@i4ctime/q-ring 0.17.5 → 0.18.0

package/dist/{chunk-5ZCQSBVS.js → chunk-ZBPMEJRO.js}

@@ -36,6 +36,10 @@ var SecretMetadataSchema = z.object({
   ephemeral: z.boolean().optional(),
   rotationFormat: z.string().optional(),
   rotationPrefix: z.string().optional(),
+  rotatedAt: z.string().optional(),
+  // `.catch(undefined)`: a bad interval strips the reminder rather than
+  // rejecting the whole envelope (which would surface the JSON as the value).
+  rotateEveryDays: z.number().int().positive().max(3650).optional().catch(void 0),
   provider: z.string().optional(),
   validationUrl: z.string().optional(),
   requiresApproval: z.boolean().optional(),
@@ -73,6 +77,8 @@ function createEnvelope(value, opts) {
       accessCount: 0,
       rotationFormat: opts?.rotationFormat,
       rotationPrefix: opts?.rotationPrefix,
+      rotatedAt: opts?.rotatedAt ?? now,
+      rotateEveryDays: opts?.rotateEveryDays,
       provider: opts?.provider,
       requiresApproval: opts?.requiresApproval,
       jitProvider: opts?.jitProvider,
@@ -302,14 +308,13 @@ import {
   closeSync,
   statSync as statSync3
 } from "fs";
-import { join as join5 } from "path";
-import { homedir as homedir3 } from "os";
+import { join as join6 } from "path";
 import { createHash, createHmac, randomBytes as randomBytes2 } from "crypto";
 
 // src/core/backend.ts
 import { Entry as NapiEntry, findCredentials as napiFindCredentials } from "@napi-rs/keyring";
 import { existsSync, readFileSync as readFileSync4, writeFileSync as writeFileSync2, mkdirSync as mkdirSync2, chmodSync } from "fs";
-import { dirname as dirname2, join as join4 } from "path";
+import { dirname as dirname2, join as join5 } from "path";
 import { homedir as homedir2 } from "os";
 import { createCipheriv, createDecipheriv, randomBytes, pbkdf2Sync } from "crypto";
 
