@sebastienrousseau/crypto-mcp 0.0.8 → 0.0.24

package/dist/tools/keystore.js

@@ -0,0 +1,84 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.keyStore = exports.KeyStore = exports.KEY_HANDLE_PATTERN = exports.MAX_KEYS = void 0;
+exports.symmetricKey = symmetricKey;
+const node_crypto_1 = __importDefault(require("node:crypto"));
+const crypto_lib_1 = require("@sebastienrousseau/crypto-lib");
+exports.MAX_KEYS = 64;
+exports.KEY_HANDLE_PATTERN = "^kh_[0-9a-f]{32}$";
+function symmetricKey(secret, source) {
+    return {
+        kind: "symmetric-256",
+        secret,
+        info: {
+            bits: 256,
+            source,
+            usage: "crypto_encrypt, crypto_decrypt, crypto_kms_wrap",
+        },
+    };
+}
+function wipe(key) {
+    if (key.secret) {
+        (0, crypto_lib_1.wipeMemory)(key.secret);
+    }
+}
+class KeyStore {
+    capacity;
+    keys = new Map();
+    constructor(capacity = exports.MAX_KEYS) {
+        this.capacity = capacity;
+    }
+    get size() {
+        return this.keys.size;
+    }
+    add(material) {
+        const handle = `kh_${node_crypto_1.default.randomBytes(16).toString("hex")}`;
+        this.keys.set(handle, {
+            ...material,
+            createdAt: new Date().toISOString(),
+        });
+        while (this.keys.size > this.capacity) {
+            const oldest = this.keys.keys().next().value;
+            this.remove(oldest);
+        }
+        return handle;
+    }
+    use(handle, kinds) {
+        const key = this.keys.get(handle);
+        if (!key) {
+            throw new Error("Unknown key handle: it was never issued, or the key was destroyed or evicted");
+        }
+        if (!kinds.includes(key.kind)) {
+            throw new Error(`Key handle refers to a ${key.kind} key; this tool needs ${kinds.join(" or ")}`);
+        }
+        this.keys.delete(handle);
+        this.keys.set(handle, key);
+        return key;
+    }
+    describe(handle) {
+        const key = this.keys.get(handle);
+        return {
+            keyHandle: handle,
+            type: key.kind,
+            createdAt: key.createdAt,
+            ...key.info,
+        };
+    }
+    list() {
+        return [...this.keys.keys()].map((handle) => this.describe(handle));
+    }
+    remove(handle) {
+        const key = this.keys.get(handle);
+        if (!key)
+            return false;
+        wipe(key);
+        this.keys.delete(handle);
+        return true;
+    }
+}
+exports.KeyStore = KeyStore;
+exports.keyStore = new KeyStore();
+//# sourceMappingURL=keystore.js.map

package/dist/tools/kms.d.ts

@@ -1,4 +1,5 @@
 import { ToolHandler } from "./result";
+export declare const MAX_KEK_LABELS = 64;
 export declare const kmsWrap: ToolHandler;
 export declare const kmsUnwrap: ToolHandler;
 //# sourceMappingURL=kms.d.ts.map

package/dist/tools/kms.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"kms.d.ts","sourceRoot":"","sources":["../../src/tools/kms.ts"],"names":[],"mappings":"AAGA,OAAO,EAAY,WAAW,EAA2B,MAAM,UAAU,CAAC;AA4C1E,eAAO,MAAM,OAAO,EAAE,WAerB,CAAC;AAGF,eAAO,MAAM,SAAS,EAAE,WAkBvB,CAAC"}
+{"version":3,"file":"kms.d.ts","sourceRoot":"","sources":["../../src/tools/kms.ts"],"names":[],"mappings":"AAKA,OAAO,EAAY,WAAW,EAAc,MAAM,UAAU,CAAC;AAe7D,eAAO,MAAM,cAAc,KAAK,CAAC;AA2CjC,eAAO,MAAM,OAAO,EAAE,WAmBrB,CAAC;AAMF,eAAO,MAAM,SAAS,EAAE,WAgBvB,CAAC"}

