@sebastienrousseau/crypto-mcp 0.0.8 → 0.0.9

package/dist/tools/keyimport.js

@@ -0,0 +1,206 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.importKey = void 0;
+exports.readAtMost = readAtMost;
+const node_crypto_1 = __importDefault(require("node:crypto"));
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_path_1 = __importDefault(require("node:path"));
+const definitions_1 = require("./definitions");
+const keys_1 = require("./keys");
+const keystore_1 = require("./keystore");
+const result_1 = require("./result");
+const RAW_KEY_BYTES = 32;
+const SOURCE = "crypto_key_import";
+const UNREADABLE = `Key file not found or not readable in ${definitions_1.KEY_DIR_ENV}`;
+const OPEN_FLAGS = node_fs_1.default.constants.O_RDONLY | (node_fs_1.default.constants.O_NOFOLLOW | 0);
+async function keyDirectory() {
+    const dir = process.env[definitions_1.KEY_DIR_ENV];
+    if (!dir) {
+        throw new Error(`Key import is disabled: set ${definitions_1.KEY_DIR_ENV} to the directory holding the key files`);
+    }
+    try {
+        return await node_fs_1.default.promises.realpath(dir);
+    }
+    catch {
+        throw new Error(`${definitions_1.KEY_DIR_ENV} does not exist or cannot be read`);
+    }
+}
+function checkRelative(file) {
+    if (node_path_1.default.isAbsolute(file)) {
+        throw new Error(`path must be relative to ${definitions_1.KEY_DIR_ENV}`);
+    }
+    if (Array.from(file).some((char) => char < " ")) {
+        throw new Error("path must not contain control characters");
+    }
+    if (file.split(/[\\/]/).includes("..")) {
+        throw new Error("path must not contain '..' segments");
+    }
+}
+async function resolveKeyFile(dir, file) {
+    checkRelative(file);
+    const resolved = await fsStep(node_fs_1.default.promises.realpath(node_path_1.default.resolve(dir, file)));
+    if (!resolved.startsWith(dir + node_path_1.default.sep)) {
+        throw new Error(`path resolves outside ${definitions_1.KEY_DIR_ENV}`);
+    }
+    return resolved;
+}
+async function fsStep(operation) {
+    try {
+        return await operation;
+    }
+    catch {
+        throw new Error(UNREADABLE);
+    }
+}
+function checkFile(stats) {
+    if (!stats.isFile())
+        throw new Error("path is not a regular file");
+    if (stats.size > definitions_1.MAX_KEY_FILE_BYTES) {
+        throw new Error(`Key file is larger than ${definitions_1.MAX_KEY_FILE_BYTES} bytes`);
+    }
+}
+async function readAtMost(handle, max) {
+    const buf = Buffer.alloc(max + 1);
+    let length = 0;
+    for (;;) {
+        const { bytesRead } = await handle.read(buf, length, buf.length - length);
+        if (bytesRead === 0)
+            break;
+        length += bytesRead;
+        if (length > max) {
+            buf.fill(0);
+            throw new Error(`Key file is larger than ${max} bytes`);
+        }
+    }
+    return buf.subarray(0, length);
+}
+async function readKeyFile(file) {
+    checkFile(await fsStep(node_fs_1.default.promises.stat(file)));
+    const handle = await fsStep(node_fs_1.default.promises.open(file, OPEN_FLAGS));
+    try {
+        checkFile(await fsStep(handle.stat()));
+        return await readAtMost(handle, definitions_1.MAX_KEY_FILE_BYTES);
+    }
+    finally {
+        await handle.close();
+    }
+}
+function hexDigit(byte) {
+    if (byte >= 0x30 && byte <= 0x39)
+        return byte - 0x30;
+    const lower = byte | 0x20;
+    if (lower >= 0x61 && lower <= 0x66)
+        return lower - 0x57;
+    return -1;
+}
+function decodeHex(text) {
+    const out = Buffer.alloc(text.length / 2);
+    for (let i = 0; i < out.length; i++) {
+        const high = hexDigit(text[2 * i]);
+        const low = hexDigit(text[2 * i + 1]);
+        if (high < 0 || low < 0) {
+            out.fill(0);
+            return undefined;
+        }
+        out[i] = high * 16 + low;
+    }
+    return out;
