@de-otio/chaoskb-client 0.2.0

package/dist/cli/tools/kb-query.d.ts

@@ -0,0 +1,20 @@
+import type { McpDependencies } from '../mcp-server.js';
+export interface KbQueryInput {
+    query: string;
+    limit?: number;
+    mode?: 'semantic' | 'keyword' | 'hybrid';
+}
+export interface KbQueryResultItem {
+    sourceId: string;
+    title: string;
+    url: string;
+    content: string;
+    score: number;
+    chunkIndex: number;
+}
+export interface KbQueryResult {
+    results: KbQueryResultItem[];
+    mode: string;
+}
+export declare function handleKbQuery(input: KbQueryInput, deps: McpDependencies): Promise<KbQueryResult>;
+//# sourceMappingURL=kb-query.d.ts.map

package/dist/cli/tools/kb-query.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"kb-query.d.ts","sourceRoot":"","sources":["../../../cli/tools/kb-query.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAExD,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,UAAU,GAAG,SAAS,GAAG,QAAQ,CAAC;CAC1C;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,iBAAiB,EAAE,CAAC;IAC7B,IAAI,EAAE,MAAM,CAAC;CACd;AAED,wBAAsB,aAAa,CACjC,KAAK,EAAE,YAAY,EACnB,IAAI,EAAE,eAAe,GACpB,OAAO,CAAC,aAAa,CAAC,CAcxB"}

package/dist/cli/tools/kb-query.js

@@ -0,0 +1,109 @@
+export async function handleKbQuery(input, deps) {
+    const limit = input.limit ?? 10;
+    const mode = input.mode ?? 'semantic';
+    if (mode === 'keyword') {
+        return keywordSearch(input.query, limit, deps);
+    }
+    if (mode === 'hybrid') {
+        return hybridSearch(input.query, limit, deps);
+    }
+    // Default: semantic search
+    return semanticSearch(input.query, limit, deps);
+}
+async function semanticSearch(query, limit, deps) {
+    const { db, pipeline } = deps;
+    // 1. Embed the query using the pipeline embedder
+    const queryEmbedding = await pipeline.embed(query);
+    // 2. Search the embedding index for top-K matches
+    const matches = db.embeddingIndex.search(queryEmbedding, limit);
+    // 3. For each match, load the chunk content and source metadata
+    const results = [];
+    for (const match of matches) {
+        const source = db.sources.getById(match.sourceId);
+        if (!source || source.deletedAt)
+            continue;
+        const chunks = db.chunks.getBySourceId(match.sourceId);
+        const chunk = chunks.find((c) => c.chunkIndex === match.chunkIndex);
+        if (!chunk)
+            continue;
+        // Update last accessed timestamp
+        db.sources.updateLastAccessed(match.sourceId);
+        results.push({
+            sourceId: match.sourceId,
+            title: source.title,
+            url: source.url,
+            content: chunk.content,
+            score: match.score,
+            chunkIndex: match.chunkIndex,
+        });
+    }
+    return { results, mode: 'semantic' };
+}
+async function keywordSearch(query, limit, deps) {
+    const { db } = deps;
+    const matches = db.chunks.searchKeyword(query, limit);
+    const results = [];
+    for (const match of matches) {
+        const source = db.sources.getById(match.sourceId);
+        if (!source || source.deletedAt)
+            continue;
+        db.sources.updateLastAccessed(match.sourceId);
+        results.push({
+            sourceId: match.sourceId,
+            title: source.title,
+            url: source.url,
+            content: match.snippet,
+            score: -match.rank, // FTS5 rank is negative (lower = better), flip for consistency
+            chunkIndex: match.chunkIndex,
+        });
+    }
+    return { results, mode: 'keyword' };
+}
+async function hybridSearch(query, limit, deps) {
+    // Run both searches with 2x limit to ensure we have enough after deduplication
+    const [semanticResults, keywordResults] = await Promise.all([
+        semanticSearch(query, limit * 2, deps),
+        keywordSearch(query, limit * 2, deps),
+    ]);
+    // Normalize scores to [0, 1] range for merging
+    const semanticMax = Math.max(...semanticResults.results.map((r) => r.score), 0.001);
+    const keywordMax = Math.max(...keywordResults.results.map((r) => r.score), 0.001);
+    // Build combined score map: key = sourceId:chunkIndex
+    const combined = new Map();
+    const SEMANTIC_WEIGHT = 0.7;
+    const KEYWORD_WEIGHT = 0.3;
+    for (const r of semanticResults.results) {
+        const key = `${r.sourceId}:${r.chunkIndex}`;
+        const normScore = r.score / semanticMax;
+        combined.set(key, {
+            ...r,
+            combinedScore: normScore * SEMANTIC_WEIGHT,
+        });
+    }
+    for (const r of keywordResults.results) {
+        const key = `${r.sourceId}:${r.chunkIndex}`;
+        const normScore = r.score / keywordMax;
+        const existing = combined.get(key);
+        if (existing) {
+            // Boost: this chunk appeared in both searches
+            existing.combinedScore += normScore * KEYWORD_WEIGHT;
+            // Prefer semantic content over keyword snippet
+        }
+        else {
+            combined.set(key, {
+                ...r,
+                combinedScore: normScore * KEYWORD_WEIGHT,
+            });
+        }
+    }
+    // Sort by combined score and take top-K
+    const sorted = [...combined.values()]
+        .sort((a, b) => b.combinedScore - a.combinedScore)
+        .slice(0, limit);
+    const results = sorted.map(({ combinedScore, ...rest }) => ({
+        ...rest,
+        score: combinedScore,
+    }));
+    return { results, mode: 'hybrid' };
+}
+//# sourceMappingURL=kb-query.js.map