package/dist/tools/kms.js

@@ -1,16 +1,20 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.kmsUnwrap = exports.kmsWrap = void 0;
+exports.kmsUnwrap = exports.kmsWrap = exports.MAX_KEK_LABELS = void 0;
 const crypto_kms_1 = require("@sebastienrousseau/crypto-kms");
+const crypto_lib_1 = require("@sebastienrousseau/crypto-lib");
+const keystore_1 = require("./keystore");
 const result_1 = require("./result");
+const symmetric_1 = require("./symmetric");
 const localKms = new crypto_kms_1.LocalKmsProvider();
 const localKeyIds = new Map();
+exports.MAX_KEK_LABELS = 64;
 function kmsRequest(args) {
-    const provider = String(args.provider || "local");
+    const provider = String(args.provider);
     if (provider !== "local") {
         throw new Error(`KMS provider '${provider}' is not configured in this server; only 'local' is available`);
     }
-    return { provider, keyId: String(args.keyId || "kms-key-default") };
+    return { provider, keyId: String(args.keyId) };
 }
 function wrapContext(keyId) {
     return { purpose: "crypto-mcp-dek-wrap", keyId };
@@ -19,6 +23,9 @@ async function localKeyFor(label) {
     const existing = localKeyIds.get(label);
     if (existing)
         return existing;
+    if (localKeyIds.size >= exports.MAX_KEK_LABELS) {
+        throw new Error(`At most ${exports.MAX_KEK_LABELS} KEK labels can be created; reuse an existing keyId`);
+    }
     const created = await localKms.createKey("aes-256-gcm", "wrap", {
         label,
     });
@@ -27,15 +34,20 @@ async function localKeyFor(label) {
 }
 const kmsWrap = async (args) => {
     const { provider, keyId } = kmsRequest(args);
-    const dek = (0, result_1.parseKey256)(args.dek, "dek");
-    const kmsKeyId = await localKeyFor(keyId);
-    const { ciphertext } = await localKms.encrypt(kmsKeyId, dek, wrapContext(keyId));
-    return (0, result_1.jsonResult)({
-        provider,
-        keyId,
-        status: "wrapped",
-        wrappedKey: Buffer.from(ciphertext, "base64").toString("hex"),
-    });
+    const dek = Buffer.from((0, symmetric_1.symmetricSecret)(args.keyHandle));
+    try {
+        const kmsKeyId = await localKeyFor(keyId);
+        const { ciphertext } = await localKms.encrypt(kmsKeyId, dek, wrapContext(keyId));
+        return (0, result_1.jsonResult)({
+            provider,
+            keyId,
+            status: "wrapped",
+            wrappedKey: Buffer.from(ciphertext, "base64").toString("hex"),
+        });
+    }
+    finally {
+        (0, crypto_lib_1.wipeMemory)(dek);
+    }
 };
 exports.kmsWrap = kmsWrap;
 const kmsUnwrap = async (args) => {
@@ -46,12 +58,10 @@ const kmsUnwrap = async (args) => {
     }
     const wrapped = Buffer.from(String(args.wrappedKey), "hex");
     const { plaintext } = await localKms.decrypt(kmsKeyId, wrapped.toString("base64"), wrapContext(keyId));
-    return (0, result_1.jsonResult)({
-        provider,
-        keyId,
-        status: "unwrapped",
-        dek: Buffer.from(plaintext).toString("hex"),
-    });
+    const dek = Buffer.from(plaintext);
+    (0, crypto_lib_1.wipeMemory)(plaintext);
+    const keyHandle = keystore_1.keyStore.add((0, keystore_1.symmetricKey)(dek, "crypto_kms_unwrap"));
+    return (0, result_1.jsonResult)({ provider, keyId, status: "unwrapped", keyHandle });
 };
 exports.kmsUnwrap = kmsUnwrap;
 //# sourceMappingURL=kms.js.map

