kemdicode-mcp 1.15.0

package/dist/mpc/crypto.js

@@ -0,0 +1,287 @@
+/**
+ * KemdiCode MCP Server
+ * Copyright (C) 2025-2026 Kemdi Sp. z o.o.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+/**
+ * MPC Cryptographic Utilities
+ *
+ * AES-256-GCM encryption for securing shares and deriving session keys.
+ * Uses Node.js built-in crypto module.
+ */
+import { randomBytes, createCipheriv, createDecipheriv, createHash, createHmac, pbkdf2Sync, } from 'crypto';
+/**
+ * Generate a random 256-bit key
+ */
+export function generateKey() {
+    return randomBytes(32);
+}
+/**
+ * Generate a random 96-bit IV for AES-GCM
+ */
+export function generateIV() {
+    return randomBytes(12);
+}
+/**
+ * Derive a key from a password/passphrase using PBKDF2
+ */
+export function deriveKey(passphrase, salt) {
+    const actualSalt = salt || randomBytes(16);
+    const key = pbkdf2Sync(passphrase, actualSalt, 100000, 32, 'sha256');
+    return { key, salt: actualSalt };
+}
+/**
+ * Derive a session-specific key from session ID using HKDF
+ *
+ * SECURITY: Uses HKDF (HMAC-based Key Derivation Function) with proper
+ * salt derivation instead of simple SHA256 concatenation.
+ * This prevents collision attacks and provides proper key separation.
+ */
+export function deriveSessionKey(sessionId, masterSecret) {
+    // Use HKDF: first extract, then expand
+    // Extract: Create a PRK (pseudo-random key) using HMAC with session-derived salt
+    const salt = createHash('sha256').update(`mpc-session-salt:${sessionId}`).digest();
+    const prk = createHmac('sha256', salt).update(masterSecret).digest();
+    // Expand: Derive the final key using HMAC with context info
+    const info = Buffer.from(`mpc-key-v1:${sessionId}`, 'utf8');
+    const key = createHmac('sha256', prk)
+        .update(Buffer.concat([info, Buffer.from([1])]))
+        .digest();
+    return key;
+}
+/**
+ * Encrypt data using AES-256-GCM
+ */
+export function encrypt(data, key) {
+    const iv = generateIV();
+    const cipher = createCipheriv('aes-256-gcm', key, iv);
+    let ciphertext = cipher.update(data, 'utf8', 'hex');
+    ciphertext += cipher.final('hex');
+    const authTag = cipher.getAuthTag();
+    return {
+        ciphertext,
+        iv: iv.toString('hex'),
+        authTag: authTag.toString('hex'),
+    };
+}
+/**
+ * Decrypt data using AES-256-GCM
+ */
+export function decrypt(encrypted, key) {
+    const iv = Buffer.from(encrypted.iv, 'hex');
+    const authTag = Buffer.from(encrypted.authTag, 'hex');
+    const decipher = createDecipheriv('aes-256-gcm', key, iv);
+    decipher.setAuthTag(authTag);
+    let plaintext = decipher.update(encrypted.ciphertext, 'hex', 'utf8');
+    plaintext += decipher.final('utf8');
+    return plaintext;
+}
+/**
+ * Hash data using SHA-256
+ */
+export function sha256(data) {
+    return createHash('sha256').update(data).digest('hex');
+}
+/**
+ * Generate a verification hash for a secret
+ * Uses double hashing for security
+ */
+export function generateVerificationHash(secret) {
+    const firstHash = sha256(secret);
+    return sha256(firstHash);
+}
+/**
+ * Verify a secret against its verification hash
+ */
+export function verifySecretHash(secret, verificationHash) {
+    const computedHash = generateVerificationHash(secret);
+    // Constant-time comparison to prevent timing attacks
+    if (computedHash.length !== verificationHash.length) {
+        return false;
+    }
+    let result = 0;
+    for (let i = 0; i < computedHash.length; i++) {
+        result |= computedHash.charCodeAt(i) ^ verificationHash.charCodeAt(i);
+    }
+    return result === 0;
+}
+/**
+ * Generate a unique secret ID
+ */
+export function generateSecretId() {
+    return `secret_${Date.now()}_${randomBytes(8).toString('hex')}`;
+}
+/**
+ * Generate a unique share ID
+ */
+export function generateShareId(secretId, index) {
+    return `share_${secretId}_${index}`;
+}
+/**
+ * Encrypt a share for storage
+ */
+export function encryptShare(shareData, sessionKey) {
+    return encrypt(shareData, sessionKey);
+}
+/**
+ * Decrypt a share from storage
+ */
+export function decryptShare(encrypted, sessionKey) {
+    return decrypt(encrypted, sessionKey);
+}
+/**
+ * Key management for MPC operations
+ *
+ * SECURITY: Session keys are cached with TTL to limit exposure window.
+ */
+export class MpcKeyManager {
+    sessionKeys = new Map();
+    masterSecret;
+    static KEY_TTL_MS = 30 * 60 * 1000; // 30 minutes
+    constructor(masterSecret) {