+}
+function trimEnd(bytes) {
+    let end = bytes.length;
+    while (end > 0 && " \t\r\n".includes(String.fromCharCode(bytes[end - 1]))) {
+        end--;
+    }
+    return bytes.subarray(0, end);
+}
+function rawSecret(bytes) {
+    if (bytes.length === RAW_KEY_BYTES)
+        return Buffer.from(bytes);
+    const text = trimEnd(bytes);
+    const secret = text.length === 2 * RAW_KEY_BYTES ? decodeHex(text) : undefined;
+    if (!secret) {
+        throw new Error("Unrecognised key file: expected a PKCS#8 PEM private key, 32 raw bytes, or 64 hex digits");
+    }
+    return secret;
+}
+function rawKey(bytes, kind) {
+    const secret = rawSecret(bytes);
+    if (kind === "hmac-sha256") {
+        return {
+            kind: "hmac-sha256",
+            secret,
+            info: { bits: 256, source: SOURCE, usage: "crypto_sign, crypto_verify" },
+        };
+    }
+    return (0, keystore_1.symmetricKey)(secret, SOURCE);
+}
+function privateKeyKind(key) {
+    const details = key.asymmetricKeyDetails;
+    switch (key.asymmetricKeyType) {
+        case "ed25519":
+            return { kind: "ed25519", info: {} };
+        case "rsa":
+            if (!definitions_1.RSA_MODULUS_LENGTHS.includes(Number(details.modulusLength))) {
+                throw new Error(`Unsupported RSA modulus length (allowed: ${definitions_1.RSA_MODULUS_LENGTHS.join(", ")})`);
+            }
+            return { kind: "rsa", info: { bits: details.modulusLength } };
+        case "ec":
+            if (!definitions_1.EC_CURVES.includes(String(details.namedCurve))) {
+                throw new Error(`Unsupported EC curve (allowed: ${definitions_1.EC_CURVES.join(", ")})`);
+            }
+            return { kind: "ecc", info: { curve: details.namedCurve } };
+        default:
+            throw new Error(`Unsupported private key type: ${key.asymmetricKeyType} (allowed: ed25519, rsa, ec)`);
+    }
+}
+function parsePrivateKey(bytes) {
+    try {
+        return node_crypto_1.default.createPrivateKey({ key: bytes, format: "pem" });
+    }
+    catch {
+        throw new Error("Key file is not a valid PKCS#8 PEM private key");
+    }
+}
+function pkcs8Key(bytes) {
+    const privateKey = parsePrivateKey(bytes);
+    const { kind, info } = privateKeyKind(privateKey);
+    const publicKey = node_crypto_1.default.createPublicKey(privateKey);
+    return (0, keys_1.asymmetric)(kind, { privateKey, publicKey }, { ...info, source: SOURCE });
+}
+function pemKey(bytes, kind) {
+    if (kind !== undefined) {
+        throw new Error("kind applies only to raw keys; a PEM key's type comes from the key");
+    }
+    if (bytes.includes("-----BEGIN ENCRYPTED PRIVATE KEY-----")) {
+        throw new Error("Encrypted PKCS#8 keys are not supported: decrypt the key file first (openssl pkcs8 -nocrypt)");
+    }
+    if (bytes.includes("-----BEGIN PRIVATE KEY-----"))
+        return pkcs8Key(bytes);
+    if (bytes.includes("PUBLIC KEY-----")) {
+        throw new Error("Public keys are not imported: pass the PEM to crypto_verify as publicKey instead");
+    }
+    throw new Error("Unsupported PEM block: only unencrypted PKCS#8 private keys ('BEGIN PRIVATE KEY') are imported");
+}
+function parseKey(bytes, kind) {
+    if (bytes.length !== RAW_KEY_BYTES && bytes.includes("-----BEGIN ")) {
+        return pemKey(bytes, kind);
+    }
+    return rawKey(bytes, kind);
+}
+const importKey = async (args) => {
+    const dir = await keyDirectory();
+    const file = await resolveKeyFile(dir, String(args.path));
+    const bytes = await readKeyFile(file);
+    try {
+        const material = parseKey(bytes, args.kind);
+        return (0, result_1.jsonResult)(keystore_1.keyStore.describe(keystore_1.keyStore.add(material)));
+    }
+    finally {
+        bytes.fill(0);
+    }
+};
+exports.importKey = importKey;
+//# sourceMappingURL=keyimport.js.map

