kemdicode-mcp 1.15.0

package/dist/loci/types.js

@@ -0,0 +1,143 @@
+/**
+ * KemdiCode MCP Server
+ * Copyright (C) 2025-2026 Kemdi Sp. z o.o.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+/**
+ * Default loci templates
+ */
+export const LOCI_TEMPLATES = {
+    'error-volcano': {
+        name: 'The Error Volcano',
+        description: 'An active volcano that erupts with stack traces and error messages',
+        category: 'error',
+        associations: [
+            'Red TypeError lava flows down the slopes',
+            'Green ReferenceError gas rises from vents',
+            'Blue SyntaxError crystals form in caves',
+            'The rumbling sound of uncaught exceptions',
+        ],
+        icon: '🌋',
+        color: '#e74c3c',
+    },
+    'solution-library': {
+        name: 'The Solution Library',
+        description: 'An infinite library with books containing fixes and solutions',
+        category: 'solution',
+        associations: [
+            'Golden shelves organized by error type',
+            'Glowing books that open when you approach',
+            'Whispered hints from ancient scrolls',
+            'A wise librarian who knows all patterns',
+        ],
+        icon: '📚',
+        color: '#3498db',
+    },
+    'dependency-dungeon': {
+        name: 'The Dependency Dungeon',
+        description: 'A dark dungeon where npm packages are kept in cages',
+        category: 'dependency',
+        associations: [
+            'Rusty chains connecting package versions',
+            'Torches showing peer dependency paths',
+            'Guards checking semver compatibility',
+            'A map of the node_modules labyrinth',
+        ],
+        icon: '⛓️',
+        color: '#9b59b6',
+    },
+    'tool-workshop': {
+        name: 'The Tool Workshop',
+        description: 'A craftsman workshop filled with powerful tools',
+        category: 'tool',
+        associations: [
+            'Sparkling code-review magnifying glass',
+            'Refactoring hammer that reshapes code',
+            'Testing anvil that finds weaknesses',
+            'Git time machine in the corner',
+        ],
+        icon: '🛠️',
+        color: '#f39c12',
+    },
+    'pattern-garden': {
+        name: 'The Pattern Garden',
+        description: 'A serene garden where design patterns grow as plants',
+        category: 'pattern',
+        associations: [
+            'Factory trees producing object fruits',
+            'Singleton rose that blooms once',
+            'Observer vines that notice everything',
+            'Strategy flowers that adapt to weather',
+        ],
+        icon: '🌸',
+        color: '#2ecc71',
+    },
+    'concept-cloud': {
+        name: 'The Concept Cloud',
+        description: 'Floating platforms in the sky holding abstract concepts',