package/dist/cli/tools/kb-query.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"kb-query.js","sourceRoot":"","sources":["../../../cli/tools/kb-query.ts"],"names":[],"mappings":"AAsBA,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,KAAmB,EACnB,IAAqB;IAErB,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC;IAChC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,UAAU,CAAC;IAEtC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,aAAa,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IACjD,CAAC;IAED,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,OAAO,YAAY,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;IAChD,CAAC;IAED,2BAA2B;IAC3B,OAAO,cAAc,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;AAClD,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,KAAa,EACb,KAAa,EACb,IAAqB;IAErB,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;IAE9B,iDAAiD;IACjD,MAAM,cAAc,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAEnD,kDAAkD;IAClD,MAAM,OAAO,GAAG,EAAE,CAAC,cAAc,CAAC,MAAM,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;IAEhE,gEAAgE;IAChE,MAAM,OAAO,GAAwB,EAAE,CAAC;IACxC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAClD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,SAAS;YAAE,SAAS;QAE1C,MAAM,MAAM,GAAG,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACvD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU,CAAC,CAAC;QACpE,IAAI,CAAC,KAAK;YAAE,SAAS;QAErB,iCAAiC;QACjC,EAAE,CAAC,OAAO,CAAC,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAE9C,OAAO,CAAC,IAAI,CAAC;YACX,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,UAAU,EAAE,KAAK,CAAC,UAAU;SAC7B,CAAC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;AACvC,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,KAAa,EACb,KAAa,EACb,IAAqB;IAErB,MAAM,EAAE,EAAE,EAAE,GAAG,IAAI,CAAC;IAEpB,MAAM,OAAO,GAAG,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAEtD,MAAM,OAAO,GAAwB,EAAE,CAAC;IACxC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAClD,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,SAAS;YAAE,SAAS;QAE1C,EAAE,CAAC,OAAO,CAAC,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAE9C,OAAO,CAAC,IAAI,CAAC;YACX,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,KAAK,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,+DAA+D;YACnF,UAAU,EAAE,KAAK,CAAC,UAAU;SAC7B,CAAC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AACtC,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,KAAa,EACb,KAAa,EACb,IAAqB;IAErB,+EAA+E;IAC/E,MAAM,CAAC,eAAe,EAAE,cAAc,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAC1D,cAAc,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,EAAE,IAAI,CAAC;QACtC,aAAa,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,EAAE,IAAI,CAAC;KACtC,CAAC,CAAC;IAEH,+CAA+C;IAC/C,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC;IACpF,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC;IAElF,sDAAsD;IACtD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAyD,CAAC;IAElF,MAAM,eAAe,GAAG,GAAG,CAAC;IAC5B,MAAM,cAAc,GAAG,GAAG,CAAC;IAE3B,KAAK,MAAM,CAAC,IAAI,eAAe,CAAC,OAAO,EAAE,CAAC;QACxC,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC;QAC5C,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,GAAG,WAAW,CAAC;QACxC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE;YAChB,GAAG,CAAC;YACJ,aAAa,EAAE,SAAS,GAAG,eAAe;SAC3C,CAAC,CAAC;IACL,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,cAAc,CAAC,OAAO,EAAE,CAAC;QACvC,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC;QAC5C,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,GAAG,UAAU,CAAC;QACvC,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,QAAQ,EAAE,CAAC;YACb,8CAA8C;YAC9C,QAAQ,CAAC,aAAa,IAAI,SAAS,GAAG,cAAc,CAAC;YACrD,+CAA+C;QACjD,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE;gBAChB,GAAG,CAAC;gBACJ,aAAa,EAAE,SAAS,GAAG,cAAc;aAC1C,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,wCAAwC;IACxC,MAAM,MAAM,GAAG,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC;SAClC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,GAAG,CAAC,CAAC,aAAa,CAAC;SACjD,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAEnB,MAAM,OAAO,GAAwB,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,aAAa,EAAE,GAAG,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QAC/E,GAAG,IAAI;QACP,KAAK,EAAE,aAAa;KACrB,CAAC,CAAC,CAAC;IAEJ,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AACrC,CAAC"}

