@i4ctime/q-ring 0.17.5 → 0.18.0

package/dist/index.js

@@ -1,5 +1,7 @@
 #!/usr/bin/env node
 import {
+  Entry,
+  MAX_ROTATE_EVERY_DAYS,
   PACKAGE_VERSION,
   addCanaryAlert,
   checkDecay,
@@ -8,9 +10,12 @@ import {
   checkWrapToolPolicy,
   clearMemory,
   collapseEnvironment,
+  compareRotationUrgency,
+  configDir,
   countLegacyApprovals,
   deleteSecret,
   describeAlertUrl,
+  describeRotation,
   detectAnomalies,
   disableHook,
   disarmCanary,
@@ -31,6 +36,7 @@ import {
   hasSecret,
   hashProjectPath,
   httpRequest,
+  isValidRotateEveryDays,
   listAgentSessions,
   listApprovals,
   listCanaryAlerts,
@@ -47,6 +53,7 @@ import {
   removeCanaryAlert,
   removeHook,
   revokeApproval,
+  rotationStatus,
   sendCanaryAlerts,
   serviceForScope,
   setAuditAgentLabel,
@@ -60,7 +67,7 @@ import {
   verifyAuditChain,
   wrapRedactsResults,
   wrapToolRequiresApproval
-} from "./chunk-5ZCQSBVS.js";
+} from "./chunk-ZBPMEJRO.js";
 
 // src/cli/commands.ts
 import { Command, Help } from "commander";
@@ -339,6 +346,12 @@ function filterSecretsByKeyGlob(entries, filter) {
 }
 
 // src/cli/commands/secrets.ts
+function rotationBadge(state) {
+  if (state === "overdue") return c.red(`${SYMBOLS.cross} overdue`);
+  if (state === "due-soon") return c.yellow(`${SYMBOLS.warning} due soon`);
+  if (state === "ok") return c.green(`${SYMBOLS.check} ok`);
+  return c.dim("unscheduled");
+}
 function registerSecretsCommands(program2) {
   program2.command("set <key> [value]").description("Store a secret (with optional quantum metadata)").option("-g, --global", "Store in global scope").option("-p, --project", "Store in project scope (uses cwd)").option("--team <id>", "Store in team scope").option("--org <id>", "Store in org scope").option("--project-path <path>", "Explicit project path").option(
     "-e, --env <env>",
@@ -351,6 +364,9 @@ function registerSecretsCommands(program2) {
     "--rotation-format <format>",
     "Format for auto-rotation (api-key, password, uuid, hex, base64, alphanumeric, token)"
   ).option("--rotation-prefix <prefix>", "Prefix for auto-rotation (e.g. sk-)").option(
+    "--rotate-every <days>",
+    `Remind to rotate every N days (1-${MAX_ROTATE_EVERY_DAYS}); see \`qring rotate:due\``
+  ).option(
     "--requires-approval",
     "Require explicit user approval for MCP agents to read"
   ).option(
@@ -367,6 +383,19 @@ function registerSecretsCommands(program2) {
         process.exit(1);
       }
     }
+    let rotateEveryDays;
+    if (cmd.rotateEvery !== void 0) {
+      const parsed = /^\d+$/.test(String(cmd.rotateEvery).trim()) ? Number(cmd.rotateEvery) : Number.NaN;
+      if (!isValidRotateEveryDays(parsed)) {
+        console.error(
+          c.red(
+            `${SYMBOLS.cross} --rotate-every must be a whole number of days between 1 and ${MAX_ROTATE_EVERY_DAYS} (got "${cmd.rotateEvery}")`
+          )
+        );
+        process.exit(1);
+      }
+      rotateEveryDays = parsed;
+    }
     const setOpts = {
       ...opts,
       ttlSeconds: cmd.ttl,
@@ -375,6 +404,7 @@ function registerSecretsCommands(program2) {
       tags: cmd.tags?.split(",").map((t) => t.trim()),
       rotationFormat: cmd.rotationFormat,
       rotationPrefix: cmd.rotationPrefix,
+      rotateEveryDays,
       requiresApproval: cmd.requiresApproval,
       jitProvider: cmd.jitProvider
     };
@@ -403,6 +433,7 @@ function registerSecretsCommands(program2) {
       setSecret(key, value, setOpts);
       const extras = [];