+        category: 'concept',
+        associations: [
+            'Async clouds that float on promises',
+            'Type bridges connecting platforms',
+            'Rainbow streams of data flow',
+            'Thunder of breaking changes',
+        ],
+        icon: '☁️',
+        color: '#1abc9c',
+    },
+};
+/**
+ * Redis key patterns for Loci/Graph
+ */
+export const LOCI_KEYS = {
+    /** Node: mcp:graph:node:{nodeId} */
+    node: (nodeId) => `mcp:graph:node:${nodeId}`,
+    /** Nodes by type: mcp:graph:type:{nodeType} */
+    nodesByType: (nodeType) => `mcp:graph:type:${nodeType}`,
+    /** Nodes by session: mcp:graph:session:{sessionId} */
+    nodesBySession: (sessionId) => `mcp:graph:session:${sessionId}`,
+    /** Outgoing edges: mcp:graph:edges:out:{nodeId} */
+    edgesOut: (nodeId) => `mcp:graph:edges:out:${nodeId}`,
+    /** Incoming edges: mcp:graph:edges:in:{nodeId} */
+    edgesIn: (nodeId) => `mcp:graph:edges:in:${nodeId}`,
+    /** Edge data: mcp:graph:edge:{edgeId} */
+    edge: (edgeId) => `mcp:graph:edge:${edgeId}`,
+    /** Loci: mcp:loci:{lociId} */
+    loci: (lociId) => `mcp:loci:${lociId}`,
+    /** Loci by name: mcp:loci:name:{normalizedName} */
+    lociByName: (name) => `mcp:loci:name:${name.toLowerCase().replace(/\s+/g, '-')}`,
+    /** Loci by category: mcp:loci:category:{category} */
+    lociByCategory: (category) => `mcp:loci:category:${category}`,
+    /** Loci by session: mcp:loci:session:{sessionId} */
+    lociBySession: (sessionId) => `mcp:loci:session:${sessionId}`,
+    /** Tool sequences: mcp:sequences:{sessionId} */
+    sequences: (sessionId) => `mcp:sequences:${sessionId}`,
+    /** Current tool chain: mcp:chain:{agentId} */
+    currentChain: (agentId) => `mcp:chain:${agentId}`,
+    /** Tool transition matrix: mcp:transitions */
+    transitions: () => `mcp:transitions`,
+};
+/**
+ * Default auto-population configuration
+ */
+export const DEFAULT_AUTO_POPULATION_CONFIG = {
+    enabled: true,
+    events: ['tool_executed', 'error_detected', 'fix_applied', 'pattern_learned'],
+    defaultEdgeWeight: 0.5,
+    defaultNodeWeight: 0.5,
+    autoLociAssociation: true,
+    minSequenceOccurrences: 3,
+};
+//# sourceMappingURL=types.js.map

package/dist/loci/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/loci/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAoJH;;GAEG;AACH,MAAM,CAAC,MAAM,cAAc,GAAiC;IAC1D,eAAe,EAAE;QACf,IAAI,EAAE,mBAAmB;QACzB,WAAW,EAAE,oEAAoE;QACjF,QAAQ,EAAE,OAAO;QACjB,YAAY,EAAE;YACZ,0CAA0C;YAC1C,2CAA2C;YAC3C,yCAAyC;YACzC,2CAA2C;SAC5C;QACD,IAAI,EAAE,IAAI;QACV,KAAK,EAAE,SAAS;KACjB;IACD,kBAAkB,EAAE;QAClB,IAAI,EAAE,sBAAsB;QAC5B,WAAW,EAAE,+DAA+D;QAC5E,QAAQ,EAAE,UAAU;QACpB,YAAY,EAAE;YACZ,wCAAwC;YACxC,2CAA2C;YAC3C,sCAAsC;YACtC,yCAAyC;SAC1C;QACD,IAAI,EAAE,IAAI;QACV,KAAK,EAAE,SAAS;KACjB;IACD,oBAAoB,EAAE;QACpB,IAAI,EAAE,wBAAwB;QAC9B,WAAW,EAAE,qDAAqD;QAClE,QAAQ,EAAE,YAAY;QACtB,YAAY,EAAE;YACZ,0CAA0C;YAC1C,uCAAuC;YACvC,sCAAsC;YACtC,qCAAqC;SACtC;QACD,IAAI,EAAE,IAAI;QACV,KAAK,EAAE,SAAS;KACjB;IACD,eAAe,EAAE;QACf,IAAI,EAAE,mBAAmB;QACzB,WAAW,EAAE,iDAAiD;QAC9D,QAAQ,EAAE,MAAM;QAChB,YAAY,EAAE;YACZ,wCAAwC;YACxC,uCAAuC;YACvC,qCAAqC;YACrC,gCAAgC;SACjC;QACD,IAAI,EAAE,KAAK;QACX,KAAK,EAAE,SAAS;KACjB;IACD,gBAAgB,EAAE;QAChB,IAAI,EAAE,oBAAoB;QAC1B,WAAW,EAAE,sDAAsD;QACnE,QAAQ,EAAE,SAAS;QACnB,YAAY,EAAE;YACZ,uCAAuC;YACvC,iCAAiC;YACjC,uCAAuC;YACvC,wCAAwC;SACzC;QACD,IAAI,EAAE,IAAI;QACV,KAAK,EAAE,SAAS;KACjB;IACD,eAAe,EAAE;QACf,IAAI,EAAE,mBAAmB;QACzB,WAAW,EAAE,yDAAyD;QACtE,QAAQ,EAAE,SAAS;QACnB,YAAY,EAAE;YACZ,qCAAqC;YACrC,mCAAmC;YACnC,8BAA8B;YAC9B,6BAA6B;SAC9B;QACD,IAAI,EAAE,IAAI;QACV,KAAK,EAAE,SAAS;KACjB;CACF,CAAC;AA4HF;;GAEG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG;IACvB,oCAAoC;IACpC,IAAI,EAAE,CAAC,MAAc,EAAE,EAAE,CAAC,kBAAkB,MAAM,EAAE;IAEpD,+CAA+C;IAC/C,WAAW,EAAE,CAAC,QAAuB,EAAE,EAAE,CAAC,kBAAkB,QAAQ,EAAE;IAEtE,sDAAsD;IACtD,cAAc,EAAE,CAAC,SAAiB,EAAE,EAAE,CAAC,qBAAqB,SAAS,EAAE;IAEvE,mDAAmD;IACnD,QAAQ,EAAE,CAAC,MAAc,EAAE,EAAE,CAAC,uBAAuB,MAAM,EAAE;IAE7D,kDAAkD;IAClD,OAAO,EAAE,CAAC,MAAc,EAAE,EAAE,CAAC,sBAAsB,MAAM,EAAE;IAE3D,yCAAyC;IACzC,IAAI,EAAE,CAAC,MAAc,EAAE,EAAE,CAAC,kBAAkB,MAAM,EAAE;IAEpD,8BAA8B;IAC9B,IAAI,EAAE,CAAC,MAAc,EAAE,EAAE,CAAC,YAAY,MAAM,EAAE;IAE9C,mDAAmD;IACnD,UAAU,EAAE,CAAC,IAAY,EAAE,EAAE,CAAC,iBAAiB,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE;IAExF,qDAAqD;IACrD,cAAc,EAAE,CAAC,QAAsB,EAAE,EAAE,CAAC,qBAAqB,QAAQ,EAAE;IAE3E,oDAAoD;IACpD,aAAa,EAAE,CAAC,SAAiB,EAAE,EAAE,CAAC,oBAAoB,SAAS,EAAE;IAErE,gDAAgD;IAChD,SAAS,EAAE,CAAC,SAAiB,EAAE,EAAE,CAAC,iBAAiB,SAAS,EAAE;IAE9D,8CAA8C;IAC9C,YAAY,EAAE,CAAC,OAAe,EAAE,EAAE,CAAC,aAAa,OAAO,EAAE;IAEzD,8CAA8C;IAC9C,WAAW,EAAE,GAAG,EAAE,CAAC,iBAAiB;CAC5B,CAAC;AA+BX;;GAEG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAyB;IAClE,OAAO,EAAE,IAAI;IACb,MAAM,EAAE,CAAC,eAAe,EAAE,gBAAgB,EAAE,aAAa,EAAE,iBAAiB,CAAC;IAC7E,iBAAiB,EAAE,GAAG;IACtB,iBAAiB,EAAE,GAAG;IACtB,mBAAmB,EAAE,IAAI;IACzB,sBAAsB,EAAE,CAAC;CAC1B,CAAC"}

package/dist/mpc/auth.d.ts

@@ -0,0 +1,67 @@
+/**
+ * KemdiCode MCP Server
+ * Copyright (C) 2025-2026 Kemdi Sp. z o.o.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+import { MPC_ALLOWED_ROLES } from './types.js';
+import type { AgentRole } from '../context/types.js';
+/**
+ * MPC operation types
+ */
+export type MpcOperation = keyof typeof MPC_ALLOWED_ROLES;
+/**
+ * Authorization result
+ */
+export interface MpcAuthResult {
+    /** Whether the agent is authorized */
+    authorized: boolean;
+    /** Agent's role (if found) */
+    role?: AgentRole;
+    /** Error message (if not authorized) */
+    error?: string;
+}
+/**
+ * Generate HMAC signature for agent verification
+ * This creates a signature that can be verified later to prevent spoofing.