package/dist/cli/tools/kb-summary.d.ts

@@ -0,0 +1,29 @@
+import type { McpDependencies } from '../mcp-server.js';
+export interface KbSummaryInput {
+    period: 'week' | 'month' | 'year' | string;
+}
+export interface KbSummaryArticle {
+    title: string;
+    url: string;
+    date: string;
+    chunkCount: number;
+    tags: string[];
+    preview: string;
+}
+export interface KbSummaryResult {
+    period: string;
+    totalArticles: number;
+    totalChunks: number;
+    articles: KbSummaryArticle[];
+}
+/**
+ * Calculate the date range from a period specification.
+ * @returns [startDate, endDate] as ISO date strings (YYYY-MM-DD)
+ */
+export declare function calculateDateRange(period: string): {
+    start: string;
+    end: string;
+    label: string;
+};
+export declare function handleKbSummary(input: KbSummaryInput, deps: McpDependencies): Promise<KbSummaryResult>;
+//# sourceMappingURL=kb-summary.d.ts.map

package/dist/cli/tools/kb-summary.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"kb-summary.d.ts","sourceRoot":"","sources":["../../../cli/tools/kb-summary.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAExD,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,CAAC;CAC5C;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,gBAAgB,EAAE,CAAC;CAC9B;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAkDhG;AAED,wBAAsB,eAAe,CACnC,KAAK,EAAE,cAAc,EACrB,IAAI,EAAE,eAAe,GACpB,OAAO,CAAC,eAAe,CAAC,CAgD1B"}

package/dist/cli/tools/kb-summary.js

@@ -0,0 +1,89 @@
+/**
+ * Calculate the date range from a period specification.
+ * @returns [startDate, endDate] as ISO date strings (YYYY-MM-DD)
+ */
+export function calculateDateRange(period) {
+    const now = new Date();
+    const endDate = now.toISOString().split('T')[0];
+    switch (period) {
+        case 'week': {
+            const start = new Date(now);
+            start.setDate(start.getDate() - 7);
+            return {
+                start: start.toISOString().split('T')[0],
+                end: endDate,
+                label: `${start.toISOString().split('T')[0]} to ${endDate}`,
+            };
+        }
+        case 'month': {
+            const start = new Date(now);
+            start.setMonth(start.getMonth() - 1);
+            return {
+                start: start.toISOString().split('T')[0],
+                end: endDate,
+                label: `${start.toISOString().split('T')[0]} to ${endDate}`,
+            };
+        }
+        case 'year': {
+            const start = new Date(now);
+            start.setFullYear(start.getFullYear() - 1);
+            return {
+                start: start.toISOString().split('T')[0],
+                end: endDate,
+                label: `${start.toISOString().split('T')[0]} to ${endDate}`,
+            };
+        }
+        default: {
+            // Custom range: "YYYY-MM-DD:YYYY-MM-DD"
+            const parts = period.split(':');
+            if (parts.length !== 2) {
+                throw new Error(`Invalid period format: "${period}". Use "week", "month", "year", or "YYYY-MM-DD:YYYY-MM-DD".`);
+            }
+            const [start, end] = parts;
+            // Validate date format
+            if (!/^\d{4}-\d{2}-\d{2}$/.test(start) || !/^\d{4}-\d{2}-\d{2}$/.test(end)) {
+                throw new Error(`Invalid date format in period: "${period}". Use "YYYY-MM-DD:YYYY-MM-DD".`);
+            }
+            return { start, end, label: `${start} to ${end}` };
+        }
+    }
+}
+export async function handleKbSummary(input, deps) {
+    const { db } = deps;
+    const range = calculateDateRange(input.period);
+    // Query sources within the date range
+    const sources = db.sources.list({
+        since: range.start,
+        includeDeleted: false,
+    }, { limit: 1000, offset: 0 });
+    // Filter by end date and collect results
+    const endDateObj = new Date(range.end + 'T23:59:59.999Z');
+    const filteredSources = sources.filter((s) => {
+        const createdAt = new Date(s.createdAt);
+        return createdAt <= endDateObj;
+    });
+    let totalChunks = 0;
+    const articles = [];
+    for (const source of filteredSources) {
+        totalChunks += source.chunkCount;
+        // Get first chunk as preview
+        const chunks = db.chunks.getBySourceId(source.id);
+        const firstChunk = chunks.find((c) => c.chunkIndex === 0);
+        const preview = firstChunk?.content ?? '';
+        articles.push({
+            title: source.title,
+            url: source.url,
+            date: source.createdAt,
+            chunkCount: source.chunkCount,
+            tags: source.tags,
+            preview,
+        });
+    }
+    return {
+        period: range.label,
+        totalArticles: filteredSources.length,
+        totalChunks,
+        articles,
+    };
+}
+//# sourceMappingURL=kb-summary.js.map

