@sebastienrousseau/crypto-mcp 0.0.9 → 0.0.25

package/dist/tools/annotations.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"annotations.d.ts","sourceRoot":"","sources":["../../src/tools/annotations.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AA8CnD,wBAAgB,cAAc,CAC5B,IAAI,EAAE,MAAM,GACX;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,kBAAkB,CAAA;CAAE,GAAG,SAAS,CAKhE"}
+{"version":3,"file":"annotations.d.ts","sourceRoot":"","sources":["../../src/tools/annotations.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAkEnD,wBAAgB,cAAc,CAC5B,IAAI,EAAE,MAAM,GACX;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,kBAAkB,CAAA;CAAE,GAAG,SAAS,CAKhE"}

package/dist/tools/annotations.js

@@ -31,6 +31,26 @@ const TOOL_BEHAVIOUR = {
     crypto_decrypt: ["Decrypt data", "read"],
     crypto_kem_encapsulate: ["Encapsulate a shared secret", "add"],
     crypto_kem_decapsulate: ["Decapsulate a shared secret", "add"],
+    crypto_hybrid_kem_encapsulate: ["Hybrid post-quantum KEM encapsulate", "add"],
+    crypto_hybrid_kem_decapsulate: ["Hybrid post-quantum KEM decapsulate", "add"],
+    crypto_hybrid_kem_multi_encapsulate: [
+        "Multi-recipient hybrid KEM encapsulate",
+        "add",
+    ],
+    crypto_hybrid_kem_multi_decapsulate: [
+        "Multi-recipient hybrid KEM decapsulate",
+        "add",
+    ],
+    crypto_stream_encrypt: ["Stream encrypt data (post-quantum)", "read"],
+    crypto_stream_decrypt: ["Stream decrypt data (post-quantum)", "read"],
+    crypto_stream_multi_encrypt: [
+        "Multi-recipient stream encrypt data (post-quantum)",
+        "read",
+    ],
+    crypto_stream_multi_decrypt: [
+        "Multi-recipient stream decrypt data (post-quantum)",
+        "read",
+    ],
     crypto_sign: ["Sign data", "read"],
     crypto_verify: ["Verify a signature", "read"],
     crypto_hash: ["Hash data", "read"],

package/dist/tools/definitions.d.ts

@@ -1,11 +1,10 @@
 import { MCPTool } from "../types";
 export declare const KEY_TYPES: string[];
+export declare const ML_KEM_LEVELS: number[];
 export declare const RSA_MODULUS_LENGTHS: number[];
 export declare const EC_CURVES: string[];
 export declare const KEY_DIR_ENV = "CRYPTO_MCP_KEY_DIR";
 export declare const MAX_KEY_FILE_BYTES = 65536;
 export declare const HASH_ALGORITHMS: string[];
-export declare const MAX_TEXT_LENGTH = 1048576;
-export declare const MAX_KEY_LENGTH = 16384;
 export declare const TOOLS: MCPTool[];
 //# sourceMappingURL=definitions.d.ts.map

package/dist/tools/definitions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"definitions.d.ts","sourceRoot":"","sources":["../../src/tools/definitions.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAA4B,MAAM,UAAU,CAAC;AAK7D,eAAO,MAAM,SAAS,UAOrB,CAAC;AAGF,eAAO,MAAM,mBAAmB,UAAqB,CAAC;AAGtD,eAAO,MAAM,SAAS,UAA2C,CAAC;AAGlE,eAAO,MAAM,WAAW,uBAAuB,CAAC;AAGhD,eAAO,MAAM,kBAAkB,QAAS,CAAC;AASzC,eAAO,MAAM,eAAe,UAM3B,CAAC;AASF,eAAO,MAAM,eAAe,UAAY,CAAC;AAGzC,eAAO,MAAM,cAAc,QAAS,CAAC;AAgVrC,eAAO,MAAM,KAAK,EAAE,OAAO,EAKiC,CAAC"}
+{"version":3,"file":"definitions.d.ts","sourceRoot":"","sources":["../../src/tools/definitions.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAA4B,MAAM,UAAU,CAAC;AAgB7D,eAAO,MAAM,SAAS,UAarB,CAAC;AAGF,eAAO,MAAM,aAAa,UAAmB,CAAC;AAG9C,eAAO,MAAM,mBAAmB,UAAqB,CAAC;AAGtD,eAAO,MAAM,SAAS,UAA2C,CAAC;AAGlE,eAAO,MAAM,WAAW,uBAAuB,CAAC;AAGhD,eAAO,MAAM,kBAAkB,QAAS,CAAC;AASzC,eAAO,MAAM,eAAe,UAM3B,CAAC;AA4WF,eAAO,MAAM,KAAK,EAAE,OAAO,EAMiC,CAAC"}