@@ -321,8 +326,19 @@ import {
   readFileSync as readFileSync3,
   statSync as statSync2
 } from "fs";
-import { join as join3 } from "path";
+import { join as join4 } from "path";
+
+// src/utils/config-dir.ts
 import { homedir } from "os";
+import { join as join3 } from "path";
+var CONFIG_DIR_ENV = "QRING_CONFIG_DIR";
+function configDir() {
+  const override = process.env[CONFIG_DIR_ENV];
+  if (override && override.trim()) return override;
+  return join3(homedir(), ".config", "q-ring");
+}
+
+// src/utils/file-lock.ts
 function sleepSync(ms) {
   Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
 }
@@ -335,11 +351,11 @@ function isProcessAlive(pid) {
   }
 }
 function withFileLock(name, fn, opts = {}) {
-  const baseDir = process.env.QRING_LOCK_DIR ?? (process.env.QRING_AUDIT_DIR ? join3(process.env.QRING_AUDIT_DIR, ".locks") : join3(homedir(), ".config", "q-ring"));
-  const lockDir = join3(baseDir, opts.dir ?? "locks");
+  const baseDir = process.env.QRING_LOCK_DIR ?? (process.env.QRING_AUDIT_DIR ? join4(process.env.QRING_AUDIT_DIR, ".locks") : configDir());
+  const lockDir = join4(baseDir, opts.dir ?? "locks");
   mkdirSync(lockDir, { recursive: true, mode: 448 });
   const safe = Buffer.from(name, "utf8").toString("base64url");
-  const lockPath = join3(lockDir, `${safe}.lock`);
+  const lockPath = join4(lockDir, `${safe}.lock`);
   const deadline = Date.now() + (opts.timeoutMs ?? 8e3);
   const staleMs = opts.staleMs ?? 3e4;
   while (Date.now() < deadline) {
@@ -382,6 +398,12 @@ var PATH_ENV = "QRING_FILE_BACKEND_PATH";
 var PBKDF2_ITERATIONS = 21e4;
 var KEY_LENGTH = 32;
 var FILE_PREFIX = "qfile1";
+function keyringFailure(op, err) {
+  const detail = err instanceof Error ? err.message : String(err);
+  return new BackendUnavailableError(
+    `OS keyring ${op} failed \u2014 the credential store is locked or unreachable (${detail}). Unlock your keyring (or set ${BACKEND_ENV}=file with ${PASSPHRASE_ENV} for a headless store) and retry.`
+  );
+}
 var BackendUnavailableError = class extends Error {
   constructor(message) {
     super(message);
@@ -399,7 +421,7 @@ function activeBackend() {
   return "keyring";
 }
 function storePath() {
-  return process.env[PATH_ENV] ?? join4(homedir2(), ".config", "q-ring", "file-backend.enc");
+  return process.env[PATH_ENV] ?? join5(homedir2(), ".config", "q-ring", "file-backend.enc");
 }
 function passphrase() {
   const p = process.env[PASSPHRASE_ENV];
@@ -492,7 +514,11 @@ var Entry = class {
     if (activeBackend() === "file") {
       return loadStore().map[this.storeKey()] ?? null;
     }
-    return this.delegate().getPassword();
+    try {
+      return this.delegate().getPassword();
+    } catch (err) {
+      throw keyringFailure("read", err);
+    }
   }
   setPassword(password) {
     if (activeBackend() === "file") {
@@ -511,7 +537,11 @@ var Entry = class {
         return existed;
       });
     }
-    return this.delegate().deleteCredential();
+    try {
+      return this.delegate().deleteCredential();
+    } catch (err) {
+      throw keyringFailure("delete", err);
+    }
   }
   // @napi-rs/keyring's other delete alias, used by `qring doctor`.
   deletePassword() {
@@ -592,14 +622,14 @@ function getAuditDir() {
     }
     return process.env.QRING_AUDIT_DIR;
   }
-  const dir = join5(homedir3(), ".config", "q-ring");
+  const dir = configDir();
   if (!existsSync2(dir)) {
     mkdirSync3(dir, { recursive: true, mode: 448 });
   }
   return dir;
 }
 function getAuditPath() {
-  return join5(getAuditDir(), "audit.jsonl");
+  return join6(getAuditDir(), "audit.jsonl");
 }
 function getLastLineHash() {
   const path = getAuditPath();
@@ -849,8 +879,7 @@ function detectAnomalies(key) {
 
 // src/core/entanglement.ts
 import { existsSync as existsSync4, writeFileSync as writeFileSync3, mkdirSync as mkdirSync4 } from "fs";
-import { join as join6 } from "path";
-import { homedir as homedir4 } from "os";
+import { join as join7 } from "path";
 
 // src/utils/registry.ts
 import { existsSync as existsSync3, readFileSync as readFileSync6, renameSync } from "fs";
@@ -880,11 +909,11 @@ function loadJsonRegistry(path, empty) {
 // src/core/entanglement.ts
 var REGISTRY_VERSION = 1;
 function getRegistryPath() {
-  const dir = join6(homedir4(), ".config", "q-ring");
+  const dir = configDir();
   if (!existsSync4(dir)) {
     mkdirSync4(dir, { recursive: true, mode: 448 });
   }
-  return join6(dir, "entanglement.json");
+  return join7(dir, "entanglement.json");
 }
 function loadRegistry() {
   return loadJsonRegistry(getRegistryPath(), { pairs: [] });
@@ -926,8 +955,7 @@ function listEntanglements() {
 
 // src/core/hooks.ts
 import { existsSync as existsSync5, writeFileSync as writeFileSync4, mkdirSync as mkdirSync5 } from "fs";
-import { join as join7 } from "path";
-import { homedir as homedir5 } from "os";
+import { join as join8 } from "path";
 import { execFile, spawn } from "child_process";
 import { randomUUID } from "crypto";
 