package/dist/cli/tools/kb-summary.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"kb-summary.js","sourceRoot":"","sources":["../../../cli/tools/kb-summary.ts"],"names":[],"mappings":"AAsBA;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAc;IAC/C,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,MAAM,OAAO,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAEhD,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC;YAC5B,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;YACnC,OAAO;gBACL,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;gBACxC,GAAG,EAAE,OAAO;gBACZ,KAAK,EAAE,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,OAAO,EAAE;aAC5D,CAAC;QACJ,CAAC;QACD,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC;YAC5B,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC;YACrC,OAAO;gBACL,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;gBACxC,GAAG,EAAE,OAAO;gBACZ,KAAK,EAAE,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,OAAO,EAAE;aAC5D,CAAC;QACJ,CAAC;QACD,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC;YAC5B,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC;YAC3C,OAAO;gBACL,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;gBACxC,GAAG,EAAE,OAAO;gBACZ,KAAK,EAAE,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,OAAO,EAAE;aAC5D,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,CAAC,CAAC;YACR,wCAAwC;YACxC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAChC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvB,MAAM,IAAI,KAAK,CACb,2BAA2B,MAAM,6DAA6D,CAC/F,CAAC;YACJ,CAAC;YACD,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC;YAC3B,uBAAuB;YACvB,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC3E,MAAM,IAAI,KAAK,CACb,mCAAmC,MAAM,iCAAiC,CAC3E,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,KAAK,OAAO,GAAG,EAAE,EAAE,CAAC;QACrD,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,KAAqB,EACrB,IAAqB;IAErB,MAAM,EAAE,EAAE,EAAE,GAAG,IAAI,CAAC;IAEpB,MAAM,KAAK,GAAG,kBAAkB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAE/C,sCAAsC;IACtC,MAAM,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAC7B;QACE,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,cAAc,EAAE,KAAK;KACtB,EACD,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,CAC3B,CAAC;IAEF,yCAAyC;IACzC,MAAM,UAAU,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,gBAAgB,CAAC,CAAC;IAC1D,MAAM,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QAC3C,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACxC,OAAO,SAAS,IAAI,UAAU,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,MAAM,QAAQ,GAAuB,EAAE,CAAC;IAExC,KAAK,MAAM,MAAM,IAAI,eAAe,EAAE,CAAC;QACrC,WAAW,IAAI,MAAM,CAAC,UAAU,CAAC;QAEjC,6BAA6B;QAC7B,MAAM,MAAM,GAAG,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAClD,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,CAAC,CAAC,CAAC;QAC1D,MAAM,OAAO,GAAG,UAAU,EAAE,OAAO,IAAI,EAAE,CAAC;QAE1C,QAAQ,CAAC,IAAI,CAAC;YACZ,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,IAAI,EAAE,MAAM,CAAC,SAAS;YACtB,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,OAAO;SACR,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL,MAAM,EAAE,KAAK,CAAC,KAAK;QACnB,aAAa,EAAE,eAAe,CAAC,MAAM;QACrC,WAAW;QACX,QAAQ;KACT,CAAC;AACJ,CAAC"}

package/dist/cli/tools/kb-sync-status.d.ts

@@ -0,0 +1,7 @@
+/**
+ * MCP tool: kb_sync_status
+ *
+ * Returns the current sync status, key type, and device configuration.
+ */
+export declare function kbSyncStatus(): Promise<string>;
+//# sourceMappingURL=kb-sync-status.d.ts.map

package/dist/cli/tools/kb-sync-status.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"kb-sync-status.d.ts","sourceRoot":"","sources":["../../../cli/tools/kb-sync-status.ts"],"names":[],"mappings":"AAKA;;;;GAIG;AACH,wBAAsB,YAAY,IAAI,OAAO,CAAC,MAAM,CAAC,CA6CpD"}

