@sebastienrousseau/crypto-mcp 0.0.8 → 0.0.9

package/dist/tools/definitions.js

@@ -1,9 +1,22 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.TOOLS = exports.HASH_ALGORITHMS = exports.EC_CURVES = exports.RSA_MODULUS_LENGTHS = exports.KEY_TYPES = void 0;
-exports.KEY_TYPES = ["rsa", "ecc", "ed25519", "ml-kem-768"];
+exports.TOOLS = exports.MAX_KEY_LENGTH = exports.MAX_TEXT_LENGTH = exports.HASH_ALGORITHMS = exports.MAX_KEY_FILE_BYTES = exports.KEY_DIR_ENV = exports.EC_CURVES = exports.RSA_MODULUS_LENGTHS = exports.KEY_TYPES = void 0;
+const keystore_1 = require("./keystore");
+const annotations_1 = require("./annotations");
+exports.KEY_TYPES = [
+    "rsa",
+    "ecc",
+    "ed25519",
+    "ml-kem-768",
+    "symmetric-256",
+    "hmac-sha256",
+];
 exports.RSA_MODULUS_LENGTHS = [2048, 3072, 4096];
 exports.EC_CURVES = ["prime256v1", "secp384r1", "secp256k1"];
+exports.KEY_DIR_ENV = "CRYPTO_MCP_KEY_DIR";
+exports.MAX_KEY_FILE_BYTES = 65_536;
+const MAX_KEY_PATH_LENGTH = 512;
+const RAW_KEY_KINDS = ["symmetric-256", "hmac-sha256"];
 exports.HASH_ALGORITHMS = [
     "sha256",
     "sha384",
@@ -11,133 +24,206 @@ exports.HASH_ALGORITHMS = [
     "sha3-256",
     "blake2b512",
 ];
-exports.TOOLS = [
+const AEAD_ALGORITHMS = ["aes-256-gcm", "chacha20-poly1305"];
+const KMS_PROVIDERS = ["aws", "gcp", "azure", "vault", "local"];
+exports.MAX_TEXT_LENGTH = 1_048_576;
+exports.MAX_KEY_LENGTH = 16_384;
+const HEX_BYTES = "^(?:[0-9a-fA-F]{2})*$";
+const ML_KEM_768_PUBLIC_KEY_HEX = 2368;
+const ML_KEM_768_CIPHERTEXT_HEX = 2176;
+const HANDLE_NOTE = "Secret key material stays inside the server; only an opaque keyHandle is returned.";
+function keyHandle(description) {
+    return {
+        type: "string",
+        description: `${description} Key handles look like 'kh_' followed by 32 hex characters.`,
+        maxLength: 35,
+        pattern: keystore_1.KEY_HANDLE_PATTERN,
+    };
+}
+function text(description) {
+    return { type: "string", description, maxLength: exports.MAX_TEXT_LENGTH };
+}
+function hex(description, length, upTo = false) {
+    return {
+        type: "string",
+        description,
+        minLength: upTo ? 2 : length,
+        maxLength: length,
+        pattern: HEX_BYTES,
+    };
+}
+function oneOf(description, values) {
+    return { type: "string", description, enum: values };
+}
+const KMS_PROVIDER = oneOf("KMS provider ('aws', 'gcp', 'azure', 'vault', or 'local'). Only 'local' (random, in-process key material that does not survive a restart) is configured; the others return an error.", KMS_PROVIDERS);
+const KEK_LABEL = {
+    type: "string",
+    description: "Label of the Key Encryption Key (KEK). It names the key; it is never used to derive it.",
+    minLength: 1,
+    maxLength: 256,
+};
+const KEY_TOOLS = [
     {
         name: "crypto_generate_key",
-        description: "Generate cryptographic keypairs for classical (RSA, ECC, Ed25519) or post-quantum (ML-KEM-768, FIPS 203) algorithms.",
+        description: `Generate a key inside the server: a classical (RSA, ECC, Ed25519) or post-quantum (ML-KEM-768, FIPS 203) keypair, a 256-bit symmetric key, or an HMAC-SHA256 key. Returns a keyHandle and, for keypairs, the public key. ${HANDLE_NOTE}`,
         inputSchema: {
             type: "object",
+            additionalProperties: false,
             properties: {
-                type: {
-                    type: "string",
-                    description: "Key algorithm: 'rsa', 'ecc', 'ed25519', or 'ml-kem-768'.",
-                    enum: exports.KEY_TYPES,
-                },
+                type: oneOf("Key type: 'rsa', 'ecc', 'ed25519', 'ml-kem-768', 'symmetric-256' (for crypto_encrypt, crypto_decrypt and crypto_kms_wrap), or 'hmac-sha256'.", exports.KEY_TYPES),
                 modulusLength: {
-                    type: "number",
+                    type: "integer",
                     description: "Modulus length for RSA (2048, 3072, 4096). Default is 2048.",