+        const secret = masterSecret || process.env.MPC_MASTER_SECRET;
+        if (!secret) {
+            throw new Error('MPC_MASTER_SECRET environment variable is required for MPC operations. ' +
+                'Set a persistent 64-character hex string (256 bits) to enable secret sharing. ' +
+                'Example: export MPC_MASTER_SECRET=$(openssl rand -hex 32)');
+        }
+        // Validate master secret format (should be at least 32 characters)
+        if (secret.length < 32) {
+            throw new Error('MPC_MASTER_SECRET must be at least 32 characters (256 bits recommended). ' +
+                'Generate with: openssl rand -hex 32');
+        }
+        // SECURITY: Validate entropy - reject low-entropy secrets
+        if (!this.hasAdequateEntropy(secret)) {
+            throw new Error('MPC_MASTER_SECRET has insufficient entropy. ' +
+                'The secret appears to be a weak pattern (repeated chars, sequential, etc.). ' +
+                'Generate a cryptographically secure secret with: openssl rand -hex 32');
+        }
+        this.masterSecret = secret;
+    }
+    /**
+     * Check if secret has adequate entropy
+     * Rejects patterns like "aaaa...", "1234...", "0000..."
+     */
+    hasAdequateEntropy(secret) {
+        // Check for repeated characters (more than 50% same char)
+        const charCounts = new Map();
+        for (const char of secret) {
+            charCounts.set(char, (charCounts.get(char) || 0) + 1);
+        }
+        const maxCount = Math.max(...charCounts.values());
+        if (maxCount > secret.length * 0.5) {
+            return false;
+        }
+        // Check for sequential patterns (at least 8 unique chars required)
+        if (charCounts.size < 8) {
+            return false;
+        }
+        // Check for common weak patterns
+        const weakPatterns = [
+            /^(.)\1+$/, // All same character
+            /^(01)+|^(10)+/, // Binary alternating
+            /^(12)+|^(21)+|^(ab)+|^(ba)+/i, // Simple alternating
+            /^0+$|^1+$/, // All zeros or ones
+        ];
+        for (const pattern of weakPatterns) {
+            if (pattern.test(secret)) {
+                return false;
+            }
+        }
+        return true;
+    }
+    /**
+     * Get or derive a session key
+     *
+     * SECURITY: Keys are cached with TTL to limit exposure window.
+     */
+    getSessionKey(sessionId) {
+        const now = Date.now();
+        const cached = this.sessionKeys.get(sessionId);
+        // Check if cached key is still valid
+        if (cached && cached.expiresAt > now) {
+            return cached.key;
+        }
+        // Derive new key and cache it
+        const key = deriveSessionKey(sessionId, this.masterSecret);
+        this.sessionKeys.set(sessionId, {
+            key,
+            expiresAt: now + MpcKeyManager.KEY_TTL_MS,
+        });
+        // Cleanup expired keys periodically
+        if (this.sessionKeys.size > 100) {
+            this.cleanupExpiredKeys();
+        }
+        return key;
+    }
+    /**
+     * Remove expired keys from cache
+     */
+    cleanupExpiredKeys() {
+        const now = Date.now();
+        for (const [sessionId, cached] of this.sessionKeys.entries()) {
+            if (cached.expiresAt <= now) {
+                this.sessionKeys.delete(sessionId);
+            }
+        }
+    }
+    /**
+     * Clear a session key
+     */
+    clearSessionKey(sessionId) {
+        this.sessionKeys.delete(sessionId);
+    }
+    /**
+     * Clear all session keys
+     */
+    clearAllKeys() {
+        this.sessionKeys.clear();
+    }
+    /**
+     * Encrypt data for a session
+     */
+    encryptForSession(sessionId, data) {
+        const key = this.getSessionKey(sessionId);
+        return encrypt(data, key);
+    }
+    /**
+     * Decrypt data for a session
+     */
+    decryptForSession(sessionId, encrypted) {
+        const key = this.getSessionKey(sessionId);
+        return decrypt(encrypted, key);
+    }
+}
+// Singleton instance
+let keyManager = null;
+/**
+ * Get the global MPC key manager
+ */
+export function getKeyManager() {
+    if (!keyManager) {
+        keyManager = new MpcKeyManager();
+    }
+    return keyManager;
+}
+/**
+ * Reset the global key manager (for testing)
+ */
+export function resetKeyManager() {
+    if (keyManager) {
+        keyManager.clearAllKeys();
+    }
+    keyManager = null;
+}
+//# sourceMappingURL=crypto.js.map