package/dist/cli/tools/kb-sync-status.js

@@ -0,0 +1,48 @@
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { CHAOSKB_DIR } from '../bootstrap.js';
+/**
+ * MCP tool: kb_sync_status
+ *
+ * Returns the current sync status, key type, and device configuration.
+ */
+export async function kbSyncStatus() {
+    const configPath = path.join(CHAOSKB_DIR, 'config.json');
+    if (!fs.existsSync(configPath)) {
+        return JSON.stringify({
+            status: 'not_configured',
+            message: 'ChaosKB is not configured. Run any KB tool to auto-bootstrap.',
+        });
+    }
+    const config = JSON.parse(fs.readFileSync(configPath, 'utf-8'));
+    const result = {
+        status: config.syncEnabled ? 'active' : config.syncPending ? 'pending' : 'disabled',
+        securityTier: config.securityTier,
+        syncEnabled: config.syncEnabled ?? false,
+    };
+    if (config.endpoint) {
+        result.endpoint = config.endpoint;
+    }
+    if (config.sshKeyFingerprint) {
+        result.sshKeyFingerprint = config.sshKeyFingerprint;
+        result.keySource = config.sshKeyPath ? 'file' : 'agent_or_generated';
+    }
+    else {
+        result.keySource = 'none';
+        result.message = 'No SSH key configured. Multi-device sync requires an SSH key. Run: ssh-keygen -t ed25519';
+    }
+    if (config.syncPending) {
+        result.message = 'Sync server was unreachable. Will retry on next launch.';
+    }
+    // Check if an SSH key has appeared since bootstrap (nudge)
+    if (!config.sshKeyPath && !config.sshKeyFingerprint) {
+        const sshDir = path.join(process.env.HOME ?? '', '.ssh');
+        const hasSSHKey = fs.existsSync(path.join(sshDir, 'id_ed25519.pub')) ||
+            fs.existsSync(path.join(sshDir, 'id_rsa.pub'));
+        if (hasSSHKey) {
+            result.nudge = 'SSH key detected on this system. Switch to it for multi-device sync: chaoskb-mcp config rotate-key';
+        }
+    }
+    return JSON.stringify(result, null, 2);
+}
+//# sourceMappingURL=kb-sync-status.js.map

package/dist/cli/tools/kb-sync-status.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"kb-sync-status.js","sourceRoot":"","sources":["../../../cli/tools/kb-sync-status.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAE9C;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY;IAChC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;IAEzD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC,SAAS,CAAC;YACpB,MAAM,EAAE,gBAAgB;YACxB,OAAO,EAAE,+DAA+D;SACzE,CAAC,CAAC;IACL,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAkB,CAAC;IAEjF,MAAM,MAAM,GAA4B;QACtC,MAAM,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU;QACnF,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,KAAK;KACzC,CAAC;IAEF,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACpB,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;IACpC,CAAC;IAED,IAAI,MAAM,CAAC,iBAAiB,EAAE,CAAC;QAC7B,MAAM,CAAC,iBAAiB,GAAG,MAAM,CAAC,iBAAiB,CAAC;QACpD,MAAM,CAAC,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,oBAAoB,CAAC;IACvE,CAAC;SAAM,CAAC;QACN,MAAM,CAAC,SAAS,GAAG,MAAM,CAAC;QAC1B,MAAM,CAAC,OAAO,GAAG,0FAA0F,CAAC;IAC9G,CAAC;IAED,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;QACvB,MAAM,CAAC,OAAO,GAAG,yDAAyD,CAAC;IAC7E,CAAC;IAED,2DAA2D;IAC3D,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,CAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC;QACpD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;QACzD,MAAM,SAAS,GAAG,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;YAClD,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC;QACjE,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,CAAC,KAAK,GAAG,oGAAoG,CAAC;QACtH,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AACzC,CAAC"}

package/dist/crypto/aad.d.ts

@@ -0,0 +1,8 @@
+import type { Algorithm, KeyId } from './types.js';
+/**
+ * Construct AAD (Associated Authenticated Data) for AEAD encryption.
+ * Per the envelope spec: AAD = UTF-8 bytes of canonicalJson({alg, id, kid, v})
+ * Keys are sorted alphabetically by RFC 8785.
+ */
+export declare function constructAAD(alg: Algorithm, id: string, kid: KeyId, v: number): Uint8Array;
+//# sourceMappingURL=aad.d.ts.map