       if (cmd.ttl) extras.push(`${SYMBOLS.clock} ttl=${cmd.ttl}s`);
+      if (rotateEveryDays) extras.push(c.dim(`rotate every ${rotateEveryDays}d`));
       if (cmd.description) extras.push(c.dim(cmd.description));
       console.log(
         `${SYMBOLS.check} ${c.green("saved")} ${c.bold(key)} ${c.dim(`[${scopeColor(opts.scope ?? "global")}]`)} ${extras.join(" ")}`
@@ -541,6 +572,7 @@ function registerSecretsCommands(program2) {
     }
     const { envelope, scope } = result;
     const decay = checkDecay(envelope);
+    const rotation = rotationStatus(envelope.meta);
     if (emitJson(program2, cmd, {
       key: safeStr(key),
       scope: safeStr(scope),
@@ -557,7 +589,8 @@ function registerSecretsCommands(program2) {
         service: safeStr(l.service),
         key: safeStr(l.key)
       })),
-      decay
+      decay,
+      rotation
     })) {
       return;
     }
@@ -611,6 +644,9 @@ function registerSecretsCommands(program2) {
         `  ${c.dim("decay:")}     ${decayIndicator(decayPct, expired)} ${decayTime}`
       );
     }
+    const rotAge = `${rotation.ageDays}d ago`;
+    const rotLine = rotation.state === "unscheduled" ? c.dim(`last rotated ${rotAge} \xB7 no reminder set`) : `${rotationBadge(rotation.state)} ${describeRotation(rotation)} ${c.dim(`(last rotated ${rotAge}, every ${rotation.rotateEveryDays}d)`)}`;
+    console.log(`  ${c.dim("rotation:")}  ${rotLine}`);
     if (entangled.length > 0) {
       console.log(`  ${c.dim("entangled:")}`);
       for (const link of entangled) {
@@ -1450,11 +1486,181 @@ ${SYMBOLS.zap} ${c.bold(`Setting up service: ${name}`)}
   });
 }
 
+// src/core/promote.ts
+var PromoteConflictError = class extends Error {
+  code = "ERR_PROMOTE_CONFLICT";
+  constructor(key, to) {
+    super(
+      `"${key}" already has a different value for env "${to}" \u2014 pass force to overwrite it`
+    );
+  }
+};
+function assertEnvName(env, label) {
+  if (!/^[A-Za-z0-9_.-]{1,64}$/.test(env)) {
+    throw new Error(`${label} environment name "${env}" is invalid (letters, digits, _ . - only)`);
+  }
+}
+function promoteSecret(key, opts) {
+  assertEnvName(opts.from, "source");
+  assertEnvName(opts.to, "target");
+  if (opts.from === opts.to) {
+    throw new Error(`source and target environment are both "${opts.from}"`);
+  }
+  const found = getEnvelope(key, opts);
+  if (!found) throw new Error(`Secret "${key}" not found`);
+  const { envelope, scope } = found;
+  const states = envelope.states;
+  if (!states) {
+    throw new Error(
+      `"${key}" has a single value, not per-environment states \u2014 set one with: qring set ${key} --env ${opts.from}`
+    );
+  }
+  const source = states[opts.from];
+  if (source === void 0) {
+    const available = Object.keys(states).join(", ") || "none";
+    throw new Error(`"${key}" has no value for env "${opts.from}" (available: ${available})`);
+  }
+  const current = states[opts.to];
+  const previous = current === void 0 ? "absent" : current === source ? "same" : "different";
+  if (previous === "same") {
+    return { key, scope, from: opts.from, to: opts.to, previous, changed: false };
+  }
+  if (previous === "different" && !opts.force) {
+    throw new PromoteConflictError(key, opts.to);
+  }
+  const nextStates = { ...states, [opts.to]: source };
+  setSecret(key, "", {
+    ...opts,
+    scope,
+    states: nextStates,
+    defaultEnv: envelope.defaultEnv
+  });
+  return { key, scope, from: opts.from, to: opts.to, previous, changed: true };
