keeper_secrets_manager 17.0.4 → 17.2.0

data/RUBY_SDK_COMPLETE_DOCUMENTATION.md

@@ -1,354 +0,0 @@
-# Ruby SDK Complete Documentation - Keeper Secrets Manager
-
-## Overview
-
-The Ruby SDK for Keeper Secrets Manager is a feature-complete implementation that provides secure access to secrets, records, and files stored in Keeper vaults. This document consolidates all technical documentation, implementation details, and status reports.
-
-## Implementation Status: ✅ COMPLETE
-
-### Core Features Implemented
-- **Authentication & Configuration**: Token-based auth with ECDSA signatures and AES-GCM encryption
-- **Secrets Management**: Full CRUD operations for records with batch support
-- **File Operations**: Binary-safe upload/download with encryption (tested up to 5MB+)
-- **Notation System**: Complete keeper:// URI parsing with all selector types
-- **Folder Operations**: Full folder management (create, update, delete, list)
-- **TOTP Support**: RFC 6238 compliant with SHA1/256/512 algorithms
-- **Caching**: In-memory cache with TTL management
-- **Testing**: Comprehensive test suite with mock mode for offline testing
-
-### Technical Architecture
-
-#### Design Philosophy
-- **Dynamic DTOs**: JavaScript-style flexible records using Ruby's method_missing
-- **Minimal Dependencies**: Mostly stdlib with FedRAMP compliance in mind
-- **Ruby Idiomatic**: Snake_case methods, keyword arguments, blocks where appropriate
-- **Runtime Validation**: No rigid type constraints, flexible field handling
-
-#### Project Structure
-```
-sdk/ruby/
-├── lib/keeper_secrets_manager/
-│   ├── core.rb                    # Main SDK logic and client
-│   ├── crypto.rb                  # Encryption/decryption operations
-│   ├── storage.rb                 # Storage backends (memory, file)
-│   ├── notation.rb                # Keeper URI notation parser
-│   ├── dto.rb                     # Dynamic data transfer objects
-│   ├── totp.rb                    # TOTP implementation
-│   └── version.rb                 # Version management
-├── spec/                          # RSpec unit tests
-├── test/integration/              # Integration tests
-├── examples/                      # Usage examples
-└── README.md                      # User documentation
-```
-
-## Key Implementation Details
-
-### Authentication Flow
-1. Parse one-time token (format: `REGION:BASE64_TOKEN`)
-2. Exchange token for encrypted app key via `/get_client_params`
-3. Generate EC key pair and sign request with ECDSA
-4. Store derived keys in configured storage backend
-
-### Encryption Specifications
-- **Record Encryption**: AES-GCM with 256-bit keys
-- **Key Exchange**: RSA-OAEP for app key encryption
-- **Request Signing**: ECDSA with P-256 curve
-- **HMAC**: SHA512 for request authentication
-- **Nonce**: 96-bit random for AES-GCM
-
-### Dynamic Record Structure
-```ruby
-# Flexible field access without rigid types
-record = KeeperRecord.new(
-  title: 'My Login',
-  fields: [
-    { 'type' => 'login', 'value' => ['username'] },
-    { 'type' => 'password', 'value' => ['pass123'] }
-  ]
-)
-
-# Dynamic accessors
-record.login = 'new_username'
-puts record.password  # => 'pass123'
-
-# Complex fields
-record.set_field('name', { 
-  'first' => 'John', 
-  'middle' => 'Q', 
-  'last' => 'Doe' 
-})
-```
-
-### Notation System Examples
-```ruby
-# Basic selectors
-"keeper://RECORD_UID/type"                    # Record type
-"keeper://RECORD_UID/title"                   # Record title
-"keeper://RECORD_UID/notes"                   # Record notes
-
-# Field selectors
-"keeper://RECORD_UID/field/password"          # Password field
-"keeper://RECORD_UID/field/name[0][first]"    # First name
-"keeper://RECORD_UID/custom_field/API Key"    # Custom field
-
-# File operations
-"keeper://RECORD_UID/file/document.pdf"       # File by name
-```
-
-## Ruby Version Requirements