package/dist/crypto/aad.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"aad.d.ts","sourceRoot":"","sources":["../../crypto/aad.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAEnD;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,GAAG,UAAU,CAG1F"}

package/dist/crypto/aad.js

@@ -0,0 +1,11 @@
+import { canonicalJson } from './canonical-json.js';
+/**
+ * Construct AAD (Associated Authenticated Data) for AEAD encryption.
+ * Per the envelope spec: AAD = UTF-8 bytes of canonicalJson({alg, id, kid, v})
+ * Keys are sorted alphabetically by RFC 8785.
+ */
+export function constructAAD(alg, id, kid, v) {
+    const json = canonicalJson({ alg, id, kid, v });
+    return new TextEncoder().encode(json);
+}
+//# sourceMappingURL=aad.js.map

package/dist/crypto/aad.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"aad.js","sourceRoot":"","sources":["../../crypto/aad.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGpD;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,GAAc,EAAE,EAAU,EAAE,GAAU,EAAE,CAAS;IAC5E,MAAM,IAAI,GAAG,aAAa,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;IAChD,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;AACxC,CAAC"}

package/dist/crypto/aead.d.ts

@@ -0,0 +1,21 @@
+export interface AeadResult {
+    nonce: Uint8Array;
+    ciphertext: Uint8Array;
+    tag: Uint8Array;
+}
+/**
+ * Encrypt using XChaCha20-Poly1305.
+ * Generates a random 24-byte nonce.
+ * Returns separate nonce, ciphertext, and authentication tag.
+ */
+export declare function aeadEncrypt(key: Uint8Array, plaintext: Uint8Array, aad: Uint8Array): AeadResult;
+/**
+ * Encrypt with a specified nonce (for testing only).
+ */
+export declare function aeadEncryptWithNonce(key: Uint8Array, nonce: Uint8Array, plaintext: Uint8Array, aad: Uint8Array): AeadResult;
+/**
+ * Decrypt using XChaCha20-Poly1305.
+ * Throws if authentication fails.
+ */
+export declare function aeadDecrypt(key: Uint8Array, nonce: Uint8Array, ciphertext: Uint8Array, tag: Uint8Array, aad: Uint8Array): Uint8Array;
+//# sourceMappingURL=aead.d.ts.map

package/dist/crypto/aead.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"aead.d.ts","sourceRoot":"","sources":["../../crypto/aead.ts"],"names":[],"mappings":"AAMA,MAAM,WAAW,UAAU;IACzB,KAAK,EAAE,UAAU,CAAC;IAClB,UAAU,EAAE,UAAU,CAAC;IACvB,GAAG,EAAE,UAAU,CAAC;CACjB;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CACzB,GAAG,EAAE,UAAU,EACf,SAAS,EAAE,UAAU,EACrB,GAAG,EAAE,UAAU,GACd,UAAU,CAGZ;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,UAAU,EACf,KAAK,EAAE,UAAU,EACjB,SAAS,EAAE,UAAU,EACrB,GAAG,EAAE,UAAU,GACd,UAAU,CAaZ;AAED;;;GAGG;AACH,wBAAgB,WAAW,CACzB,GAAG,EAAE,UAAU,EACf,KAAK,EAAE,UAAU,EACjB,UAAU,EAAE,UAAU,EACtB,GAAG,EAAE,UAAU,EACf,GAAG,EAAE,UAAU,GACd,UAAU,CAYZ"}

package/dist/crypto/aead.js

@@ -0,0 +1,43 @@
+import { randomBytes } from 'node:crypto';
+import { xchacha20poly1305 } from '@noble/ciphers/chacha.js';
+const NONCE_LENGTH = 24;
+const TAG_LENGTH = 16;
+/**
+ * Encrypt using XChaCha20-Poly1305.
+ * Generates a random 24-byte nonce.
+ * Returns separate nonce, ciphertext, and authentication tag.
+ */
+export function aeadEncrypt(key, plaintext, aad) {
+    const nonce = new Uint8Array(randomBytes(NONCE_LENGTH));
+    return aeadEncryptWithNonce(key, nonce, plaintext, aad);
+}
+/**
+ * Encrypt with a specified nonce (for testing only).
+ */
+export function aeadEncryptWithNonce(key, nonce, plaintext, aad) {
+    if (nonce.length !== NONCE_LENGTH) {
+        throw new Error(`Nonce must be ${NONCE_LENGTH} bytes, got ${nonce.length}`);
+    }
+    const cipher = xchacha20poly1305(key, nonce, aad);
+    const sealed = cipher.encrypt(plaintext);
+    // noble/ciphers returns ciphertext || tag concatenated
+    const ciphertext = sealed.slice(0, sealed.length - TAG_LENGTH);
+    const tag = sealed.slice(sealed.length - TAG_LENGTH);
+    return { nonce, ciphertext, tag };
+}
+/**
+ * Decrypt using XChaCha20-Poly1305.
+ * Throws if authentication fails.
+ */
+export function aeadDecrypt(key, nonce, ciphertext, tag, aad) {
+    if (nonce.length !== NONCE_LENGTH) {
+        throw new Error(`Nonce must be ${NONCE_LENGTH} bytes, got ${nonce.length}`);
+    }
+    // noble/ciphers expects ciphertext || tag concatenated
+    const sealed = new Uint8Array(ciphertext.length + tag.length);
+    sealed.set(ciphertext, 0);
+    sealed.set(tag, ciphertext.length);
+    const cipher = xchacha20poly1305(key, nonce, aad);
+    return cipher.decrypt(sealed);
+}
+//# sourceMappingURL=aead.js.map