+                    enum: exports.RSA_MODULUS_LENGTHS,
                 },
-                curve: {
-                    type: "string",
-                    description: "Elliptic curve: 'prime256v1' (P-256), 'secp384r1' (P-384), or 'secp256k1'.",
-                    enum: exports.EC_CURVES,
-                },
+                curve: oneOf("Elliptic curve for 'ecc': 'prime256v1' (P-256), 'secp384r1' (P-384), or 'secp256k1'. Default is 'prime256v1'.", exports.EC_CURVES),
             },
             required: ["type"],
         },
     },
     {
-        name: "crypto_encrypt",
-        description: "Encrypt plaintext using authenticated symmetric encryption (AES-256-GCM, ChaCha20-Poly1305) or asymmetric keys.",
+        name: "crypto_key_list",
+        description: `List the key handles this server holds, with each key's type and public metadata. At most ${keystore_1.MAX_KEYS} keys are held; beyond that the least recently used key is destroyed.`,
+        inputSchema: {
+            type: "object",
+            additionalProperties: false,
+            properties: {},
+        },
+    },
+    {
+        name: "crypto_key_destroy",
+        description: "Destroy a key: overwrite its secret bytes where the runtime allows and invalidate its handle.",
+        inputSchema: {
+            type: "object",
+            additionalProperties: false,
+            properties: { keyHandle: keyHandle("Handle of the key to destroy.") },
+            required: ["keyHandle"],
+        },
+    },
+    {
+        name: "crypto_key_import",
+        description: `Import an existing key from a file in the directory the server operator set in ${exports.KEY_DIR_ENV} (disabled when it is unset). Reads an unencrypted PKCS#8 PEM private key (Ed25519, RSA 2048/3072/4096, ECDSA P-256/P-384/secp256k1; the type comes from the key) or a raw 32-byte key, as 32 binary bytes or 64 hex digits, imported as 'symmetric-256' (default) or 'hmac-sha256'. Files over ${exports.MAX_KEY_FILE_BYTES} bytes are refused. The key bytes never pass through the conversation. ${HANDLE_NOTE}`,
         inputSchema: {
             type: "object",
+            additionalProperties: false,
             properties: {
-                plaintext: {
+                path: {
                     type: "string",
-                    description: "Plaintext string to encrypt.",
+                    description: `Path of the key file, relative to ${exports.KEY_DIR_ENV}. Absolute paths, '..' segments and symlinks that lead outside the directory are refused.`,
+                    minLength: 1,
+                    maxLength: MAX_KEY_PATH_LENGTH,
                 },
-                algorithm: {
-                    type: "string",
-                    description: "Encryption algorithm ('aes-256-gcm' or 'chacha20-poly1305'). Default is 'aes-256-gcm'.",
-                    enum: ["aes-256-gcm", "chacha20-poly1305"],
-                },
-                key: {
+                kind: oneOf("For a raw 32-byte key only: 'symmetric-256' (crypto_encrypt, crypto_decrypt, crypto_kms_wrap; default) or 'hmac-sha256' (crypto_sign, crypto_verify).", RAW_KEY_KINDS),
+            },
+            required: ["path"],
+        },
+    },
+    {
+        name: "crypto_inspect_key",
+        description: "Inspect and parse PEM certificate, public key, or OpenPGP armored block.",
+        inputSchema: {
+            type: "object",
+            additionalProperties: false,
+            properties: {
+                keyData: {
                     type: "string",
-                    description: "Hex-encoded 256-bit key (64 hex characters). If omitted, a secure 256-bit key is generated and returned.",
+                    description: "PEM or armored key string.",
+                    maxLength: exports.MAX_KEY_LENGTH,
                 },
             },
+            required: ["keyData"],
+        },
+    },
+];
+const CIPHER_TOOLS = [
+    {
+        name: "crypto_encrypt",