package/dist/tools/result.d.ts

@@ -3,5 +3,4 @@ export type ToolArgs = Record<string, unknown>;
 export type ToolHandler = (args: ToolArgs) => Promise<MCPCallToolResult>;
 export declare function jsonResult(value: unknown): MCPCallToolResult;
 export declare function errorResult(text: string): MCPCallToolResult;
-export declare function parseKey256(value: unknown, label?: string): Buffer;
 //# sourceMappingURL=result.d.ts.map

package/dist/tools/result.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"result.d.ts","sourceRoot":"","sources":["../../src/tools/result.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAG7C,MAAM,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAG/C,MAAM,MAAM,WAAW,GAAG,CAAC,IAAI,EAAE,QAAQ,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAC;AAGzE,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,iBAAiB,CAI5D;AAGD,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,iBAAiB,CAE3D;AAOD,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,SAAQ,GAAG,MAAM,CAQjE"}
+{"version":3,"file":"result.d.ts","sourceRoot":"","sources":["../../src/tools/result.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAG7C,MAAM,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAG/C,MAAM,MAAM,WAAW,GAAG,CAAC,IAAI,EAAE,QAAQ,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAC;AAGzE,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,iBAAiB,CAI5D;AAGD,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,iBAAiB,CAE3D"}

package/dist/tools/result.js

@@ -2,7 +2,6 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.jsonResult = jsonResult;
 exports.errorResult = errorResult;
-exports.parseKey256 = parseKey256;
 function jsonResult(value) {
     return {
         content: [{ type: "text", text: JSON.stringify(value, null, 2) }],
@@ -11,11 +10,4 @@ function jsonResult(value) {
 function errorResult(text) {
     return { isError: true, content: [{ type: "text", text }] };
 }
-function parseKey256(value, label = "key") {
-    const hex = String(value ?? "");
-    if (!/^[0-9a-fA-F]{64}$/.test(hex)) {
-        throw new Error(`${label} must be a 256-bit key encoded as 64 hex characters`);
-    }
-    return Buffer.from(hex, "hex");
-}
 //# sourceMappingURL=result.js.map

package/dist/tools/schema-helpers.d.ts

@@ -0,0 +1,12 @@
+import { MCPToolParameterProperty } from "../types";
+export declare const MAX_TEXT_LENGTH = 1048576;
+export declare const MAX_KEY_LENGTH = 16384;
+export declare const HEX_BYTES = "^(?:[0-9a-fA-F]{2})*$";
+export declare const X25519_PUBLIC_KEY_HEX = 64;
+export declare const ML_KEM_768_PUBLIC_KEY_HEX = 2368;
+export declare const HANDLE_NOTE = "Secret key material stays inside the server; only an opaque keyHandle is returned.";
+export declare function keyHandle(description: string): MCPToolParameterProperty;
+export declare function text(description: string): MCPToolParameterProperty;
+export declare function hex(description: string, length: number, upTo?: boolean): MCPToolParameterProperty;
+export declare function oneOf(description: string, values: string[]): MCPToolParameterProperty;
+//# sourceMappingURL=schema-helpers.d.ts.map

package/dist/tools/schema-helpers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema-helpers.d.ts","sourceRoot":"","sources":["../../src/tools/schema-helpers.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,wBAAwB,EAAE,MAAM,UAAU,CAAC;AAIpD,eAAO,MAAM,eAAe,UAAY,CAAC;AAGzC,eAAO,MAAM,cAAc,QAAS,CAAC;AAGrC,eAAO,MAAM,SAAS,0BAA0B,CAAC;AAGjD,eAAO,MAAM,qBAAqB,KAAK,CAAC;AAGxC,eAAO,MAAM,yBAAyB,OAAO,CAAC;AAG9C,eAAO,MAAM,WAAW,uFAC8D,CAAC;AAGvF,wBAAgB,SAAS,CAAC,WAAW,EAAE,MAAM,GAAG,wBAAwB,CAOvE;AAGD,wBAAgB,IAAI,CAAC,WAAW,EAAE,MAAM,GAAG,wBAAwB,CAElE;AAGD,wBAAgB,GAAG,CACjB,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,EACd,IAAI,UAAQ,GACX,wBAAwB,CAQ1B;AAGD,wBAAgB,KAAK,CACnB,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,EAAE,GACf,wBAAwB,CAE1B"}