+}
+function diffEnvironments(opts) {
+  assertEnvName(opts.a, "first");
+  assertEnvName(opts.b, "second");
+  const wanted = opts.keys ? new Set(opts.keys) : null;
+  const entries = [];
+  for (const entry of listSecrets(opts)) {
+    if (wanted && !wanted.has(entry.key)) continue;
+    const states = entry.envelope?.states;
+    let status;
+    if (!states) {
+      status = "collapsed";
+    } else {
+      const va = states[opts.a];
+      const vb = states[opts.b];
+      if (va === void 0 && vb === void 0) continue;
+      if (va === void 0) status = "only-b";
+      else if (vb === void 0) status = "only-a";
+      else status = va === vb ? "same" : "different";
+    }
+    entries.push({ key: entry.key, scope: entry.scope, status });
+  }
+  const summary = {
+    same: 0,
+    different: 0,
+    "only-a": 0,
+    "only-b": 0,
+    collapsed: 0
+  };
+  for (const e of entries) summary[e.status] += 1;
+  const drift = summary.different + summary["only-a"] + summary["only-b"] > 0;
+  return { a: opts.a, b: opts.b, entries, summary, drift };
+}
+
+// src/cli/commands/environments.ts
+var STATUS_LABEL = {
+  same: c.green("same"),
+  different: c.yellow("different"),
+  "only-a": c.red("missing in B"),
+  "only-b": c.red("missing in A"),
+  collapsed: c.dim("single value")
+};
+function registerEnvironmentCommands(program2) {
+  program2.command("promote <key>").description("Copy a secret's value from one environment to another (superposition)").requiredOption("--from <env>", "Source environment").requiredOption("--to <env>", "Target environment").option("-g, --global", "Global scope").option("-p, --project", "Project scope (uses cwd)").option("--team <id>", "Team scope").option("--org <id>", "Org scope").option("--project-path <path>", "Explicit project path").option("-f, --force", "Overwrite a differing target value without asking").option("-y, --yes", "Alias for --force").action(async (key, cmd) => {
+    const opts = buildOpts(cmd);
+    const json = wantsJsonOutput(program2, cmd);
+    const run = (force) => promoteSecret(key, { ...opts, from: cmd.from, to: cmd.to, force });
+    try {
+      let result;
+      try {
+        result = run(Boolean(cmd.force || cmd.yes));
+      } catch (err) {
+        if (!(err instanceof PromoteConflictError) || json) throw err;
+        const ok = await confirm(
+          `${SYMBOLS.warning} ${c.bold(key)} already has a different value for ${envBadge(cmd.to)}. Overwrite it with the ${envBadge(cmd.from)} value?`
+        );
+        if (!ok) {
+          console.error(c.dim("Cancelled."));
+          process.exitCode = 1;
+          return;
+        }
+        result = run(true);
+      }
+      if (emitJson(program2, cmd, result)) return;
+      const verb = result.changed ? c.green("promoted") : c.dim("already in sync");
+      console.log(
+        `${SYMBOLS.check} ${verb} ${c.bold(key)} ${envBadge(result.from)} ${c.dim("\u2192")} ${envBadge(result.to)} ${c.dim(`[${scopeColor(result.scope)}]`)}`
+      );
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      if (json) console.log(JSON.stringify({ ok: false, error: message }));
+      else console.error(c.red(`${SYMBOLS.cross} ${message}`));
+      process.exitCode = 1;
+    }
+  });