+        description: `Encrypt plaintext with authenticated encryption (AES-256-GCM or ChaCha20-Poly1305) under a symmetric-256 key handle. Without keyHandle, a new key is generated and its handle returned. ${HANDLE_NOTE}`,
+        inputSchema: {
+            type: "object",
+            additionalProperties: false,
+            properties: {
+                plaintext: text("Plaintext string to encrypt."),
+                algorithm: oneOf("Encryption algorithm ('aes-256-gcm' or 'chacha20-poly1305'). Default is 'aes-256-gcm'.", AEAD_ALGORITHMS),
+                keyHandle: keyHandle("Handle of a symmetric-256 key. If omitted, a new key is generated."),
+            },
             required: ["plaintext"],
         },
     },
     {
         name: "crypto_decrypt",
-        description: "Decrypt ciphertext encrypted with authenticated AES-256-GCM or ChaCha20-Poly1305.",
+        description: "Decrypt and authenticate an AES-256-GCM or ChaCha20-Poly1305 ciphertext with a symmetric-256 key handle.",
         inputSchema: {
             type: "object",
+            additionalProperties: false,
             properties: {
-                ciphertext: {
-                    type: "string",
-                    description: "Hex-encoded or base64-encoded ciphertext payload.",
-                },
-                algorithm: {
-                    type: "string",
-                    description: "Algorithm used for encryption ('aes-256-gcm' or 'chacha20-poly1305').",
-                    enum: ["aes-256-gcm", "chacha20-poly1305"],
-                },
-                key: {
-                    type: "string",
-                    description: "Hex-encoded 256-bit key (64 hex characters).",
-                },
-                iv: {
-                    type: "string",
-                    description: "Hex-encoded initialization vector / nonce.",
-                },
-                authTag: {
-                    type: "string",
-                    description: "Hex-encoded 128-bit authentication tag.",
-                },
+                ciphertext: hex("Hex-encoded ciphertext.", 2 * exports.MAX_TEXT_LENGTH, true),
+                algorithm: oneOf("Algorithm used for encryption ('aes-256-gcm' or 'chacha20-poly1305'). Default is 'aes-256-gcm'.", AEAD_ALGORITHMS),
+                keyHandle: keyHandle("Handle of the symmetric-256 key."),
+                iv: hex("Hex-encoded 96-bit nonce (24 hex characters).", 24),
+                authTag: hex("Hex-encoded 128-bit authentication tag.", 32),
             },
-            required: ["ciphertext", "key", "iv", "authTag"],
+            required: ["ciphertext", "keyHandle", "iv", "authTag"],
         },
     },
+    {
+        name: "crypto_kem_encapsulate",
+        description: `Encapsulate a shared secret to an ML-KEM-768 (FIPS 203) public key. Returns the KEM ciphertext for the recipient and a symmetric-256 keyHandle for the shared secret, usable with crypto_encrypt. ${HANDLE_NOTE}`,
+        inputSchema: {
+            type: "object",
+            additionalProperties: false,
+            properties: {
+                publicKey: hex("Hex-encoded ML-KEM-768 public key (2368 hex characters).", ML_KEM_768_PUBLIC_KEY_HEX),
+            },
+            required: ["publicKey"],
+        },
+    },
+    {
+        name: "crypto_kem_decapsulate",
+        description: `Recover an ML-KEM-768 shared secret with an ml-kem-768 key handle. Returns a symmetric-256 keyHandle for the shared secret. ${HANDLE_NOTE}`,
+        inputSchema: {
+            type: "object",
+            additionalProperties: false,
+            properties: {
+                keyHandle: keyHandle("Handle of the ml-kem-768 key."),
+                ciphertext: hex("Hex-encoded ML-KEM-768 ciphertext (2176 hex characters).", ML_KEM_768_CIPHERTEXT_HEX),
+            },
+            required: ["keyHandle", "ciphertext"],
+        },
+    },
+];
+const SIGNATURE_TOOLS = [
     {
         name: "crypto_sign",