package/dist/tools/schema-helpers.js

@@ -0,0 +1,38 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HANDLE_NOTE = exports.ML_KEM_768_PUBLIC_KEY_HEX = exports.X25519_PUBLIC_KEY_HEX = exports.HEX_BYTES = exports.MAX_KEY_LENGTH = exports.MAX_TEXT_LENGTH = void 0;
+exports.keyHandle = keyHandle;
+exports.text = text;
+exports.hex = hex;
+exports.oneOf = oneOf;
+const keystore_1 = require("./keystore");
+exports.MAX_TEXT_LENGTH = 1_048_576;
+exports.MAX_KEY_LENGTH = 16_384;
+exports.HEX_BYTES = "^(?:[0-9a-fA-F]{2})*$";
+exports.X25519_PUBLIC_KEY_HEX = 64;
+exports.ML_KEM_768_PUBLIC_KEY_HEX = 2368;
+exports.HANDLE_NOTE = "Secret key material stays inside the server; only an opaque keyHandle is returned.";
+function keyHandle(description) {
+    return {
+        type: "string",
+        description: `${description} Key handles look like 'kh_' followed by 32 hex characters.`,
+        maxLength: 35,
+        pattern: keystore_1.KEY_HANDLE_PATTERN,
+    };
+}
+function text(description) {
+    return { type: "string", description, maxLength: exports.MAX_TEXT_LENGTH };
+}
+function hex(description, length, upTo = false) {
+    return {
+        type: "string",
+        description,
+        minLength: upTo ? 2 : length,
+        maxLength: length,
+        pattern: exports.HEX_BYTES,
+    };
+}
+function oneOf(description, values) {
+    return { type: "string", description, enum: values };
+}
+//# sourceMappingURL=schema-helpers.js.map

package/dist/tools/signing.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"signing.d.ts","sourceRoot":"","sources":["../../src/tools/signing.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,WAAW,EAAc,MAAM,UAAU,CAAC;AAGnD,eAAO,MAAM,IAAI,EAAE,WAwBlB,CAAC;AAiCF,eAAO,MAAM,MAAM,EAAE,WASpB,CAAC;AAGF,eAAO,MAAM,IAAI,EAAE,WAUlB,CAAC"}
+{"version":3,"file":"signing.d.ts","sourceRoot":"","sources":["../../src/tools/signing.ts"],"names":[],"mappings":"AAUA,OAAO,EAAY,WAAW,EAAc,MAAM,UAAU,CAAC;AA6D7D,eAAO,MAAM,IAAI,EAAE,WAmBlB,CAAC;AAmFF,eAAO,MAAM,MAAM,EAAE,WAsBpB,CAAC;AAGF,eAAO,MAAM,IAAI,EAAE,WAUlB,CAAC"}