@@ -1151,11 +1179,11 @@ function httpRequest(opts) {
 
 // src/core/hooks.ts
 function getRegistryPath2() {
-  const dir = join7(homedir5(), ".config", "q-ring");
+  const dir = configDir();
   if (!existsSync5(dir)) {
     mkdirSync5(dir, { recursive: true, mode: 448 });
   }
-  return join7(dir, "hooks.json");
+  return join8(dir, "hooks.json");
 }
 function loadRegistry2() {
   return loadJsonRegistry(getRegistryPath2(), { hooks: [] });
@@ -1425,12 +1453,11 @@ async function fireHooks(payload, tags) {
 
 // src/core/approval.ts
 import { existsSync as existsSync6, readFileSync as readFileSync7, writeFileSync as writeFileSync5, mkdirSync as mkdirSync6 } from "fs";
-import { join as join8 } from "path";
-import { homedir as homedir6 } from "os";
+import { join as join9 } from "path";
 import { createHmac as createHmac2, randomBytes as randomBytes3, timingSafeEqual } from "crypto";
 function getHmacSecret() {
-  const dir = join8(homedir6(), ".config", "q-ring");
-  const secretPath = join8(dir, ".approval-key");
+  const dir = configDir();
+  const secretPath = join9(dir, ".approval-key");
   if (!existsSync6(dir)) mkdirSync6(dir, { recursive: true, mode: 448 });
   if (existsSync6(secretPath)) {
     return readFileSync7(secretPath, "utf8").trim();
@@ -1466,11 +1493,11 @@ function verifyHmac(entry) {
   }
 }
 function getRegistryPath3() {
-  const dir = join8(homedir6(), ".config", "q-ring");
+  const dir = configDir();
   if (!existsSync6(dir)) {
     mkdirSync6(dir, { recursive: true, mode: 448 });
   }
-  return join8(dir, "approvals.json");
+  return join9(dir, "approvals.json");
 }
 function loadRegistry3() {
   return loadJsonRegistry(getRegistryPath3(), { approvals: [] });
@@ -1548,7 +1575,7 @@ function listApprovals() {
 
 // src/core/policy.ts
 import { statSync as statSync4 } from "fs";
-import { join as join9 } from "path";
+import { join as join10 } from "path";
 import { z as z2 } from "zod";
 var stringArray = z2.array(z2.string());
 var mcpPolicySchema = z2.object({
@@ -1607,7 +1634,7 @@ function resolvePolicyPath(projectPath) {
 }
 function configMtime(pp) {
   try {
-    return statSync4(join9(pp, ".q-ring.json")).mtimeMs;
+    return statSync4(join10(pp, ".q-ring.json")).mtimeMs;
   } catch {
     return 0;
   }
@@ -1630,7 +1657,7 @@ function loadPolicy(projectPath) {
   if (!parsed.success) {
     const issues = parsed.error.issues.map((i) => `policy${i.path.length ? "." + i.path.join(".") : ""}: ${i.message}`).join("; ");
     const error = new PolicyConfigError(
-      `Invalid policy in ${join9(pp, ".q-ring.json")} \u2014 refusing to run under an unparseable security policy (fail closed). Fix these and retry: ${issues}`
+      `Invalid policy in ${join10(pp, ".q-ring.json")} \u2014 refusing to run under an unparseable security policy (fail closed). Fix these and retry: ${issues}`
     );
     console.error(`q-ring: ${error.message}`);
     cachedPolicy = { path: pp, mtimeMs, error };
@@ -1894,16 +1921,15 @@ function notifyApprovalRequested(key, source) {
 