-        description: "Digitally sign data using Ed25519, RSA-PSS, or HMAC.",
+        description: "Sign data with a key handle. The algorithm follows the key: Ed25519, RSASSA-PSS (SHA-256), ECDSA (SHA-256; SHA-384 on P-384), or HMAC-SHA256.",
         inputSchema: {
             type: "object",
+            additionalProperties: false,
             properties: {
-                data: {
-                    type: "string",
-                    description: "Data string to sign.",
-                },
-                algorithm: {
-                    type: "string",
-                    description: "Signing algorithm ('ed25519', 'rsa-pss', or 'hmac-sha256').",
-                    enum: ["ed25519", "rsa-pss", "hmac-sha256"],
-                },
-                privateKey: {
-                    type: "string",
-                    description: "Private key in PEM format or secret key for HMAC.",
-                },
+                data: text("Data string to sign."),
+                keyHandle: keyHandle("Handle of an ed25519, rsa, ecc, or hmac-sha256 key."),
             },
-            required: ["data", "algorithm", "privateKey"],
+            required: ["data", "keyHandle"],
         },
     },
     {
         name: "crypto_verify",
-        description: "Verify digital signature against original data and public key.",
+        description: "Verify a signature against a public key PEM (Ed25519, RSA-PSS, ECDSA) or a key handle (also HMAC-SHA256). Pass exactly one of publicKey or keyHandle.",
         inputSchema: {
             type: "object",
+            additionalProperties: false,
             properties: {
-                data: {
-                    type: "string",
-                    description: "Original data string.",
-                },
-                signature: {
-                    type: "string",
-                    description: "Hex-encoded signature.",
-                },
-                algorithm: {
-                    type: "string",
-                    description: "Signing algorithm ('ed25519', 'rsa-pss', or 'hmac-sha256').",
-                    enum: ["ed25519", "rsa-pss", "hmac-sha256"],
-                },
+                data: text("Original data string."),
+                signature: hex("Hex-encoded signature.", 1024, true),
                 publicKey: {
                     type: "string",
-                    description: "Public key in PEM format or secret key for HMAC.",
+                    description: "Public key in SPKI PEM format. Private keys are refused.",
+                    minLength: 1,
+                    maxLength: exports.MAX_KEY_LENGTH,
                 },
+                keyHandle: keyHandle("Handle of an ed25519, rsa, ecc, or hmac-sha256 key."),
             },
-            required: ["data", "signature", "algorithm", "publicKey"],
+            required: ["data", "signature"],
         },
     },
     {
@@ -145,93 +231,65 @@ exports.TOOLS = [
         description: "Compute cryptographic digest (SHA-256, SHA-384, SHA-512, SHA3-256, BLAKE2b512).",
         inputSchema: {
             type: "object",
+            additionalProperties: false,
             properties: {
-                data: {
-                    type: "string",
-                    description: "Data string to hash.",
-                },
-                algorithm: {
-                    type: "string",
-                    description: "Hash algorithm.",
-                    enum: exports.HASH_ALGORITHMS,
-                },
+                data: text("Data string to hash."),
+                algorithm: oneOf("Hash algorithm.", exports.HASH_ALGORITHMS),
             },
             required: ["data"],
         },
     },
+];
+const KMS_AND_AUDIT_TOOLS = [
     {
         name: "crypto_kms_wrap",
-        description: "Wrap a Data Encryption Key (DEK) under a Key Encryption Key held by a KMS provider. Only the 'local' provider (random, in-process key material that does not survive a restart) is configured.",
