = node_crypto_1.default.generateKeyPairSync("rsa", {
-        modulusLength,
-        ...PEM,
-    });
-    return {
-        type: "rsa",
-        bits: modulusLength,
-        quantumSafe: false,
-        publicKey,
-        privateKey,
-    };
+    const pair = node_crypto_1.default.generateKeyPairSync("rsa", { modulusLength });
+    return asymmetric("rsa", pair, { bits: modulusLength });
 }
 function generateEcc(args) {
-    const namedCurve = args.curve || "prime256v1";
+    const namedCurve = String(args.curve ?? "prime256v1");
     if (!definitions_1.EC_CURVES.includes(namedCurve)) {
         throw new Error(`Unsupported curve: ${namedCurve} (allowed: ${definitions_1.EC_CURVES.join(", ")})`);
     }
-    const { publicKey, privateKey } = node_crypto_1.default.generateKeyPairSync("ec", {
-        namedCurve,
-        ...PEM,
-    });
+    const pair = node_crypto_1.default.generateKeyPairSync("ec", { namedCurve });
+    return asymmetric("ecc", pair, { curve: namedCurve });
+}
+function generateMlKem(level) {
+    const { publicKey, secretKey } = (0, crypto_lib_1.mlKemKeygen)(level);
+    const securityCategory = level === 512 ? 1 : level === 768 ? 3 : 5;
     return {
-        type: "ecc",
-        curve: namedCurve,
-        quantumSafe: false,
-        publicKey,
-        privateKey,
+        kind: `ml-kem-${level}`,
+        secret: Buffer.from(secretKey, "hex"),
+        info: {
+            standard: "NIST FIPS 203",
+            securityCategory,
+            quantumSafe: true,
+            encoding: "hex",
+            publicKey,
+        },
     };
 }
-function generateMlKem768() {
-    const { publicKey, secretKey } = (0, crypto_lib_1.mlKemKeygen)(768);
+function generateMlDsa(level) {
+    const { publicKey, secretKey } = (0, crypto_lib_1.mlDsaKeygen)(level);
+    const securityCategory = level === 44 ? 2 : level === 65 ? 3 : 5;
     return {
-        type: "ml-kem-768",
-        standard: "NIST FIPS 203",
-        securityCategory: 3,
-        quantumSafe: true,
-        encoding: "hex",
-        publicKey,
-        privateKey: secretKey,
+        kind: `ml-dsa-${level}`,
+        secret: Buffer.from(secretKey, "hex"),
+        info: {
+            standard: "NIST FIPS 204",
+            securityCategory,
+            quantumSafe: true,
+            encoding: "hex",
+            publicKey,
+        },
+    };
+}
+function generateSymmetric() {
+    return (0, keystore_1.symmetricKey)(node_crypto_1.default.randomBytes(32), "generated");
+}
+function generateX25519() {
+    const pair = (0, crypto_lib_1.generateX25519KeyPair)();
+    return {
+        kind: "x25519",
+        secret: Buffer.from(pair.privateKey, "hex"),
+        info: {
+            curve: "x25519",
+            quantumSafe: false,
+            encoding: "hex",
+            publicKey: pair.publicKey,
+        },
+    };
+}
+function generateHmac() {
+    return {
+        kind: "hmac-sha256",
+        secret: node_crypto_1.default.randomBytes(32),
+        info: { bits: 256, usage: "crypto_sign, crypto_verify" },
     };
 }
 const GENERATORS = {
     ed25519: generateEd25519,
+    x25519: generateX25519,
     rsa: generateRsa,
     ecc: generateEcc,
-    "ml-kem-768": generateMlKem768,
+    "ml-kem-512": () => generateMlKem(512),
+    "ml-kem-768": () => generateMlKem(768),
+    "ml-kem-1024": () => generateMlKem(1024),
+    "ml-dsa-44": () => generateMlDsa(44),
+    "ml-dsa-65": () => generateMlDsa(65),
+    "ml-dsa-87": () => generateMlDsa(87),
+    "symmetric-256": generateSymmetric,
+    "hmac-sha256": generateHmac,
 };
 const generateKey = async (args) => {
-    const type = args.type || "ed25519";
+    const type = String(args.type);
     const generator = Object.hasOwn(GENERATORS, type)
         ? GENERATORS[type]
         : undefined;
     if (!generator)
         return (0, result_1.errorResult)(`Unsupported key type: ${type}`);
-    return (0, result_1.jsonResult)(generator(args));
+    return (0, result_1.jsonResult)(keystore_1.keyStore.describe(keystore_1.keyStore.add(generator(args))));
 };
 exports.generateKey = generateKey;
+const listKeys = async () => (0, result_1.jsonResult)({ keys: keystore_1.keyStore.list(), capacity: keystore_1.keyStore.capacity });
+exports.listKeys = listKeys;
+const destroyKey = async (args) => {
+    const keyHandle = String(args.keyHandle);
+    if (!keystore_1.keyStore.remove(keyHandle)) {
+        return (0, result_1.errorResult)("Unknown key handle: nothing was destroyed");
+    }
+    return (0, result_1.jsonResult)({ keyHandle, destroyed: true });
+};
+exports.destroyKey = destroyKey;
 function classifyKey(keyData) {
     if (keyData.includes("-----BEGIN PGP"))
         return "OpenPGP Key Block";
@@ -97,7 +147,7 @@ function keyFormat(keyData) {
     return keyData.includes("-----BEGIN") ? "PEM" : "Raw";
 }
 const inspectKey = async (args) => {
-    const keyData = args.keyData ? String(args.keyData).trim() : "";
+    const keyData = String(args.keyData).trim();
     const fingerprint = node_crypto_1.default
         .createHash("sha256")
         .update(keyData)

