@de-otio/chaoskb-client 0.2.0

package/dist/cli/commands/register.js

@@ -0,0 +1,146 @@
+import * as readline from 'node:readline';
+import { detectAgents } from '../agent-registry/detector.js';
+import { mergeAgentConfig, previewAgentConfig, removeAgentConfig, MCP_SCRIPT_PATH, } from '../agent-registry/config-merger.js';
+function prompt(question) {
+    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+    return new Promise((resolve) => {
+        rl.question(question, (answer) => {
+            rl.close();
+            resolve(answer.trim().toLowerCase() === 'y');
+        });
+    });
+}
+function formatEntry(entry) {
+    return JSON.stringify({ chaoskb: entry }, null, 2)
+        .split('\n')
+        .map((line) => `    ${line}`);
+}
+function printDiff(before, after) {
+    if (before) {
+        for (const line of formatEntry(before)) {
+            console.log(`  - ${line}`);
+        }
+    }
+    for (const line of formatEntry(after)) {
+        console.log(`  + ${line}`);
+    }
+}
+export async function registerCommand(options) {
+    console.log('');
+    console.log('  ChaosKB Agent Registration');
+    console.log('  ==========================');
+    console.log('');
+    // 1. Detect installed agents
+    const agents = await detectAgents();
+    if (agents.length === 0) {
+        console.log('  No supported agents detected.');
+        console.log('');
+        console.log('  You can manually add ChaosKB to any MCP-compatible agent:');
+        console.log('  {');
+        console.log('    "mcpServers": {');
+        console.log('      "chaoskb": {');
+        console.log('        "command": "chaoskb-mcp",');
+        console.log('        "args": []');
+        console.log('      }');
+        console.log('    }');
+        console.log('  }');
+        console.log('');
+        return;
+    }
+    // 2. Filter to specific agent if requested
+    let targetAgents;
+    if (options.agentName) {
+        targetAgents = agents.filter((a) => a.config.name.toLowerCase() === options.agentName.toLowerCase() ||
+            a.config.displayName.toLowerCase() === options.agentName.toLowerCase());
+        if (targetAgents.length === 0) {
+            console.log(`  Agent "${options.agentName}" not found.`);
+            console.log('  Detected agents:');
+            for (const a of agents) {
+                const status = a.installed ? 'installed' : 'not installed';
+                console.log(`    - ${a.config.displayName} (${status})`);
+            }
+            console.log('');
+            return;
+        }
+    }
+    else {
+        targetAgents = agents.filter((a) => a.installed);
+    }
+    if (targetAgents.length === 0) {
+        console.log('  No installed agents found to register with.');
+        console.log('');
+        return;
+    }
+    // 3. Register with each target agent
+    const registered = [];
+    const failed = [];
+    for (const agent of targetAgents) {
+        try {
+            const args = [];
+            if (options.projectName) {
+                args.push('--project', options.projectName);
+            }
+            const preview = previewAgentConfig(agent.configFilePath, args);
+            const action = preview.isNew ? 'Add to' : 'Update';
+            console.log(`  ${action} ${agent.config.displayName} config:`);
+            console.log(`    ${preview.configFilePath}`);
+            console.log('');
+            printDiff(preview.before, preview.after);
+            console.log('');
+            const confirmed = await prompt('  Proceed? [y/N] ');
+            if (!confirmed) {
+                console.log('  Skipped.');
+                console.log('');
+                continue;
+            }
+            await mergeAgentConfig(agent.configFilePath, args);
+            registered.push(agent.config.displayName);
+            console.log(`  Done.`);
+            console.log('');
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            failed.push(`${agent.config.displayName}: ${message}`);
+            console.log(`  Failed to register with ${agent.config.displayName}: ${message}`);
+            console.log('');
+        }
+    }
+    console.log('');
+    if (registered.length > 0) {
+        console.log(`  Successfully registered with ${registered.length} agent(s):`);
+        for (const name of registered) {
+            console.log(`    - ${name}`);
+        }
+    }
+    if (failed.length > 0) {
+        console.log(`  Failed to register with ${failed.length} agent(s):`);
+        for (const msg of failed) {
+            console.log(`    - ${msg}`);
+        }
+    }
+    if (options.projectName) {
+        console.log(`  Project: ${options.projectName}`);
+    }
+    // Print manual config snippet for project-level MCP config files
+    const manualArgs = [MCP_SCRIPT_PATH];
+    if (options.projectName) {
+        manualArgs.push('--project', options.projectName);
+    }
+    const manualEntry = {
+        mcpServers: {
+            chaoskb: {
+                command: process.execPath,
+                args: manualArgs,
+            },
+        },
+    };
+    console.log('  To add manually to a project MCP config file:');
+    console.log('');
+    const lines = JSON.stringify(manualEntry, null, 2).split('\n');
+    for (const line of lines) {
+        console.log(`  ${line}`);
+    }
+    console.log('');
+}
+export { removeAgentConfig };
+//# sourceMappingURL=register.js.map