package/dist/mpc/crypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../../src/mpc/crypto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH;;;;;GAKG;AAEH,OAAO,EACL,WAAW,EACX,cAAc,EACd,gBAAgB,EAChB,UAAU,EACV,UAAU,EACV,UAAU,GACX,MAAM,QAAQ,CAAC;AAchB;;GAEG;AACH,MAAM,UAAU,WAAW;IACzB,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC;AACzB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,UAAU;IACxB,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC;AACzB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,SAAS,CAAC,UAAkB,EAAE,IAAa;IACzD,MAAM,UAAU,GAAG,IAAI,IAAI,WAAW,CAAC,EAAE,CAAC,CAAC;IAC3C,MAAM,GAAG,GAAG,UAAU,CAAC,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAC;IACrE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;AACnC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,SAAiB,EAAE,YAAoB;IACtE,uCAAuC;IACvC,iFAAiF;IACjF,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,oBAAoB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;IACnF,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,EAAE,CAAC;IAErE,4DAA4D;IAC5D,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,SAAS,EAAE,EAAE,MAAM,CAAC,CAAC;IAC5D,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,EAAE,GAAG,CAAC;SAClC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SAC/C,MAAM,EAAE,CAAC;IAEZ,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,OAAO,CAAC,IAAY,EAAE,GAAW;IAC/C,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;IACxB,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IAEtD,IAAI,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;IACpD,UAAU,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAElC,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAEpC,OAAO;QACL,UAAU;QACV,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC;QACtB,OAAO,EAAE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;KACjC,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,OAAO,CAAC,SAAwB,EAAE,GAAW;IAC3D,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IAC5C,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAEtD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IAC1D,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAE7B,IAAI,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IACrE,SAAS,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAEpC,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,MAAM,CAAC,IAAY;IACjC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CAAC,MAAc;IACrD,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IACjC,OAAO,MAAM,CAAC,SAAS,CAAC,CAAC;AAC3B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAc,EAAE,gBAAwB;IACvE,MAAM,YAAY,GAAG,wBAAwB,CAAC,MAAM,CAAC,CAAC;IACtD,qDAAqD;IACrD,IAAI,YAAY,CAAC,MAAM,KAAK,gBAAgB,CAAC,MAAM,EAAE,CAAC;QACpD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,YAAY,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7C,MAAM,IAAI,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,gBAAgB,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,MAAM,KAAK,CAAC,CAAC;AACtB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB;IAC9B,OAAO,UAAU,IAAI,CAAC,GAAG,EAAE,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;AAClE,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,QAAgB,EAAE,KAAa;IAC7D,OAAO,SAAS,QAAQ,IAAI,KAAK,EAAE,CAAC;AACtC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,SAAiB,EAAE,UAAkB;IAChE,OAAO,OAAO,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;AACxC