+  program2.command("diff <envA> <envB>").description("Compare two environments key by key \u2014 statuses only, never values (exit 1 on drift)").option("-k, --keys <keys>", "Comma-separated keys to compare (default: all visible)").option("-g, --global", "Global scope").option("-p, --project", "Project scope (uses cwd)").option("--team <id>", "Team scope").option("--org <id>", "Org scope").option("--project-path <path>", "Explicit project path").action((envA, envB, cmd) => {
+    const opts = buildOpts(cmd);
+    const keys = cmd.keys ? String(cmd.keys).split(",").map((k) => k.trim()).filter(Boolean) : void 0;
+    try {
+      const result = diffEnvironments({ ...opts, a: envA, b: envB, keys });
+      if (result.drift) process.exitCode = 1;
+      if (emitJson(program2, cmd, result)) return;
+      if (result.entries.length === 0) {
+        console.log(c.dim(`No secrets carry ${envA} or ${envB} states.`));
+        return;
+      }
+      console.log(`${envBadge(envA)} ${c.dim("A")}   ${envBadge(envB)} ${c.dim("B")}`);
+      const width = Math.max(...result.entries.map((e) => e.key.length));
+      for (const e of result.entries) {
+        console.log(
+          `  ${c.bold(e.key.padEnd(width))}  ${STATUS_LABEL[e.status] ?? e.status}  ${c.dim(`[${scopeColor(e.scope)}]`)}`
+        );
+      }
+      const s = result.summary;
+      console.log(
+        c.dim(
+          `
+${s.same} same \xB7 ${s.different} different \xB7 ${s["only-a"]} only in A \xB7 ${s["only-b"]} only in B \xB7 ${s.collapsed} single-value`
+        )
+      );
+      if (result.drift) {
+        console.log(c.yellow(`${SYMBOLS.warning} drift detected \u2014 promote with: qring promote KEY --from ${envA} --to ${envB}`));
+      } else {
+        console.log(c.green(`${SYMBOLS.check} environments aligned`));
+      }
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      if (wantsJsonOutput(program2, cmd)) console.log(JSON.stringify({ ok: false, error: message }));
+      else console.error(c.red(`${SYMBOLS.cross} ${message}`));
+      process.exitCode = 1;
+    }
+  });
+}
+
 // src/core/teleport.ts
 import {
   randomBytes as randomBytes2,
   createCipheriv,
   createDecipheriv,
+  createHash,
+  createPrivateKey,
+  createPublicKey,
+  diffieHellman,
+  generateKeyPairSync,
+  hkdfSync,
   pbkdf2Sync
 } from "crypto";
 import { z } from "zod";
@@ -1488,6 +1694,34 @@ var TeleportPayloadSchema = z.object({
 function deriveKey(passphrase, salt, iterations = PBKDF2_ITERATIONS) {
   return pbkdf2Sync(passphrase, salt, iterations, KEY_LENGTH, "sha512");
 }
+function decodeBundle(encoded) {
+  let bundleJson;
+  try {
+    bundleJson = Buffer.from(encoded, "base64").toString("utf8");
+  } catch {
+    throw new Error("ERR_TELEPORT_CORRUPT: invalid base64 bundle");
+  }
+  try {
+    return JSON.parse(bundleJson);
+  } catch {
+    throw new Error("ERR_TELEPORT_CORRUPT: bundle is not valid JSON");
+  }
+}
+function parsePayload(decrypted) {
+  let rawPayload;
+  try {
+    rawPayload = JSON.parse(decrypted.toString("utf8"));
+  } catch {
+    throw new Error("ERR_TELEPORT_CORRUPT: decrypted payload is not valid JSON");
+  }
+  const payload = TeleportPayloadSchema.safeParse(rawPayload);
+  if (!payload.success) {
+    throw new Error(
+      `ERR_TELEPORT_CORRUPT: invalid payload (${payload.error.message})`
+    );
+  }
+  return payload.data;
+}
 function teleportPack(secrets, passphrase) {
   const payload = {
     secrets,
@@ -1516,18 +1750,7 @@ function teleportPack(secrets, passphrase) {
   return Buffer.from(JSON.stringify(bundle)).toString("base64");
 }
 function teleportUnpack(encoded, passphrase) {
-  let bundleJson;
-  try {
-    bundleJson = Buffer.from(encoded, "base64").toString("utf8");