package/dist/tools/keys.d.ts

@@ -1,4 +1,13 @@
+import crypto from "node:crypto";
+import { KeyMaterial } from "./keystore";
 import { ToolHandler } from "./result";
+export declare function publicPem(key: crypto.KeyObject): string;
+export declare function asymmetric(kind: KeyMaterial["kind"], pair: {
+    privateKey: crypto.KeyObject;
+    publicKey: crypto.KeyObject;
+}, info: Record<string, unknown>): KeyMaterial;
 export declare const generateKey: ToolHandler;
+export declare const listKeys: ToolHandler;
+export declare const destroyKey: ToolHandler;
 export declare const inspectKey: ToolHandler;
 //# sourceMappingURL=keys.d.ts.map

package/dist/tools/keys.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"keys.d.ts","sourceRoot":"","sources":["../../src/tools/keys.ts"],"names":[],"mappings":"AAKA,OAAO,EAAY,WAAW,EAA2B,MAAM,UAAU,CAAC;AA2E1E,eAAO,MAAM,WAAW,EAAE,WAOzB,CAAC;AAmBF,eAAO,MAAM,UAAU,EAAE,WAaxB,CAAC"}
+{"version":3,"file":"keys.d.ts","sourceRoot":"","sources":["../../src/tools/keys.ts"],"names":[],"mappings":"AAEA,OAAO,MAAM,MAAM,aAAa,CAAC;AAGjC,OAAO,EAAE,WAAW,EAA0B,MAAM,YAAY,CAAC;AACjE,OAAO,EAAY,WAAW,EAA2B,MAAM,UAAU,CAAC;AAG1E,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,SAAS,GAAG,MAAM,CAEvD;AAGD,wBAAgB,UAAU,CACxB,IAAI,EAAE,WAAW,CAAC,MAAM,CAAC,EACzB,IAAI,EAAE;IAAE,UAAU,EAAE,MAAM,CAAC,SAAS,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC,SAAS,CAAA;CAAE,EACnE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,WAAW,CAOb;AAqED,eAAO,MAAM,WAAW,EAAE,WAOzB,CAAC;AAGF,eAAO,MAAM,QAAQ,EAAE,WAC6C,CAAC;AAGrE,eAAO,MAAM,UAAU,EAAE,WAMxB,CAAC;AAmBF,eAAO,MAAM,UAAU,EAAE,WAaxB,CAAC"}