package/dist/crypto/aead.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"aead.js","sourceRoot":"","sources":["../../crypto/aead.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAE7D,MAAM,YAAY,GAAG,EAAE,CAAC;AACxB,MAAM,UAAU,GAAG,EAAE,CAAC;AAQtB;;;;GAIG;AACH,MAAM,UAAU,WAAW,CACzB,GAAe,EACf,SAAqB,EACrB,GAAe;IAEf,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC,CAAC;IACxD,OAAO,oBAAoB,CAAC,GAAG,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;AAC1D,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAClC,GAAe,EACf,KAAiB,EACjB,SAAqB,EACrB,GAAe;IAEf,IAAI,KAAK,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,iBAAiB,YAAY,eAAe,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IAC9E,CAAC;IAED,MAAM,MAAM,GAAG,iBAAiB,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;IAClD,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAEzC,uDAAuD;IACvD,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,GAAG,UAAU,CAAC,CAAC;IAC/D,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,UAAU,CAAC,CAAC;IAErD,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;AACpC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CACzB,GAAe,EACf,KAAiB,EACjB,UAAsB,EACtB,GAAe,EACf,GAAe;IAEf,IAAI,KAAK,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,iBAAiB,YAAY,eAAe,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IAC9E,CAAC;IAED,uDAAuD;IACvD,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,UAAU,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;IAC9D,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;IAC1B,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;IAEnC,MAAM,MAAM,GAAG,iBAAiB,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;IAClD,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;AAChC,CAAC"}

package/dist/crypto/argon2.d.ts

@@ -0,0 +1,11 @@
+import type { ISecureBuffer } from './types.js';
+/**
+ * Derive a master key from a passphrase using Argon2id.
+ * The passphrase is held in a SecureBuffer and zeroed after derivation.
+ *
+ * @param passphrase - User passphrase
+ * @param salt - 16-byte salt (CSPRNG-generated, stored on server)
+ * @returns SecureBuffer containing the 32-byte derived key
+ */
+export declare function deriveFromPassphrase(passphrase: string, salt: Uint8Array): ISecureBuffer;
+//# sourceMappingURL=argon2.d.ts.map

package/dist/crypto/argon2.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"argon2.d.ts","sourceRoot":"","sources":["../../crypto/argon2.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAQhD;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,GAAG,aAAa,CAiBxF"}

package/dist/crypto/argon2.js

@@ -0,0 +1,33 @@
+import { argon2id } from '@noble/hashes/argon2.js';
+import { SecureBuffer } from './secure-buffer.js';
+// Argon2id parameters per spec: t=3, m=65536 (64MB), p=1, output 32 bytes
+const ARGON2_TIME_COST = 3;
+const ARGON2_MEMORY_COST = 65536; // in KiB = 64 MB
+const ARGON2_PARALLELISM = 1;
+const ARGON2_OUTPUT_LENGTH = 32;
+/**
+ * Derive a master key from a passphrase using Argon2id.
+ * The passphrase is held in a SecureBuffer and zeroed after derivation.
+ *
+ * @param passphrase - User passphrase
+ * @param salt - 16-byte salt (CSPRNG-generated, stored on server)
+ * @returns SecureBuffer containing the 32-byte derived key
+ */
+export function deriveFromPassphrase(passphrase, salt) {
+    // Convert passphrase to bytes and hold in a buffer we can zero
+    const passphraseBytes = Buffer.from(passphrase, 'utf-8');
+    try {
+        const derived = argon2id(passphraseBytes, salt, {
+            t: ARGON2_TIME_COST,
+            m: ARGON2_MEMORY_COST,
+            p: ARGON2_PARALLELISM,
+            dkLen: ARGON2_OUTPUT_LENGTH,
+        });
+        return SecureBuffer.from(Buffer.from(derived));
+    }
+    finally {
+        // Zero passphrase memory immediately
+        passphraseBytes.fill(0);
+    }
+}
+//# sourceMappingURL=argon2.js.map