package/dist/cli/commands/register.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"register.js","sourceRoot":"","sources":["../../../cli/commands/register.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,eAAe,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAC7D,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,iBAAiB,EACjB,eAAe,GAChB,MAAM,oCAAoC,CAAC;AAG5C,SAAS,MAAM,CAAC,QAAgB;IAC9B,MAAM,EAAE,GAAG,QAAQ,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACtF,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,EAAE;YAC/B,EAAE,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,GAAG,CAAC,CAAC;QAC/C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,WAAW,CAAC,KAA0C;IAC7D,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;SAC/C,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,SAAS,CAChB,MAAuD,EACvD,KAA0C;IAE1C,IAAI,MAAM,EAAE,CAAC;QACX,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;YACvC,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;QACtC,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;IAC7B,CAAC;AACH,CAAC;AAOD,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,OAAwB;IAC5D,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;IAC5C,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;IAC5C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAEhB,6BAA6B;IAC7B,MAAM,MAAM,GAAG,MAAM,YAAY,EAAE,CAAC;IAEpC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC;QAC/C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,6DAA6D,CAAC,CAAC;QAC3E,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACnB,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;QACnC,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;QAClC,OAAO,CAAC,GAAG,CAAC,mCAAmC,CAAC,CAAC;QACjD,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;QAClC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACvB,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACrB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACnB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO;IACT,CAAC;IAED,2CAA2C;IAC3C,IAAI,YAA6B,CAAC;IAClC,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QACtB,YAAY,GAAG,MAAM,CAAC,MAAM,CAC1B,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,SAAU,CAAC,WAAW,EAAE;YAChE,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,SAAU,CAAC,WAAW,EAAE,CAC1E,CAAC;QACF,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC9B,OAAO,CAAC,GAAG,CAAC,YAAY,OAAO,CAAC,SAAS,cAAc,CAAC,CAAC;YACzD,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;YAClC,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;gBACvB,MAAM,MAAM,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,eAAe,CAAC;gBAC3D,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,WAAW,KAAK,MAAM,GAAG,CAAC,CAAC;YAC3D,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,OAAO;QACT,CAAC;IACH,CAAC;SAAM,CAAC;QACN,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACnD,CAAC;IAED,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,OAAO,CAAC,GAAG,CAAC,+CAA+C,CAAC,CAAC;QAC7D,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO;IACT,CAAC;IAED,qCAAqC;IACrC,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,KAAK,MAAM,KAAK,IAAI,YAAY,EAAE,CAAC;QACjC,IAAI,CAAC;YACH,MAAM,IAAI,GAAa,EAAE,CAAC;YAC1B,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;gBACxB,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;YAC9C,CAAC;YAED,MAAM,OAAO,GAAG,kBAAkB,CAAC,KAAK,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;YAC/D,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;YAEnD,OAAO,CAAC,GAAG,CAAC,KAAK,MAAM,IAAI,KAAK,CAAC,MAAM,CAAC,WAAW,UAAU,CAAC,CAAC;YAC/D,OAAO,CAAC,GAAG,CAAC,OAAO,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;YAC7C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;YACzC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAEhB,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;YACpD,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;gBAC1B,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAChB,SAAS;YACX,CAAC;YAED,MAAM,gBAAgB,CAAC,KAAK,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC;YACnD,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YAC1C,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACvB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAClB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,WAAW,KAAK,OAAO,EAAE,CAAC,CAAC;YACvD,OAAO,CAAC,GAAG,CAAC,6BAA6B,KAAK,CAAC,MAAM,CAAC,WAAW,KAAK,OAAO,EAAE,CAAC,CAAC;YACjF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,OAAO,CAAC,GAAG,CAAC,kCAAkC,UAAU,CAAC,MAAM,YAAY,CAAC,CAAC;QAC7E,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;YAC9B,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO,CAAC,GAAG,CAAC,6BAA6B,MAAM,CAAC,MAAM,YAAY,CAAC,CAAC;QACpE,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;YACzB,OAAO,CAAC,GAAG,CAAC,SAAS,GAAG,EAAE,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IACD,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;QACxB,OAAO,CAAC,GAAG,CAAC,cAAc,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IACnD,CAAC;IAED,iEAAiE;IACjE,MAAM,UAAU,GAAa,CAAC,eAAe,CAAC,CAAC;IAC/C,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;QACxB,UAAU,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;IACpD,CAAC;IACD,MAAM,WAAW,GAAG;QAClB,UAAU,EAAE;YACV,OAAO,EAAE;gBACP,OAAO,EAAE,OAAO,CAAC,QAAQ;gBACzB,IAAI,EAAE,UAAU;aACjB;SACF;KACF,CAAC;IACF,OAAO,CAAC,GAAG,CAAC,iDAAiD,CAAC,CAAC;IAC/D,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/D,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAClB,CAAC;AAED,OAAO,EAAE,iBAAiB,EAAE,CAAC"}

package/dist/cli/commands/rotate-key.d.ts

@@ -0,0 +1,16 @@
+/**
+ * CLI command: chaoskb-mcp config rotate-key --new-key <path>
+ *
+ * Performs Phase 1 of two-phase key rotation:
+ * 1. Reads current config to get endpoint and current key fingerprint
+ * 2. Detects the new SSH key from --new-key path (or auto-detects)
+ * 3. Retrieves master key from keyring
+ * 4. Re-wraps master key with the new SSH public key
+ * 5. Calls POST /v1/rotate-start with { newPublicKey, wrappedBlob }
+ * 6. Uploads new wrapped blob to /v1/wrapped-key
+ * 7. Updates config with new key fingerprint and keyPath
+ */
+export declare function rotateKeyCommand(newKeyPath?: string, options?: {
+    dryRun?: boolean;
+}): Promise<void>;
+//# sourceMappingURL=rotate-key.d.ts.map

package/dist/cli/commands/rotate-key.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rotate-key.d.ts","sourceRoot":"","sources":["../../../cli/commands/rotate-key.ts"],"names":[],"mappings":"AAKA;;;;;;;;;;;GAWG;AACH,wBAAsB,gBAAgB,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;IAAE,MAAM,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CA6JzG"}

