@i4ctime/q-ring 0.15.0 → 0.16.1

package/dist/{chunk-TPPPTL4J.js → chunk-NCM5GHNW.js}

@@ -40,7 +40,9 @@ var SecretMetadataSchema = z.object({
   validationUrl: z.string().optional(),
   requiresApproval: z.boolean().optional(),
   jitProvider: z.string().optional(),
-  jitExpiresAt: z.string().optional()
+  jitExpiresAt: z.string().optional(),
+  canary: z.boolean().optional(),
+  canaryFormat: z.string().optional()
 });
 var QuantumEnvelopeSchema = z.object({
   v: z.literal(1),
@@ -73,7 +75,9 @@ function createEnvelope(value, opts) {
       rotationPrefix: opts?.rotationPrefix,
       provider: opts?.provider,
       requiresApproval: opts?.requiresApproval,
-      jitProvider: opts?.jitProvider
+      jitProvider: opts?.jitProvider,
+      canary: opts?.canary,
+      canaryFormat: opts?.canaryFormat
     }
   };
 }
@@ -561,6 +565,18 @@ function writeStoredAnchor(hash) {
   } catch {
   }
 }
+var auditAgentLabel = null;
+function setAuditAgentLabel(label) {
+  if (label === null) {
+    auditAgentLabel = null;
+    return;
+  }
+  const cleaned = label.replace(/[^\x20-\x7e]/g, "").trim().slice(0, 128);
+  auditAgentLabel = cleaned.length > 0 ? cleaned : null;
+}
+function getAuditAgentLabel() {
+  return auditAgentLabel;
+}
 function getAuditDir() {
   if (process.env.QRING_AUDIT_DIR) {
     if (!existsSync2(process.env.QRING_AUDIT_DIR)) {
@@ -612,6 +628,9 @@ function logAudit(event) {
           pid: process.pid,
           prevHash
         };
+        if (full.agent === void 0 && auditAgentLabel) {
+          full.agent = auditAgentLabel;
+        }
         const line = JSON.stringify(full);
         const path = getAuditPath();
         appendFileSync(path, line + "\n", { mode: 384 });
@@ -656,6 +675,7 @@ function queryAudit(query = {}) {
     if (query.action) events = events.filter((e) => e.action === query.action);
     if (query.source) events = events.filter((e) => e.source === query.source);
     if (query.correlationId) events = events.filter((e) => e.correlationId === query.correlationId);
+    if (query.agent) events = events.filter((e) => e.agent === query.agent);
     if (query.since) {
       const since = new Date(query.since).getTime();
       events = events.filter((e) => new Date(e.timestamp).getTime() >= since);
@@ -746,9 +766,9 @@ function exportAudit(opts = {}) {
     return JSON.stringify(events, null, 2);
   }
   if (opts.format === "csv") {
-    const header = "timestamp,action,key,scope,env,source,pid,correlationId,detail";
+    const header = "timestamp,action,key,scope,env,source,agent,pid,correlationId,detail";
     const rows = events.map(
-      (e) => `${e.timestamp},${e.action},${e.key ?? ""},${e.scope ?? ""},${e.env ?? ""},${e.source},${e.pid},${e.correlationId ?? ""},${(e.detail ?? "").replace(/,/g, ";")}`
+      (e) => `${e.timestamp},${e.action},${e.key ?? ""},${e.scope ?? ""},${e.env ?? ""},${e.source},${(e.agent ?? "").replace(/,/g, ";")},${e.pid},${e.correlationId ?? ""},${(e.detail ?? "").replace(/,/g, ";")}`
     );
     return [header, ...rows].join("\n");
   }
@@ -1727,6 +1747,31 @@ function notifyApprovalRequested(key, source) {
   );
 }
 
+// src/core/canary-alert.ts
+var TRIP_THROTTLE_MS = 30 * 1e3;
+var lastAlerted = /* @__PURE__ */ new Map();
+function recordCanaryTrip(trip) {
+  const agent = getAuditAgentLabel();
+  logAudit({
+    action: "canary",
+    key: trip.key,
+    scope: trip.scope,
+    env: trip.env,
+    source: trip.source,
+    detail: `CANARY TRIPPED: honeytoken read via ${trip.source}`
+  });
+  if (!notificationsEnabled()) return;
+  const now = Date.now();
+  const last = lastAlerted.get(trip.key);
+  if (last !== void 0 && now - last < TRIP_THROTTLE_MS) return;
+  lastAlerted.set(trip.key, now);
+  const who = agent ? `${trip.source} (${agent})` : trip.source;
+  notifyUser(
+    "q-ring: CANARY TRIPPED",
+    `Honeytoken "${trip.key}" was read by ${who}. This credential is fake \u2014 but something reached for it. Investigate: qring audit --action canary`
+  );
+}
+
 // src/core/provision.ts
 import { execFileSync, spawnSync } from "child_process";
 import { z as z3 } from "zod";
@@ -2008,6 +2053,9 @@ function getSecret(key, opts = {}) {
       const latest = readEnvelope(service, key) ?? envelope;
       writeEnvelope(service, key, recordAccess(latest));
       logAudit({ action: "read", key, scope, env, source });
+      if (envelope.meta.canary) {
+        recordCanaryTrip({ key, scope, env, source });
+      }
     }
     return value;
   }
@@ -2040,6 +2088,8 @@ function setSecret(key, value, opts = {}) {
   const prov = opts.provider ?? existing?.meta.provider;
   const reqApp = opts.requiresApproval ?? existing?.meta.requiresApproval;
   const jitProv = opts.jitProvider ?? existing?.meta.jitProvider;
+  const canaryFlag = opts.canary ?? existing?.meta.canary;
+  const canaryFmt = opts.canaryFormat ?? existing?.meta.canaryFormat;
   const mergedTags = opts.tags ?? existing?.meta.tags;
   const ttlForPolicy = opts.ttlSeconds ?? existing?.meta.ttlSeconds;
   const life = checkSecretLifecyclePolicy(
@@ -2067,7 +2117,9 @@ function setSecret(key, value, opts = {}) {
       rotationPrefix: rotPfx,
       provider: prov,
       requiresApproval: reqApp,
-      jitProvider: jitProv
+      jitProvider: jitProv,
+      canary: canaryFlag,
+      canaryFormat: canaryFmt
     });
   } else {
     envelope = createEnvelope(value, {
@@ -2080,7 +2132,9 @@ function setSecret(key, value, opts = {}) {
       rotationPrefix: rotPfx,
       provider: prov,
       requiresApproval: reqApp,
-      jitProvider: jitProv
+      jitProvider: jitProv,
+      canary: canaryFlag,
+      canaryFormat: canaryFmt
     });
   }
   if (existing) {
@@ -2572,6 +2626,7 @@ export {
   checkDecay,
   readProjectConfig,
   collapseEnvironment,
+  setAuditAgentLabel,
   logAudit,
   queryAudit,
   verifyAuditChain,
@@ -2610,4 +2665,4 @@ export {
   listMemory,
   forget
 };
-//# sourceMappingURL=chunk-TPPPTL4J.js.map
+//# sourceMappingURL=chunk-NCM5GHNW.js.map