package/dist/tools/signing.js

@@ -5,51 +5,137 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.hash = exports.verify = exports.sign = void 0;
 const node_crypto_1 = __importDefault(require("node:crypto"));
+const crypto_lib_1 = require("@sebastienrousseau/crypto-lib");
 const definitions_1 = require("./definitions");
+const keystore_1 = require("./keystore");
 const result_1 = require("./result");
+const SIGNING_KINDS = [
+    "ed25519",
+    "rsa",
+    "ecc",
+    "ml-dsa-44",
+    "ml-dsa-65",
+    "ml-dsa-87",
+    "hmac-sha256",
+];
+function ecdsaScheme(key) {
+    const curve = String(key.asymmetricKeyDetails?.namedCurve);
+    if (!definitions_1.EC_CURVES.includes(curve)) {
+        throw new Error(`Unsupported EC curve: ${curve}`);
+    }
+    const digest = curve === "secp384r1" ? "sha384" : "sha256";
+    return { algorithm: `ecdsa-${digest}`, digest, pss: false };
+}
+function schemeFor(key) {
+    switch (key.asymmetricKeyType) {
+        case "ed25519":
+            return { algorithm: "ed25519", digest: null, pss: false };
+        case "rsa":
+            return { algorithm: "rsa-pss", digest: "sha256", pss: true };
+        case "ec":
+            return ecdsaScheme(key);
+        default:
+            throw new Error(`Unsupported key type: ${key.asymmetricKeyType}`);
+    }
+}
+function keyInput(key, scheme) {
+    if (!scheme.pss)
+        return key;
+    return {
+        key,
+        padding: node_crypto_1.default.constants.RSA_PKCS1_PSS_PADDING,
+        saltLength: node_crypto_1.default.constants.RSA_PSS_SALTLEN_DIGEST,
+    };
+}
+function hmac(secret, data) {
+    return node_crypto_1.default.createHmac("sha256", secret).update(data).digest();
+}
 const sign = async (args) => {
-    const data = String(args.data);
-    const algorithm = args.algorithm || "ed25519";
-    const privateKey = String(args.privateKey);
-    if (algorithm === "hmac-sha256") {
-        const signature = node_crypto_1.default
-            .createHmac("sha256", privateKey)
-            .update(data)
-            .digest("hex");
+    const key = keystore_1.keyStore.use(String(args.keyHandle), SIGNING_KINDS);
+    const data = Buffer.from(String(args.data), "utf8");
+    if (key.kind === "hmac-sha256") {
+        const signature = hmac(key.secret, data).toString("hex");
         return (0, result_1.jsonResult)({ algorithm: "hmac-sha256", signature });
     }
-    if (algorithm === "ed25519") {
-        const signature = node_crypto_1.default
-            .sign(null, Buffer.from(data), privateKey)
-            .toString("hex");
+    if (key.kind.startsWith("ml-dsa-")) {
+        const level = Number(key.kind.slice(7));
+        const secretKeyHex = key.secret.toString("hex");
+        const { signature, algorithm } = (0, crypto_lib_1.mlDsaSign)(level, secretKeyHex, data);
         return (0, result_1.jsonResult)({ algorithm, signature });
     }
-    const signer = node_crypto_1.default.createSign("SHA256");
-    signer.update(data);
-    signer.end();
-    return (0, result_1.jsonResult)({ algorithm, signature: signer.sign(privateKey, "hex") });
+    const privateKey = key.privateKey;
+    const scheme = schemeFor(privateKey);
+    const signature = node_crypto_1.default
+        .sign(scheme.digest, data, keyInput(privateKey, scheme))
+        .toString("hex");
+    return (0, result_1.jsonResult)({ algorithm: scheme.algorithm, signature });
 };
 exports.sign = sign;
-function verifySignature(algorithm, data, signature, publicKey) {
-    if (algorithm === "hmac-sha256") {