package/dist/tools/definitions.js

@@ -1,16 +1,25 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.TOOLS = exports.MAX_KEY_LENGTH = exports.MAX_TEXT_LENGTH = exports.HASH_ALGORITHMS = exports.MAX_KEY_FILE_BYTES = exports.KEY_DIR_ENV = exports.EC_CURVES = exports.RSA_MODULUS_LENGTHS = exports.KEY_TYPES = void 0;
+exports.TOOLS = exports.HASH_ALGORITHMS = exports.MAX_KEY_FILE_BYTES = exports.KEY_DIR_ENV = exports.EC_CURVES = exports.RSA_MODULUS_LENGTHS = exports.ML_KEM_LEVELS = exports.KEY_TYPES = void 0;
 const keystore_1 = require("./keystore");
 const annotations_1 = require("./annotations");
+const stream_definitions_1 = require("./stream-definitions");
+const schema_helpers_1 = require("./schema-helpers");
 exports.KEY_TYPES = [
     "rsa",
     "ecc",
     "ed25519",
+    "x25519",
+    "ml-kem-512",
     "ml-kem-768",
+    "ml-kem-1024",
+    "ml-dsa-44",
+    "ml-dsa-65",
+    "ml-dsa-87",
     "symmetric-256",
     "hmac-sha256",
 ];
+exports.ML_KEM_LEVELS = [512, 768, 1024];
 exports.RSA_MODULUS_LENGTHS = [2048, 3072, 4096];
 exports.EC_CURVES = ["prime256v1", "secp384r1", "secp256k1"];
 exports.KEY_DIR_ENV = "CRYPTO_MCP_KEY_DIR";
@@ -26,36 +35,7 @@ exports.HASH_ALGORITHMS = [
 ];
 const AEAD_ALGORITHMS = ["aes-256-gcm", "chacha20-poly1305"];
 const KMS_PROVIDERS = ["aws", "gcp", "azure", "vault", "local"];
-exports.MAX_TEXT_LENGTH = 1_048_576;
-exports.MAX_KEY_LENGTH = 16_384;
-const HEX_BYTES = "^(?:[0-9a-fA-F]{2})*$";
-const ML_KEM_768_PUBLIC_KEY_HEX = 2368;
-const ML_KEM_768_CIPHERTEXT_HEX = 2176;
-const HANDLE_NOTE = "Secret key material stays inside the server; only an opaque keyHandle is returned.";
-function keyHandle(description) {
-    return {
-        type: "string",
-        description: `${description} Key handles look like 'kh_' followed by 32 hex characters.`,
-        maxLength: 35,
-        pattern: keystore_1.KEY_HANDLE_PATTERN,
-    };
-}
-function text(description) {
-    return { type: "string", description, maxLength: exports.MAX_TEXT_LENGTH };
-}
-function hex(description, length, upTo = false) {
-    return {
-        type: "string",
-        description,
-        minLength: upTo ? 2 : length,
-        maxLength: length,
-        pattern: HEX_BYTES,
-    };
-}
-function oneOf(description, values) {
-    return { type: "string", description, enum: values };
-}
-const KMS_PROVIDER = oneOf("KMS provider ('aws', 'gcp', 'azure', 'vault', or 'local'). Only 'local' (random, in-process key material that does not survive a restart) is configured; the others return an error.", KMS_PROVIDERS);
+const KMS_PROVIDER = (0, schema_helpers_1.oneOf)("KMS provider ('aws', 'gcp', 'azure', 'vault', or 'local'). Only 'local' (random, in-process key material that does not survive a restart) is configured; the others return an error.", KMS_PROVIDERS);
 const KEK_LABEL = {
     type: "string",
     description: "Label of the Key Encryption Key (KEK). It names the key; it is never used to derive it.",
@@ -65,18 +45,18 @@ const KEK_LABEL = {
 const KEY_TOOLS = [
     {
         name: "crypto_generate_key",
-        description: `Generate a key inside the server: a classical (RSA, ECC, Ed25519) or post-quantum (ML-KEM-768, FIPS 203) keypair, a 256-bit symmetric key, or an HMAC-SHA256 key. Returns a keyHandle and, for keypairs, the public key. ${HANDLE_NOTE}`,
+        description: `Generate a key inside the server: a classical (RSA, ECC, Ed25519) or post-quantum (ML-KEM 512/768/1024 FIPS 203, ML-DSA 44/65/87 FIPS 204) keypair, a 256-bit symmetric key, or an HMAC-SHA256 key. Returns a keyHandle and, for keypairs, the public key. ${schema_helpers_1.HANDLE_NOTE}`,
         inputSchema: {
             type: "object",
             additionalProperties: false,
             properties: {
-                type: oneOf("Key type: 'rsa', 'ecc', 'ed25519', 'ml-kem-768', 'symmetric-256' (for crypto_encrypt, crypto_decrypt and crypto_kms_wrap), or 'hmac-sha256'.", exports.KEY_TYPES),
+                type: (0, schema_helpers_1.oneOf)("Key type: 'rsa', 'ecc', 'ed25519', 'x25519', 'ml-kem-512', 'ml-kem-768', 'ml-kem-1024', 'ml-dsa-44', 'ml-dsa-65', 'ml-dsa-87', 'symmetric-256', or 'hmac-sha256'.", exports.KEY_TYPES),
                 modulusLength: {
                     type: "integer",
                     description: "Modulus length for RSA (2048, 3072, 4096). Default is 2048.",
                     enum: exports.RSA_MODULUS_LENGTHS,
                 },
-                curve: oneOf("Elliptic curve for 'ecc': 'prime256v1' (P-256), 'secp384r1' (P-384), or 'secp256k1'. Default is 'prime256v1'.", exports.EC_CURVES),
+                curve: (0, schema_helpers_1.oneOf)("Elliptic curve for 'ecc': 'prime256v1' (P-256), 'secp384r1' (P-384), or 'secp256k1'. Default is 'prime256v1'.", exports.EC_CURVES),
             },
             required: ["type"],
         },
@@ -96,13 +76,13 @@ const KEY_TOOLS = [
         inputSchema: {
             type: "object",
             additionalProperties: false,
-            properties: { keyHandle: keyHandle("Handle of the key to destroy.") },
+            properties: { keyHandle: (0, schema_helpers_1.keyHandle)("Handle of the key to destroy.") },
             required: ["keyHandle"],
         },
     },
     {
         name: "crypto_key_import",
-        description: `Import an existing key from a file in the directory the server operator set in ${exports.KEY_DIR_ENV} (disabled when it is unset). Reads an unencrypted PKCS#8 PEM private key (Ed25519, RSA 2048/3072/4096, ECDSA P-256/P-384/secp256k1; the type comes from the key) or a raw 32-byte key, as 32 binary bytes or 64 hex digits, imported as 'symmetric-256' (default) or 'hmac-sha256'. Files over ${exports.MAX_KEY_FILE_BYTES} bytes are refused. The key bytes never pass through the conversation. ${HANDLE_NOTE}`,
+        description: `Import an existing key from a file in the directory the server operator set in ${exports.KEY_DIR_ENV} (disabled when it is unset). Reads an unencrypted PKCS#8 PEM private key (Ed25519, RSA 2048/3072/4096, ECDSA P-256/P-384/secp256k1; the type comes from the key) or a raw 32-byte key, as 32 binary bytes or 64 hex digits, imported as 'symmetric-256' (default) or 'hmac-sha256'. Files over ${exports.MAX_KEY_FILE_BYTES} bytes are refused. The key bytes never pass through the conversation. ${schema_helpers_1.HANDLE_NOTE}`,
         inputSchema: {
             type: "object",
             additionalProperties: false,
@@ -113,7 +93,7 @@ const KEY_TOOLS = [
                     minLength: 1,
                     maxLength: MAX_KEY_PATH_LENGTH,
                 },
-                kind: oneOf("For a raw 32-byte key only: 'symmetric-256' (crypto_encrypt, crypto_decrypt, crypto_kms_wrap; default) or 'hmac-sha256' (crypto_sign, crypto_verify).", RAW_KEY_KINDS),
+                kind: (0, schema_helpers_1.oneOf)("For a raw 32-byte key only: 'symmetric-256' (crypto_encrypt, crypto_decrypt, crypto_kms_wrap; default) or 'hmac-sha256' (crypto_sign, crypto_verify).", RAW_KEY_KINDS),
             },
             required: ["path"],
         },
@@ -128,7 +108,7 @@ const KEY_TOOLS = [
                 keyData: {
                     type: "string",
                     description: "PEM or armored key string.",
-                    maxLength: exports.MAX_KEY_LENGTH,
+                    maxLength: schema_helpers_1.MAX_KEY_LENGTH,
                 },
             },
             required: ["keyData"],
@@ -138,14 +118,14 @@ const KEY_TOOLS = [
 const CIPHER_TOOLS = [
     {
         name: "crypto_encrypt",
-        description: `Encrypt plaintext with authenticated encryption (AES-256-GCM or ChaCha20-Poly1305) under a symmetric-256 key handle. Without keyHandle, a new key is generated and its handle returned. ${HANDLE_NOTE}`,
+        description: `Encrypt plaintext with authenticated encryption (AES-256-GCM or ChaCha20-Poly1305) under a symmetric-256 key handle. Without keyHandle, a new key is generated and its handle returned. ${schema_helpers_1.HANDLE_NOTE}`,
         inputSchema: {
             type: "object",
             additionalProperties: false,
             properties: {
-                plaintext: text("Plaintext string to encrypt."),
-                algorithm: oneOf("Encryption algorithm ('aes-256-gcm' or 'chacha20-poly1305'). Default is 'aes-256-gcm'.", AEAD_ALGORITHMS),
-                keyHandle: keyHandle("Handle of a symmetric-256 key. If omitted, a new key is generated."),
+                plaintext: (0, schema_helpers_1.text)("Plaintext string to encrypt."),
+                algorithm: (0, schema_helpers_1.oneOf)("Encryption algorithm ('aes-256-gcm' or 'chacha20-poly1305'). Default is 'aes-256-gcm'.", AEAD_ALGORITHMS),
+                keyHandle: (0, schema_helpers_1.keyHandle)("Handle of a symmetric-256 key. If omitted, a new key is generated."),
             },
             required: ["plaintext"],
         },
@@ -157,71 +137,124 @@ const CIPHER_TOOLS = [
             type: "object",
             additionalProperties: false,
             properties: {
-                ciphertext: hex("Hex-encoded ciphertext.", 2 * exports.MAX_TEXT_LENGTH, true),
-                algorithm: oneOf("Algorithm used for encryption ('aes-256-gcm' or 'chacha20-poly1305'). Default is 'aes-256-gcm'.", AEAD_ALGORITHMS),
-                keyHandle: keyHandle("Handle of the symmetric-256 key."),
-                iv: hex("Hex-encoded 96-bit nonce (24 hex characters).", 24),
-                authTag: hex("Hex-encoded 128-bit authentication tag.", 32),
+                ciphertext: (0, schema_helpers_1.hex)("Hex-encoded ciphertext.", 2 * schema_helpers_1.MAX_TEXT_LENGTH, true),
+                algorithm: (0, schema_helpers_1.oneOf)("Algorithm used for encryption ('aes-256-gcm' or 'chacha20-poly1305'). Default is 'aes-256-gcm'.", AEAD_ALGORITHMS),
+                keyHandle: (0, schema_helpers_1.keyHandle)("Handle of the symmetric-256 key."),
+                iv: (0, schema_helpers_1.hex)("Hex-encoded 96-bit nonce (24 hex characters).", 24),
+                authTag: (0, schema_helpers_1.hex)("Hex-encoded 128-bit authentication tag.", 32),
             },
             required: ["ciphertext", "keyHandle", "iv", "authTag"],
         },
     },
     {
         name: "crypto_kem_encapsulate",
-        description: `Encapsulate a shared secret to an ML-KEM-768 (FIPS 203) public key. Returns the KEM ciphertext for the recipient and a symmetric-256 keyHandle for the shared secret, usable with crypto_encrypt. ${HANDLE_NOTE}`,
+        description: `Encapsulate a shared secret to an ML-KEM (FIPS 203) public key (512, 768, 1024). Returns the KEM ciphertext for the recipient and a symmetric-256 keyHandle for the shared secret, usable with crypto_encrypt. ${schema_helpers_1.HANDLE_NOTE}`,
         inputSchema: {
             type: "object",
             additionalProperties: false,
             properties: {
-                publicKey: hex("Hex-encoded ML-KEM-768 public key (2368 hex characters).", ML_KEM_768_PUBLIC_KEY_HEX),
+                publicKey: (0, schema_helpers_1.hex)("Hex-encoded ML-KEM public key (1600, 2368, or 3136 hex characters).", 3136, true),
+                level: {
+                    type: "integer",
+                    description: "ML-KEM security level (512, 768, or 1024). Default is 768.",
+                    enum: exports.ML_KEM_LEVELS,
+                },
             },
             required: ["publicKey"],
         },
     },
     {
         name: "crypto_kem_decapsulate",
-        description: `Recover an ML-KEM-768 shared secret with an ml-kem-768 key handle. Returns a symmetric-256 keyHandle for the shared secret. ${HANDLE_NOTE}`,
+        description: `Recover an ML-KEM shared secret with an ml-kem key handle (512, 768, 1024). Returns a symmetric-256 keyHandle for the shared secret. ${schema_helpers_1.HANDLE_NOTE}`,
         inputSchema: {
             type: "object",
             additionalProperties: false,
             properties: {
-                keyHandle: keyHandle("Handle of the ml-kem-768 key."),
-                ciphertext: hex("Hex-encoded ML-KEM-768 ciphertext (2176 hex characters).", ML_KEM_768_CIPHERTEXT_HEX),
+                keyHandle: (0, schema_helpers_1.keyHandle)("Handle of the ml-kem key."),
+                ciphertext: (0, schema_helpers_1.hex)("Hex-encoded ML-KEM ciphertext (1536, 2176, or 3136 hex characters).", 3136, true),
+                level: {
+                    type: "integer",
+                    description: "ML-KEM security level (512, 768, or 1024). Default is inferred from key or 768.",
+                    enum: exports.ML_KEM_LEVELS,
+                },
             },
             required: ["keyHandle", "ciphertext"],
         },
     },
+    {
+        name: "crypto_hybrid_kem_encapsulate",
+        description: `Encapsulate a shared secret using Post-Quantum Hybrid KEM (X25519 + ML-KEM, RFC 9180/10024). Returns the classical ephemeral public key, ML-KEM ciphertext, and a symmetric-256 keyHandle for the combined shared secret. ${schema_helpers_1.HANDLE_NOTE}`,
+        inputSchema: {
+            type: "object",
+            additionalProperties: false,
+            properties: {
+                x25519PublicKey: (0, schema_helpers_1.hex)("Hex-encoded recipient X25519 public key (64 hex characters).", schema_helpers_1.X25519_PUBLIC_KEY_HEX),
+                mlKemPublicKey: (0, schema_helpers_1.hex)("Hex-encoded recipient ML-KEM public key (1600, 2368, or 3136 hex characters).", 3136, true),
+                level: {
+                    type: "integer",
+                    description: "ML-KEM security level (512, 768, or 1024). Default is 768.",
+                    enum: exports.ML_KEM_LEVELS,
+                },
+            },
+            required: ["x25519PublicKey", "mlKemPublicKey"],
+        },
+    },
+    {
+        name: "crypto_hybrid_kem_decapsulate",
+        description: `Recover a Post-Quantum Hybrid KEM shared secret (X25519 + ML-KEM) using server-held x25519 and ml-kem key handles. Returns a symmetric-256 keyHandle for the combined shared secret. ${schema_helpers_1.HANDLE_NOTE}`,
+        inputSchema: {
+            type: "object",
+            additionalProperties: false,
+            properties: {
+                x25519KeyHandle: (0, schema_helpers_1.keyHandle)("Handle of the recipient X25519 key."),
+                mlKemKeyHandle: (0, schema_helpers_1.keyHandle)("Handle of the recipient ML-KEM key."),
+                x25519EphemeralPublic: (0, schema_helpers_1.hex)("Hex-encoded sender ephemeral X25519 public key (64 hex characters).", schema_helpers_1.X25519_PUBLIC_KEY_HEX),
+                mlKemCiphertext: (0, schema_helpers_1.hex)("Hex-encoded ML-KEM ciphertext (1536, 2176, or 3136 hex characters).", 3136, true),
+                level: {
+                    type: "integer",
+                    description: "ML-KEM security level (512, 768, or 1024). Default is inferred from key or 768.",
+                    enum: exports.ML_KEM_LEVELS,
+                },
+            },
+            required: [
+                "x25519KeyHandle",
+                "mlKemKeyHandle",
+                "x25519EphemeralPublic",
+                "mlKemCiphertext",
+            ],
+        },
+    },
 ];
 const SIGNATURE_TOOLS = [
     {
         name: "crypto_sign",
-        description: "Sign data with a key handle. The algorithm follows the key: Ed25519, RSASSA-PSS (SHA-256), ECDSA (SHA-256; SHA-384 on P-384), or HMAC-SHA256.",
+        description: "Sign data with a key handle. The algorithm follows the key: Ed25519, RSASSA-PSS (SHA-256), ECDSA (SHA-256; SHA-384 on P-384), ML-DSA (44, 65, 87, FIPS 204), or HMAC-SHA256.",
         inputSchema: {
             type: "object",
             additionalProperties: false,
             properties: {
-                data: text("Data string to sign."),
-                keyHandle: keyHandle("Handle of an ed25519, rsa, ecc, or hmac-sha256 key."),
+                data: (0, schema_helpers_1.text)("Data string to sign."),
+                keyHandle: (0, schema_helpers_1.keyHandle)("Handle of an ed25519, rsa, ecc, ml-dsa, or hmac-sha256 key."),
             },
             required: ["data", "keyHandle"],
         },
     },
     {
         name: "crypto_verify",
-        description: "Verify a signature against a public key PEM (Ed25519, RSA-PSS, ECDSA) or a key handle (also HMAC-SHA256). Pass exactly one of publicKey or keyHandle.",
+        description: "Verify a signature against a public key (SPKI PEM or ML-DSA hex) or a key handle (also HMAC-SHA256). Pass exactly one of publicKey or keyHandle.",
         inputSchema: {
             type: "object",
             additionalProperties: false,
             properties: {
-                data: text("Original data string."),
-                signature: hex("Hex-encoded signature.", 1024, true),
+                data: (0, schema_helpers_1.text)("Original data string."),
+                signature: (0, schema_helpers_1.hex)("Hex-encoded signature.", schema_helpers_1.MAX_KEY_LENGTH, true),
                 publicKey: {
                     type: "string",
-                    description: "Public key in SPKI PEM format. Private keys are refused.",
+                    description: "Public key in SPKI PEM format or ML-DSA hex format. Private keys are refused.",
                     minLength: 1,
-                    maxLength: exports.MAX_KEY_LENGTH,
+                    maxLength: schema_helpers_1.MAX_KEY_LENGTH,
                 },
-                keyHandle: keyHandle("Handle of an ed25519, rsa, ecc, or hmac-sha256 key."),
+                keyHandle: (0, schema_helpers_1.keyHandle)("Handle of an ed25519, rsa, ecc, ml-dsa, or hmac-sha256 key."),
             },
             required: ["data", "signature"],
         },
@@ -233,8 +266,8 @@ const SIGNATURE_TOOLS = [
             type: "object",
             additionalProperties: false,
             properties: {
-                data: text("Data string to hash."),
-                algorithm: oneOf("Hash algorithm.", exports.HASH_ALGORITHMS),
+                data: (0, schema_helpers_1.text)("Data string to hash."),
+                algorithm: (0, schema_helpers_1.oneOf)("Hash algorithm.", exports.HASH_ALGORITHMS),
             },
             required: ["data"],
         },
@@ -250,21 +283,21 @@ const KMS_AND_AUDIT_TOOLS = [
             properties: {
                 provider: KMS_PROVIDER,
                 keyId: KEK_LABEL,
-                keyHandle: keyHandle("Handle of the symmetric-256 DEK to wrap."),
+                keyHandle: (0, schema_helpers_1.keyHandle)("Handle of the symmetric-256 DEK to wrap."),
             },
             required: ["provider", "keyId", "keyHandle"],
         },
     },
     {
         name: "crypto_kms_unwrap",
-        description: `Unwrap a DEK previously wrapped by crypto_kms_wrap in this server process into a symmetric-256 key handle. Only the 'local' provider is configured. ${HANDLE_NOTE}`,
+        description: `Unwrap a DEK previously wrapped by crypto_kms_wrap in this server process into a symmetric-256 key handle. Only the 'local' provider is configured. ${schema_helpers_1.HANDLE_NOTE}`,
         inputSchema: {
             type: "object",
             additionalProperties: false,
             properties: {
                 provider: KMS_PROVIDER,
                 keyId: KEK_LABEL,
-                wrappedKey: hex("Hex-encoded wrapped key payload.", 1024, true),
+                wrappedKey: (0, schema_helpers_1.hex)("Hex-encoded wrapped key payload.", 1024, true),
             },
             required: ["provider", "keyId", "wrappedKey"],
         },
@@ -289,6 +322,7 @@ const KMS_AND_AUDIT_TOOLS = [
 exports.TOOLS = [
     ...KEY_TOOLS,
     ...CIPHER_TOOLS,
+    ...stream_definitions_1.STREAM_TOOLS,
     ...SIGNATURE_TOOLS,
     ...KMS_AND_AUDIT_TOOLS,
 ].map((tool) => ({ ...tool, ...(0, annotations_1.annotationsFor)(tool.name) }));