+ */
+export declare function generateAgentSignature(agentId: string, sessionId: string, timestamp: number): string;
+/**
+ * Verify agent signature to prevent spoofing
+ */
+export declare function verifyAgentSignature(agentId: string, sessionId: string, timestamp: number, signature: string): boolean;
+/**
+ * Verify agent authorization for an MPC operation
+ *
+ * SECURITY: Includes rate limiting to prevent brute-force attacks.
+ *
+ * @param agentId - The agent ID to verify
+ * @param operation - The MPC operation being performed
+ * @param signature - Optional HMAC signature for enhanced security
+ * @param sessionId - Session ID (required if signature provided)
+ * @param timestamp - Timestamp (required if signature provided)
+ * @returns Authorization result with role info or error
+ */
+export declare function verifyMpcAuthorization(agentId: string, operation: MpcOperation, signature?: string, sessionId?: string, timestamp?: number): Promise<MpcAuthResult>;
+/**
+ * Check if an operation requires authorization
+ *
+ * All MPC operations except 'viewStatus' require supervisor/coordinator role.
+ */
+export declare function requiresElevatedRole(operation: MpcOperation): boolean;
+/**
+ * Get human-readable description of required roles for an operation
+ */
+export declare function getRequiredRolesDescription(operation: MpcOperation): string;
+//# sourceMappingURL=auth.d.ts.map

package/dist/mpc/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/mpc/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAYH,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAWrD;;GAEG;AACH,MAAM,MAAM,YAAY,GAAG,MAAM,OAAO,iBAAiB,CAAC;AAE1D;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,sCAAsC;IACtC,UAAU,EAAE,OAAO,CAAC;IACpB,8BAA8B;IAC9B,IAAI,CAAC,EAAE,SAAS,CAAC;IACjB,wCAAwC;IACxC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAqCD;;;GAGG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,GAChB,MAAM,CAOR;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,GAChB,OAAO,CAkBT;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,sBAAsB,CAC1C,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,YAAY,EACvB,SAAS,CAAC,EAAE,MAAM,EAClB,SAAS,CAAC,EAAE,MAAM,EAClB,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,aAAa,CAAC,CAqDxB;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,YAAY,GAAG,OAAO,CAIrE;AAED;;GAEG;AACH,wBAAgB,2BAA2B,CAAC,SAAS,EAAE,YAAY,GAAG,MAAM,CAG3E"}

package/dist/mpc/auth.js

@@ -0,0 +1,173 @@
+/**
+ * KemdiCode MCP Server
+ * Copyright (C) 2025-2026 Kemdi Sp. z o.o.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+/**
+ * MPC Authorization Module
+ *
+ * Provides role-based access control for MPC operations.
+ * Only authorized agent roles can perform sensitive operations.
+ *
+ * SECURITY: Includes rate limiting to prevent brute-force attacks on agent IDs.