-        const expected = node_crypto_1.default
-            .createHmac("sha256", publicKey)
-            .update(data)
-            .digest("hex");
-        return node_crypto_1.default.timingSafeEqual(Buffer.from(signature, "hex"), Buffer.from(expected, "hex"));
+function verifyAsymmetric(publicKey, data, signature) {
+    const scheme = schemeFor(publicKey);
+    const valid = node_crypto_1.default.verify(scheme.digest, data, keyInput(publicKey, scheme), signature);
+    return { algorithm: scheme.algorithm, valid };
+}
+function verifyHmac(secret, data, signature) {
+    const expected = hmac(secret, data);
+    const valid = signature.length === expected.length &&
+        node_crypto_1.default.timingSafeEqual(signature, expected);
+    return { algorithm: "hmac-sha256", valid };
+}
+const ML_DSA_LEVELS_BY_LEN = {
+    2624: 44,
+    3904: 65,
+    5184: 87,
+};
+function verifierFromPublic(raw) {
+    const pub = raw.trim();
+    if (pub.includes("PRIVATE KEY")) {
+        throw new Error("publicKey must be a public key, not a private key");
+    }
+    const mlDsaLevel = /^[0-9a-fA-F]+$/.test(pub)
+        ? ML_DSA_LEVELS_BY_LEN[pub.length]
+        : undefined;
+    if (mlDsaLevel) {
+        return { kind: "ml-dsa", level: mlDsaLevel, publicKeyHex: pub };
+    }
+    return { kind: "asymmetric", publicKey: node_crypto_1.default.createPublicKey(pub) };
+}
+function verifierFromKey(handle) {
+    const key = keystore_1.keyStore.use(handle, SIGNING_KINDS);
+    if (key.kind === "hmac-sha256") {
+        return { kind: "hmac", secret: key.secret };
+    }
+    if (key.kind.startsWith("ml-dsa-")) {
+        const level = Number(key.kind.slice(7));
+        return { kind: "ml-dsa", level, publicKeyHex: String(key.info.publicKey) };
     }
-    if (algorithm === "ed25519") {
-        return node_crypto_1.default.verify(null, Buffer.from(data), publicKey, Buffer.from(signature, "hex"));
+    return { kind: "asymmetric", publicKey: key.publicKey };
+}
+function verifierFor(args) {
+    const hasPub = args.publicKey !== undefined;
+    if (hasPub === (args.keyHandle !== undefined)) {
+        throw new Error("Pass exactly one of publicKey or keyHandle");
     }
-    const verifier = node_crypto_1.default.createVerify("SHA256");
-    verifier.update(data);
-    verifier.end();
-    return verifier.verify(publicKey, Buffer.from(signature, "hex"));
+    return hasPub
+        ? verifierFromPublic(String(args.publicKey))
+        : verifierFromKey(String(args.keyHandle));
 }
 const verify = async (args) => {
-    const algorithm = args.algorithm || "ed25519";
-    const valid = verifySignature(algorithm, String(args.data), String(args.signature), String(args.publicKey));
-    return (0, result_1.jsonResult)({ algorithm, valid });
+    const verifier = verifierFor(args);
+    const data = Buffer.from(String(args.data), "utf8");
+    const signatureHex = String(args.signature);
+    if (verifier.kind === "ml-dsa") {
+        const res = (0, crypto_lib_1.mlDsaVerify)(verifier.level, verifier.publicKeyHex, data, signatureHex);
+        return (0, result_1.jsonResult)({
+            algorithm: `ml-dsa-${verifier.level}`,
+            valid: res.valid,
+        });
+    }
+    const signature = Buffer.from(signatureHex, "hex");
+    const result = verifier.kind === "hmac"
+        ? verifyHmac(verifier.secret, data, signature)
+        : verifyAsymmetric(verifier.publicKey, data, signature);
+    return (0, result_1.jsonResult)(result);
 };
 exports.verify = verify;
 const hash = async (args) => {