package/dist/tools/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/tools/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,iBAAiB,EAAsB,MAAM,UAAU,CAAC;AAYjE,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AACtC,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAwC/C,wBAAsB,WAAW,CAC/B,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GACjC,OAAO,CAAC,iBAAiB,CAAC,CAU5B"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/tools/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,iBAAiB,EAAsB,MAAM,UAAU,CAAC;AAyBjE,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AACtC,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAgD/C,wBAAsB,WAAW,CAC/B,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GACjC,OAAO,CAAC,iBAAiB,CAAC,CAU5B"}

package/dist/tools/index.js

@@ -10,6 +10,7 @@ const keys_1 = require("./keys");
 const kms_1 = require("./kms");
 const result_1 = require("./result");
 const signing_1 = require("./signing");
+const stream_1 = require("./stream");
 const symmetric_1 = require("./symmetric");
 const validate_1 = require("./validate");
 var definitions_2 = require("./definitions");
@@ -23,8 +24,16 @@ const HANDLERS = {
     crypto_key_import: keyimport_1.importKey,
     crypto_kem_encapsulate: kem_1.kemEncapsulate,
     crypto_kem_decapsulate: kem_1.kemDecapsulate,
+    crypto_hybrid_kem_encapsulate: kem_1.hybridKemEncapsulateHandler,
+    crypto_hybrid_kem_decapsulate: kem_1.hybridKemDecapsulateHandler,
+    crypto_hybrid_kem_multi_encapsulate: kem_1.hybridKemMultiEncapsulateHandler,
+    crypto_hybrid_kem_multi_decapsulate: kem_1.hybridKemMultiDecapsulateHandler,
     crypto_encrypt: symmetric_1.encrypt,
     crypto_decrypt: symmetric_1.decrypt,
+    crypto_stream_encrypt: stream_1.streamEncrypt,
+    crypto_stream_decrypt: stream_1.streamDecrypt,
+    crypto_stream_multi_encrypt: stream_1.streamMultiEncrypt,
+    crypto_stream_multi_decrypt: stream_1.streamMultiDecrypt,
     crypto_sign: signing_1.sign,
     crypto_verify: signing_1.verify,
     crypto_hash: signing_1.hash,

package/dist/tools/kem.d.ts

@@ -1,4 +1,8 @@
 import { ToolHandler } from "./result";
 export declare const kemEncapsulate: ToolHandler;
 export declare const kemDecapsulate: ToolHandler;
+export declare const hybridKemEncapsulateHandler: ToolHandler;
+export declare const hybridKemDecapsulateHandler: ToolHandler;
+export declare const hybridKemMultiEncapsulateHandler: ToolHandler;
+export declare const hybridKemMultiDecapsulateHandler: ToolHandler;
 //# sourceMappingURL=kem.d.ts.map

package/dist/tools/kem.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"kem.d.ts","sourceRoot":"","sources":["../../src/tools/kem.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,WAAW,EAAc,MAAM,UAAU,CAAC;AASnD,eAAO,MAAM,cAAc,EAAE,WAS5B,CAAC;AAGF,eAAO,MAAM,cAAc,EAAE,WAW5B,CAAC"}
+{"version":3,"file":"kem.d.ts","sourceRoot":"","sources":["../../src/tools/kem.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,WAAW,EAAc,MAAM,UAAU,CAAC;AA2BnD,eAAO,MAAM,cAAc,EAAE,WAa5B,CAAC;AAGF,eAAO,MAAM,cAAc,EAAE,WAoB5B,CAAC;AAGF,eAAO,MAAM,2BAA2B,EAAE,WAoBzC,CAAC;AAGF,eAAO,MAAM,2BAA2B,EAAE,WAuBzC,CAAC;AAmBF,eAAO,MAAM,gCAAgC,EAAE,WAoC9C,CAAC;AAgEF,eAAO,MAAM,gCAAgC,EAAE,WAqB9C,CAAC"}