-  } catch {
-    throw new Error("ERR_TELEPORT_CORRUPT: invalid base64 bundle");
-  }
-  let rawBundle;
-  try {
-    rawBundle = JSON.parse(bundleJson);
-  } catch {
-    throw new Error("ERR_TELEPORT_CORRUPT: bundle is not valid JSON");
-  }
+  const rawBundle = decodeBundle(encoded);
   const parsedBundle = TeleportBundleSchema.safeParse(rawBundle);
   if (!parsedBundle.success) {
     throw new Error(
@@ -1551,19 +1774,301 @@ function teleportUnpack(encoded, passphrase) {
   } catch {
     throw new Error("ERR_TELEPORT_BAD_PASSPHRASE: decryption failed (wrong passphrase or corrupt data)");
   }
-  let rawPayload;
+  return parsePayload(decrypted);
+}
+var RECIPIENT_PREFIX = "qring1";
+var RECIPIENT_RE = /^qring1([A-Za-z0-9_-]{43})$/;
+var X25519_RAW_LENGTH = 32;
+var V2_AAD = "qring-teleport-v2";
+var V2_WRAP_INFO = "qring-teleport-v2-wrap";
+var TELEPORT_KEYRING_SERVICE = "q-ring-teleport";
+var TELEPORT_KEYRING_ACCOUNT = "identity";
+var TeleportBundleV2Schema = z.object({
+  v: z.literal(2),
+  createdAt: z.string(),
+  count: z.number(),
+  ephemeral: z.string(),
+  recipients: z.array(
+    z.object({
+      id: z.string(),
+      wrap: z.string(),
+      iv: z.string(),
+      tag: z.string()
+    })
+  ).min(1),
+  iv: z.string(),
+  tag: z.string(),
+  data: z.string()
+});
+function rawPublicKey(key) {
+  const jwk = key.export({ format: "jwk" });
+  if (jwk.kty !== "OKP" || jwk.crv !== "X25519" || typeof jwk.x !== "string") {
+    throw new Error("ERR_TELEPORT_BAD_RECIPIENT: not an X25519 public key");
+  }
+  const raw = Buffer.from(jwk.x, "base64url");
+  if (raw.length !== X25519_RAW_LENGTH) {
+    throw new Error("ERR_TELEPORT_BAD_RECIPIENT: not an X25519 public key");
+  }
+  return raw;
+}
+function publicKeyFromRaw(raw) {
+  return createPublicKey({
+    key: { kty: "OKP", crv: "X25519", x: raw.toString("base64url") },
+    format: "jwk"
+  });
+}
+function formatRecipient(publicKey) {
+  const raw = Buffer.isBuffer(publicKey) ? publicKey : rawPublicKey(publicKey);
+  if (raw.length !== X25519_RAW_LENGTH) {
+    throw new Error("ERR_TELEPORT_BAD_RECIPIENT: public key must be 32 raw bytes");
+  }
+  return `${RECIPIENT_PREFIX}${raw.toString("base64url")}`;
+}
+function parseRecipient(str) {
+  const trimmed = typeof str === "string" ? str.trim() : "";
+  const match = RECIPIENT_RE.exec(trimmed);
+  if (!match) {
+    throw new Error(
+      `ERR_TELEPORT_BAD_RECIPIENT: expected "${RECIPIENT_PREFIX}" followed by a base64url X25519 public key (run \`qring teleport identity\` on the recipient's machine to get one)`
+    );
+  }
+  const raw = Buffer.from(match[1], "base64url");
+  if (raw.length !== X25519_RAW_LENGTH) {
+    throw new Error(
+      "ERR_TELEPORT_BAD_RECIPIENT: recipient key does not decode to 32 bytes"
+    );
+  }
+  return raw;
+}
+function recipientId(rawPub) {
+  return createHash("sha256").update(rawPub).digest("hex").slice(0, 8);
+}
+function deriveWrapKey(shared, ephemeralPub, recipientPub) {
+  return Buffer.from(
+    hkdfSync(
+      "sha256",
+      shared,
+      Buffer.concat([ephemeralPub, recipientPub]),
+      V2_WRAP_INFO,
+      KEY_LENGTH
+    )
+  );
+}
+function teleportPackFor(secrets, recipients) {
+  const seen = /* @__PURE__ */ new Map();
+  for (const r of recipients) {
+    const raw = parseRecipient(r);
+    seen.set(recipientId(raw), raw);
+  }
+  if (seen.size === 0) {
+    throw new Error("ERR_TELEPORT_NO_RECIPIENTS: at least one recipient is required");