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,SAAwB,EAAE,UAAkB;IACvE,OAAO,OAAO,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;AACxC,CAAC;AAiBD;;;;GAIG;AACH,MAAM,OAAO,aAAa;IAChB,WAAW,GAA2B,IAAI,GAAG,EAAE,CAAC;IAChD,YAAY,CAAS;IACrB,MAAM,CAAU,UAAU,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,aAAa;IAElE,YAAY,YAAqB;QAC/B,MAAM,MAAM,GAAG,YAAY,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;QAE7D,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CACb,yEAAyE;gBACvE,gFAAgF;gBAChF,2DAA2D,CAC9D,CAAC;QACJ,CAAC;QAED,mEAAmE;QACnE,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CACb,2EAA2E;gBACzE,qCAAqC,CACxC,CAAC;QACJ,CAAC;QAED,0DAA0D;QAC1D,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC;YACrC,MAAM,IAAI,KAAK,CACb,8CAA8C;gBAC5C,8EAA8E;gBAC9E,uEAAuE,CAC1E,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC;IAC7B,CAAC;IAED;;;OAGG;IACK,kBAAkB,CAAC,MAAc;QACvC,0DAA0D;QAC1D,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;QAC7C,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;YAC1B,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QACxD,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;QAClD,IAAI,QAAQ,GAAG,MAAM,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YACnC,OAAO,KAAK,CAAC;QACf,CAAC;QAED,mEAAmE;QACnE,IAAI,UAAU,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YACxB,OAAO,KAAK,CAAC;QACf,CAAC;QAED,iCAAiC;QACjC,MAAM,YAAY,GAAG;YACnB,UAAU,EAAE,qBAAqB;YACjC,eAAe,EAAE,qBAAqB;YACtC,8BAA8B,EAAE,qBAAqB;YACrD,WAAW,EAAE,oBAAoB;SAClC,CAAC;QACF,KAAK,MAAM,OAAO,IAAI,YAAY,EAAE,CAAC;YACnC,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;gBACzB,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;OAIG;IACH,aAAa,CAAC,SAAiB;QAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAE/C,qCAAqC;QACrC,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC;YACrC,OAAO,MAAM,CAAC,GAAG,CAAC;QACpB,CAAC;QAED,8BAA8B;QAC9B,MAAM,GAAG,GAAG,gBAAgB,CAAC,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QAC3D,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,EAAE;YAC9B,GAAG;YACH,SAAS,EAAE,GAAG,GAAG,aAAa,CAAC,UAAU;SAC1C,CAAC,CAAC;QAEH,oCAAoC;QACpC,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,GAAG,GAAG,EAAE,CAAC;YAChC,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAC5B,CAAC;QAED,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;OAEG;IACK,kBAAkB;QACxB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,EAAE,CAAC;YAC7D,IAAI,MAAM,CAAC,SAAS,IAAI,GAAG,EAAE,CAAC;gBAC5B,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YACrC,CAAC;QACH,CAAC;IACH,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,SAAiB;QAC/B,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACrC,CAAC;IAED;;OAEG;IACH,YAAY;QACV,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;IAC3B,CAAC;IAED;;OAEG;IACH,iBAAiB,CAAC,SAAiB,EAAE,IAAY;QAC/C,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;QAC1C,OAAO,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC5B,CAAC;IAED;;OAEG;IACH,iBAAiB,CAAC,SAAiB,EAAE,SAAwB;QAC3D,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;QAC1C,OAAO,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IACjC,CAAC;;AAGH,qBAAqB;AACrB,IAAI,UAAU,GAAyB,IAAI,CAAC;AAE5C;;GAEG;AACH,MAAM,UAAU,aAAa;IAC3B,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,UAAU,GAAG,IAAI,aAAa,EAAE,CAAC;IACnC,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe;IAC7B,IAAI,UAAU,EAAE,CAAC;QACf,UAAU,CAAC,YAAY,EAAE,CAAC;IAC5B,CAAC;IACD,UAAU,GAAG,IAAI,CAAC;AACpB,CAAC"}