package/dist/tools/kem.js

@@ -1,20 +1,156 @@
 "use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.kemDecapsulate = exports.kemEncapsulate = void 0;
+exports.hybridKemMultiDecapsulateHandler = exports.hybridKemMultiEncapsulateHandler = exports.hybridKemDecapsulateHandler = exports.hybridKemEncapsulateHandler = exports.kemDecapsulate = exports.kemEncapsulate = void 0;
+const node_crypto_1 = __importDefault(require("node:crypto"));
 const crypto_lib_1 = require("@sebastienrousseau/crypto-lib");
 const keystore_1 = require("./keystore");
 const result_1 = require("./result");
+function resolveKemLevel(levelArg, defaultLevel = 768) {
+    const num = Number(levelArg);
+    if (num === 512 || num === 768 || num === 1024) {
+        return num;
+    }
+    return defaultLevel;
+}
+function inferLevelFromKey(keyKind) {
+    if (keyKind === "ml-kem-512")
+        return 512;
+    if (keyKind === "ml-kem-1024")
+        return 1024;
+    return 768;
+}
 const kemEncapsulate = async (args) => {
-    const { ciphertext, sharedSecret, algorithm } = (0, crypto_lib_1.mlKemEncap)(768, String(args.publicKey));
-    const keyHandle = keystore_1.keyStore.add((0, keystore_1.symmetricKey)(Buffer.from(sharedSecret, "hex"), "ml-kem-768 encapsulation"));
+    const level = resolveKemLevel(args.level, 768);
+    const { ciphertext, sharedSecret, algorithm } = (0, crypto_lib_1.mlKemEncap)(level, String(args.publicKey));
+    const keyHandle = keystore_1.keyStore.add((0, keystore_1.symmetricKey)(Buffer.from(sharedSecret, "hex"), `${algorithm} encapsulation`));
     return (0, result_1.jsonResult)({ algorithm, ciphertext, keyHandle });
 };
 exports.kemEncapsulate = kemEncapsulate;
 const kemDecapsulate = async (args) => {
-    const key = keystore_1.keyStore.use(String(args.keyHandle), ["ml-kem-768"]);
-    const { sharedSecret, algorithm } = (0, crypto_lib_1.mlKemDecap)(768, key.secret.toString("hex"), String(args.ciphertext));
-    const keyHandle = keystore_1.keyStore.add((0, keystore_1.symmetricKey)(Buffer.from(sharedSecret, "hex"), "ml-kem-768 decapsulation"));
+    const key = keystore_1.keyStore.use(String(args.keyHandle), [
+        "ml-kem-512",
+        "ml-kem-768",
+        "ml-kem-1024",
+    ]);
+    const defaultLevel = inferLevelFromKey(key.kind);
+    const level = resolveKemLevel(args.level, defaultLevel);
+    const { sharedSecret, algorithm } = (0, crypto_lib_1.mlKemDecap)(level, key.secret.toString("hex"), String(args.ciphertext));
+    const keyHandle = keystore_1.keyStore.add((0, keystore_1.symmetricKey)(Buffer.from(sharedSecret, "hex"), `${algorithm} decapsulation`));
     return (0, result_1.jsonResult)({ algorithm, keyHandle });
 };
 exports.kemDecapsulate = kemDecapsulate;
+const hybridKemEncapsulateHandler = async (args) => {
+    const level = resolveKemLevel(args.level, 768);
+    const { x25519EphemeralPublic, mlKemCiphertext, sharedSecret, algorithm } = (0, crypto_lib_1.hybridKemEncapsulate)(level, String(args.x25519PublicKey), String(args.mlKemPublicKey));
+    const keyHandle = keystore_1.keyStore.add((0, keystore_1.symmetricKey)(Buffer.from(sharedSecret, "hex"), `${algorithm} encapsulation`));
+    return (0, result_1.jsonResult)({
+        algorithm,
+        x25519EphemeralPublic,
+        mlKemCiphertext,
+        keyHandle,
+    });
+};
+exports.hybridKemEncapsulateHandler = hybridKemEncapsulateHandler;
+const hybridKemDecapsulateHandler = async (args) => {
+    const xKey = keystore_1.keyStore.use(String(args.x25519KeyHandle), ["x25519"]);
+    const kemKey = keystore_1.keyStore.use(String(args.mlKemKeyHandle), [
+        "ml-kem-512",
+        "ml-kem-768",
+        "ml-kem-1024",
+    ]);
+    const defaultLevel = inferLevelFromKey(kemKey.kind);
+    const level = resolveKemLevel(args.level, defaultLevel);
+    const { sharedSecret, algorithm } = (0, crypto_lib_1.hybridKemDecapsulate)(level, xKey.secret.toString("hex"), kemKey.secret.toString("hex"), String(args.x25519EphemeralPublic), String(args.mlKemCiphertext));
+    const keyHandle = keystore_1.keyStore.add((0, keystore_1.symmetricKey)(Buffer.from(sharedSecret, "hex"), `${algorithm} decapsulation`));
+    return (0, result_1.jsonResult)({ algorithm, keyHandle });
+};
+exports.hybridKemDecapsulateHandler = hybridKemDecapsulateHandler;
+function parseHybridRecipients(raw) {
+    const parsed = JSON.parse(String(raw));
+    if (!Array.isArray(parsed) || parsed.length === 0) {
+        throw new Error("recipients must be a non-empty array of recipient objects");
+    }
+    return parsed;
+}
+const hybridKemMultiEncapsulateHandler = async (args) => {
+    const recipients = parseHybridRecipients(args.recipients);
+    let dek;
+    let keyHandle;
+    if (args.keyHandle !== undefined && args.keyHandle !== null) {
+        keyHandle = String(args.keyHandle);
+        const stored = keystore_1.keyStore.use(keyHandle, ["symmetric-256"]);
+        dek = Buffer.from(stored.secret);
+    }
+    else {
+        dek = node_crypto_1.default.randomBytes(32);
+        keyHandle = keystore_1.keyStore.add((0, keystore_1.symmetricKey)(dek, "multi-recipient hybrid KEM DEK"));
+    }
+    const encryptedRecipients = recipients.map((r) => {
+        const wrapped = (0, crypto_lib_1.wrapDekHybrid)(dek, String(r.x25519PublicKey), String(r.mlKemPublicKey));
+        return {
+            ...(r.id !== undefined ? { id: String(r.id) } : {}),
+            ephemeralPublicKey: wrapped.ephemeralPublicKey,
+            mlKemCiphertext: wrapped.mlKemCiphertext,
+            wrappedKey: wrapped.wrappedKey,
+            encryptedKey: wrapped.wrappedKey,
+        };
+    });
+    return (0, result_1.jsonResult)({
+        algorithm: "multi-hybrid-kem-768-aes-256-gcm",
+        keyHandle,
+        recipients: encryptedRecipients,
+    });
+};
+exports.hybridKemMultiEncapsulateHandler = hybridKemMultiEncapsulateHandler;
+function resolveDirectRecipient(args) {
+    const encKey = args.wrappedKey ?? args.encryptedKey;
+    if (!args.ephemeralPublicKey || !args.mlKemCiphertext || !encKey) {
+        return undefined;
+    }
+    return {
+        ephemeralPublicKey: String(args.ephemeralPublicKey),
+        mlKemCiphertext: String(args.mlKemCiphertext),
+        wrappedKey: String(encKey),
+    };
+}
+function resolveListRecipient(args) {
+    if (args.recipients === undefined)
+        return undefined;
+    const list = JSON.parse(String(args.recipients));
+    const item = args.recipientId !== undefined
+        ? list.find((e) => e.id === String(args.recipientId))
+        : list[args.recipientIndex !== undefined ? Number(args.recipientIndex) : 0];
+    if (!item)
+        return undefined;
+    const key = item.wrappedKey ?? item.encryptedKey;
+    if (!key)
+        return undefined;
+    return {
+        ephemeralPublicKey: item.ephemeralPublicKey,
+        mlKemCiphertext: item.mlKemCiphertext,
+        wrappedKey: String(key),
+    };
+}
+function resolveRecipientEntry(args) {
+    const resolved = resolveDirectRecipient(args) ?? resolveListRecipient(args);
+    if (!resolved) {
+        throw new Error("Missing recipient encryption details (ephemeralPublicKey, mlKemCiphertext, wrappedKey)");
+    }
+    return resolved;
+}
+const hybridKemMultiDecapsulateHandler = async (args) => {
+    const xKey = keystore_1.keyStore.use(String(args.x25519KeyHandle), ["x25519"]);
+    const kemKey = keystore_1.keyStore.use(String(args.mlKemKeyHandle), ["ml-kem-768"]);
+    const entry = resolveRecipientEntry(args);
+    const dek = (0, crypto_lib_1.unwrapDekHybrid)(xKey.secret, kemKey.secret, entry.ephemeralPublicKey, entry.mlKemCiphertext, entry.wrappedKey);
+    const keyHandle = keystore_1.keyStore.add((0, keystore_1.symmetricKey)(Buffer.from(dek), "multi-recipient hybrid KEM DEK"));
+    return (0, result_1.jsonResult)({
+        algorithm: "multi-hybrid-kem-768-aes-256-gcm",
+        keyHandle,
+    });
+};
+exports.hybridKemMultiDecapsulateHandler = hybridKemMultiDecapsulateHandler;
 //# sourceMappingURL=kem.js.map