+        description: "Wrap the Data Encryption Key (DEK) a symmetric-256 key handle refers to under a Key Encryption Key held by a KMS provider. Only the 'local' provider is configured.",
         inputSchema: {
             type: "object",
+            additionalProperties: false,
             properties: {
-                provider: {
-                    type: "string",
-                    description: "KMS provider ('aws', 'gcp', 'azure', 'vault', or 'local'). Only 'local' is configured; the others return an error.",
-                    enum: ["aws", "gcp", "azure", "vault", "local"],
-                },
-                keyId: {
-                    type: "string",
-                    description: "Label of the Key Encryption Key (KEK). It names the key; it is never used to derive it.",
-                },
-                dek: {
-                    type: "string",
-                    description: "Hex-encoded 256-bit Data Encryption Key to wrap.",
-                },
+                provider: KMS_PROVIDER,
+                keyId: KEK_LABEL,
+                keyHandle: keyHandle("Handle of the symmetric-256 DEK to wrap."),
             },
-            required: ["provider", "keyId", "dek"],
+            required: ["provider", "keyId", "keyHandle"],
         },
     },
     {
         name: "crypto_kms_unwrap",
-        description: "Unwrap a Data Encryption Key (DEK) previously wrapped by crypto_kms_wrap in this server process. Only the 'local' provider is configured.",
+        description: `Unwrap a DEK previously wrapped by crypto_kms_wrap in this server process into a symmetric-256 key handle. Only the 'local' provider is configured. ${HANDLE_NOTE}`,
         inputSchema: {
             type: "object",
+            additionalProperties: false,
             properties: {
-                provider: {
-                    type: "string",
-                    description: "KMS provider ('aws', 'gcp', 'azure', 'vault', or 'local'). Only 'local' is configured; the others return an error.",
-                    enum: ["aws", "gcp", "azure", "vault", "local"],
-                },
-                keyId: {
-                    type: "string",
-                    description: "Key Encryption Key (KEK) identifier.",
-                },
-                wrappedKey: {
-                    type: "string",
-                    description: "Hex-encoded wrapped key payload.",
-                },
+                provider: KMS_PROVIDER,
+                keyId: KEK_LABEL,
+                wrappedKey: hex("Hex-encoded wrapped key payload.", 1024, true),
             },
             required: ["provider", "keyId", "wrappedKey"],
         },
     },
-    {
-        name: "crypto_inspect_key",
-        description: "Inspect and parse PEM certificate, public key, or OpenPGP armored block.",
-        inputSchema: {
-            type: "object",
-            properties: {
-                keyData: {
-                    type: "string",
-                    description: "PEM or armored key string.",
-                },
-            },
-            required: ["keyData"],
-        },
-    },
     {
         name: "crypto_audit_cbom",
         description: "Generate a Cryptographic Bill of Materials (CBOM) inventory from cryptographic identifiers.",
         inputSchema: {
             type: "object",
+            additionalProperties: false,
             properties: {
                 algorithms: {
                     type: "string",
                     description: "Comma-separated list of algorithm names to evaluate (e.g. 'RSA-2048,AES-256-GCM,ML-KEM-768,SHA-1').",
+                    maxLength: 4096,
                 },
             },
             required: ["algorithms"],
         },
     },
 ];
+exports.TOOLS = [
+    ...KEY_TOOLS,
+    ...CIPHER_TOOLS,
+    ...SIGNATURE_TOOLS,
+    ...KMS_AND_AUDIT_TOOLS,
+].map((tool) => ({ ...tool, ...(0, annotations_1.annotationsFor)(tool.name) }));
 //# sourceMappingURL=definitions.js.map