+  }
+  const payload = {
+    secrets,
+    exportedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  const plaintext = JSON.stringify(payload);
+  const cek = randomBytes2(KEY_LENGTH);
+  const iv = randomBytes2(IV_LENGTH);
+  const cipher = createCipheriv(ALGORITHM, cek, iv);
+  cipher.setAAD(Buffer.from(V2_AAD, "utf8"));
+  const encrypted = Buffer.concat([
+    cipher.update(plaintext, "utf8"),
+    cipher.final()
+  ]);
+  const tag = cipher.getAuthTag();
+  const ephemeral = generateKeyPairSync("x25519");
+  const ephemeralPub = rawPublicKey(ephemeral.publicKey);
+  const wrapped = [];
+  for (const [id, recipientPub] of seen) {
+    const shared = diffieHellman({
+      privateKey: ephemeral.privateKey,
+      publicKey: publicKeyFromRaw(recipientPub)
+    });
+    const wrapKey = deriveWrapKey(shared, ephemeralPub, recipientPub);
+    shared.fill(0);
+    const wrapIv = randomBytes2(IV_LENGTH);
+    const wrapCipher = createCipheriv(ALGORITHM, wrapKey, wrapIv);
+    wrapCipher.setAAD(Buffer.from(id, "utf8"));
+    const wrap2 = Buffer.concat([wrapCipher.update(cek), wrapCipher.final()]);
+    const wrapTag = wrapCipher.getAuthTag();
+    wrapKey.fill(0);
+    wrapped.push({
+      id,
+      wrap: wrap2.toString("base64"),
+      iv: wrapIv.toString("base64"),
+      tag: wrapTag.toString("base64")
+    });
+  }
+  cek.fill(0);
+  const bundle = {
+    v: 2,
+    createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+    count: secrets.length,
+    ephemeral: ephemeralPub.toString("base64url"),
+    recipients: wrapped,
+    iv: iv.toString("base64"),
+    tag: tag.toString("base64"),
+    data: encrypted.toString("base64")
+  };
+  return Buffer.from(JSON.stringify(bundle)).toString("base64");
+}
+function toPrivateKey(identity) {
+  if (typeof identity !== "string") return identity;
   try {
-    rawPayload = JSON.parse(decrypted.toString("utf8"));
+    return createPrivateKey(identity);
   } catch {
-    throw new Error("ERR_TELEPORT_CORRUPT: decrypted payload is not valid JSON");
+    throw new Error("ERR_TELEPORT_BAD_IDENTITY: private key is not a valid PEM");
   }
-  const payload = TeleportPayloadSchema.safeParse(rawPayload);
-  if (!payload.success) {
+}
+function teleportUnpackWith(encoded, identity) {
+  const privateKey = toPrivateKey(identity);
+  const rawBundle = decodeBundle(encoded);
+  const parsedBundle = TeleportBundleV2Schema.safeParse(rawBundle);
+  if (!parsedBundle.success) {
     throw new Error(
-      `ERR_TELEPORT_CORRUPT: invalid payload (${payload.error.message})`
+      `ERR_TELEPORT_CORRUPT: invalid bundle shape (${parsedBundle.error.message})`
     );
   }
-  return payload.data;
+  const bundle = parsedBundle.data;
+  const myPub = rawPublicKey(createPublicKey(privateKey));
+  const myId = recipientId(myPub);
+  const mine = bundle.recipients.filter((r) => r.id === myId);
+  if (mine.length === 0) {
+    const ids = bundle.recipients.map((r) => r.id).join(", ");
+    throw new Error(
+      `ERR_TELEPORT_NOT_A_RECIPIENT: bundle is addressed to [${ids}], not to ${myId}`
+    );
+  }
+  const ephemeralPub = Buffer.from(bundle.ephemeral, "base64url");
+  if (ephemeralPub.length !== X25519_RAW_LENGTH) {
+    throw new Error("ERR_TELEPORT_CORRUPT: ephemeral key is not 32 bytes");
+  }
+  let ephemeralKey;
+  try {
+    ephemeralKey = publicKeyFromRaw(ephemeralPub);
+  } catch {
+    throw new Error("ERR_TELEPORT_CORRUPT: ephemeral key is not a valid X25519 point");
+  }