package/dist/tools/keyimport.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"keyimport.d.ts","sourceRoot":"","sources":["../../src/tools/keyimport.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,MAAM,SAAS,CAAC;AAUzB,OAAO,EAAY,WAAW,EAAc,MAAM,UAAU,CAAC;AA2F7D,wBAAsB,UAAU,CAC9B,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,EAC5C,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,CAajB;AAuKD,eAAO,MAAM,SAAS,EAAE,WAUvB,CAAC"}
+{"version":3,"file":"keyimport.d.ts","sourceRoot":"","sources":["../../src/tools/keyimport.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,MAAM,SAAS,CAAC;AAUzB,OAAO,EAAY,WAAW,EAAc,MAAM,UAAU,CAAC;AA4F7D,wBAAsB,UAAU,CAC9B,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,EAC5C,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,CAajB;AAuKD,eAAO,MAAM,SAAS,EAAE,WAUvB,CAAC"}

package/dist/tools/keyimport.js

@@ -12,6 +12,7 @@ const definitions_1 = require("./definitions");
 const keys_1 = require("./keys");
 const keystore_1 = require("./keystore");
 const result_1 = require("./result");
+const crypto_lib_1 = require("@sebastienrousseau/crypto-lib");
 const RAW_KEY_BYTES = 32;
 const SOURCE = "crypto_key_import";
 const UNREADABLE = `Key file not found or not readable in ${definitions_1.KEY_DIR_ENV}`;
@@ -102,7 +103,7 @@ function decodeHex(text) {
         const high = hexDigit(text[2 * i]);
         const low = hexDigit(text[2 * i + 1]);
         if (high < 0 || low < 0) {
-            out.fill(0);
+            (0, crypto_lib_1.wipeMemory)(out);
             return undefined;
         }
         out[i] = high * 16 + low;
@@ -199,7 +200,7 @@ const importKey = async (args) => {
         return (0, result_1.jsonResult)(keystore_1.keyStore.describe(keystore_1.keyStore.add(material)));
     }
     finally {
-        bytes.fill(0);
+        (0, crypto_lib_1.wipeMemory)(bytes);
     }
 };
 exports.importKey = importKey;

package/dist/tools/keys.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"keys.d.ts","sourceRoot":"","sources":["../../src/tools/keys.ts"],"names":[],"mappings":"AAEA,OAAO,MAAM,MAAM,aAAa,CAAC;AAGjC,OAAO,EAAE,WAAW,EAA0B,MAAM,YAAY,CAAC;AACjE,OAAO,EAAY,WAAW,EAA2B,MAAM,UAAU,CAAC;AAG1E,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,SAAS,GAAG,MAAM,CAEvD;AAGD,wBAAgB,UAAU,CACxB,IAAI,EAAE,WAAW,CAAC,MAAM,CAAC,EACzB,IAAI,EAAE;IAAE,UAAU,EAAE,MAAM,CAAC,SAAS,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC,SAAS,CAAA;CAAE,EACnE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,WAAW,CAOb;AAqED,eAAO,MAAM,WAAW,EAAE,WAOzB,CAAC;AAGF,eAAO,MAAM,QAAQ,EAAE,WAC6C,CAAC;AAGrE,eAAO,MAAM,UAAU,EAAE,WAMxB,CAAC;AAmBF,eAAO,MAAM,UAAU,EAAE,WAaxB,CAAC"}
+{"version":3,"file":"keys.d.ts","sourceRoot":"","sources":["../../src/tools/keys.ts"],"names":[],"mappings":"AAEA,OAAO,MAAM,MAAM,aAAa,CAAC;AAOjC,OAAO,EAAE,WAAW,EAA0B,MAAM,YAAY,CAAC;AACjE,OAAO,EAAY,WAAW,EAA2B,MAAM,UAAU,CAAC;AAG1E,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,SAAS,GAAG,MAAM,CAEvD;AAGD,wBAAgB,UAAU,CACxB,IAAI,EAAE,WAAW,CAAC,MAAM,CAAC,EACzB,IAAI,EAAE;IAAE,UAAU,EAAE,MAAM,CAAC,SAAS,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC,SAAS,CAAA;CAAE,EACnE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,WAAW,CAOb;AA2GD,eAAO,MAAM,WAAW,EAAE,WAOzB,CAAC;AAGF,eAAO,MAAM,QAAQ,EAAE,WAC6C,CAAC;AAGrE,eAAO,MAAM,UAAU,EAAE,WAMxB,CAAC;AAmBF,eAAO,MAAM,UAAU,EAAE,WAaxB,CAAC"}

package/dist/tools/keys.js

@@ -41,14 +41,30 @@ function generateEcc(args) {
     const pair = node_crypto_1.default.generateKeyPairSync("ec", { namedCurve });
     return asymmetric("ecc", pair, { curve: namedCurve });
 }
-function generateMlKem768() {
-    const { publicKey, secretKey } = (0, crypto_lib_1.mlKemKeygen)(768);
+function generateMlKem(level) {
+    const { publicKey, secretKey } = (0, crypto_lib_1.mlKemKeygen)(level);
+    const securityCategory = level === 512 ? 1 : level === 768 ? 3 : 5;
     return {
-        kind: "ml-kem-768",
+        kind: `ml-kem-${level}`,
         secret: Buffer.from(secretKey, "hex"),
         info: {
             standard: "NIST FIPS 203",
-            securityCategory: 3,
+            securityCategory,
+            quantumSafe: true,
+            encoding: "hex",
+            publicKey,
+        },
+    };
+}
+function generateMlDsa(level) {
+    const { publicKey, secretKey } = (0, crypto_lib_1.mlDsaKeygen)(level);
+    const securityCategory = level === 44 ? 2 : level === 65 ? 3 : 5;
+    return {
+        kind: `ml-dsa-${level}`,
+        secret: Buffer.from(secretKey, "hex"),
+        info: {
+            standard: "NIST FIPS 204",
+            securityCategory,
             quantumSafe: true,
             encoding: "hex",
             publicKey,
@@ -58,6 +74,19 @@ function generateMlKem768() {
 function generateSymmetric() {
     return (0, keystore_1.symmetricKey)(node_crypto_1.default.randomBytes(32), "generated");
 }
+function generateX25519() {
+    const pair = (0, crypto_lib_1.generateX25519KeyPair)();
+    return {
+        kind: "x25519",
+        secret: Buffer.from(pair.privateKey, "hex"),
+        info: {
+            curve: "x25519",
+            quantumSafe: false,
+            encoding: "hex",
+            publicKey: pair.publicKey,
+        },
+    };
+}
 function generateHmac() {
     return {
         kind: "hmac-sha256",
@@ -67,9 +96,15 @@ function generateHmac() {
 }
 const GENERATORS = {
     ed25519: generateEd25519,
+    x25519: generateX25519,
     rsa: generateRsa,
     ecc: generateEcc,
-    "ml-kem-768": generateMlKem768,
+    "ml-kem-512": () => generateMlKem(512),
+    "ml-kem-768": () => generateMlKem(768),
+    "ml-kem-1024": () => generateMlKem(1024),
+    "ml-dsa-44": () => generateMlDsa(44),
+    "ml-dsa-65": () => generateMlDsa(65),
+    "ml-dsa-87": () => generateMlDsa(87),
     "symmetric-256": generateSymmetric,
     "hmac-sha256": generateHmac,
 };

package/dist/tools/keystore.d.ts

@@ -1,5 +1,5 @@
 import crypto from "node:crypto";
-export type KeyKind = "ed25519" | "rsa" | "ecc" | "ml-kem-768" | "symmetric-256" | "hmac-sha256";
+export type KeyKind = "ed25519" | "rsa" | "ecc" | "x25519" | "ml-kem-512" | "ml-kem-768" | "ml-kem-1024" | "ml-dsa-44" | "ml-dsa-65" | "ml-dsa-87" | "symmetric-256" | "hmac-sha256";
 export interface KeyMaterial {
     kind: KeyKind;
     info: Record<string, unknown>;

package/dist/tools/keystore.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"keystore.d.ts","sourceRoot":"","sources":["../../src/tools/keystore.ts"],"names":[],"mappings":"AAEA,OAAO,MAAM,MAAM,aAAa,CAAC;AAYjC,MAAM,MAAM,OAAO,GACjB,SAAS,GAAG,KAAK,GAAG,KAAK,GAAG,YAAY,GAAG,eAAe,GAAG,aAAa,CAAC;AAG7E,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,OAAO,CAAC;IAEd,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAE9B,UAAU,CAAC,EAAE,MAAM,CAAC,SAAS,CAAC;IAE9B,SAAS,CAAC,EAAE,MAAM,CAAC,SAAS,CAAC;IAE7B,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAOD,eAAO,MAAM,QAAQ,KAAK,CAAC;AAG3B,eAAO,MAAM,kBAAkB,sBAAsB,CAAC;AAMtD,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,WAAW,CAUxE;AAQD,qBAAa,QAAQ;aAIgB,QAAQ,EAAE,MAAM;IAHnD,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAgC;gBAGlB,QAAQ,GAAE,MAAiB;IAG9D,IAAW,IAAI,IAAI,MAAM,CAExB;IAGM,GAAG,CAAC,QAAQ,EAAE,WAAW,GAAG,MAAM;IAiBlC,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,OAAO,EAAE,GAAG,WAAW;IAkB3D,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAWjD,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAKtC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO;CAOvC;AAGD,eAAO,MAAM,QAAQ,UAAiB,CAAC"}
+{"version":3,"file":"keystore.d.ts","sourceRoot":"","sources":["../../src/tools/keystore.ts"],"names":[],"mappings":"AAEA,OAAO,MAAM,MAAM,aAAa,CAAC;AAajC,MAAM,MAAM,OAAO,GACf,SAAS,GACT,KAAK,GACL,KAAK,GACL,QAAQ,GACR,YAAY,GACZ,YAAY,GACZ,aAAa,GACb,WAAW,GACX,WAAW,GACX,WAAW,GACX,eAAe,GACf,aAAa,CAAC;AAGlB,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,OAAO,CAAC;IAEd,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAE9B,UAAU,CAAC,EAAE,MAAM,CAAC,SAAS,CAAC;IAE9B,SAAS,CAAC,EAAE,MAAM,CAAC,SAAS,CAAC;IAE7B,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAOD,eAAO,MAAM,QAAQ,KAAK,CAAC;AAG3B,eAAO,MAAM,kBAAkB,sBAAsB,CAAC;AAMtD,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,WAAW,CAUxE;AAUD,qBAAa,QAAQ;aAIgB,QAAQ,EAAE,MAAM;IAHnD,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAgC;gBAGlB,QAAQ,GAAE,MAAiB;IAG9D,IAAW,IAAI,IAAI,MAAM,CAExB;IAGM,GAAG,CAAC,QAAQ,EAAE,WAAW,GAAG,MAAM;IAiBlC,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,OAAO,EAAE,GAAG,WAAW;IAkB3D,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAWjD,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAKtC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO;CAOvC;AAGD,eAAO,MAAM,QAAQ,UAAiB,CAAC"}