+ */
+import { getAgentMonitor } from '../context/agent-monitor.js';
+import { MPC_ALLOWED_ROLES } from './types.js';
+import { createHmac } from 'crypto';
+/**
+ * Rate limiter for authorization attempts
+ */
+const authAttempts = new Map();
+const MAX_AUTH_ATTEMPTS = 10;
+const MAX_AUTH_KEYS = 1000;
+const RATE_LIMIT_WINDOW_MS = 60000; // 1 minute
+/**
+ * Check rate limit for authorization attempts
+ */
+function checkRateLimit(agentId) {
+    const now = Date.now();
+    const key = `auth:${agentId}`;
+    const record = authAttempts.get(key);
+    if (record) {
+        if (now > record.resetAt) {
+            // Window expired, reset
+            authAttempts.set(key, { count: 1, resetAt: now + RATE_LIMIT_WINDOW_MS });
+            return { allowed: true };
+        }
+        if (record.count >= MAX_AUTH_ATTEMPTS) {
+            return { allowed: false, retryAfterMs: record.resetAt - now };
+        }
+        record.count++;
+        return { allowed: true };
+    }
+    // Evict expired entries if map grows too large
+    if (authAttempts.size > MAX_AUTH_KEYS) {
+        for (const [k, v] of authAttempts) {
+            if (now > v.resetAt)
+                authAttempts.delete(k);
+            if (authAttempts.size <= MAX_AUTH_KEYS)
+                break;
+        }
+    }
+    authAttempts.set(key, { count: 1, resetAt: now + RATE_LIMIT_WINDOW_MS });
+    return { allowed: true };
+}
+/**
+ * Generate HMAC signature for agent verification
+ * This creates a signature that can be verified later to prevent spoofing.
+ */
+export function generateAgentSignature(agentId, sessionId, timestamp) {
+    const secret = process.env.MPC_MASTER_SECRET || '';
+    if (!secret) {
+        throw new Error('MPC_MASTER_SECRET required for agent signature generation');
+    }
+    const data = `${agentId}:${sessionId}:${timestamp}`;
+    return createHmac('sha256', secret).update(data).digest('hex');
+}
+/**
+ * Verify agent signature to prevent spoofing
+ */
+export function verifyAgentSignature(agentId, sessionId, timestamp, signature) {
+    // Signature must not be older than 5 minutes
+    const MAX_SIGNATURE_AGE_MS = 5 * 60 * 1000;
+    if (Date.now() - timestamp > MAX_SIGNATURE_AGE_MS) {
+        return false;
+    }
+    const expectedSignature = generateAgentSignature(agentId, sessionId, timestamp);
+    // Constant-time comparison to prevent timing attacks
+    if (signature.length !== expectedSignature.length) {
+        return false;
+    }
+    let result = 0;
+    for (let i = 0; i < signature.length; i++) {
+        result |= signature.charCodeAt(i) ^ expectedSignature.charCodeAt(i);
+    }
+    return result === 0;
+}
+/**
+ * Verify agent authorization for an MPC operation
+ *
+ * SECURITY: Includes rate limiting to prevent brute-force attacks.
+ *
+ * @param agentId - The agent ID to verify
+ * @param operation - The MPC operation being performed
+ * @param signature - Optional HMAC signature for enhanced security
+ * @param sessionId - Session ID (required if signature provided)
+ * @param timestamp - Timestamp (required if signature provided)
+ * @returns Authorization result with role info or error
+ */
+export async function verifyMpcAuthorization(agentId, operation, signature, sessionId, timestamp) {
+    // SECURITY: Check rate limit first
+    const rateCheck = checkRateLimit(agentId);
+    if (!rateCheck.allowed) {
+        return {
+            authorized: false,
+            error: `Rate limit exceeded. Too many authorization attempts. ` +
+                `Try again in ${Math.ceil((rateCheck.retryAfterMs || 0) / 1000)} seconds.`,
+        };
+    }
+    const monitor = getAgentMonitor();
+    // Get agent info from registry
+    const agent = await monitor.getAgent(agentId);
+    if (!agent) {
+        return {
+            authorized: false,
+            error: `Agent ${agentId} not found in registry. Register agent first using agent-register tool.`,
+        };
+    }
+    // SECURITY: If signature provided, verify it to prevent spoofing
+    if (signature && sessionId && timestamp) {
+        if (!verifyAgentSignature(agentId, sessionId, timestamp, signature)) {
+            return {
+                authorized: false,
+                role: agent.role,
+                error: 'Invalid or expired agent signature. Agent identity could not be verified.',
+            };
+        }
+    }
+    // Check if agent's role is allowed for this operation
+    const allowedRoles = MPC_ALLOWED_ROLES[operation];
+    const isAllowed = allowedRoles.includes(agent.role);
+    if (!isAllowed) {
+        return {
+            authorized: false,
+            role: agent.role,
+            error: `Agent role '${agent.role}' is not authorized for '${operation}' operation. ` +
+                `Required roles: ${allowedRoles.join(', ')}`,
+        };
+    }
+    return {
+        authorized: true,
+        role: agent.role,
+    };
+}
+/**
+ * Check if an operation requires authorization
+ *
+ * All MPC operations except 'viewStatus' require supervisor/coordinator role.