package/dist/mpc/index.d.ts

@@ -0,0 +1,30 @@
+/**
+ * KemdiCode MCP Server
+ * Copyright (C) 2025-2026 Kemdi Sp. z o.o.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+/**
+ * MPC (Multi-Party Computation) Module
+ *
+ * Provides Shamir Secret Sharing based threshold cryptography
+ * for secure secret distribution among agents.
+ */
+export type { MpcShare, MpcSecretMetadata, MpcSplitConfig, MpcSplitResult, MpcDistribution, MpcReconstructRequest, MpcReconstructResult, MpcSecretStatus, MpcMessageType, MpcShareRequestMessage, MpcShareResponseMessage, } from './types.js';
+export { MPC_KEYS, MPC_ALLOWED_ROLES } from './types.js';
+export { generateKey, generateIV, deriveKey, deriveSessionKey, encrypt, decrypt, sha256, generateVerificationHash, verifySecretHash, generateSecretId, generateShareId, encryptShare, decryptShare, MpcKeyManager, getKeyManager, resetKeyManager, type EncryptedData, } from './crypto.js';
+export { splitSecret, distributeShares, validateSharesForReconstruction, reconstructSecret, generateRandomSecret, canPerformMpcOperation, calculateDistributionStats, } from './share-manager.js';
+export { MpcRedisStore, getMpcStore, resetMpcStore, type MpcRedisStoreConfig, } from './redis-store.js';
+export { verifyMpcAuthorization, requiresElevatedRole, getRequiredRolesDescription, generateAgentSignature, verifyAgentSignature, type MpcOperation, type MpcAuthResult, } from './auth.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/mpc/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/mpc/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH;;;;;GAKG;AAGH,YAAY,EACV,QAAQ,EACR,iBAAiB,EACjB,cAAc,EACd,cAAc,EACd,eAAe,EACf,qBAAqB,EACrB,oBAAoB,EACpB,eAAe,EACf,cAAc,EACd,sBAAsB,EACtB,uBAAuB,GACxB,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAGzD,OAAO,EACL,WAAW,EACX,UAAU,EACV,SAAS,EACT,gBAAgB,EAChB,OAAO,EACP,OAAO,EACP,MAAM,EACN,wBAAwB,EACxB,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,EACf,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,aAAa,EACb,eAAe,EACf,KAAK,aAAa,GACnB,MAAM,aAAa,CAAC;AAGrB,OAAO,EACL,WAAW,EACX,gBAAgB,EAChB,+BAA+B,EAC/B,iBAAiB,EACjB,oBAAoB,EACpB,sBAAsB,EACtB,0BAA0B,GAC3B,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EACL,aAAa,EACb,WAAW,EACX,aAAa,EACb,KAAK,mBAAmB,GACzB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,2BAA2B,EAC3B,sBAAsB,EACtB,oBAAoB,EACpB,KAAK,YAAY,EACjB,KAAK,aAAa,GACnB,MAAM,WAAW,CAAC"}

package/dist/mpc/index.js

@@ -0,0 +1,27 @@
+/**
+ * KemdiCode MCP Server
+ * Copyright (C) 2025-2026 Kemdi Sp. z o.o.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+export { MPC_KEYS, MPC_ALLOWED_ROLES } from './types.js';
+// Crypto utilities
+export { generateKey, generateIV, deriveKey, deriveSessionKey, encrypt, decrypt, sha256, generateVerificationHash, verifySecretHash, generateSecretId, generateShareId, encryptShare, decryptShare, MpcKeyManager, getKeyManager, resetKeyManager, } from './crypto.js';
+// Share management
+export { splitSecret, distributeShares, validateSharesForReconstruction, reconstructSecret, generateRandomSecret, canPerformMpcOperation, calculateDistributionStats, } from './share-manager.js';
+// Redis store
+export { MpcRedisStore, getMpcStore, resetMpcStore, } from './redis-store.js';
+// Authorization
+export { verifyMpcAuthorization, requiresElevatedRole, getRequiredRolesDescription, generateAgentSignature, verifyAgentSignature, } from './auth.js';
+//# sourceMappingURL=index.js.map

package/dist/mpc/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/mpc/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAwBH,OAAO,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAEzD,mBAAmB;AACnB,OAAO,EACL,WAAW,EACX,UAAU,EACV,SAAS,EACT,gBAAgB,EAChB,OAAO,EACP,OAAO,EACP,MAAM,EACN,wBAAwB,EACxB,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,EACf,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,aAAa,EACb,eAAe,GAEhB,MAAM,aAAa,CAAC;AAErB,mBAAmB;AACnB,OAAO,EACL,WAAW,EACX,gBAAgB,EAChB,+BAA+B,EAC/B,iBAAiB,EACjB,oBAAoB,EACpB,sBAAsB,EACtB,0BAA0B,GAC3B,MAAM,oBAAoB,CAAC;AAE5B,cAAc;AACd,OAAO,EACL,aAAa,EACb,WAAW,EACX,aAAa,GAEd,MAAM,kBAAkB,CAAC;AAE1B,gBAAgB;AAChB,OAAO,EACL,sBAAsB,EACtB,oBAAoB,EACpB,2BAA2B,EAC3B,sBAAsB,EACtB,oBAAoB,GAGrB,MAAM,WAAW,CAAC"}