package/dist/tools/keystore.js

@@ -6,6 +6,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.keyStore = exports.KeyStore = exports.KEY_HANDLE_PATTERN = exports.MAX_KEYS = void 0;
 exports.symmetricKey = symmetricKey;
 const node_crypto_1 = __importDefault(require("node:crypto"));
+const crypto_lib_1 = require("@sebastienrousseau/crypto-lib");
 exports.MAX_KEYS = 64;
 exports.KEY_HANDLE_PATTERN = "^kh_[0-9a-f]{32}$";
 function symmetricKey(secret, source) {
@@ -20,7 +21,9 @@ function symmetricKey(secret, source) {
     };
 }
 function wipe(key) {
-    key.secret?.fill(0);
+    if (key.secret) {
+        (0, crypto_lib_1.wipeMemory)(key.secret);
+    }
 }
 class KeyStore {
     capacity;

package/dist/tools/kms.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"kms.d.ts","sourceRoot":"","sources":["../../src/tools/kms.ts"],"names":[],"mappings":"AAIA,OAAO,EAAY,WAAW,EAAc,MAAM,UAAU,CAAC;AAe7D,eAAO,MAAM,cAAc,KAAK,CAAC;AA2CjC,eAAO,MAAM,OAAO,EAAE,WAmBrB,CAAC;AAMF,eAAO,MAAM,SAAS,EAAE,WAgBvB,CAAC"}
+{"version":3,"file":"kms.d.ts","sourceRoot":"","sources":["../../src/tools/kms.ts"],"names":[],"mappings":"AAKA,OAAO,EAAY,WAAW,EAAc,MAAM,UAAU,CAAC;AAe7D,eAAO,MAAM,cAAc,KAAK,CAAC;AA2CjC,eAAO,MAAM,OAAO,EAAE,WAmBrB,CAAC;AAMF,eAAO,MAAM,SAAS,EAAE,WAgBvB,CAAC"}

package/dist/tools/kms.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.kmsUnwrap = exports.kmsWrap = exports.MAX_KEK_LABELS = void 0;
 const crypto_kms_1 = require("@sebastienrousseau/crypto-kms");
+const crypto_lib_1 = require("@sebastienrousseau/crypto-lib");
 const keystore_1 = require("./keystore");
 const result_1 = require("./result");
 const symmetric_1 = require("./symmetric");
@@ -45,7 +46,7 @@ const kmsWrap = async (args) => {
         });
     }
     finally {
-        dek.fill(0);
+        (0, crypto_lib_1.wipeMemory)(dek);
     }
 };
 exports.kmsWrap = kmsWrap;
@@ -58,7 +59,7 @@ const kmsUnwrap = async (args) => {
     const wrapped = Buffer.from(String(args.wrappedKey), "hex");
     const { plaintext } = await localKms.decrypt(kmsKeyId, wrapped.toString("base64"), wrapContext(keyId));
     const dek = Buffer.from(plaintext);
-    plaintext.fill(0);
+    (0, crypto_lib_1.wipeMemory)(plaintext);
     const keyHandle = keystore_1.keyStore.add((0, keystore_1.symmetricKey)(dek, "crypto_kms_unwrap"));
     return (0, result_1.jsonResult)({ provider, keyId, status: "unwrapped", keyHandle });
 };

package/dist/tools/schema-helpers.d.ts

@@ -0,0 +1,12 @@
+import { MCPToolParameterProperty } from "../types";
+export declare const MAX_TEXT_LENGTH = 1048576;
+export declare const MAX_KEY_LENGTH = 16384;
+export declare const HEX_BYTES = "^(?:[0-9a-fA-F]{2})*$";
+export declare const X25519_PUBLIC_KEY_HEX = 64;
+export declare const ML_KEM_768_PUBLIC_KEY_HEX = 2368;
+export declare const HANDLE_NOTE = "Secret key material stays inside the server; only an opaque keyHandle is returned.";
+export declare function keyHandle(description: string): MCPToolParameterProperty;
+export declare function text(description: string): MCPToolParameterProperty;
+export declare function hex(description: string, length: number, upTo?: boolean): MCPToolParameterProperty;
+export declare function oneOf(description: string, values: string[]): MCPToolParameterProperty;
+//# sourceMappingURL=schema-helpers.d.ts.map

package/dist/tools/schema-helpers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema-helpers.d.ts","sourceRoot":"","sources":["../../src/tools/schema-helpers.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,wBAAwB,EAAE,MAAM,UAAU,CAAC;AAIpD,eAAO,MAAM,eAAe,UAAY,CAAC;AAGzC,eAAO,MAAM,cAAc,QAAS,CAAC;AAGrC,eAAO,MAAM,SAAS,0BAA0B,CAAC;AAGjD,eAAO,MAAM,qBAAqB,KAAK,CAAC;AAGxC,eAAO,MAAM,yBAAyB,OAAO,CAAC;AAG9C,eAAO,MAAM,WAAW,uFAC8D,CAAC;AAGvF,wBAAgB,SAAS,CAAC,WAAW,EAAE,MAAM,GAAG,wBAAwB,CAOvE;AAGD,wBAAgB,IAAI,CAAC,WAAW,EAAE,MAAM,GAAG,wBAAwB,CAElE;AAGD,wBAAgB,GAAG,CACjB,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,EACd,IAAI,UAAQ,GACX,wBAAwB,CAQ1B;AAGD,wBAAgB,KAAK,CACnB,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,EAAE,GACf,wBAAwB,CAE1B"}

package/dist/tools/schema-helpers.js

@@ -0,0 +1,38 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HANDLE_NOTE = exports.ML_KEM_768_PUBLIC_KEY_HEX = exports.X25519_PUBLIC_KEY_HEX = exports.HEX_BYTES = exports.MAX_KEY_LENGTH = exports.MAX_TEXT_LENGTH = void 0;
+exports.keyHandle = keyHandle;
+exports.text = text;
+exports.hex = hex;
+exports.oneOf = oneOf;
+const keystore_1 = require("./keystore");
+exports.MAX_TEXT_LENGTH = 1_048_576;
+exports.MAX_KEY_LENGTH = 16_384;
+exports.HEX_BYTES = "^(?:[0-9a-fA-F]{2})*$";
+exports.X25519_PUBLIC_KEY_HEX = 64;
+exports.ML_KEM_768_PUBLIC_KEY_HEX = 2368;
+exports.HANDLE_NOTE = "Secret key material stays inside the server; only an opaque keyHandle is returned.";
+function keyHandle(description) {
+    return {
+        type: "string",
+        description: `${description} Key handles look like 'kh_' followed by 32 hex characters.`,
+        maxLength: 35,
+        pattern: keystore_1.KEY_HANDLE_PATTERN,
+    };
+}
+function text(description) {
+    return { type: "string", description, maxLength: exports.MAX_TEXT_LENGTH };
+}
+function hex(description, length, upTo = false) {
+    return {
+        type: "string",
+        description,
+        minLength: upTo ? 2 : length,
+        maxLength: length,
+        pattern: exports.HEX_BYTES,
+    };
+}
+function oneOf(description, values) {
+    return { type: "string", description, enum: values };
+}
+//# sourceMappingURL=schema-helpers.js.map

package/dist/tools/signing.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"signing.d.ts","sourceRoot":"","sources":["../../src/tools/signing.ts"],"names":[],"mappings":"AAKA,OAAO,EAAY,WAAW,EAAc,MAAM,UAAU,CAAC;AA0D7D,eAAO,MAAM,IAAI,EAAE,WAalB,CAAC;AAwDF,eAAO,MAAM,MAAM,EAAE,WASpB,CAAC;AAGF,eAAO,MAAM,IAAI,EAAE,WAUlB,CAAC"}
+{"version":3,"file":"signing.d.ts","sourceRoot":"","sources":["../../src/tools/signing.ts"],"names":[],"mappings":"AAUA,OAAO,EAAY,WAAW,EAAc,MAAM,UAAU,CAAC;AA6D7D,eAAO,MAAM,IAAI,EAAE,WAmBlB,CAAC;AAmFF,eAAO,MAAM,MAAM,EAAE,WAsBpB,CAAC;AAGF,eAAO,MAAM,IAAI,EAAE,WAUlB,CAAC"}