package/dist/tools/keystore.d.ts

@@ -0,0 +1,25 @@
+import crypto from "node:crypto";
+export type KeyKind = "ed25519" | "rsa" | "ecc" | "x25519" | "ml-kem-512" | "ml-kem-768" | "ml-kem-1024" | "ml-dsa-44" | "ml-dsa-65" | "ml-dsa-87" | "symmetric-256" | "hmac-sha256";
+export interface KeyMaterial {
+    kind: KeyKind;
+    info: Record<string, unknown>;
+    privateKey?: crypto.KeyObject;
+    publicKey?: crypto.KeyObject;
+    secret?: Buffer;
+}
+export declare const MAX_KEYS = 64;
+export declare const KEY_HANDLE_PATTERN = "^kh_[0-9a-f]{32}$";
+export declare function symmetricKey(secret: Buffer, source: string): KeyMaterial;
+export declare class KeyStore {
+    readonly capacity: number;
+    private readonly keys;
+    constructor(capacity?: number);
+    get size(): number;
+    add(material: KeyMaterial): string;
+    use(handle: string, kinds: readonly KeyKind[]): KeyMaterial;
+    describe(handle: string): Record<string, unknown>;
+    list(): Array<Record<string, unknown>>;
+    remove(handle: string): boolean;
+}
+export declare const keyStore: KeyStore;
+//# sourceMappingURL=keystore.d.ts.map

package/dist/tools/keystore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keystore.d.ts","sourceRoot":"","sources":["../../src/tools/keystore.ts"],"names":[],"mappings":"AAEA,OAAO,MAAM,MAAM,aAAa,CAAC;AAajC,MAAM,MAAM,OAAO,GACf,SAAS,GACT,KAAK,GACL,KAAK,GACL,QAAQ,GACR,YAAY,GACZ,YAAY,GACZ,aAAa,GACb,WAAW,GACX,WAAW,GACX,WAAW,GACX,eAAe,GACf,aAAa,CAAC;AAGlB,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,OAAO,CAAC;IAEd,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAE9B,UAAU,CAAC,EAAE,MAAM,CAAC,SAAS,CAAC;IAE9B,SAAS,CAAC,EAAE,MAAM,CAAC,SAAS,CAAC;IAE7B,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAOD,eAAO,MAAM,QAAQ,KAAK,CAAC;AAG3B,eAAO,MAAM,kBAAkB,sBAAsB,CAAC;AAMtD,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,WAAW,CAUxE;AAUD,qBAAa,QAAQ;aAIgB,QAAQ,EAAE,MAAM;IAHnD,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAgC;gBAGlB,QAAQ,GAAE,MAAiB;IAG9D,IAAW,IAAI,IAAI,MAAM,CAExB;IAGM,GAAG,CAAC,QAAQ,EAAE,WAAW,GAAG,MAAM;IAiBlC,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,OAAO,EAAE,GAAG,WAAW;IAkB3D,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAWjD,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAKtC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO;CAOvC;AAGD,eAAO,MAAM,QAAQ,UAAiB,CAAC"}