-
-- **Minimum**: Ruby 2.7+ (for AES-GCM support)
-- **Tested**: Ruby 2.7, 3.0, 3.1, 3.2, 3.3, latest
-- **Note**: Requires OpenSSL 1.1.0+ for full functionality
-
-## Testing Infrastructure
-
-### Unit Tests (RSpec)
-- 19 comprehensive tests covering all components
-- 100% pass rate
-- Tests for DTOs, storage, crypto, notation, utils
-
-### Integration Tests
-- Mock mode for offline testing without credentials
-- Docker test suite for multi-version testing
-- Performance benchmarks
-- Error handling scenarios
-
-### Mock Mode
-```ruby
-# Automatically enabled when no config.base64 exists
-ENV['KEEPER_MOCK_MODE'] = 'true'
-
-# Works with all operations
-secrets = sm.get_secrets()  # Returns mock data
-sm.create_secret(record)     # Simulates creation
-```
-
-### Folder and Record Structure
-The SDK returns a flat list of all records, including those stored in folders:
-- `response.records` contains ALL records (root + folder records)
-- Each record has `folder_uid` property indicating its parent folder
-- `response.folders` contains folder objects with their own `records` arrays
-- This matches the behavior of Python, JavaScript, and Java SDKs
-
-### Folder Hierarchy Management
-The SDK provides advanced folder hierarchy functionality:
-
-```ruby
-# Get all folders
-folders = client.get_folders
-
-# Get folder manager for advanced operations
-fm = client.folder_manager
-
-# Build folder tree
-tree = fm.build_folder_tree
-
-# Get folder path
-path = client.get_folder_path(folder_uid)  # Returns "Parent/Child/Grandchild"
-
-# Find folder by name
-folder = client.find_folder_by_name("Finance")
-folder = client.find_folder_by_name("Finance", parent_uid: "parent_uid")
-
-# Get folder relationships
-ancestors = fm.get_ancestors(folder_uid)    # Returns parent, grandparent, etc.
-descendants = fm.get_descendants(folder_uid) # Returns children, grandchildren, etc.
-
-# Print folder tree
-fm.print_tree  # Displays hierarchical structure with records
-```
-
-## Critical Implementation Details for Future SDKs
-
-### One-Time Token Authentication (CRITICAL)
-When implementing token authentication in new SDKs, the following steps are MANDATORY:
-
-1. **Token Parsing**: Extract region/hostname from format `[REGION:]TOKEN`
-   - Regions: US, EU, AU, GOV, JP, CA map to specific hostnames
-   - Legacy format: Just the token without region prefix
-
-2. **Client ID Generation** (Often missed!):
-   ```
-   client_id = Base64(HMAC-SHA512(token_bytes, "KEEPER_SECRETS_MANAGER_CLIENT_ID"))
-   ```
-   - The token is NEVER sent directly to the server
-   - Only the hashed client_id is transmitted
-
-3. **Initial Authentication Request**:
-   - Send: client_id, public_key, client_version
-   - Receive: encryptedAppKey, appOwnerPublicKey
-
-4. **App Key Decryption**:
-   - Use AES-GCM decryption with the original token as the key
-   - NOT EC/RSA decryption (common mistake)
-   ```
-   app_key = AES_DECRYPT(encryptedAppKey, token_bytes)
-   ```
-
-5. **Cleanup**: Delete the token from storage after successful binding
-
-### OpenSSL 3.0 Compatibility
-For EC key creation in OpenSSL 3.0+, use ASN.1 DER format instead of direct private key assignment:
-```ruby
-# Create ASN1 sequence
-asn1 = OpenSSL::ASN1::Sequence([
-  OpenSSL::ASN1::Integer(1),
-  OpenSSL::ASN1::OctetString(private_key_bytes),
-  OpenSSL::ASN1::ObjectId('prime256v1', 0, :EXPLICIT),
-  OpenSSL::ASN1::BitString(public_key_bytes, 1, :EXPLICIT)
-])
-key = OpenSSL::PKey::EC.new(asn1.to_der)
-```
-
-### Server Public Key ID Selection
-Different SDKs use different default key IDs:
-- **Python**: Default key ID `"10"`
-- **Java/JavaScript**: Default key ID `7`
-- **Ruby**: Should use `7` as default
-
-The server will respond with `"invalid key id"` error if wrong key is used, and will specify the correct key ID to retry with. The SDK must handle this retry automatically.