package/dist/cli/commands/rotate-key.js

@@ -0,0 +1,197 @@
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import * as os from 'node:os';
+import { loadConfig, saveConfig } from './setup.js';
+/**
+ * CLI command: chaoskb-mcp config rotate-key --new-key <path>
+ *
+ * Performs Phase 1 of two-phase key rotation:
+ * 1. Reads current config to get endpoint and current key fingerprint
+ * 2. Detects the new SSH key from --new-key path (or auto-detects)
+ * 3. Retrieves master key from keyring
+ * 4. Re-wraps master key with the new SSH public key
+ * 5. Calls POST /v1/rotate-start with { newPublicKey, wrappedBlob }
+ * 6. Uploads new wrapped blob to /v1/wrapped-key
+ * 7. Updates config with new key fingerprint and keyPath
+ */
+export async function rotateKeyCommand(newKeyPath, options) {
+    const dryRun = options?.dryRun ?? false;
+    const config = await loadConfig();
+    if (!config) {
+        console.error('ChaosKB is not configured. Run `chaoskb-mcp setup` first.');
+        process.exitCode = 1;
+        return;
+    }
+    if (!config.endpoint) {
+        console.error('Sync is not configured. Key rotation requires an active sync endpoint.');
+        process.exitCode = 1;
+        return;
+    }
+    if (!config.sshKeyFingerprint) {
+        console.error('No SSH key configured. Run `chaoskb-mcp setup-sync` first.');
+        process.exitCode = 1;
+        return;
+    }
+    // Detect the new SSH key
+    const newKeyInfo = await detectNewSSHKey(newKeyPath);
+    if (!newKeyInfo) {
+        console.error('Could not detect a new SSH key.' +
+            (newKeyPath ? ` File not found: ${newKeyPath}` : ' Specify --new-key <path>.'));
+        process.exitCode = 1;
+        return;
+    }
+    // Verify the new key is different from the current one
+    if (newKeyInfo.fingerprint === config.sshKeyFingerprint) {
+        console.error('The new key is the same as the current key. Nothing to rotate.');
+        process.exitCode = 1;
+        return;
+    }
+    // Retrieve master key from OS keyring
+    const { KeyringService } = await import('../../crypto/keyring.js');
+    const keyring = new KeyringService();
+    let masterKey = await keyring.retrieve('chaoskb', 'master-key');
+    if (!masterKey) {
+        // Try file-based key fallback
+        if (process.env.CHAOSKB_KEY_STORAGE === 'file') {
+            const { FILE_KEY_PATH } = await import('../bootstrap.js');
+            try {
+                const hex = fs.readFileSync(FILE_KEY_PATH, 'utf-8').trim();
+                const { SecureBuffer } = await import('../../crypto/secure-buffer.js');
+                masterKey = SecureBuffer.from(Buffer.from(hex, 'hex'));
+            }
+            catch {
+                // Fall through to error
+            }
+        }
+        if (!masterKey) {
+            console.error('Master key not found. Ensure your OS keyring is accessible.');
+            process.exitCode = 1;
+            return;
+        }
+    }
+    if (dryRun) {
+        console.log('[dry-run] Would rotate SSH key for sync.');
+        console.log('[dry-run]   Current key: %s', config.sshKeyFingerprint);
+        console.log('[dry-run]   New key:     %s', newKeyInfo.fingerprint);
+        console.log('[dry-run] This will:');
+        console.log('[dry-run]   - Re-wrap the master key with the new SSH public key');
+        console.log('[dry-run]   - Call POST /v1/rotate-start on the sync server');
+        console.log('[dry-run]   - Upload new wrapped key blob to /v1/wrapped-key');
+        console.log('[dry-run]   - Update config with new key fingerprint');
+        console.log('[dry-run] No changes made.');
+        masterKey.dispose();
+        return;
+    }
+    try {
+        // Re-wrap master key with the new SSH public key
+        const { parseSSHPublicKey } = await import('../../crypto/ssh-keys.js');
+        const { wrapMasterKey } = await import('../../crypto/tiers/standard.js');
+        const sshKeyInfo = parseSSHPublicKey(newKeyInfo.publicKeyLine);
+        const wrappedBlob = wrapMasterKey(masterKey, sshKeyInfo);
+        const wrappedBlobBase64 = Buffer.from(wrappedBlob).toString('base64');
+        // Extract the base64 key blob from the public key line
+        const pubKeyParts = newKeyInfo.publicKeyLine.trim().split(/\s+/);
+        const newPublicKeyBase64 = pubKeyParts.length >= 2 ? pubKeyParts[1] : pubKeyParts[0];