 // src/core/canary-webhooks.ts
 import { existsSync as existsSync7, writeFileSync as writeFileSync6, mkdirSync as mkdirSync7 } from "fs";
-import { join as join10 } from "path";
-import { homedir as homedir7 } from "os";
+import { join as join11 } from "path";
 import { randomUUID as randomUUID2 } from "crypto";
 var CANARY_ALERT_TYPES = ["discord", "slack", "ntfy", "generic"];
 function getRegistryPath4() {
   const override = process.env.QRING_CANARY_ALERTS_PATH;
   if (override) return override;
-  const dir = join10(homedir7(), ".config", "q-ring");
+  const dir = configDir();
   if (!existsSync7(dir)) mkdirSync7(dir, { recursive: true, mode: 448 });
-  return join10(dir, "canary-alerts.json");
+  return join11(dir, "canary-alerts.json");
 }
 function loadRegistry4() {
   return loadJsonRegistry(getRegistryPath4(), { channels: [] });
@@ -2253,6 +2279,10 @@ registry.register(httpProvider);
 function withJitEnvelopeLock(service, key, fn) {
   return withFileLock(`${service}\0${key}`, fn, { dir: "jit-locks" });
 }
+var MAX_ROTATE_EVERY_DAYS = 3650;
+function isValidRotateEveryDays(days) {
+  return Number.isInteger(days) && days >= 1 && days <= MAX_ROTATE_EVERY_DAYS;
+}
 function readEnvelope(service, key) {
   const entry = new Entry(service, key);
   const raw = entry.getPassword();
@@ -2415,6 +2445,14 @@ function setSecret(key, value, opts = {}) {
   let envelope;
   const rotFmt = opts.rotationFormat ?? existing?.meta.rotationFormat;
   const rotPfx = opts.rotationPrefix ?? existing?.meta.rotationPrefix;
+  const rotEvery = opts.rotateEveryDays ?? existing?.meta.rotateEveryDays;
+  if (rotEvery !== void 0 && !isValidRotateEveryDays(rotEvery)) {
+    throw new Error(
+      `rotateEveryDays must be a whole number of days between 1 and ${MAX_ROTATE_EVERY_DAYS}`
+    );
+  }
+  const valueChanged = !existing || (opts.states ? JSON.stringify(existing.states ?? null) !== JSON.stringify(opts.states) : existing.states !== void 0 || existing.value !== value);
+  const rotatedAt = valueChanged ? (/* @__PURE__ */ new Date()).toISOString() : existing?.meta.rotatedAt ?? existing?.meta.updatedAt ?? existing?.meta.createdAt;
   const prov = opts.provider ?? existing?.meta.provider;
   const reqApp = opts.requiresApproval ?? existing?.meta.requiresApproval;
   const jitProv = opts.jitProvider ?? existing?.meta.jitProvider;
@@ -2445,6 +2483,8 @@ function setSecret(key, value, opts = {}) {
       entangled: existing?.meta.entangled,
       rotationFormat: rotFmt,
       rotationPrefix: rotPfx,
+      rotatedAt,
+      rotateEveryDays: rotEvery,
       provider: prov,
       requiresApproval: reqApp,
       jitProvider: jitProv,
@@ -2460,6 +2500,8 @@ function setSecret(key, value, opts = {}) {
       entangled: existing?.meta.entangled,
       rotationFormat: rotFmt,
       rotationPrefix: rotPfx,
+      rotatedAt,
+      rotateEveryDays: rotEvery,
       provider: prov,
       requiresApproval: reqApp,
       jitProvider: jitProv,
@@ -2742,6 +2784,61 @@ function disentangleSecrets(sourceKey, sourceOpts, targetKey, targetOpts) {
   });
 }
 