package/dist/tools/index.d.ts

@@ -1,4 +1,5 @@
 import { MCPCallToolResult } from "../types";
 export { TOOLS } from "./definitions";
+export { validateArguments } from "./validate";
 export declare function executeTool(name: string, args?: Record<string, unknown>): Promise<MCPCallToolResult>;
 //# sourceMappingURL=index.d.ts.map

package/dist/tools/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/tools/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAQ7C,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAmBtC,wBAAsB,WAAW,CAC/B,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GACjC,OAAO,CAAC,iBAAiB,CAAC,CAQ5B"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/tools/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,iBAAiB,EAAsB,MAAM,UAAU,CAAC;AAYjE,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AACtC,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAwC/C,wBAAsB,WAAW,CAC/B,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GACjC,OAAO,CAAC,iBAAiB,CAAC,CAU5B"}

package/dist/tools/index.js

@@ -1,17 +1,28 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.TOOLS = void 0;
+exports.validateArguments = exports.TOOLS = void 0;
 exports.executeTool = executeTool;
 const cbom_1 = require("./cbom");
+const definitions_1 = require("./definitions");
+const keyimport_1 = require("./keyimport");
+const kem_1 = require("./kem");
 const keys_1 = require("./keys");
 const kms_1 = require("./kms");
 const result_1 = require("./result");
 const signing_1 = require("./signing");
 const symmetric_1 = require("./symmetric");
-var definitions_1 = require("./definitions");
-Object.defineProperty(exports, "TOOLS", { enumerable: true, get: function () { return definitions_1.TOOLS; } });
+const validate_1 = require("./validate");
+var definitions_2 = require("./definitions");
+Object.defineProperty(exports, "TOOLS", { enumerable: true, get: function () { return definitions_2.TOOLS; } });
+var validate_2 = require("./validate");
+Object.defineProperty(exports, "validateArguments", { enumerable: true, get: function () { return validate_2.validateArguments; } });
 const HANDLERS = {
     crypto_generate_key: keys_1.generateKey,
+    crypto_key_list: keys_1.listKeys,
+    crypto_key_destroy: keys_1.destroyKey,
+    crypto_key_import: keyimport_1.importKey,
+    crypto_kem_encapsulate: kem_1.kemEncapsulate,
+    crypto_kem_decapsulate: kem_1.kemDecapsulate,
     crypto_encrypt: symmetric_1.encrypt,
     crypto_decrypt: symmetric_1.decrypt,
     crypto_sign: signing_1.sign,
@@ -22,12 +33,19 @@ const HANDLERS = {
     crypto_inspect_key: keys_1.inspectKey,
     crypto_audit_cbom: cbom_1.auditCbom,
 };
+const REGISTRY = new Map(definitions_1.TOOLS.map((tool) => [
+    tool.name,
+    { schema: tool.inputSchema, handler: HANDLERS[tool.name] },
+]));
 async function executeTool(name, args = {}) {
-    const handler = Object.hasOwn(HANDLERS, name) ? HANDLERS[name] : undefined;
-    if (!handler)
+    const tool = REGISTRY.get(name);
+    if (!tool)
         return (0, result_1.errorResult)(`Unknown tool name: ${name}`);
+    const problem = (0, validate_1.validateArguments)(tool.schema, args);
+    if (problem)
+        return (0, result_1.errorResult)(`Invalid arguments for ${name}: ${problem}`);
     try {
-        return await handler(args);
+        return await tool.handler(args);
     }
     catch (err) {
         return (0, result_1.errorResult)(`Tool error (${name}): ${err.message}`);

package/dist/tools/kem.d.ts

@@ -0,0 +1,4 @@
+import { ToolHandler } from "./result";
+export declare const kemEncapsulate: ToolHandler;
+export declare const kemDecapsulate: ToolHandler;
+//# sourceMappingURL=kem.d.ts.map

package/dist/tools/kem.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"kem.d.ts","sourceRoot":"","sources":["../../src/tools/kem.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,WAAW,EAAc,MAAM,UAAU,CAAC;AASnD,eAAO,MAAM,cAAc,EAAE,WAS5B,CAAC;AAGF,eAAO,MAAM,cAAc,EAAE,WAW5B,CAAC"}

package/dist/tools/kem.js

@@ -0,0 +1,20 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.kemDecapsulate = exports.kemEncapsulate = void 0;
+const crypto_lib_1 = require("@sebastienrousseau/crypto-lib");
+const keystore_1 = require("./keystore");
+const result_1 = require("./result");
+const kemEncapsulate = async (args) => {
+    const { ciphertext, sharedSecret, algorithm } = (0, crypto_lib_1.mlKemEncap)(768, String(args.publicKey));
+    const keyHandle = keystore_1.keyStore.add((0, keystore_1.symmetricKey)(Buffer.from(sharedSecret, "hex"), "ml-kem-768 encapsulation"));
+    return (0, result_1.jsonResult)({ algorithm, ciphertext, keyHandle });
+};
+exports.kemEncapsulate = kemEncapsulate;
+const kemDecapsulate = async (args) => {
+    const key = keystore_1.keyStore.use(String(args.keyHandle), ["ml-kem-768"]);
+    const { sharedSecret, algorithm } = (0, crypto_lib_1.mlKemDecap)(768, key.secret.toString("hex"), String(args.ciphertext));
+    const keyHandle = keystore_1.keyStore.add((0, keystore_1.symmetricKey)(Buffer.from(sharedSecret, "hex"), "ml-kem-768 decapsulation"));
+    return (0, result_1.jsonResult)({ algorithm, keyHandle });
+};
+exports.kemDecapsulate = kemDecapsulate;
+//# sourceMappingURL=kem.js.map

package/dist/tools/keyimport.d.ts

@@ -0,0 +1,5 @@
+import fs from "node:fs";
+import { ToolHandler } from "./result";
+export declare function readAtMost(handle: Pick<fs.promises.FileHandle, "read">, max: number): Promise<Buffer>;
+export declare const importKey: ToolHandler;
+//# sourceMappingURL=keyimport.d.ts.map

package/dist/tools/keyimport.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keyimport.d.ts","sourceRoot":"","sources":["../../src/tools/keyimport.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,MAAM,SAAS,CAAC;AAUzB,OAAO,EAAY,WAAW,EAAc,MAAM,UAAU,CAAC;AA2F7D,wBAAsB,UAAU,CAC9B,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,EAC5C,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,CAajB;AAuKD,eAAO,MAAM,SAAS,EAAE,WAUvB,CAAC"}