-
-## Known Issues and Pending Work
-
-### ⚠️ CRITICAL: Client Version Registration
-- **Current**: Using 'mr' prefix (from Rust SDK) as temporary workaround
-- **Required**: Register 'mb' prefix with Keeper servers
-- **Action**: Update CLIENT_VERSION_PREFIX before production release
-
-### Not Implemented (Low Priority)
-1. **Proxy Support**: Not implemented (can be added later)
-2. **Async Operations**: Synchronous only (matches most SDKs)
-3. **Advanced Search**: Server-side search (client filtering available)
-4. **True Batch Operations**: Sequential implementation exists
-
-## API Reference
-
-### Initialization
-```ruby
-require 'keeper_secrets_manager'
-
-# From token
-sm = KeeperSecretsManager::SecretsManager.new(
-  token: 'US:ONE_TIME_TOKEN_HERE'
-)
-
-# From config
-sm = KeeperSecretsManager::SecretsManager.new(
-  config: KeeperSecretsManager::FileStorage.new('ksm-config.json')
-)
-```
-
-### Secret Operations
-```ruby
-# List all secrets
-secrets = sm.get_secrets()
-
-# Get by UID
-secret = sm.get_secrets(['RECORD_UID'])[0]
-
-# Create new
-record = sm.create_secret(
-  KeeperSecretsManager::Dto::KeeperRecord.new(
-    title: 'New Secret',
-    fields: [...]
-  )
-)
-
-# Update
-sm.update_secret(record)
-
-# Delete
-sm.delete_secret(['RECORD_UID'])
-```
-
-### File Operations
-```ruby
-# Upload
-file_uid = sm.upload_file(
-  'RECORD_UID',
-  'document.pdf',
-  File.read('path/to/document.pdf', mode: 'rb')
-)
-
-# Download
-file_data = sm.download_file('FILE_UID')
-File.write('output.pdf', file_data['data'], mode: 'wb')
-```
-
-### Folder Operations
-```ruby
-# List folders
-folders = sm.get_folders()
-
-# Create folder
-folder_uid = sm.create_folder('New Folder', parent_uid: 'PARENT_UID')
-
-# Update folder
-sm.update_folder('FOLDER_UID', 'Updated Name')
-
-# Delete folder
-sm.delete_folder('FOLDER_UID', force: true)
-```
-
-### TOTP Support
-```ruby
-# Get TOTP URL via notation
-totp_url = sm.get_notation("keeper://RECORD/field/oneTimeCode")
-
-# Generate code
-params = KeeperSecretsManager::TOTP.parse_url(totp_url)
-code = KeeperSecretsManager::TOTP.generate_code(params['secret'])
-```
-
-## Security Considerations
-
-1. **Key Storage**: Never commit keys or tokens to version control
-2. **Memory Security**: Sensitive data cleared after use where possible
-3. **Transport Security**: All API calls use HTTPS with certificate validation
-4. **Encryption**: All data encrypted at rest and in transit
-5. **Authentication**: Each request signed with ECDSA
-
-## Performance Notes
-
-- File operations optimized for streaming (5MB+ tested)
-- In-memory caching reduces API calls
-- Lazy loading of record details
-- Efficient batch operations
-
-## Publishing Checklist
-
-1. ✅ Complete implementation of all features
-2. ✅ Comprehensive test coverage
-3. ✅ Documentation and examples
-4. ⚠️ Register 'mb' client version with Keeper
-5. ⚠️ Update CLIENT_VERSION_PREFIX to 'mb'
-6. ⚠️ Publish to RubyGems.org
-
-## Support and Resources
-
-- **Documentation**: See README.md for usage guide
-- **Examples**: Check examples/ directory for code samples
-- **Tests**: Run `rspec` for unit tests
-- **Integration**: See test/integration/ for API tests
-
-## Recent Fixes and Improvements
-
-### Token Authentication Implementation (Fixed)
-The Ruby SDK now correctly implements one-time token authentication:
-1. **Client ID Generation**: Properly hashes token using HMAC-SHA512
-2. **App Key Decryption**: Uses AES-GCM with token as key (not EC decryption)
-3. **OpenSSL 3.0 Support**: Uses ASN.1 DER format for EC key creation
-4. **Server Key ID**: Defaults to "7" with automatic retry on key errors
-5. **Error Handling**: Fixed config access during token binding
-
-See `TOKEN_AUTH_FIXES.md` for complete details.