+// src/core/rotation.ts
+var DAY_MS = 864e5;
+var DUE_SOON_FRACTION = 0.2;
+var DUE_SOON_MAX_DAYS = 7;
+function dueSoonWindowDays(rotateEveryDays) {
+  return Math.min(rotateEveryDays * DUE_SOON_FRACTION, DUE_SOON_MAX_DAYS);
+}
+function parseMs(iso) {
+  if (!iso) return null;
+  const ms = new Date(iso).getTime();
+  return Number.isFinite(ms) ? ms : null;
+}
+function rotationStatus(meta, now = Date.now()) {
+  const nowMs = typeof now === "number" ? now : now.getTime();
+  const lastRotatedAt = meta.rotatedAt ?? meta.updatedAt ?? meta.createdAt;
+  const lastMs = parseMs(lastRotatedAt) ?? nowMs;
+  const ageDays = Math.max(0, Math.floor((nowMs - lastMs) / DAY_MS));
+  const every = meta.rotateEveryDays;
+  if (!every || !Number.isFinite(every) || every <= 0) {
+    return {
+      lastRotatedAt,
+      ageDays,
+      rotateEveryDays: null,
+      dueAt: null,
+      daysUntilDue: null,
+      state: "unscheduled"
+    };
+  }
+  const dueMs = lastMs + every * DAY_MS;
+  const untilMs = dueMs - nowMs;
+  const daysUntilDue = Math.ceil(untilMs / DAY_MS);
+  let state = "ok";
+  if (untilMs <= 0) state = "overdue";
+  else if (untilMs <= dueSoonWindowDays(every) * DAY_MS) state = "due-soon";
+  return {
+    lastRotatedAt,
+    ageDays,
+    rotateEveryDays: every,
+    dueAt: new Date(dueMs).toISOString(),
+    daysUntilDue,
+    state
+  };
+}
+function describeRotation(status) {
+  if (status.state === "unscheduled" || status.daysUntilDue === null) return "unscheduled";
+  if (status.daysUntilDue > 0) return `due in ${status.daysUntilDue}d`;
+  if (status.daysUntilDue === 0) return "due now";
+  return `overdue ${-status.daysUntilDue}d`;
+}
+function compareRotationUrgency(a, b) {
+  const ad = a.daysUntilDue ?? Number.POSITIVE_INFINITY;
+  const bd = b.daysUntilDue ?? Number.POSITIVE_INFINITY;
+  return ad - bd;
+}
+
 // src/core/tunnel.ts
 import { randomBytes as randomBytes4 } from "crypto";
 var tunnelStore = /* @__PURE__ */ new Map();
@@ -2816,8 +2913,8 @@ function tunnelList() {
 
 // src/core/memory.ts
 import { existsSync as existsSync8, readFileSync as readFileSync8, writeFileSync as writeFileSync7, mkdirSync as mkdirSync8, chmodSync as chmodSync3 } from "fs";
-import { join as join11 } from "path";
-import { homedir as homedir8, hostname, userInfo } from "os";
+import { join as join12 } from "path";
+import { hostname, userInfo } from "os";
 import {
   createCipheriv as createCipheriv2,
   createDecipheriv as createDecipheriv2,
@@ -2829,7 +2926,7 @@ var MEMORY_FILE = "agent-memory.enc";
 var KEYRING_SERVICE = "qring-memory-key";
 var KEYRING_ACCOUNT = "encryption-key";
 function getMemoryDir() {
-  const dir = join11(homedir8(), ".config", "q-ring");
+  const dir = configDir();
   if (!existsSync8(dir)) {
     mkdirSync8(dir, { recursive: true, mode: 448 });
   }
@@ -2843,7 +2940,7 @@ function writeMemoryFile(path, data) {
   }
 }
 function getMemoryPath() {
-  return join11(getMemoryDir(), MEMORY_FILE);
+  return join12(getMemoryDir(), MEMORY_FILE);
 }
 var PBKDF2_ITERATIONS2 = 21e4;
 var KEY_LENGTH2 = 32;
@@ -3061,6 +3158,8 @@ function listAgentSessions(query = {}) {
 
 export {
   PACKAGE_VERSION,
+  configDir,
+  Entry,
   hashProjectPath,
   serviceForScope,
   checkDecay,
@@ -3101,6 +3200,8 @@ export {
   wrapToolRequiresApproval,
   getWrapRateLimit,
   wrapRedactsResults,
+  MAX_ROTATE_EVERY_DAYS,
+  isValidRotateEveryDays,
   getSecret,
   getEnvelope,
   setSecret,
@@ -3111,6 +3212,9 @@ export {
   exportSecrets,
   entangleSecrets,
   disentangleSecrets,
+  rotationStatus,
+  describeRotation,
+  compareRotationUrgency,
   tunnelCreate,
   tunnelRead,
   tunnelDestroy,
@@ -3123,4 +3227,4 @@ export {
   buildSessions,
   listAgentSessions
 };
-//# sourceMappingURL=chunk-5ZCQSBVS.js.map
+//# sourceMappingURL=chunk-ZBPMEJRO.js.map