package/dist/tools/stream-definitions.d.ts

@@ -0,0 +1,3 @@
+import { MCPTool } from "../types";
+export declare const STREAM_TOOLS: MCPTool[];
+//# sourceMappingURL=stream-definitions.d.ts.map

package/dist/tools/stream-definitions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stream-definitions.d.ts","sourceRoot":"","sources":["../../src/tools/stream-definitions.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AASnC,eAAO,MAAM,YAAY,EAAE,OAAO,EA0JjC,CAAC"}

package/dist/tools/stream-definitions.js

@@ -0,0 +1,122 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.STREAM_TOOLS = void 0;
+const schema_helpers_1 = require("./schema-helpers");
+exports.STREAM_TOOLS = [
+    {
+        name: "crypto_stream_encrypt",
+        description: "Encrypt plaintext using post-quantum hybrid STREAM AEAD (X25519 + ML-KEM-768 + XChaCha20-Poly1305) with anti-truncation protection. Returns base64 ciphertext.",
+        inputSchema: {
+            type: "object",
+            additionalProperties: false,
+            properties: {
+                plaintext: (0, schema_helpers_1.text)("Plaintext string to encrypt."),
+                x25519PublicKey: (0, schema_helpers_1.hex)("Hex-encoded X25519 public key (64 hex characters).", schema_helpers_1.X25519_PUBLIC_KEY_HEX),
+                mlKemPublicKey: (0, schema_helpers_1.hex)("Hex-encoded ML-KEM-768 public key (2368 hex characters).", schema_helpers_1.ML_KEM_768_PUBLIC_KEY_HEX),
+                chunkSize: {
+                    type: "integer",
+                    description: "Chunk size in bytes (minimum 64, default 65536).",
+                    minimum: 64,
+                },
+            },
+            required: ["plaintext", "x25519PublicKey", "mlKemPublicKey"],
+        },
+    },
+    {
+        name: "crypto_stream_decrypt",
+        description: "Decrypt a post-quantum hybrid STREAM AEAD ciphertext using server-held x25519 and ml-kem-768 key handles. Plaintext memory is wiped after decoding.",
+        inputSchema: {
+            type: "object",
+            additionalProperties: false,
+            properties: {
+                ciphertext: (0, schema_helpers_1.text)("Base64-encoded STREAM ciphertext."),
+                x25519KeyHandle: (0, schema_helpers_1.keyHandle)("Handle of the recipient X25519 key (or 32-byte symmetric-256 key)."),
+                mlKemKeyHandle: (0, schema_helpers_1.keyHandle)("Handle of the recipient ML-KEM-768 key."),
+                chunkSize: {
+                    type: "integer",
+                    description: "Chunk size used during encryption (default 65536).",
+                    minimum: 64,
+                },
+            },
+            required: ["ciphertext", "x25519KeyHandle", "mlKemKeyHandle"],
+        },
+    },
+    {
+        name: "crypto_stream_multi_encrypt",
+        description: "Encrypt plaintext for multiple recipients using post-quantum hybrid STREAM AEAD (X25519 + ML-KEM-768 + XChaCha20-Poly1305) with anti-truncation framing. Returns base64 ciphertext.",
+        inputSchema: {
+            type: "object",
+            additionalProperties: false,
+            properties: {
+                plaintext: (0, schema_helpers_1.text)("Plaintext string to encrypt."),
+                recipients: (0, schema_helpers_1.text)("JSON-serialized array of recipient public key descriptors: [{ recipientId, recipientX25519Public, recipientMlKemPublic }]."),
+                chunkSize: {
+                    type: "integer",
+                    description: "Chunk size in bytes (minimum 1024, maximum 16777216, default 65536).",
+                    minimum: 1024,
+                    maximum: 16777216,
+                },
+            },
+            required: ["plaintext", "recipients"],
+        },
+    },
+    {
+        name: "crypto_stream_multi_decrypt",
+        description: "Decrypt a multi-recipient post-quantum hybrid STREAM AEAD ciphertext using server-held x25519 and ml-kem-768 key handles. Plaintext memory is wiped after decoding.",
+        inputSchema: {
+            type: "object",
+            additionalProperties: false,
+            properties: {