+        // Call POST /v1/rotate-start with the old key for auth
+        const { SSHSigner } = await import('../../sync/ssh-signer.js');
+        const { SequenceCounter } = await import('../../sync/sequence.js');
+        const oldSigner = new SSHSigner(config.sshKeyPath ?? undefined);
+        const sequence = new SequenceCounter();
+        const body = JSON.stringify({ newPublicKey: newPublicKeyBase64, wrappedBlob: wrappedBlobBase64 });
+        const bodyBytes = new TextEncoder().encode(body);
+        const seq = sequence.next();
+        const authResult = await oldSigner.signRequest('POST', '/v1/rotate-start', seq, bodyBytes);
+        const endpoint = config.endpoint.replace(/\/+$/, '');
+        const rotateResponse = await fetch(`${endpoint}/v1/rotate-start`, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+                Authorization: authResult.authorization,
+                'X-ChaosKB-Timestamp': authResult.timestamp,
+                'X-ChaosKB-Sequence': String(authResult.sequence),
+                'X-ChaosKB-PublicKey': authResult.publicKey,
+            },
+            body,
+        });
+        if (!rotateResponse.ok) {
+            const errBody = await rotateResponse.text();
+            console.error(`Failed to start key rotation: ${rotateResponse.status} ${errBody}`);
+            process.exitCode = 1;
+            return;
+        }
+        // Upload new wrapped blob to /v1/wrapped-key using the NEW key for auth
+        const newSigner = new SSHSigner(newKeyInfo.keyPath);
+        const seq2 = sequence.next();
+        const uploadAuth = await newSigner.signRequest('PUT', '/v1/wrapped-key', seq2, wrappedBlob);
+        const uploadResponse = await fetch(`${endpoint}/v1/wrapped-key`, {
+            method: 'PUT',
+            headers: {
+                'Content-Type': 'application/octet-stream',
+                Authorization: uploadAuth.authorization,
+                'X-ChaosKB-Timestamp': uploadAuth.timestamp,
+                'X-ChaosKB-Sequence': String(uploadAuth.sequence),
+                'X-ChaosKB-PublicKey': uploadAuth.publicKey,
+            },
+            body: wrappedBlob,
+        });
+        if (!uploadResponse.ok) {
+            const errBody = await uploadResponse.text();
+            console.error(`Failed to upload wrapped key: ${uploadResponse.status} ${errBody}`);
+            process.exitCode = 1;
+            return;
+        }
+        // Update config with new key fingerprint and keyPath
+        config.sshKeyFingerprint = newKeyInfo.fingerprint;
+        config.sshKeyPath = newKeyInfo.keyPath;
+        await saveConfig(config);
+        console.log('Key rotation started. Other devices will be notified on next sync.');
+    }
+    finally {
+        masterKey.dispose();
+    }
+}
+/**
+ * Detect the new SSH key to rotate to.
+ *
+ * If newKeyPath is provided, reads that key file.
+ * Otherwise, auto-detects from common SSH key locations, preferring
+ * keys that are NOT the currently configured key.
+ */
+async function detectNewSSHKey(newKeyPath) {
+    if (newKeyPath) {
+        return readSSHKeyFromPath(newKeyPath);
+    }
+    // Auto-detect: try common locations
+    const sshDir = path.join(os.homedir(), '.ssh');
+    const candidates = [
+        { file: 'id_ed25519.pub', keyFile: 'id_ed25519' },
+        { file: 'id_rsa.pub', keyFile: 'id_rsa' },
+    ];
+    for (const { file, keyFile } of candidates) {
+        const pubKeyPath = path.join(sshDir, file);
+        if (fs.existsSync(pubKeyPath)) {
+            const result = await readSSHKeyFromPath(path.join(sshDir, keyFile));
+            if (result)
+                return result;
+        }
+    }
+    return null;
+}
+async function readSSHKeyFromPath(keyPath) {
+    const pubKeyPath = keyPath.endsWith('.pub') ? keyPath : keyPath + '.pub';
+    const privateKeyPath = keyPath.endsWith('.pub') ? keyPath.slice(0, -4) : keyPath;
+    try {
+        const content = fs.readFileSync(pubKeyPath, 'utf-8').trim();
+        const { parseSSHPublicKey } = await import('../../crypto/ssh-keys.js');
+        const parsed = parseSSHPublicKey(content);
+        return {
+            publicKeyLine: content,
+            fingerprint: parsed.fingerprint,
+            keyPath: privateKeyPath,
+        };
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=rotate-key.js.map