+ */
+export function requiresElevatedRole(operation) {
+    const roles = MPC_ALLOWED_ROLES[operation];
+    // If workers are allowed, it's not elevated
+    return !roles.includes('worker');
+}
+/**
+ * Get human-readable description of required roles for an operation
+ */
+export function getRequiredRolesDescription(operation) {
+    const roles = MPC_ALLOWED_ROLES[operation];
+    return roles.join(' or ');
+}
+//# sourceMappingURL=auth.js.map

package/dist/mpc/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/mpc/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH;;;;;;;GAOG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAE/C,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAEpC;;GAEG;AACH,MAAM,YAAY,GAAG,IAAI,GAAG,EAA8C,CAAC;AAC3E,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAC7B,MAAM,aAAa,GAAG,IAAI,CAAC;AAC3B,MAAM,oBAAoB,GAAG,KAAK,CAAC,CAAC,WAAW;AAmB/C;;GAEG;AACH,SAAS,cAAc,CAAC,OAAe;IACrC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,GAAG,GAAG,QAAQ,OAAO,EAAE,CAAC;IAC9B,MAAM,MAAM,GAAG,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAErC,IAAI,MAAM,EAAE,CAAC;QACX,IAAI,GAAG,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;YACzB,wBAAwB;YACxB,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,GAAG,oBAAoB,EAAE,CAAC,CAAC;YACzE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC;QAED,IAAI,MAAM,CAAC,KAAK,IAAI,iBAAiB,EAAE,CAAC;YACtC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,CAAC,OAAO,GAAG,GAAG,EAAE,CAAC;QAChE,CAAC;QAED,MAAM,CAAC,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,+CAA+C;IAC/C,IAAI,YAAY,CAAC,IAAI,GAAG,aAAa,EAAE,CAAC;QACtC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,YAAY,EAAE,CAAC;YAClC,IAAI,GAAG,GAAG,CAAC,CAAC,OAAO;gBAAE,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAC5C,IAAI,YAAY,CAAC,IAAI,IAAI,aAAa;gBAAE,MAAM;QAChD,CAAC;IACH,CAAC;IAED,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,GAAG,oBAAoB,EAAE,CAAC,CAAC;IACzE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CACpC,OAAe,EACf,SAAiB,EACjB,SAAiB;IAEjB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,EAAE,CAAC;IACnD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;IAC/E,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,OAAO,IAAI,SAAS,IAAI,SAAS,EAAE,CAAC;IACpD,OAAO,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACjE,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAAe,EACf,SAAiB,EACjB,SAAiB,EACjB,SAAiB;IAEjB,6CAA6C;IAC7C,MAAM,oBAAoB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;IAC3C,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,oBAAoB,EAAE,CAAC;QAClD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,iBAAiB,GAAG,sBAAsB,CAAC,OAAO,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;IAEhF,qDAAqD;IACrD,IAAI,SAAS,CAAC,MAAM,KAAK,iBAAiB,CAAC,MAAM,EAAE,CAAC;QAClD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC1C,MAAM,IAAI,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,MAAM,KAAK,CAAC,CAAC;AACtB,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAAe,EACf,SAAuB,EACvB,SAAkB,EAClB,SAAkB,EAClB,SAAkB;IAElB,mCAAmC;IACnC,MAAM,SAAS,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IAC1C,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;QACvB,OAAO;YACL,UAAU,EAAE,KAAK;YACjB,KAAK,EACH,wDAAwD;gBACxD,gBAAgB,IAAI,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,YAAY,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,WAAW;SAC7E,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,eAAe,EAAE,CAAC;IAElC,+BAA+B;IAC/B,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAE9C,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO;YACL,UAAU,EAAE,KAAK;YACjB,KAAK,EAAE,SAAS,OAAO,yEAAyE;SACjG,CAAC;IACJ,CAAC;IAED,iEAAiE;IACjE,IAAI,SAAS,IAAI,SAAS,IAAI,SAAS,EAAE,CAAC;QACxC,IAAI,CAAC,oBAAoB,CAAC,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC,EAAE,CAAC;YACpE,OAAO;gBACL,UAAU,EAAE,KAAK;gBACjB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,KAAK,EAAE,2EAA2E;aACnF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,sDAAsD;IACtD,MAAM,YAAY,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAClD,MAAM,SAAS,GAAI,YAAkC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAE3E,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO;YACL,UAAU,EAAE,KAAK;YACjB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,KAAK,EACH,eAAe,KAAK,CAAC,IAAI,4BAA4B,SAAS,eAAe;gBAC7E,mBAAmB,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;SAC/C,CAAC;IACJ,CAAC;IAED,OAAO;QACL,UAAU,EAAE,IAAI;QAChB,IAAI,EAAE,KAAK,CAAC,IAAI;KACjB,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,SAAuB;IAC1D,MAAM,KAAK,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAC3C,4CAA4C;IAC5C,OAAO,CAAE,KAA2B,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAC1D,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,2BAA2B,CAAC,SAAuB;IACjE,MAAM,KAAK,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAC3C,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC5B,CAAC"}

package/dist/mpc/crypto.d.ts

@@ -0,0 +1,139 @@
+/**
+ * KemdiCode MCP Server
+ * Copyright (C) 2025-2026 Kemdi Sp. z o.o.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+/**
+ * Encryption result with IV and auth tag
+ */
+export interface EncryptedData {
+    /** Encrypted data (hex) */
+    ciphertext: string;
+    /** Initialization vector (hex) */
+    iv: string;
+    /** Authentication tag (hex) */
+    authTag: string;
+}
+/**
+ * Generate a random 256-bit key
+ */
+export declare function generateKey(): Buffer;
+/**
+ * Generate a random 96-bit IV for AES-GCM
+ */
+export declare function generateIV(): Buffer;
+/**
+ * Derive a key from a password/passphrase using PBKDF2
+ */
+export declare function deriveKey(passphrase: string, salt?: Buffer): {
+    key: Buffer;
+    salt: Buffer;
+};
+/**
+ * Derive a session-specific key from session ID using HKDF
+ *
+ * SECURITY: Uses HKDF (HMAC-based Key Derivation Function) with proper
+ * salt derivation instead of simple SHA256 concatenation.
+ * This prevents collision attacks and provides proper key separation.
+ */
+export declare function deriveSessionKey(sessionId: string, masterSecret: string): Buffer;
+/**
+ * Encrypt data using AES-256-GCM
+ */
+export declare function encrypt(data: string, key: Buffer): EncryptedData;
+/**
+ * Decrypt data using AES-256-GCM
+ */
+export declare function decrypt(encrypted: EncryptedData, key: Buffer): string;
+/**
+ * Hash data using SHA-256
+ */
+export declare function sha256(data: string): string;
+/**
+ * Generate a verification hash for a secret
+ * Uses double hashing for security
+ */
+export declare function generateVerificationHash(secret: string): string;
+/**
+ * Verify a secret against its verification hash
+ */
+export declare function verifySecretHash(secret: string, verificationHash: string): boolean;
+/**
+ * Generate a unique secret ID
+ */
+export declare function generateSecretId(): string;
+/**
+ * Generate a unique share ID
+ */
+export declare function generateShareId(secretId: string, index: number): string;
+/**
+ * Encrypt a share for storage
+ */
+export declare function encryptShare(shareData: string, sessionKey: Buffer): EncryptedData;
+/**
+ * Decrypt a share from storage
+ */
+export declare function decryptShare(encrypted: EncryptedData, sessionKey: Buffer): string;
+/**
+ * Key management for MPC operations
+ *
+ * SECURITY: Session keys are cached with TTL to limit exposure window.