+                ciphertext: (0, schema_helpers_1.text)("Base64-encoded multi-recipient STREAM ciphertext."),
+                x25519KeyHandle: (0, schema_helpers_1.keyHandle)("Handle of the recipient X25519 key (or 32-byte symmetric-256 key)."),
+                mlKemKeyHandle: (0, schema_helpers_1.keyHandle)("Handle of the recipient ML-KEM-768 key."),
+                recipientId: (0, schema_helpers_1.text)("Optional recipient identifier for direct slot lookup."),
+                chunkSize: {
+                    type: "integer",
+                    description: "Chunk size in bytes (minimum 1024, maximum 16777216, default 65536).",
+                    minimum: 1024,
+                    maximum: 16777216,
+                },
+            },
+            required: ["ciphertext", "x25519KeyHandle", "mlKemKeyHandle"],
+        },
+    },
+    {
+        name: "crypto_hybrid_kem_multi_encapsulate",
+        description: "Encapsulate a symmetric key for multiple recipients using post-quantum hybrid KEM (X25519 + ML-KEM-768 + AES-256-GCM key wrapping). Returns recipient ciphertexts and a symmetric-256 keyHandle.",
+        inputSchema: {
+            type: "object",
+            additionalProperties: false,
+            properties: {
+                recipients: (0, schema_helpers_1.text)("JSON-serialized array of recipient public key objects: [{ id?, x25519PublicKey, mlKemPublicKey }]."),
+                keyHandle: (0, schema_helpers_1.keyHandle)("Optional handle of an existing symmetric-256 key to encapsulate. If omitted, a fresh 256-bit DEK is generated."),
+            },
+            required: ["recipients"],
+        },
+    },
+    {
+        name: "crypto_hybrid_kem_multi_decapsulate",
+        description: "Decapsulate a multi-recipient post-quantum hybrid KEM key using server-held x25519 and ml-kem-768 key handles. Returns a symmetric-256 keyHandle for the recovered DEK.",
+        inputSchema: {
+            type: "object",
+            additionalProperties: false,
+            properties: {
+                x25519KeyHandle: (0, schema_helpers_1.keyHandle)("Handle of recipient X25519 key."),
+                mlKemKeyHandle: (0, schema_helpers_1.keyHandle)("Handle of recipient ML-KEM-768 key."),
+                ephemeralPublicKey: (0, schema_helpers_1.hex)("Hex-encoded sender ephemeral X25519 public key (64 hex characters).", schema_helpers_1.X25519_PUBLIC_KEY_HEX),
+                mlKemCiphertext: (0, schema_helpers_1.hex)("Hex-encoded ML-KEM-768 ciphertext (2176 hex characters).", 2176, true),
+                wrappedKey: (0, schema_helpers_1.text)("Base64-encoded wrapped DEK (RFC 3394 AES Key Wrap)."),
+                encryptedKey: (0, schema_helpers_1.text)("Alias for wrappedKey."),
+                recipients: (0, schema_helpers_1.text)("Optional JSON-serialized array of encrypted recipient objects: [{ id?, ephemeralPublicKey, mlKemCiphertext, encryptedKey }]."),
+                recipientId: (0, schema_helpers_1.text)("Optional recipient ID to select from recipients array."),
+                recipientIndex: {
+                    type: "integer",
+                    description: "Optional index to select from recipients array (default 0).",
+                    minimum: 0,
+                },
+            },
+            required: ["x25519KeyHandle", "mlKemKeyHandle"],
+        },
+    },
+];
+//# sourceMappingURL=stream-definitions.js.map

package/dist/tools/stream.d.ts

@@ -0,0 +1,6 @@
+import { ToolHandler } from "./result";
+export declare const streamEncrypt: ToolHandler;
+export declare const streamDecrypt: ToolHandler;
+export declare const streamMultiEncrypt: ToolHandler;
+export declare const streamMultiDecrypt: ToolHandler;
+//# sourceMappingURL=stream.d.ts.map

package/dist/tools/stream.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stream.d.ts","sourceRoot":"","sources":["../../src/tools/stream.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,WAAW,EAAc,MAAM,UAAU,CAAC;AAMnD,eAAO,MAAM,aAAa,EAAE,WAmB3B,CAAC;AAOF,eAAO,MAAM,aAAa,EAAE,WAwB3B,CAAC;AAiBF,eAAO,MAAM,kBAAkB,EAAE,WAkBhC,CAAC;AAOF,eAAO,MAAM,kBAAkB,EAAE,WA4BhC,CAAC"}