package/dist/tools/keys.js

@@ -3,63 +3,66 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.inspectKey = exports.generateKey = void 0;
+exports.inspectKey = exports.destroyKey = exports.listKeys = exports.generateKey = void 0;
+exports.publicPem = publicPem;
+exports.asymmetric = asymmetric;
 const node_crypto_1 = __importDefault(require("node:crypto"));
 const crypto_lib_1 = require("@sebastienrousseau/crypto-lib");
 const definitions_1 = require("./definitions");
+const keystore_1 = require("./keystore");
 const result_1 = require("./result");
-const PEM = {
-    publicKeyEncoding: { type: "spki", format: "pem" },
-    privateKeyEncoding: { type: "pkcs8", format: "pem" },
-};
+function publicPem(key) {
+    return key.export({ type: "spki", format: "pem" });
+}
+function asymmetric(kind, pair, info) {
+    return {
+        kind,
+        privateKey: pair.privateKey,
+        publicKey: pair.publicKey,
+        info: { ...info, quantumSafe: false, publicKey: publicPem(pair.publicKey) },
+    };
+}
 function generateEd25519() {
-    const { publicKey, privateKey } = node_crypto_1.default.generateKeyPairSync("ed25519", PEM);
-    return { type: "ed25519", quantumSafe: false, publicKey, privateKey };
+    return asymmetric("ed25519", node_crypto_1.default.generateKeyPairSync("ed25519"), {});
 }
 function generateRsa(args) {
-    const modulusLength = Number(args.modulusLength) || 2048;
+    const modulusLength = Number(args.modulusLength ?? 2048);
     if (!definitions_1.RSA_MODULUS_LENGTHS.includes(modulusLength)) {
         throw new Error(`Unsupported RSA modulus length: ${modulusLength} (allowed: ${definitions_1.RSA_MODULUS_LENGTHS.join(", ")})`);
     }
-    const { publicKey, privateKey } = node_crypto_1.default.generateKeyPairSync("rsa", {
-        modulusLength,
-        ...PEM,
-    });
-    return {
-        type: "rsa",
-        bits: modulusLength,
-        quantumSafe: false,
-        publicKey,
-        privateKey,
-    };
+    const pair = node_crypto_1.default.generateKeyPairSync("rsa", { modulusLength });
+    return asymmetric("rsa", pair, { bits: modulusLength });
 }
 function generateEcc(args) {
-    const namedCurve = args.curve || "prime256v1";
+    const namedCurve = String(args.curve ?? "prime256v1");
     if (!definitions_1.EC_CURVES.includes(namedCurve)) {
         throw new Error(`Unsupported curve: ${namedCurve} (allowed: ${definitions_1.EC_CURVES.join(", ")})`);
     }
-    const { publicKey, privateKey } = node_crypto_1.default.generateKeyPairSync("ec", {
-        namedCurve,
-        ...PEM,
-    });
-    return {
-        type: "ecc",
-        curve: namedCurve,
-        quantumSafe: false,
-        publicKey,
-        privateKey,
-    };
+    const pair = node_crypto_1.default.generateKeyPairSync("ec", { namedCurve });
+    return asymmetric("ecc", pair, { curve: namedCurve });
 }
 function generateMlKem768() {
     const { publicKey, secretKey } = (0, crypto_lib_1.mlKemKeygen)(768);
     return {
-        type: "ml-kem-768",
-        standard: "NIST FIPS 203",
-        securityCategory: 3,
-        quantumSafe: true,
-        encoding: "hex",
-        publicKey,
-        privateKey: secretKey,
+        kind: "ml-kem-768",
+        secret: Buffer.from(secretKey, "hex"),
+        info: {
+            standard: "NIST FIPS 203",
+            securityCategory: 3,
+            quantumSafe: true,
+            encoding: "hex",
+            publicKey,
+        },
+    };
+}
+function generateSymmetric() {
+    return (0, keystore_1.symmetricKey)(node_crypto_1.default.randomBytes(32), "generated");
+}
+function generateHmac() {
+    return {
+        kind: "hmac-sha256",
+        secret: node_crypto_1.default.randomBytes(32),
+        info: { bits: 256, usage: "crypto_sign, crypto_verify" },
     };
 }
 const GENERATORS = {
@@ -67,17 +70,29 @@ const GENERATORS = {
     rsa: generateRsa,
     ecc: generateEcc,
     "ml-kem-768": generateMlKem768,
+    "symmetric-256": generateSymmetric,
+    "hmac-sha256": generateHmac,
 };
 const generateKey = async (args) => {
-    const type = args.type || "ed25519";
+    const type = String(args.type);
     const generator = Object.hasOwn(GENERATORS, type)
         ? GENERATORS[type]
         : undefined;
     if (!generator)
         return (0, result_1.errorResult)(`Unsupported key type: ${type}`);
-    return (0, result_1.jsonResult)(generator(args));
+    return (0, result_1.jsonResult)(keystore_1.keyStore.describe(keystore_1.keyStore.add(generator(args))));
 };
 exports.generateKey = generateKey;
+const listKeys = async () => (0, result_1.jsonResult)({ keys: keystore_1.keyStore.list(), capacity: keystore_1.keyStore.capacity });
+exports.listKeys = listKeys;
+const destroyKey = async (args) => {
+    const keyHandle = String(args.keyHandle);
+    if (!keystore_1.keyStore.remove(keyHandle)) {
+        return (0, result_1.errorResult)("Unknown key handle: nothing was destroyed");
+    }
+    return (0, result_1.jsonResult)({ keyHandle, destroyed: true });
+};
+exports.destroyKey = destroyKey;
 function classifyKey(keyData) {
     if (keyData.includes("-----BEGIN PGP"))
         return "OpenPGP Key Block";
@@ -97,7 +112,7 @@ function keyFormat(keyData) {
     return keyData.includes("-----BEGIN") ? "PEM" : "Raw";
 }
 const inspectKey = async (args) => {
-    const keyData = args.keyData ? String(args.keyData).trim() : "";
+    const keyData = String(args.keyData).trim();
     const fingerprint = node_crypto_1.default
         .createHash("sha256")
         .update(keyData)