-
-## Summary
-
-The Ruby SDK for Keeper Secrets Manager is feature-complete and ready for production use after client version registration. It maintains compatibility with existing Keeper SDKs while providing a Ruby-idiomatic interface with flexible, dynamic record handling as requested.
-
----
-
-*Last Updated: SDK Version 1.0.0*
-*Ruby 2.7+ Required | Full API Compatibility*

data/RUBY_SDK_COMPREHENSIVE_SUMMARY.md

@@ -1,192 +0,0 @@
-# Keeper Secrets Manager Ruby SDK - Comprehensive Summary
-
-## Overview
-The Keeper Secrets Manager Ruby SDK is a fully-featured implementation that provides secure access to Keeper's secrets management platform. The SDK follows the architectural patterns established by other Keeper SDKs while embracing Ruby idioms and conventions.
-
-## Current Implementation Status
-
-### ✅ Fully Implemented Features
-
-#### 1. **Core Authentication & Configuration**
-- Token-based authentication with ECDSA signatures
-- AES-GCM encryption (requires Ruby 2.7+ or OpenSSL 1.1.0+)
-- Multiple storage backends (In-memory, File-based)
-- Environment variable support
-- Configuration management with validation
-
-#### 2. **Secrets Management**
-- **Read Operations**: Get secrets by UID, list all secrets, search by title
-- **Write Operations**: Create, update, and delete secrets (fully implemented)
-- **Batch Operations**: Delete multiple secrets in one call
-- **Caching**: In-memory caching with TTL management
-
-#### 3. **File Operations**
-- **Upload**: Fully implemented with AES-GCM encryption
-  - Supports binary and text files
-  - Tested with files up to 5MB+
-  - Multiple files per record
-- **Download**: Complete implementation
-  - Retrieves encrypted files from server
-  - Decrypts using AES-GCM
-  - Returns file metadata and content
-
-#### 4. **Keeper Notation System**
-Complete implementation of the keeper:// URI notation:
-- Basic selectors: `type`, `title`, `notes`
-- Field access: `field/TYPE[INDEX]`
-- Custom fields: `custom_field/LABEL`
-- File references: `file/FILENAME` or `file/FILE_UID`
-- Complex field properties: `name[0][first]`
-- Escape sequences and Base64 encoding support
-
-#### 5. **Folder Operations**
-Full CRUD support for folders:
-- List all folders
-- Create folders (with parent hierarchy)
-- Update folder names
-- Delete folders (with force option for non-empty)
-- Create records within specific folders
-
-#### 6. **TOTP Support**
-Comprehensive Time-based One-Time Password implementation:
-- Generate TOTP codes (RFC 6238 compliant)
-- Parse otpauth:// URLs
-- Support for SHA1, SHA256, SHA512 algorithms
-- 6 or 8 digit codes
-- Configurable time windows
-- Code validation with drift tolerance
-
-### 🏗️ Technical Architecture
-
-#### 1. **Dynamic DTO Structure**
-JavaScript-style flexible records using Ruby's dynamic features:
-- Hash-based initialization
-- Fields stored as arrays of hashes
-- Dynamic field access via `method_missing`
-- No rigid type constraints
-- Runtime validation
-
-#### 2. **Project Structure**
-```
-sdk/ruby/
-├── lib/                    # Core SDK implementation
-│   └── keeper_secrets_manager/
-│       ├── core.rb        # Main SecretsManager class
-│       ├── crypto.rb      # Cryptographic operations
-│       ├── storage.rb     # Storage implementations
-│       ├── notation.rb    # Notation parser
-│       ├── records.rb     # Record models
-│       ├── totp.rb       # TOTP implementation
-│       └── errors.rb      # Error classes
-├── spec/                  # RSpec unit tests
-├── test/                  # Integration tests
-├── examples/              # Usage examples
-└── README.md             # Documentation