package/dist/tools/signing.js

@@ -5,6 +5,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.hash = exports.verify = exports.sign = void 0;
 const node_crypto_1 = __importDefault(require("node:crypto"));
+const crypto_lib_1 = require("@sebastienrousseau/crypto-lib");
 const definitions_1 = require("./definitions");
 const keystore_1 = require("./keystore");
 const result_1 = require("./result");
@@ -12,6 +13,9 @@ const SIGNING_KINDS = [
     "ed25519",
     "rsa",
     "ecc",
+    "ml-dsa-44",
+    "ml-dsa-65",
+    "ml-dsa-87",
     "hmac-sha256",
 ];
 function ecdsaScheme(key) {
@@ -53,6 +57,12 @@ const sign = async (args) => {
         const signature = hmac(key.secret, data).toString("hex");
         return (0, result_1.jsonResult)({ algorithm: "hmac-sha256", signature });
     }
+    if (key.kind.startsWith("ml-dsa-")) {
+        const level = Number(key.kind.slice(7));
+        const secretKeyHex = key.secret.toString("hex");
+        const { signature, algorithm } = (0, crypto_lib_1.mlDsaSign)(level, secretKeyHex, data);
+        return (0, result_1.jsonResult)({ algorithm, signature });
+    }
     const privateKey = key.privateKey;
     const scheme = schemeFor(privateKey);
     const signature = node_crypto_1.default
@@ -72,28 +82,57 @@ function verifyHmac(secret, data, signature) {
         node_crypto_1.default.timingSafeEqual(signature, expected);
     return { algorithm: "hmac-sha256", valid };
 }
+const ML_DSA_LEVELS_BY_LEN = {
+    2624: 44,
+    3904: 65,
+    5184: 87,
+};
+function verifierFromPublic(raw) {
+    const pub = raw.trim();
+    if (pub.includes("PRIVATE KEY")) {
+        throw new Error("publicKey must be a public key, not a private key");
+    }
+    const mlDsaLevel = /^[0-9a-fA-F]+$/.test(pub)
+        ? ML_DSA_LEVELS_BY_LEN[pub.length]
+        : undefined;
+    if (mlDsaLevel) {
+        return { kind: "ml-dsa", level: mlDsaLevel, publicKeyHex: pub };
+    }
+    return { kind: "asymmetric", publicKey: node_crypto_1.default.createPublicKey(pub) };
+}
+function verifierFromKey(handle) {
+    const key = keystore_1.keyStore.use(handle, SIGNING_KINDS);
+    if (key.kind === "hmac-sha256") {
+        return { kind: "hmac", secret: key.secret };
+    }
+    if (key.kind.startsWith("ml-dsa-")) {
+        const level = Number(key.kind.slice(7));
+        return { kind: "ml-dsa", level, publicKeyHex: String(key.info.publicKey) };
+    }
+    return { kind: "asymmetric", publicKey: key.publicKey };
+}
 function verifierFor(args) {
-    const hasPem = args.publicKey !== undefined;
-    if (hasPem === (args.keyHandle !== undefined)) {
+    const hasPub = args.publicKey !== undefined;
+    if (hasPub === (args.keyHandle !== undefined)) {
         throw new Error("Pass exactly one of publicKey or keyHandle");
     }
-    if (hasPem) {
-        const pem = String(args.publicKey);
-        if (pem.includes("PRIVATE KEY")) {
-            throw new Error("publicKey must be a public key, not a private key");
-        }
-        return { publicKey: node_crypto_1.default.createPublicKey(pem) };
-    }
-    const key = keystore_1.keyStore.use(String(args.keyHandle), SIGNING_KINDS);
-    return key.kind === "hmac-sha256"
-        ? { secret: key.secret }
-        : { publicKey: key.publicKey };
+    return hasPub
+        ? verifierFromPublic(String(args.publicKey))
+        : verifierFromKey(String(args.keyHandle));
 }
 const verify = async (args) => {
     const verifier = verifierFor(args);
     const data = Buffer.from(String(args.data), "utf8");
-    const signature = Buffer.from(String(args.signature), "hex");
-    const result = "secret" in verifier
+    const signatureHex = String(args.signature);
+    if (verifier.kind === "ml-dsa") {
+        const res = (0, crypto_lib_1.mlDsaVerify)(verifier.level, verifier.publicKeyHex, data, signatureHex);
+        return (0, result_1.jsonResult)({
+            algorithm: `ml-dsa-${verifier.level}`,
+            valid: res.valid,
+        });
+    }
+    const signature = Buffer.from(signatureHex, "hex");
+    const result = verifier.kind === "hmac"
         ? verifyHmac(verifier.secret, data, signature)
         : verifyAsymmetric(verifier.publicKey, data, signature);
     return (0, result_1.jsonResult)(result);

package/dist/tools/stream-definitions.d.ts

@@ -0,0 +1,3 @@
+import { MCPTool } from "../types";
+export declare const STREAM_TOOLS: MCPTool[];
+//# sourceMappingURL=stream-definitions.d.ts.map

package/dist/tools/stream-definitions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stream-definitions.d.ts","sourceRoot":"","sources":["../../src/tools/stream-definitions.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AASnC,eAAO,MAAM,YAAY,EAAE,OAAO,EA0JjC,CAAC"}

package/dist/tools/stream-definitions.js

@@ -0,0 +1,122 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.STREAM_TOOLS = void 0;
+const schema_helpers_1 = require("./schema-helpers");
+exports.STREAM_TOOLS = [
+    {
+        name: "crypto_stream_encrypt",
+        description: "Encrypt plaintext using post-quantum hybrid STREAM AEAD (X25519 + ML-KEM-768 + XChaCha20-Poly1305) with anti-truncation protection. Returns base64 ciphertext.",
+        inputSchema: {
+            type: "object",
+            additionalProperties: false,
+            properties: {
+                plaintext: (0, schema_helpers_1.text)("Plaintext string to encrypt."),
+                x25519PublicKey: (0, schema_helpers_1.hex)("Hex-encoded X25519 public key (64 hex characters).", schema_helpers_1.X25519_PUBLIC_KEY_HEX),
+                mlKemPublicKey: (0, schema_helpers_1.hex)("Hex-encoded ML-KEM-768 public key (2368 hex characters).", schema_helpers_1.ML_KEM_768_PUBLIC_KEY_HEX),
+                chunkSize: {
+                    type: "integer",
+                    description: "Chunk size in bytes (minimum 64, default 65536).",
+                    minimum: 64,
+                },
+            },
+            required: ["plaintext", "x25519PublicKey", "mlKemPublicKey"],
+        },
+    },
+    {
+        name: "crypto_stream_decrypt",
+        description: "Decrypt a post-quantum hybrid STREAM AEAD ciphertext using server-held x25519 and ml-kem-768 key handles. Plaintext memory is wiped after decoding.",
+        inputSchema: {
+            type: "object",
+            additionalProperties: false,
+            properties: {
+                ciphertext: (0, schema_helpers_1.text)("Base64-encoded STREAM ciphertext."),
+                x25519KeyHandle: (0, schema_helpers_1.keyHandle)("Handle of the recipient X25519 key (or 32-byte symmetric-256 key)."),
+                mlKemKeyHandle: (0, schema_helpers_1.keyHandle)("Handle of the recipient ML-KEM-768 key."),
+                chunkSize: {
+                    type: "integer",
+                    description: "Chunk size used during encryption (default 65536).",
+                    minimum: 64,
+                },
+            },
+            required: ["ciphertext", "x25519KeyHandle", "mlKemKeyHandle"],
+        },
+    },
+    {
+        name: "crypto_stream_multi_encrypt",
+        description: "Encrypt plaintext for multiple recipients using post-quantum hybrid STREAM AEAD (X25519 + ML-KEM-768 + XChaCha20-Poly1305) with anti-truncation framing. Returns base64 ciphertext.",
+        inputSchema: {
+            type: "object",
+            additionalProperties: false,
+            properties: {
+                plaintext: (0, schema_helpers_1.text)("Plaintext string to encrypt."),
+                recipients: (0, schema_helpers_1.text)("JSON-serialized array of recipient public key descriptors: [{ recipientId, recipientX25519Public, recipientMlKemPublic }]."),
+                chunkSize: {
+                    type: "integer",
+                    description: "Chunk size in bytes (minimum 1024, maximum 16777216, default 65536).",
+                    minimum: 1024,
+                    maximum: 16777216,
+                },
+            },
+            required: ["plaintext", "recipients"],
+        },
+    },
+    {
+        name: "crypto_stream_multi_decrypt",
+        description: "Decrypt a multi-recipient post-quantum hybrid STREAM AEAD ciphertext using server-held x25519 and ml-kem-768 key handles. Plaintext memory is wiped after decoding.",
+        inputSchema: {
+            type: "object",
+            additionalProperties: false,
+            properties: {
+                ciphertext: (0, schema_helpers_1.text)("Base64-encoded multi-recipient STREAM ciphertext."),
+                x25519KeyHandle: (0, schema_helpers_1.keyHandle)("Handle of the recipient X25519 key (or 32-byte symmetric-256 key)."),
+                mlKemKeyHandle: (0, schema_helpers_1.keyHandle)("Handle of the recipient ML-KEM-768 key."),
+                recipientId: (0, schema_helpers_1.text)("Optional recipient identifier for direct slot lookup."),
+                chunkSize: {
+                    type: "integer",
+                    description: "Chunk size in bytes (minimum 1024, maximum 16777216, default 65536).",
+                    minimum: 1024,
+                    maximum: 16777216,
+                },
+            },
+            required: ["ciphertext", "x25519KeyHandle", "mlKemKeyHandle"],
+        },
+    },
+    {
+        name: "crypto_hybrid_kem_multi_encapsulate",
+        description: "Encapsulate a symmetric key for multiple recipients using post-quantum hybrid KEM (X25519 + ML-KEM-768 + AES-256-GCM key wrapping). Returns recipient ciphertexts and a symmetric-256 keyHandle.",
+        inputSchema: {
+            type: "object",
+            additionalProperties: false,
+            properties: {
+                recipients: (0, schema_helpers_1.text)("JSON-serialized array of recipient public key objects: [{ id?, x25519PublicKey, mlKemPublicKey }]."),
+                keyHandle: (0, schema_helpers_1.keyHandle)("Optional handle of an existing symmetric-256 key to encapsulate. If omitted, a fresh 256-bit DEK is generated."),
+            },
+            required: ["recipients"],
+        },
+    },
+    {
+        name: "crypto_hybrid_kem_multi_decapsulate",
+        description: "Decapsulate a multi-recipient post-quantum hybrid KEM key using server-held x25519 and ml-kem-768 key handles. Returns a symmetric-256 keyHandle for the recovered DEK.",
+        inputSchema: {
+            type: "object",
+            additionalProperties: false,
+            properties: {
+                x25519KeyHandle: (0, schema_helpers_1.keyHandle)("Handle of recipient X25519 key."),
+                mlKemKeyHandle: (0, schema_helpers_1.keyHandle)("Handle of recipient ML-KEM-768 key."),
+                ephemeralPublicKey: (0, schema_helpers_1.hex)("Hex-encoded sender ephemeral X25519 public key (64 hex characters).", schema_helpers_1.X25519_PUBLIC_KEY_HEX),
+                mlKemCiphertext: (0, schema_helpers_1.hex)("Hex-encoded ML-KEM-768 ciphertext (2176 hex characters).", 2176, true),
+                wrappedKey: (0, schema_helpers_1.text)("Base64-encoded wrapped DEK (RFC 3394 AES Key Wrap)."),
+                encryptedKey: (0, schema_helpers_1.text)("Alias for wrappedKey."),
+                recipients: (0, schema_helpers_1.text)("Optional JSON-serialized array of encrypted recipient objects: [{ id?, ephemeralPublicKey, mlKemCiphertext, encryptedKey }]."),
+                recipientId: (0, schema_helpers_1.text)("Optional recipient ID to select from recipients array."),
+                recipientIndex: {
+                    type: "integer",
+                    description: "Optional index to select from recipients array (default 0).",
+                    minimum: 0,
+                },
+            },
+            required: ["x25519KeyHandle", "mlKemKeyHandle"],
+        },
+    },
+];
+//# sourceMappingURL=stream-definitions.js.map