package/dist/tools/keystore.d.ts

@@ -0,0 +1,25 @@
+import crypto from "node:crypto";
+export type KeyKind = "ed25519" | "rsa" | "ecc" | "ml-kem-768" | "symmetric-256" | "hmac-sha256";
+export interface KeyMaterial {
+    kind: KeyKind;
+    info: Record<string, unknown>;
+    privateKey?: crypto.KeyObject;
+    publicKey?: crypto.KeyObject;
+    secret?: Buffer;
+}
+export declare const MAX_KEYS = 64;
+export declare const KEY_HANDLE_PATTERN = "^kh_[0-9a-f]{32}$";
+export declare function symmetricKey(secret: Buffer, source: string): KeyMaterial;
+export declare class KeyStore {
+    readonly capacity: number;
+    private readonly keys;
+    constructor(capacity?: number);
+    get size(): number;
+    add(material: KeyMaterial): string;
+    use(handle: string, kinds: readonly KeyKind[]): KeyMaterial;
+    describe(handle: string): Record<string, unknown>;
+    list(): Array<Record<string, unknown>>;
+    remove(handle: string): boolean;
+}
+export declare const keyStore: KeyStore;
+//# sourceMappingURL=keystore.d.ts.map

package/dist/tools/keystore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keystore.d.ts","sourceRoot":"","sources":["../../src/tools/keystore.ts"],"names":[],"mappings":"AAEA,OAAO,MAAM,MAAM,aAAa,CAAC;AAYjC,MAAM,MAAM,OAAO,GACjB,SAAS,GAAG,KAAK,GAAG,KAAK,GAAG,YAAY,GAAG,eAAe,GAAG,aAAa,CAAC;AAG7E,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,OAAO,CAAC;IAEd,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAE9B,UAAU,CAAC,EAAE,MAAM,CAAC,SAAS,CAAC;IAE9B,SAAS,CAAC,EAAE,MAAM,CAAC,SAAS,CAAC;IAE7B,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAOD,eAAO,MAAM,QAAQ,KAAK,CAAC;AAG3B,eAAO,MAAM,kBAAkB,sBAAsB,CAAC;AAMtD,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,WAAW,CAUxE;AAQD,qBAAa,QAAQ;aAIgB,QAAQ,EAAE,MAAM;IAHnD,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAgC;gBAGlB,QAAQ,GAAE,MAAiB;IAG9D,IAAW,IAAI,IAAI,MAAM,CAExB;IAGM,GAAG,CAAC,QAAQ,EAAE,WAAW,GAAG,MAAM;IAiBlC,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,OAAO,EAAE,GAAG,WAAW;IAkB3D,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAWjD,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAKtC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO;CAOvC;AAGD,eAAO,MAAM,QAAQ,UAAiB,CAAC"}

package/dist/tools/keystore.js

@@ -0,0 +1,81 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.keyStore = exports.KeyStore = exports.KEY_HANDLE_PATTERN = exports.MAX_KEYS = void 0;
+exports.symmetricKey = symmetricKey;
+const node_crypto_1 = __importDefault(require("node:crypto"));
+exports.MAX_KEYS = 64;
+exports.KEY_HANDLE_PATTERN = "^kh_[0-9a-f]{32}$";
+function symmetricKey(secret, source) {
+    return {
+        kind: "symmetric-256",
+        secret,
+        info: {
+            bits: 256,
+            source,
+            usage: "crypto_encrypt, crypto_decrypt, crypto_kms_wrap",
+        },
+    };
+}
+function wipe(key) {
+    key.secret?.fill(0);
+}
+class KeyStore {
+    capacity;
+    keys = new Map();
+    constructor(capacity = exports.MAX_KEYS) {
+        this.capacity = capacity;
+    }
+    get size() {
+        return this.keys.size;
+    }
+    add(material) {
+        const handle = `kh_${node_crypto_1.default.randomBytes(16).toString("hex")}`;
+        this.keys.set(handle, {
+            ...material,
+            createdAt: new Date().toISOString(),
+        });
+        while (this.keys.size > this.capacity) {
+            const oldest = this.keys.keys().next().value;
+            this.remove(oldest);
+        }
+        return handle;
+    }
+    use(handle, kinds) {
+        const key = this.keys.get(handle);
+        if (!key) {
+            throw new Error("Unknown key handle: it was never issued, or the key was destroyed or evicted");
+        }
+        if (!kinds.includes(key.kind)) {
+            throw new Error(`Key handle refers to a ${key.kind} key; this tool needs ${kinds.join(" or ")}`);
+        }
+        this.keys.delete(handle);
+        this.keys.set(handle, key);
+        return key;
+    }
+    describe(handle) {
+        const key = this.keys.get(handle);
+        return {
+            keyHandle: handle,
+            type: key.kind,
+            createdAt: key.createdAt,
+            ...key.info,
+        };
+    }
+    list() {
+        return [...this.keys.keys()].map((handle) => this.describe(handle));
+    }
+    remove(handle) {
+        const key = this.keys.get(handle);
+        if (!key)
+            return false;
+        wipe(key);
+        this.keys.delete(handle);
+        return true;
+    }
+}
+exports.KeyStore = KeyStore;
+exports.keyStore = new KeyStore();
+//# sourceMappingURL=keystore.js.map