-```
-
-#### 3. **Dependencies**
-Minimal external dependencies:
-- `openssl` (standard library)
-- `json` (standard library)
-- `base64` (standard library)
-- `net/http` (standard library)
-- `base32` gem (for TOTP support)
-
-### 🧪 Testing Status
-
-#### Unit Tests
-- 19 comprehensive unit tests
-- 100% pass rate
-- Coverage includes:
-  - DTO operations
-  - Field manipulations
-  - Storage implementations
-  - Notation parsing
-  - Cryptographic operations
-
-#### Integration Tests
-- Mock mode for offline testing
-- Full mock infrastructure for all operations
-- Real API testing requires Ruby 2.7+
-- Test scripts for CRUD operations
-
-### ⚠️ Known Issues and Pending Work
-
-#### 1. **Client Version Registration**
-- **Current**: Using 'mr' prefix (borrowed from Rust SDK)
-- **Required**: Register 'mb' prefix with Keeper servers
-- **Impact**: Must be resolved before production release
-
-#### 2. **Not Yet Implemented**
-- Advanced server-side search (client-side filtering available)
-- True batch create/update operations (sequential implementation exists)
-- Additional storage backends (Redis, Database)
-- Proxy support (can be added later)
-- Async operations (synchronous only)
-
-#### 3. **Platform Requirements**
-- Ruby 2.7+ required for full functionality (AES-GCM support)
-- Write operations require records to be in folders (Keeper platform requirement)
-
-### 📊 Comparison with Other SDKs
-
-The Ruby SDK achieves feature parity with other Keeper SDKs:
-
-| Feature | Ruby | Python | JavaScript | Java | Status |
-|---------|------|--------|------------|------|--------|
-| Core CRUD | ✅ | ✅ | ✅ | ✅ | Complete |
-| File Operations | ✅ | ✅ | ✅ | ✅ | Complete |
-| Notation System | ✅ | ✅ | ✅ | ✅ | Complete |
-| Folder Operations | ✅ | ✅ | ✅ | ✅ | Complete |
-| TOTP Support | ✅ | ✅ | ✅ | ✅ | Complete |
-| Batch Operations | Partial | ✅ | ✅ | ✅ | Sequential only |
-| Proxy Support | ❌ | ✅ | ❌ | ❌ | Not implemented |
-
-### 🚀 Usage Examples
-
-```ruby
-# Initialize SDK
-require 'keeper_secrets_manager'
-
-storage = KeeperSecretsManager::LocalConfigStorage.new()
-sm = KeeperSecretsManager::SecretsManager.new(storage: storage)
-
-# Get secrets
-secrets = sm.get_secrets()
-secret = sm.get_secret_by_title('My Login')
-
-# Use notation
-password = sm.get_notation('keeper://My Login/field/password')
-
-# TOTP
-totp_url = sm.get_notation('keeper://My 2FA/field/oneTimeCode')
-params = KeeperSecretsManager::TOTP.parse_url(totp_url)
-code = KeeperSecretsManager::TOTP.generate_code(params['secret'])
-
-# File operations
-file_uid = sm.upload_file(record_uid, file_data, 'document.pdf')
-downloaded = sm.download_file(file_uid)
-File.write('output.pdf', downloaded['data'], mode: 'wb')
-
-# Folder operations
-folder_uid = sm.create_folder('New Folder')
-sm.update_folder(folder_uid, 'Renamed Folder')
-```
-
-### 📝 Key Design Decisions
-
-1. **Ruby Idioms**: Snake_case methods, keyword arguments, blocks where appropriate
-2. **Flexible DTOs**: JavaScript-style dynamic records without rigid type constraints
-3. **Minimal Dependencies**: FedRAMP-compliant, using mostly standard library
-4. **Compatibility**: Targets Ruby 2.7+ for full functionality
-5. **Testing**: RSpec for unit tests, custom integration test suite
-
-### ✅ Summary
-
-The Ruby SDK is **feature-complete and production-ready** (pending client version registration). It successfully implements all core Keeper Secrets Manager functionality while maintaining Ruby's expressive and developer-friendly style. The SDK matches the capabilities of other Keeper SDKs and has been thoroughly tested with comprehensive unit and integration test suites.