package/dist/cli/commands/rotate-key.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rotate-key.js","sourceRoot":"","sources":["../../../cli/commands/rotate-key.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAEpD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,UAAmB,EAAE,OAA8B;IACxF,MAAM,MAAM,GAAG,OAAO,EAAE,MAAM,IAAI,KAAK,CAAC;IACxC,MAAM,MAAM,GAAG,MAAM,UAAU,EAAE,CAAC;IAClC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,CAAC,KAAK,CAAC,2DAA2D,CAAC,CAAC;QAC3E,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,OAAO;IACT,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QACrB,OAAO,CAAC,KAAK,CAAC,wEAAwE,CAAC,CAAC;QACxF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,OAAO;IACT,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC;QAC9B,OAAO,CAAC,KAAK,CAAC,4DAA4D,CAAC,CAAC;QAC5E,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,OAAO;IACT,CAAC;IAED,yBAAyB;IACzB,MAAM,UAAU,GAAG,MAAM,eAAe,CAAC,UAAU,CAAC,CAAC;IACrD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,CAAC,KAAK,CACX,iCAAiC;YACjC,CAAC,UAAU,CAAC,CAAC,CAAC,oBAAoB,UAAU,EAAE,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAC/E,CAAC;QACF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,OAAO;IACT,CAAC;IAED,uDAAuD;IACvD,IAAI,UAAU,CAAC,WAAW,KAAK,MAAM,CAAC,iBAAiB,EAAE,CAAC;QACxD,OAAO,CAAC,KAAK,CAAC,gEAAgE,CAAC,CAAC;QAChF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,OAAO;IACT,CAAC;IAED,sCAAsC;IACtC,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,yBAAyB,CAAC,CAAC;IACnE,MAAM,OAAO,GAAG,IAAI,cAAc,EAAE,CAAC;IACrC,IAAI,SAAS,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IAEhE,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,8BAA8B;QAC9B,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,KAAK,MAAM,EAAE,CAAC;YAC/C,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAC,CAAC;YAC1D,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;gBAC3D,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,+BAA+B,CAAC,CAAC;gBACvE,SAAS,GAAG,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;YACzD,CAAC;YAAC,MAAM,CAAC;gBACP,wBAAwB;YAC1B,CAAC;QACH,CAAC;QACD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,6DAA6D,CAAC,CAAC;YAC7E,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;YACrB,OAAO;QACT,CAAC;IACH,CAAC;IAED,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,CAAC,GAAG,CAAC,0CAA0C,CAAC,CAAC;QACxD,OAAO,CAAC,GAAG,CAAC,6BAA6B,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC;QACrE,OAAO,CAAC,GAAG,CAAC,6BAA6B,EAAE,UAAU,CAAC,WAAW,CAAC,CAAC;QACnE,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;QACpC,OAAO,CAAC,GAAG,CAAC,kEAAkE,CAAC,CAAC;QAChF,OAAO,CAAC,GAAG,CAAC,6DAA6D,CAAC,CAAC;QAC3E,OAAO,CAAC,GAAG,CAAC,8DAA8D,CAAC,CAAC;QAC5E,OAAO,CAAC,GAAG,CAAC,sDAAsD,CAAC,CAAC;QACpE,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;QAC1C,SAAS,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO;IACT,CAAC;IAED,IAAI,CAAC;QACH,iDAAiD;QACjD,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC;QACvE,MAAM,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,gCAAgC,CAAC,CAAC;QAEzE,MAAM,UAAU,GAAG,iBAAiB,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;QAC/D,MAAM,WAAW,GAAG,aAAa,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;QACzD,MAAM,iBAAiB,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAEtE,uDAAuD;QACvD,MAAM,WAAW,GAAG,UAAU,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACjE,MAAM,kBAAkB,GAAG,WAAW,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;QAErF,uDAAuD;QACvD,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC;QAC/D,MAAM,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;QAEnE,MAAM,SAAS,GAAG,IAAI,SAAS,CAAC,MAAM,CAAC,UAAU,IAAI,SAAS,CAAC,CAAC;QAChE,MAAM,QAAQ,GAAG,IAAI,eAAe,EAAE,CAAC;QAEvC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,YAAY,EAAE,kBAAkB,EAAE,WAAW,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAClG,MAAM,SAAS,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAEjD,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC5B,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,MAAM,EAAE,kBAAkB,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC;QAE3F,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAErD,MAAM,cAAc,GAAG,MAAM,KAAK,CAAC,GAAG,QAAQ,kBAAkB,EAAE;YAChE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,CAAC,aAAa;gBACvC,qBAAqB,EAAE,UAAU,CAAC,SAAS;gBAC3C,oBAAoB,EAAE,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC;gBACjD,qBAAqB,EAAE,UAAU,CAAC,SAAS;aAC5C;YACD,IAAI;SACL,CAAC,CAAC;QAEH,IAAI,CAAC,cAAc,CAAC,EAAE,EAAE,CAAC;YACvB,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,CAAC;YAC5C,OAAO,CAAC,KAAK,CAAC,iCAAiC,cAAc,CAAC,MAAM,IAAI,OAAO,EAAE,CAAC,CAAC;YACnF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;YACrB,OAAO;QACT,CAAC;QAED,wEAAwE;QACxE,MAAM,SAAS,GAAG,IAAI,SAAS,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QACpD,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC7B,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,KAAK,EAAE,iBAAiB,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;QAE5F,MAAM,cAAc,GAAG,MAAM,KAAK,CAAC,GAAG,QAAQ,iBAAiB,EAAE;YAC/D,MAAM,EAAE,KAAK;YACb,OAAO,EAAE;gBACP,cAAc,EAAE,0BAA0B;gBAC1C,aAAa,EAAE,UAAU,CAAC,aAAa;gBACvC,qBAAqB,EAAE,UAAU,CAAC,SAAS;gBAC3C,oBAAoB,EAAE,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC;gBACjD,qBAAqB,EAAE,UAAU,CAAC,SAAS;aAC5C;YACD,IAAI,EAAE,WAAW;SAClB,CAAC,CAAC;QAEH,IAAI,CAAC,cAAc,CAAC,EAAE,EAAE,CAAC;YACvB,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,CAAC;YAC5C,OAAO,CAAC,KAAK,CAAC,iCAAiC,cAAc,CAAC,MAAM,IAAI,OAAO,EAAE,CAAC,CAAC;YACnF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;YACrB,OAAO;QACT,CAAC;QAED,qDAAqD;QACrD,MAAM,CAAC,iBAAiB,GAAG,UAAU,CAAC,WAAW,CAAC;QAClD,MAAM,CAAC,UAAU,GAAG,UAAU,CAAC,OAAO,CAAC;QACvC,MAAM,UAAU,CAAC,MAAM,CAAC,CAAC;QAEzB,OAAO,CAAC,GAAG,CAAC,oEAAoE,CAAC,CAAC;IACpF,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,OAAO,EAAE,CAAC;IACtB,CAAC;AACH,CAAC;AAUD;;;;;;GAMG;AACH,KAAK,UAAU,eAAe,CAAC,UAAmB;IAChD,IAAI,UAAU,EAAE,CAAC;QACf,OAAO,kBAAkB,CAAC,UAAU,CAAC,CAAC;IACxC,CAAC;IAED,oCAAoC;IACpC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,MAAM,CAAC,CAAC;IAC/C,MAAM,UAAU,GAAG;QACjB,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,YAAY,EAAE;QACjD,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE;KAC1C,CAAC;IAEF,KAAK,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,UAAU,EAAE,CAAC;QAC3C,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC3C,IAAI,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9B,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;YACpE,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAC;QAC5B,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,OAAe;IAC/C,MAAM,UAAU,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,GAAG,MAAM,CAAC;IACzE,MAAM,cAAc,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IAEjF,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5D,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC;QACvE,MAAM,MAAM,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAC1C,OAAO;YACL,aAAa,EAAE,OAAO;YACtB,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,OAAO,EAAE,cAAc;SACxB,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/cli/commands/setup-sync.d.ts