package/dist/tools/kms.d.ts

@@ -1,4 +1,5 @@
 import { ToolHandler } from "./result";
+export declare const MAX_KEK_LABELS = 64;
 export declare const kmsWrap: ToolHandler;
 export declare const kmsUnwrap: ToolHandler;
 //# sourceMappingURL=kms.d.ts.map

package/dist/tools/kms.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"kms.d.ts","sourceRoot":"","sources":["../../src/tools/kms.ts"],"names":[],"mappings":"AAGA,OAAO,EAAY,WAAW,EAA2B,MAAM,UAAU,CAAC;AA4C1E,eAAO,MAAM,OAAO,EAAE,WAerB,CAAC;AAGF,eAAO,MAAM,SAAS,EAAE,WAkBvB,CAAC"}
+{"version":3,"file":"kms.d.ts","sourceRoot":"","sources":["../../src/tools/kms.ts"],"names":[],"mappings":"AAIA,OAAO,EAAY,WAAW,EAAc,MAAM,UAAU,CAAC;AAe7D,eAAO,MAAM,cAAc,KAAK,CAAC;AA2CjC,eAAO,MAAM,OAAO,EAAE,WAmBrB,CAAC;AAMF,eAAO,MAAM,SAAS,EAAE,WAgBvB,CAAC"}

package/dist/tools/kms.js

@@ -1,16 +1,19 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.kmsUnwrap = exports.kmsWrap = void 0;
+exports.kmsUnwrap = exports.kmsWrap = exports.MAX_KEK_LABELS = void 0;
 const crypto_kms_1 = require("@sebastienrousseau/crypto-kms");
+const keystore_1 = require("./keystore");
 const result_1 = require("./result");
+const symmetric_1 = require("./symmetric");
 const localKms = new crypto_kms_1.LocalKmsProvider();
 const localKeyIds = new Map();
+exports.MAX_KEK_LABELS = 64;
 function kmsRequest(args) {
-    const provider = String(args.provider || "local");
+    const provider = String(args.provider);
     if (provider !== "local") {
         throw new Error(`KMS provider '${provider}' is not configured in this server; only 'local' is available`);
     }
-    return { provider, keyId: String(args.keyId || "kms-key-default") };
+    return { provider, keyId: String(args.keyId) };
 }
 function wrapContext(keyId) {
     return { purpose: "crypto-mcp-dek-wrap", keyId };
@@ -19,6 +22,9 @@ async function localKeyFor(label) {
     const existing = localKeyIds.get(label);
     if (existing)
         return existing;
+    if (localKeyIds.size >= exports.MAX_KEK_LABELS) {
+        throw new Error(`At most ${exports.MAX_KEK_LABELS} KEK labels can be created; reuse an existing keyId`);
+    }
     const created = await localKms.createKey("aes-256-gcm", "wrap", {
         label,
     });
@@ -27,15 +33,20 @@ async function localKeyFor(label) {
 }
 const kmsWrap = async (args) => {
     const { provider, keyId } = kmsRequest(args);
-    const dek = (0, result_1.parseKey256)(args.dek, "dek");
-    const kmsKeyId = await localKeyFor(keyId);
-    const { ciphertext } = await localKms.encrypt(kmsKeyId, dek, wrapContext(keyId));
-    return (0, result_1.jsonResult)({
-        provider,
-        keyId,
-        status: "wrapped",
-        wrappedKey: Buffer.from(ciphertext, "base64").toString("hex"),
-    });
+    const dek = Buffer.from((0, symmetric_1.symmetricSecret)(args.keyHandle));
+    try {
+        const kmsKeyId = await localKeyFor(keyId);
+        const { ciphertext } = await localKms.encrypt(kmsKeyId, dek, wrapContext(keyId));
+        return (0, result_1.jsonResult)({
+            provider,
+            keyId,
+            status: "wrapped",
+            wrappedKey: Buffer.from(ciphertext, "base64").toString("hex"),
+        });
+    }
+    finally {
+        dek.fill(0);
+    }
 };
 exports.kmsWrap = kmsWrap;
 const kmsUnwrap = async (args) => {
@@ -46,12 +57,10 @@ const kmsUnwrap = async (args) => {
     }
     const wrapped = Buffer.from(String(args.wrappedKey), "hex");
     const { plaintext } = await localKms.decrypt(kmsKeyId, wrapped.toString("base64"), wrapContext(keyId));
-    return (0, result_1.jsonResult)({
-        provider,
-        keyId,
-        status: "unwrapped",
-        dek: Buffer.from(plaintext).toString("hex"),
-    });
+    const dek = Buffer.from(plaintext);
+    plaintext.fill(0);
+    const keyHandle = keystore_1.keyStore.add((0, keystore_1.symmetricKey)(dek, "crypto_kms_unwrap"));
+    return (0, result_1.jsonResult)({ provider, keyId, status: "unwrapped", keyHandle });
 };
 exports.kmsUnwrap = kmsUnwrap;
 //# sourceMappingURL=kms.js.map