-
-**Next Steps**:
-1. Register 'mb' client version prefix with Keeper
-2. Update CLIENT_VERSION_PREFIX constant
-3. Publish to RubyGems.org
-4. Monitor for user feedback on batch operations and search features

data/examples/01_quick_start.rb

@@ -1,45 +0,0 @@
-#!/usr/bin/env ruby
-
-# Quick Start Example - Getting started with Keeper Secrets Manager
-# This example shows the simplest way to connect and retrieve secrets
-
-require 'keeper_secrets_manager'
-
-# Method 1: Using a one-time token (simplest)
-# Get your token from: https://app.keeper-security.com/secrets-manager
-begin
-  token = ENV['KSM_TOKEN'] || 'US:YOUR_ONE_TIME_TOKEN'
-  
-  # Initialize SDK with token
-  secrets_manager = KeeperSecretsManager.from_token(token)
-  
-  # Get all secrets
-  secrets = secrets_manager.get_secrets
-  
-  puts "Found #{secrets.length} secrets:"
-  secrets.each do |secret|
-    puts "  - #{secret.title} (#{secret.type})"
-  end
-  
-rescue => e
-  puts "Error: #{e.message}"
-  puts "Make sure to set KSM_TOKEN environment variable or replace with your token"
-end
-
-# Method 2: Using base64 configuration (for repeated use)
-# After first connection, save your config for reuse
-begin
-  config_base64 = ENV['KSM_CONFIG'] || 'YOUR_BASE64_CONFIG_STRING'
-  
-  # Initialize with saved configuration
-  secrets_manager = KeeperSecretsManager.from_config(config_base64)
-  
-  # Get specific secret by UID
-  secret = secrets_manager.get_secret_by_uid('RECORD_UID')
-  puts "\nSecret details:"
-  puts "  Title: #{secret.title}"
-  puts "  Login: #{secret.fields['login']}"
-  
-rescue => e
-  puts "Error: #{e.message}"
-end

data/examples/02_authentication.rb

@@ -1,82 +0,0 @@
-#!/usr/bin/env ruby
-
-# Authentication Example - Different ways to authenticate
-# Shows how to initialize the SDK and save credentials for reuse
-
-require 'keeper_secrets_manager'
-
-puts "=== Authentication Methods ==="
-
-# Method 1: One-time token (first time setup)
-puts "\n1. Using One-Time Token:"
-begin
-  # Get token from Keeper Secrets Manager UI
-  token = ENV['KSM_TOKEN'] || 'US:YOUR_ONE_TIME_TOKEN'
-  
-  # Option A: Direct use (credentials not saved)
-  sm = KeeperSecretsManager.from_token(token)
-  puts "✓ Connected with token"
-  
-  # Option B: Save credentials for reuse
-  storage = KeeperSecretsManager::Storage::InMemoryStorage.new
-  sm = KeeperSecretsManager.new(token: token, config: storage)
-  
-  # Get the configuration as base64 for future use
-  config_base64 = storage.to_base64
-  puts "✓ Configuration saved. Use this for future connections:"
-  puts "  export KSM_CONFIG='#{config_base64}'"
-  
-rescue => e
-  puts "✗ Error: #{e.message}"
-end
-
-# Method 2: Base64 configuration (subsequent connections)
-puts "\n2. Using Base64 Configuration:"
-begin
-  # Use saved configuration from environment or file
-  config_base64 = ENV['KSM_CONFIG'] || 'YOUR_SAVED_BASE64_CONFIG'
-  
-  # Initialize with configuration
-  sm = KeeperSecretsManager.from_config(config_base64)
-  
-  # Test connection
-  secrets = sm.get_secrets
-  puts "✓ Connected with saved config, found #{secrets.length} secrets"
-  
-rescue => e
-  puts "✗ Error: #{e.message}"
-end
-
-# Method 3: Using configuration file
-puts "\n3. Using Configuration File:"
-begin
-  # Save configuration to a file
-  config_file = 'keeper-config.json'
-  
-  # Initialize with file storage
-  sm = KeeperSecretsManager.from_file(config_file)
-  
-  puts "✓ Connected using config file: #{config_file}"
-  
-rescue => e
-  puts "✗ Error: #{e.message}"
-end
-
-# Method 4: Using environment variables
-puts "\n4. Using Environment Variables:"
-begin
-  # Set these environment variables:
-  # export KSM_HOSTNAME=keepersecurity.com
-  # export KSM_CLIENT_ID=your-client-id
-  # export KSM_PRIVATE_KEY=your-private-key
-  # export KSM_APP_KEY=your-app-key
-  
-  storage = KeeperSecretsManager::Storage::EnvironmentStorage.new('KSM_')
-  sm = KeeperSecretsManager.new(config: storage)
-  
-  puts "✓ Connected using environment variables"
-  
-rescue => e
-  puts "✗ Error: #{e.message}"
-  puts "  Make sure KSM_* environment variables are set"
-end