@@ -0,0 +1,2 @@
+export declare function setupSyncCommand(): Promise<void>;
+//# sourceMappingURL=setup-sync.d.ts.map

package/dist/cli/commands/setup-sync.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup-sync.d.ts","sourceRoot":"","sources":["../../../cli/commands/setup-sync.ts"],"names":[],"mappings":"AAcA,wBAAsB,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC,CA4JtD"}

package/dist/cli/commands/setup-sync.js

@@ -0,0 +1,165 @@
+import * as readline from 'node:readline';
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
+import { loadConfig, saveConfig } from './setup.js';
+function prompt(rl, question) {
+    return new Promise((resolve) => {
+        rl.question(question, (answer) => {
+            resolve(answer.trim());
+        });
+    });
+}
+export async function setupSyncCommand() {
+    const rl = readline.createInterface({
+        input: process.stdin,
+        output: process.stdout,
+    });
+    try {
+        const config = await loadConfig();
+        if (!config) {
+            console.error('ChaosKB is not set up. Run `chaoskb-mcp setup` first.');
+            process.exit(1);
+        }
+        console.log('');
+        console.log('  ChaosKB Sync Setup');
+        console.log('  ==================');
+        console.log('');
+        // 1. Prompt for server endpoint
+        const endpoint = await prompt(rl, '  Server endpoint URL: ');
+        if (!endpoint) {
+            console.log('  No endpoint provided. Setup cancelled.');
+            return;
+        }
+        // 2. Reject non-HTTPS endpoints
+        if (!endpoint.startsWith('https://')) {
+            console.error('');
+            console.error('  Error: Only HTTPS endpoints are supported.');
+            console.error('  The endpoint must start with https://');
+            console.error('');
+            process.exit(1);
+        }
+        // 3. Test connection
+        console.log('');
+        console.log('  Testing connection...');
+        try {
+            const healthUrl = new URL('/health', endpoint).href;
+            const response = await fetch(healthUrl, {
+                method: 'GET',
+                signal: AbortSignal.timeout(10000),
+            });
+            if (!response.ok) {
+                console.error(`  Server returned status ${response.status}. Check the endpoint and try again.`);
+                process.exit(1);
+            }
+            console.log('  Connection successful.');
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            console.error(`  Connection failed: ${message}`);
+            console.error('  Check the endpoint and try again.');
+            process.exit(1);
+        }
+        // 4. Register SSH public key
+        console.log('');
+        console.log('  Registering SSH public key...');
+        const sshPubKeyPath = findSSHPublicKey();
+        if (!sshPubKeyPath) {
+            console.error('  No SSH public key found. Ensure you have ~/.ssh/id_ed25519.pub or ~/.ssh/id_rsa.pub');
+            process.exit(1);
+        }
+        const pubKey = fs.readFileSync(sshPubKeyPath, 'utf-8').trim();
+        try {
+            const registerUrl = new URL('/v1/auth/register', endpoint).href;
+            const response = await fetch(registerUrl, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({ publicKey: pubKey }),
+                signal: AbortSignal.timeout(10000),
+            });
+            if (!response.ok) {
+                const body = await response.text();
+                console.error(`  Registration failed (${response.status}): ${body}`);
+                process.exit(1);
+            }
+            console.log('  SSH public key registered.');
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            console.error(`  Registration failed: ${message}`);
+            process.exit(1);
+        }
+        // 5. Write config
+        config.endpoint = endpoint;
+        config.sshKeyPath = sshPubKeyPath.replace('.pub', '');
+        await saveConfig(config);
+        console.log('');
+        console.log(`  Config saved to ~/.chaoskb/config.json`);
+        // 6. Canary blob verification
+        console.log('');
+        console.log('  Running canary blob verification...');
+        try {
+            const { EncryptionService } = await import('../../crypto/encryption-service.js');
+            const { KeyringService } = await import('../../crypto/keyring.js');
+            const keyring = new KeyringService();
+            const masterKey = await keyring.retrieve('chaoskb', 'master-key');
+            if (!masterKey) {
+                console.error('  Master key not found. Run `chaoskb-mcp setup` first.');
+                process.exit(1);
+            }
+            const encryption = new EncryptionService();
+            const keys = encryption.deriveKeys(masterKey);
+            const canary = encryption.encrypt({ type: 'canary', value: 'chaoskb-canary-v1' }, keys);
+            // Upload canary
+            const putUrl = new URL(`/v1/blobs/${canary.envelope.id}`, endpoint).href;
+            const putResp = await fetch(putUrl, {
+                method: 'PUT',
+                headers: { 'Content-Type': 'application/octet-stream' },
+                body: canary.bytes,
+                signal: AbortSignal.timeout(10000),
+            });
+            if (!putResp.ok) {
+                throw new Error(`Upload failed: ${putResp.status}`);
+            }
+            // Download and verify
+            const getUrl = new URL(`/v1/blobs/${canary.envelope.id}`, endpoint).href;
+            const getResp = await fetch(getUrl, { signal: AbortSignal.timeout(10000) });
+            if (!getResp.ok) {
+                throw new Error(`Download failed: ${getResp.status}`);
+            }
+            const downloaded = await getResp.arrayBuffer();
+            const downloadedEnvelope = JSON.parse(new TextDecoder().decode(downloaded));
+            const decrypted = encryption.decrypt(downloadedEnvelope, keys);
+            if (decrypted.payload.type !== 'canary' || decrypted.payload.value !== 'chaoskb-canary-v1') {
+                throw new Error('Canary payload mismatch');
+            }
+            masterKey.dispose();
+            console.log('  Canary verification passed.');
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            console.error(`  Canary verification failed: ${message}`);
+            console.error('  Sync setup cancelled.');
+            process.exit(1);
+        }
+        console.log('');
+        console.log('  Sync setup complete!');
+        console.log(`  Endpoint: ${endpoint}`);
+        console.log('');
+    }
+    finally {
+        rl.close();
+    }
+}
+function findSSHPublicKey() {
+    const sshDir = path.join(os.homedir(), '.ssh');
+    const candidates = ['id_ed25519.pub', 'id_rsa.pub'];
+    for (const candidate of candidates) {
+        const keyPath = path.join(sshDir, candidate);
+        if (fs.existsSync(keyPath)) {
+            return keyPath;
+        }
+    }
+    return null;
+}
+//# sourceMappingURL=setup-sync.js.map