package/dist/tools/stream.d.ts

@@ -0,0 +1,6 @@
+import { ToolHandler } from "./result";
+export declare const streamEncrypt: ToolHandler;
+export declare const streamDecrypt: ToolHandler;
+export declare const streamMultiEncrypt: ToolHandler;
+export declare const streamMultiDecrypt: ToolHandler;
+//# sourceMappingURL=stream.d.ts.map

package/dist/tools/stream.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stream.d.ts","sourceRoot":"","sources":["../../src/tools/stream.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,WAAW,EAAc,MAAM,UAAU,CAAC;AAMnD,eAAO,MAAM,aAAa,EAAE,WAmB3B,CAAC;AAOF,eAAO,MAAM,aAAa,EAAE,WAwB3B,CAAC;AAiBF,eAAO,MAAM,kBAAkB,EAAE,WAkBhC,CAAC;AAOF,eAAO,MAAM,kBAAkB,EAAE,WA4BhC,CAAC"}

package/dist/tools/stream.js

@@ -0,0 +1,97 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.streamMultiDecrypt = exports.streamMultiEncrypt = exports.streamDecrypt = exports.streamEncrypt = void 0;
+const crypto_lib_1 = require("@sebastienrousseau/crypto-lib");
+const streaming_1 = require("@sebastienrousseau/crypto-lib/streaming");
+const keystore_1 = require("./keystore");
+const result_1 = require("./result");
+const streamEncrypt = async (args) => {
+    const plaintext = Buffer.from(String(args.plaintext), "utf8");
+    const recipientX25519Public = String(args.x25519PublicKey);
+    const recipientMlKemPublic = String(args.mlKemPublicKey);
+    const chunkSize = args.chunkSize !== undefined ? Number(args.chunkSize) : undefined;
+    const result = (0, streaming_1.streamPqEncrypt)({
+        recipientX25519Public,
+        recipientMlKemPublic,
+        plaintext,
+        chunkSize,
+    });
+    return (0, result_1.jsonResult)({
+        algorithm: result.algorithm,
+        ciphertext: Buffer.from(result.ciphertext).toString("base64"),
+        chunkSize: chunkSize ?? 65536,
+    });
+};
+exports.streamEncrypt = streamEncrypt;
+const streamDecrypt = async (args) => {
+    const ciphertext = Buffer.from(String(args.ciphertext), "base64");
+    const xKey = keystore_1.keyStore.use(String(args.x25519KeyHandle), [
+        "x25519",
+        "symmetric-256",
+    ]);
+    const mlKey = keystore_1.keyStore.use(String(args.mlKemKeyHandle), ["ml-kem-768"]);
+    const chunkSize = args.chunkSize !== undefined ? Number(args.chunkSize) : undefined;
+    const decrypted = (0, streaming_1.streamPqDecrypt)({
+        recipientX25519Secret: xKey.secret,
+        recipientMlKemSecret: mlKey.secret,
+        ciphertext,
+        chunkSize,
+    });
+    const plaintext = Buffer.from(decrypted).toString("utf8");
+    (0, crypto_lib_1.wipeMemory)(decrypted);
+    return (0, result_1.jsonResult)({
+        algorithm: "x25519-ml-kem-768-xchacha20-poly1305-stream",
+        plaintext,
+    });
+};
+exports.streamDecrypt = streamDecrypt;
+const parseMcpRecipients = (raw) => {
+    const list = JSON.parse(String(raw));
+    if (!Array.isArray(list) || list.length === 0) {
+        throw new Error("recipients must be a non-empty array of recipient objects");
+    }
+    return list;
+};
+const streamMultiEncrypt = async (args) => {
+    const plaintext = Buffer.from(String(args.plaintext), "utf8");
+    const recipients = parseMcpRecipients(args.recipients);
+    const chunkSize = args.chunkSize !== undefined ? Number(args.chunkSize) : undefined;
+    const result = (0, streaming_1.streamMultiPqEncrypt)({
+        recipients,
+        plaintext,
+        chunkSize,
+    });
+    return (0, result_1.jsonResult)({
+        algorithm: result.algorithm,
+        ciphertext: Buffer.from(result.ciphertext).toString("base64"),
+        recipientCount: result.recipientCount,
+        chunkSize: chunkSize ?? 65536,
+    });
+};
+exports.streamMultiEncrypt = streamMultiEncrypt;
+const streamMultiDecrypt = async (args) => {
+    const ciphertext = Buffer.from(String(args.ciphertext), "base64");
+    const xKey = keystore_1.keyStore.use(String(args.x25519KeyHandle), [
+        "x25519",
+        "symmetric-256",
+    ]);
+    const mlKey = keystore_1.keyStore.use(String(args.mlKemKeyHandle), ["ml-kem-768"]);
+    const recipientId = args.recipientId !== undefined ? String(args.recipientId) : undefined;
+    const chunkSize = args.chunkSize !== undefined ? Number(args.chunkSize) : undefined;
+    const decrypted = (0, streaming_1.streamMultiPqDecrypt)({
+        recipientX25519Secret: xKey.secret,
+        recipientMlKemSecret: mlKey.secret,
+        ...(recipientId !== undefined ? { recipientId } : {}),
+        ciphertext,
+        chunkSize,
+    });
+    const plaintext = Buffer.from(decrypted.plaintext).toString("utf8");
+    (0, crypto_lib_1.wipeMemory)(decrypted.plaintext);
+    return (0, result_1.jsonResult)({
+        algorithm: "multi-x25519-ml-kem-768-xchacha20-poly1305-stream",
+        recipientId: decrypted.recipientId,
+        plaintext,
+    });
+};
+exports.streamMultiDecrypt = streamMultiDecrypt;
+//# sourceMappingURL=stream.js.map

package/dist/tools/symmetric.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"symmetric.d.ts","sourceRoot":"","sources":["../../src/tools/symmetric.ts"],"names":[],"mappings":"AAIA,OAAO,EAAY,WAAW,EAAc,MAAM,UAAU,CAAC;AA0B7D,wBAAgB,eAAe,CAAC,SAAS,EAAE,OAAO,GAAG,MAAM,CAE1D;AAaD,eAAO,MAAM,OAAO,EAAE,WAmBrB,CAAC;AAGF,eAAO,MAAM,OAAO,EAAE,WAWrB,CAAC"}
+{"version":3,"file":"symmetric.d.ts","sourceRoot":"","sources":["../../src/tools/symmetric.ts"],"names":[],"mappings":"AAKA,OAAO,EAAY,WAAW,EAAc,MAAM,UAAU,CAAC;AA0B7D,wBAAgB,eAAe,CAAC,SAAS,EAAE,OAAO,GAAG,MAAM,CAE1D;AAaD,eAAO,MAAM,OAAO,EAAE,WAmBrB,CAAC;AAGF,eAAO,MAAM,OAAO,EAAE,WAarB,CAAC"}

package/dist/tools/symmetric.js

@@ -6,6 +6,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.decrypt = exports.encrypt = void 0;
 exports.symmetricSecret = symmetricSecret;
 const node_crypto_1 = __importDefault(require("node:crypto"));
+const crypto_lib_1 = require("@sebastienrousseau/crypto-lib");
 const keystore_1 = require("./keystore");
 const result_1 = require("./result");
 function aeadAlgorithm(value) {
@@ -63,7 +64,9 @@ const decrypt = async (args) => {
         decipher.update(Buffer.from(String(args.ciphertext), "hex")),
         decipher.final(),
     ]);
-    return (0, result_1.jsonResult)({ algorithm, plaintext: decrypted.toString("utf8") });
+    const plaintext = decrypted.toString("utf8");
+    (0, crypto_lib_1.wipeMemory)(decrypted);
+    return (0, result_1.jsonResult)({ algorithm, plaintext });
 };
 exports.decrypt = decrypt;
 //# sourceMappingURL=symmetric.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sebastienrousseau/crypto-mcp",
-  "version": "0.0.9",
+  "version": "0.0.25",
   "description": "Model Context Protocol (MCP) server for the Crypto Service Suite — exposing cryptographic operations, post-quantum primitives, and key management to AI assistants and agentic workflows.",
   "author": "Sebastien Rousseau <sebastienrousseau@users.noreply.github.com>",
   "license": "MIT OR Apache-2.0",
@@ -28,9 +28,9 @@
     "dist/**/*.d.ts.map"
   ],
   "dependencies": {
-    "@sebastienrousseau/crypto-lib": "0.0.9",
-    "@sebastienrousseau/crypto-kms": "0.0.9",
-    "@sebastienrousseau/crypto-wasm": "0.0.9"
+    "@sebastienrousseau/crypto-kms": "0.0.25",
+    "@sebastienrousseau/crypto-lib": "0.0.25",
+    "@sebastienrousseau/crypto-wasm": "0.0.25"
   },
   "devDependencies": {
     "@types/chai": "^5.2.3",