+ */
+export declare class MpcKeyManager {
+    private sessionKeys;
+    private masterSecret;
+    private static readonly KEY_TTL_MS;
+    constructor(masterSecret?: string);
+    /**
+     * Check if secret has adequate entropy
+     * Rejects patterns like "aaaa...", "1234...", "0000..."
+     */
+    private hasAdequateEntropy;
+    /**
+     * Get or derive a session key
+     *
+     * SECURITY: Keys are cached with TTL to limit exposure window.
+     */
+    getSessionKey(sessionId: string): Buffer;
+    /**
+     * Remove expired keys from cache
+     */
+    private cleanupExpiredKeys;
+    /**
+     * Clear a session key
+     */
+    clearSessionKey(sessionId: string): void;
+    /**
+     * Clear all session keys
+     */
+    clearAllKeys(): void;
+    /**
+     * Encrypt data for a session
+     */
+    encryptForSession(sessionId: string, data: string): EncryptedData;
+    /**
+     * Decrypt data for a session
+     */
+    decryptForSession(sessionId: string, encrypted: EncryptedData): string;
+}
+/**
+ * Get the global MPC key manager
+ */
+export declare function getKeyManager(): MpcKeyManager;
+/**
+ * Reset the global key manager (for testing)
+ */
+export declare function resetKeyManager(): void;
+//# sourceMappingURL=crypto.d.ts.map

package/dist/mpc/crypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../../src/mpc/crypto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAkBH;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,2BAA2B;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,kCAAkC;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,+BAA+B;IAC/B,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;GAEG;AACH,wBAAgB,WAAW,IAAI,MAAM,CAEpC;AAED;;GAEG;AACH,wBAAgB,UAAU,IAAI,MAAM,CAEnC;AAED;;GAEG;AACH,wBAAgB,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAI1F;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM,CAahF;AAED;;GAEG;AACH,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,aAAa,CAchE;AAED;;GAEG;AACH,wBAAgB,OAAO,CAAC,SAAS,EAAE,aAAa,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAWrE;AAED;;GAEG;AACH,wBAAgB,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE3C;AAED;;;GAGG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAG/D;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,GAAG,OAAO,CAWlF;AAED;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,CAEzC;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAEvE;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,aAAa,CAEjF;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,SAAS,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAEjF;AAiBD;;;;GAIG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,WAAW,CAAqC;IACxD,OAAO,CAAC,YAAY,CAAS;IAC7B,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAkB;gBAExC,YAAY,CAAC,EAAE,MAAM;IA+BjC;;;OAGG;IACH,OAAO,CAAC,kBAAkB;IAgC1B;;;;OAIG;IACH,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM;IAwBxC;;OAEG;IACH,OAAO,CAAC,kBAAkB;IAS1B;;OAEG;IACH,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAIxC;;OAEG;IACH,YAAY,IAAI,IAAI;IAIpB;;OAEG;IACH,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,aAAa;IAKjE;;OAEG;IACH,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,aAAa,GAAG,MAAM;CAIvE;AAKD;;GAEG;AACH,wBAAgB,aAAa,IAAI,aAAa,CAK7C;AAED;;GAEG;AACH,wBAAgB,eAAe,IAAI,IAAI,CAKtC"}