package/dist/tools/result.d.ts

@@ -3,5 +3,4 @@ export type ToolArgs = Record<string, unknown>;
 export type ToolHandler = (args: ToolArgs) => Promise<MCPCallToolResult>;
 export declare function jsonResult(value: unknown): MCPCallToolResult;
 export declare function errorResult(text: string): MCPCallToolResult;
-export declare function parseKey256(value: unknown, label?: string): Buffer;
 //# sourceMappingURL=result.d.ts.map

package/dist/tools/result.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"result.d.ts","sourceRoot":"","sources":["../../src/tools/result.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAG7C,MAAM,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAG/C,MAAM,MAAM,WAAW,GAAG,CAAC,IAAI,EAAE,QAAQ,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAC;AAGzE,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,iBAAiB,CAI5D;AAGD,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,iBAAiB,CAE3D;AAOD,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,SAAQ,GAAG,MAAM,CAQjE"}
+{"version":3,"file":"result.d.ts","sourceRoot":"","sources":["../../src/tools/result.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAG7C,MAAM,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAG/C,MAAM,MAAM,WAAW,GAAG,CAAC,IAAI,EAAE,QAAQ,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAC;AAGzE,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,iBAAiB,CAI5D;AAGD,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,iBAAiB,CAE3D"}

package/dist/tools/result.js

@@ -2,7 +2,6 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.jsonResult = jsonResult;
 exports.errorResult = errorResult;
-exports.parseKey256 = parseKey256;
 function jsonResult(value) {
     return {
         content: [{ type: "text", text: JSON.stringify(value, null, 2) }],
@@ -11,11 +10,4 @@ function jsonResult(value) {
 function errorResult(text) {
     return { isError: true, content: [{ type: "text", text }] };
 }
-function parseKey256(value, label = "key") {
-    const hex = String(value ?? "");
-    if (!/^[0-9a-fA-F]{64}$/.test(hex)) {
-        throw new Error(`${label} must be a 256-bit key encoded as 64 hex characters`);
-    }
-    return Buffer.from(hex, "hex");
-}
 //# sourceMappingURL=result.js.map

package/dist/tools/signing.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"signing.d.ts","sourceRoot":"","sources":["../../src/tools/signing.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,WAAW,EAAc,MAAM,UAAU,CAAC;AAGnD,eAAO,MAAM,IAAI,EAAE,WAwBlB,CAAC;AAiCF,eAAO,MAAM,MAAM,EAAE,WASpB,CAAC;AAGF,eAAO,MAAM,IAAI,EAAE,WAUlB,CAAC"}
+{"version":3,"file":"signing.d.ts","sourceRoot":"","sources":["../../src/tools/signing.ts"],"names":[],"mappings":"AAKA,OAAO,EAAY,WAAW,EAAc,MAAM,UAAU,CAAC;AA0D7D,eAAO,MAAM,IAAI,EAAE,WAalB,CAAC;AAwDF,eAAO,MAAM,MAAM,EAAE,WASpB,CAAC;AAGF,eAAO,MAAM,IAAI,EAAE,WAUlB,CAAC"}