package/dist/cli/commands/setup-sync.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup-sync.js","sourceRoot":"","sources":["../../../cli/commands/setup-sync.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,eAAe,CAAC;AAC1C,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAEpD,SAAS,MAAM,CAAC,EAAsB,EAAE,QAAgB;IACtD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,EAAE;YAC/B,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QACzB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB;IACpC,MAAM,EAAE,GAAG,QAAQ,CAAC,eAAe,CAAC;QAClC,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,MAAM,EAAE,OAAO,CAAC,MAAM;KACvB,CAAC,CAAC;IAEH,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,UAAU,EAAE,CAAC;QAClC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,CAAC,KAAK,CAAC,uDAAuD,CAAC,CAAC;YACvE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;QACpC,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;QACpC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAEhB,gCAAgC;QAChC,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,EAAE,EAAE,yBAAyB,CAAC,CAAC;QAE7D,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,CAAC,GAAG,CAAC,0CAA0C,CAAC,CAAC;YACxD,OAAO;QACT,CAAC;QAED,gCAAgC;QAChC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;YACrC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAClB,OAAO,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAC;YAC9D,OAAO,CAAC,KAAK,CAAC,yCAAyC,CAAC,CAAC;YACzD,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAClB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,qBAAqB;QACrB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;QAEvC,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC;YACpD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,SAAS,EAAE;gBACtC,MAAM,EAAE,KAAK;gBACb,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC;aACnC,CAAC,CAAC;YAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,OAAO,CAAC,KAAK,CAAC,4BAA4B,QAAQ,CAAC,MAAM,qCAAqC,CAAC,CAAC;gBAChG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC;QAC1C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,OAAO,CAAC,KAAK,CAAC,wBAAwB,OAAO,EAAE,CAAC,CAAC;YACjD,OAAO,CAAC,KAAK,CAAC,qCAAqC,CAAC,CAAC;YACrD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,6BAA6B;QAC7B,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC;QAE/C,MAAM,aAAa,GAAG,gBAAgB,EAAE,CAAC;QACzC,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,OAAO,CAAC,KAAK,CAAC,uFAAuF,CAAC,CAAC;YACvG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,MAAM,MAAM,GAAG,EAAE,CAAC,YAAY,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;QAE9D,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,mBAAmB,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC;YAChE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,WAAW,EAAE;gBACxC,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;gBAC3C,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC;aACnC,CAAC,CAAC;YAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;gBACnC,OAAO,CAAC,KAAK,CAAC,0BAA0B,QAAQ,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAC;gBACrE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;QAC9C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,OAAO,CAAC,KAAK,CAAC,0BAA0B,OAAO,EAAE,CAAC,CAAC;YACnD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,kBAAkB;QAClB,MAAM,CAAC,QAAQ,GAAG,QAAQ,CAAC;QAC3B,MAAM,CAAC,UAAU,GAAG,aAAa,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACtD,MAAM,UAAU,CAAC,MAAM,CAAC,CAAC;QAEzB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,0CAA0C,CAAC,CAAC;QAExD,8BAA8B;QAC9B,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,uCAAuC,CAAC,CAAC;QACrD,IAAI,CAAC;YACH,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CAAC,oCAAoC,CAAC,CAAC;YACjF,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,yBAAyB,CAAC,CAAC;YACnE,MAAM,OAAO,GAAG,IAAI,cAAc,EAAE,CAAC;YACrC,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;YAClE,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,OAAO,CAAC,KAAK,CAAC,wDAAwD,CAAC,CAAC;gBACxE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YACD,MAAM,UAAU,GAAG,IAAI,iBAAiB,EAAE,CAAC;YAC3C,MAAM,IAAI,GAAG,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;YAC9C,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAC/B,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAC9C,IAAI,CACL,CAAC;YACF,gBAAgB;YAChB,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,aAAa,MAAM,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC;YACzE,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,MAAM,EAAE;gBAClC,MAAM,EAAE,KAAK;gBACb,OAAO,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE;gBACvD,IAAI,EAAE,MAAM,CAAC,KAAK;gBAClB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC;aACnC,CAAC,CAAC;YACH,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;gBAChB,MAAM,IAAI,KAAK,CAAC,kBAAkB,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;YACtD,CAAC;YACD,sBAAsB;YACtB,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,aAAa,MAAM,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC;YACzE,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC5E,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;gBAChB,MAAM,IAAI,KAAK,CAAC,oBAAoB,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;YACxD,CAAC;YACD,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,WAAW,EAAE,CAAC;YAC/C,MAAM,kBAAkB,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;YAC5E,MAAM,SAAS,GAAG,UAAU,CAAC,OAAO,CAAC,kBAAkB,EAAE,IAAI,CAAC,CAAC;YAC/D,IAAI,SAAS,CAAC,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,SAAS,CAAC,OAAO,CAAC,KAAK,KAAK,mBAAmB,EAAE,CAAC;gBAC3F,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;YAC7C,CAAC;YACD,SAAS,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC,CAAC;QAC/C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACjE,OAAO,CAAC,KAAK,CAAC,iCAAiC,OAAO,EAAE,CAAC,CAAC;YAC1D,OAAO,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC;YACzC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;QACtC,OAAO,CAAC,GAAG,CAAC,eAAe,QAAQ,EAAE,CAAC,CAAC;QACvC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClB,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,KAAK,EAAE,CAAC;IACb,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB;IACvB,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,MAAM,CAAC,CAAC;IAC/C,MAAM,UAAU,GAAG,CAAC,gBAAgB,EAAE,YAAY,CAAC,CAAC;IAEpD,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAC7C,IAAI,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3B,OAAO,OAAO,CAAC;QACjB,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/cli/commands/setup.d.ts