package/dist/crypto/argon2.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"argon2.js","sourceRoot":"","sources":["../../crypto/argon2.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AAEnD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAGlD,0EAA0E;AAC1E,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAC3B,MAAM,kBAAkB,GAAG,KAAK,CAAC,CAAC,iBAAiB;AACnD,MAAM,kBAAkB,GAAG,CAAC,CAAC;AAC7B,MAAM,oBAAoB,GAAG,EAAE,CAAC;AAEhC;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,UAAkB,EAAE,IAAgB;IACvE,+DAA+D;IAC/D,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAEzD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,QAAQ,CAAC,eAAe,EAAE,IAAI,EAAE;YAC9C,CAAC,EAAE,gBAAgB;YACnB,CAAC,EAAE,kBAAkB;YACrB,CAAC,EAAE,kBAAkB;YACrB,KAAK,EAAE,oBAAoB;SAC5B,CAAC,CAAC;QAEH,OAAO,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IACjD,CAAC;YAAS,CAAC;QACT,qCAAqC;QACrC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1B,CAAC;AACH,CAAC"}

package/dist/crypto/blob-id.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Generate a CSPRNG blob ID.
+ * Format: b_ + base62-encoded 16 random bytes.
+ */
+export declare function generateBlobId(): string;
+//# sourceMappingURL=blob-id.d.ts.map

package/dist/crypto/blob-id.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"blob-id.d.ts","sourceRoot":"","sources":["../../crypto/blob-id.ts"],"names":[],"mappings":"AA8BA;;;GAGG;AACH,wBAAgB,cAAc,IAAI,MAAM,CAGvC"}

package/dist/crypto/blob-id.js

@@ -0,0 +1,33 @@
+import { randomBytes } from 'node:crypto';
+const BASE62_ALPHABET = '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ';
+/**
+ * Encode a byte array as base62.
+ * Uses repeated division for exact encoding.
+ */
+function base62Encode(bytes) {
+    // Convert bytes to a BigInt
+    let num = BigInt(0);
+    for (const byte of bytes) {
+        num = (num << 8n) | BigInt(byte);
+    }
+    if (num === 0n) {
+        return BASE62_ALPHABET[0];
+    }
+    const chars = [];
+    const base = BigInt(BASE62_ALPHABET.length);
+    while (num > 0n) {
+        const remainder = Number(num % base);
+        chars.unshift(BASE62_ALPHABET[remainder]);
+        num = num / base;
+    }
+    return chars.join('');
+}
+/**
+ * Generate a CSPRNG blob ID.
+ * Format: b_ + base62-encoded 16 random bytes.
+ */
+export function generateBlobId() {
+    const bytes = randomBytes(16);
+    return 'b_' + base62Encode(bytes);
+}
+//# sourceMappingURL=blob-id.js.map

package/dist/crypto/blob-id.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"blob-id.js","sourceRoot":"","sources":["../../crypto/blob-id.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,MAAM,eAAe,GAAG,gEAAgE,CAAC;AAEzF;;;GAGG;AACH,SAAS,YAAY,CAAC,KAAiB;IACrC,4BAA4B;IAC5B,IAAI,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IACpB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,GAAG,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC;IAED,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;QACf,OAAO,eAAe,CAAC,CAAC,CAAC,CAAC;IAC5B,CAAC;IAED,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,IAAI,GAAG,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;IAC5C,OAAO,GAAG,GAAG,EAAE,EAAE,CAAC;QAChB,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC;QACrC,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC;QAC1C,GAAG,GAAG,GAAG,GAAG,IAAI,CAAC;IACnB,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACxB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc;IAC5B,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAC9B,OAAO,IAAI,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;AACpC,CAAC"}

package/dist/crypto/canonical-json.d.ts

@@ -0,0 +1,6 @@
+/**
+ * RFC 8785 Canonical JSON serialization.
+ * Sorted keys (recursive), no whitespace, proper Unicode escaping.
+ */
+export declare function canonicalJson(obj: Record<string, unknown>): string;
+//# sourceMappingURL=canonical-json.d.ts.map

package/dist/crypto/canonical-json.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonical-json.d.ts","sourceRoot":"","sources":["../../crypto/canonical-json.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAElE"}