package/dist/mpc/redis-store.d.ts

@@ -0,0 +1,88 @@
+/**
+ * KemdiCode MCP Server
+ * Copyright (C) 2025-2026 Kemdi Sp. z o.o.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program. If not, see <https://www.gnu.org/licenses/>.
+ */
+/**
+ * MPC Redis Store
+ *
+ * Persistent storage for MPC shares and secret metadata using Redis.
+ */
+import { RedisBackedService } from '../infrastructure/redis/redis-backed-service.js';
+import type { MpcShare, MpcSecretMetadata, MpcSecretStatus } from './types.js';
+/**
+ * MPC Redis Store configuration
+ */
+export interface MpcRedisStoreConfig {
+}
+/**
+ * MPC Redis Store
+ */
+export declare class MpcRedisStore extends RedisBackedService {
+    protected get serviceName(): string;
+    constructor(_config?: MpcRedisStoreConfig);
+    /**
+     * Save secret metadata
+     */
+    saveSecretMetadata(metadata: MpcSecretMetadata): Promise<boolean>;
+    /**
+     * Get secret metadata
+     */
+    getSecretMetadata(sessionId: string, secretId: string): Promise<MpcSecretMetadata | null>;
+    /**
+     * Update holders list in metadata
+     */
+    updateHolders(sessionId: string, secretId: string, holders: string[]): Promise<boolean>;
+    /**
+     * Save a share (always encrypted)
+     *
+     * SECURITY: Shares are always encrypted with AES-256-GCM using session-derived keys.
+     * Plaintext storage is not supported to prevent accidental data exposure.
+     */
+    saveShare(share: MpcShare): Promise<boolean>;
+    /**
+     * Get a share (decrypted)
+     */
+    getShare(sessionId: string, secretId: string, agentId: string): Promise<MpcShare | null>;
+    /**
+     * Get all shares for a secret from specific agents
+     */
+    getSharesForReconstruction(sessionId: string, secretId: string, agentIds: string[]): Promise<MpcShare[]>;
+    /**
+     * Get all secrets for a session
+     */
+    getSessionSecrets(sessionId: string): Promise<MpcSecretMetadata[]>;
+    /**
+     * Get secrets held by an agent
+     */
+    getAgentSecrets(agentId: string): Promise<string[]>;
+    /**
+     * Get secret status including distribution info
+     */
+    getSecretStatus(sessionId: string, secretId: string): Promise<MpcSecretStatus | null>;
+    /**
+     * Delete a secret and all its shares
+     */
+    deleteSecret(sessionId: string, secretId: string): Promise<boolean>;
+}
+/**
+ * Get the global MPC store
+ */
+export declare function getMpcStore(): MpcRedisStore;
+/**
+ * Reset the global MPC store (for testing)
+ */
+export declare function resetMpcStore(): void;
+//# sourceMappingURL=redis-store.d.ts.map

package/dist/mpc/redis-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redis-store.d.ts","sourceRoot":"","sources":["../../src/mpc/redis-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH;;;;GAIG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,iDAAiD,CAAC;AACrF,OAAO,KAAK,EAAE,QAAQ,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAY/E;;GAEG;AAEH,MAAM,WAAW,mBAAmB;CACnC;AAED;;GAEG;AACH,qBAAa,aAAc,SAAQ,kBAAkB;IACnD,SAAS,KAAK,WAAW,WAA8B;gBAE3C,OAAO,GAAE,mBAAwB;IAI7C;;OAEG;IACG,kBAAkB,CAAC,QAAQ,EAAE,iBAAiB,GAAG,OAAO,CAAC,OAAO,CAAC;IA2BvE;;OAEG;IACG,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;IA+B/F;;OAEG;IACG,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;IAa7F;;;;;OAKG;IACG,SAAS,CAAC,KAAK,EAAE,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;IAiClD;;OAEG;IACG,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;IA2D9F;;OAEG;IACG,0BAA0B,CAC9B,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAAE,GACjB,OAAO,CAAC,QAAQ,EAAE,CAAC;IAatB;;OAEG;IACG,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC;IAsBxE;;OAEG;IACG,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAYzD;;OAEG;IACG,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;IAwB3F;;OAEG;IACG,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CAgC1E;AAKD;;GAEG;AACH,wBAAgB,WAAW,IAAI,aAAa,CAK3C;AAED;;GAEG;AACH,wBAAgB,aAAa,IAAI,IAAI,CAKpC"}