@@ -0,0 +1,12 @@
+import type { ChaosKBConfig } from '../mcp-server.js';
+declare const CHAOSKB_DIR: string;
+declare const CONFIG_PATH: string;
+export declare function loadConfig(): Promise<ChaosKBConfig | null>;
+export declare function saveConfig(config: ChaosKBConfig): Promise<void>;
+/**
+ * Setup command — now a thin alias for auto-bootstrap.
+ * Kept for backwards compatibility with existing documentation and scripts.
+ */
+export declare function setupCommand(): Promise<void>;
+export { CHAOSKB_DIR, CONFIG_PATH };
+//# sourceMappingURL=setup.d.ts.map

package/dist/cli/commands/setup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup.d.ts","sourceRoot":"","sources":["../../../cli/commands/setup.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEtD,QAAA,MAAM,WAAW,QAAsC,CAAC;AACxD,QAAA,MAAM,WAAW,QAAwC,CAAC;AAE1D,wBAAsB,UAAU,IAAI,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAOhE;AAED,wBAAsB,UAAU,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAKrE;AAED;;;GAGG;AACH,wBAAsB,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC,CAalD;AAED,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC"}

package/dist/cli/commands/setup.js

@@ -0,0 +1,39 @@
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import * as os from 'node:os';
+const CHAOSKB_DIR = path.join(os.homedir(), '.chaoskb');
+const CONFIG_PATH = path.join(CHAOSKB_DIR, 'config.json');
+export async function loadConfig() {
+    try {
+        const raw = fs.readFileSync(CONFIG_PATH, 'utf-8');
+        return JSON.parse(raw);
+    }
+    catch {
+        return null;
+    }
+}
+export async function saveConfig(config) {
+    fs.mkdirSync(CHAOSKB_DIR, { recursive: true, mode: 0o700 });
+    fs.writeFileSync(CONFIG_PATH, JSON.stringify(config, null, 2), {
+        mode: 0o600,
+    });
+}
+/**
+ * Setup command — now a thin alias for auto-bootstrap.
+ * Kept for backwards compatibility with existing documentation and scripts.
+ */
+export async function setupCommand() {
+    const config = await loadConfig();
+    if (config) {
+        console.log('ChaosKB is already configured.');
+        console.log(`  Config: ${CONFIG_PATH}`);
+        console.log(`  Security tier: ${config.securityTier}`);
+        return;
+    }
+    console.log('Setting up ChaosKB...');
+    const { bootstrap } = await import('../bootstrap.js');
+    await bootstrap();
+    console.log('ChaosKB is ready.');
+}
+export { CHAOSKB_DIR, CONFIG_PATH };
+//# sourceMappingURL=setup.js.map

package/dist/cli/commands/setup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup.js","sourceRoot":"","sources":["../../../cli/commands/setup.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAG9B,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,UAAU,CAAC,CAAC;AACxD,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;AAE1D,MAAM,CAAC,KAAK,UAAU,UAAU;IAC9B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QAClD,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAkB,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,MAAqB;IACpD,EAAE,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5D,EAAE,CAAC,aAAa,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE;QAC7D,IAAI,EAAE,KAAK;KACZ,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY;IAChC,MAAM,MAAM,GAAG,MAAM,UAAU,EAAE,CAAC;IAClC,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC;QAC9C,OAAO,CAAC,GAAG,CAAC,aAAa,WAAW,EAAE,CAAC,CAAC;QACxC,OAAO,CAAC,GAAG,CAAC,oBAAoB,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC;QACvD,OAAO;IACT,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;IACrC,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAC,CAAC;IACtD,MAAM,SAAS,EAAE,CAAC;IAClB,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;AACnC,CAAC;AAED,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC"}

package/dist/cli/commands/status.d.ts

@@ -0,0 +1,5 @@
+export interface StatusOptions {
+    projectName?: string;
+}
+export declare function statusCommand(options: StatusOptions): Promise<void>;
+//# sourceMappingURL=status.d.ts.map

package/dist/cli/commands/status.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"status.d.ts","sourceRoot":"","sources":["../../../cli/commands/status.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,aAAa;IAC5B,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,wBAAsB,aAAa,CAAC,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CA4FzE"}