+  const shared = diffieHellman({ privateKey, publicKey: ephemeralKey });
+  const wrapKey = deriveWrapKey(shared, ephemeralPub, myPub);
+  shared.fill(0);
+  let cek = null;
+  for (const entry of mine) {
+    try {
+      const decipher = createDecipheriv(
+        ALGORITHM,
+        wrapKey,
+        Buffer.from(entry.iv, "base64")
+      );
+      decipher.setAAD(Buffer.from(entry.id, "utf8"));
+      decipher.setAuthTag(Buffer.from(entry.tag, "base64"));
+      cek = Buffer.concat([
+        decipher.update(Buffer.from(entry.wrap, "base64")),
+        decipher.final()
+      ]);
+      break;
+    } catch {
+      cek = null;
+    }
+  }
+  wrapKey.fill(0);
+  if (cek === null || cek.length !== KEY_LENGTH) {
+    cek?.fill(0);
+    throw new Error(
+      "ERR_TELEPORT_CORRUPT: could not unwrap content key (tampered bundle or mismatched identity)"
+    );
+  }
+  let decrypted;
+  try {
+    const decipher = createDecipheriv(
+      ALGORITHM,
+      cek,
+      Buffer.from(bundle.iv, "base64")
+    );
+    decipher.setAAD(Buffer.from(V2_AAD, "utf8"));
+    decipher.setAuthTag(Buffer.from(bundle.tag, "base64"));
+    decrypted = Buffer.concat([
+      decipher.update(Buffer.from(bundle.data, "base64")),
+      decipher.final()
+    ]);
+  } catch {
+    throw new Error("ERR_TELEPORT_CORRUPT: payload authentication failed (tampered bundle)");
+  } finally {
+    cek.fill(0);
+  }
+  return parsePayload(decrypted);
+}
+function inspectTeleportBundle(encoded) {
+  const raw = decodeBundle(encoded);
+  const v1 = TeleportBundleSchema.safeParse(raw);
+  if (v1.success) return { v: 1, count: v1.data.count };
+  const v2 = TeleportBundleV2Schema.safeParse(raw);
+  if (v2.success) {
+    return {
+      v: 2,
+      count: v2.data.count,
+      recipients: v2.data.recipients.map((r) => r.id)
+    };
+  }
+  const version = raw !== null && typeof raw === "object" && "v" in raw ? String(raw.v) : "unknown";
+  throw new Error(
+    `ERR_TELEPORT_CORRUPT: unsupported or malformed bundle (v=${version})`
+  );
+}
+function teleportUnpackAuto(encoded, creds) {
+  const info = inspectTeleportBundle(encoded);
+  if (info.v === 1) {
+    if (creds.passphrase === void 0) {
+      throw new Error(
+        "ERR_TELEPORT_PASSPHRASE_REQUIRED: this is a passphrase (v1) bundle"
+      );
+    }
+    return teleportUnpack(encoded, creds.passphrase);
+  }
+  if (creds.identity === void 0) {
+    throw new Error(
+      "ERR_TELEPORT_NO_IDENTITY: this bundle is addressed to recipient keys \u2014 run `qring teleport keygen` to create yours"
+    );
+  }
+  return teleportUnpackWith(encoded, creds.identity);
+}
+function identityFrom(privateKey) {
+  const raw = rawPublicKey(createPublicKey(privateKey));
+  return { privateKey, recipient: formatRecipient(raw), id: recipientId(raw) };
+}
+function generateTeleportIdentity(options = {}) {
+  const entry = new Entry(TELEPORT_KEYRING_SERVICE, TELEPORT_KEYRING_ACCOUNT);
+  if (!options.force && entry.getPassword()) {
+    throw new Error(
+      "ERR_TELEPORT_IDENTITY_EXISTS: a teleport identity already exists \u2014 pass --force to replace it (bundles sent to the old key become unreadable)"
+    );
+  }
+  const { privateKey } = generateKeyPairSync("x25519");
+  const der = privateKey.export({ format: "der", type: "pkcs8" });
+  entry.setPassword(der.toString("base64"));
+  der.fill(0);
+  return identityFrom(privateKey);
+}
+function loadTeleportIdentity() {
+  const stored = new Entry(
+    TELEPORT_KEYRING_SERVICE,
+    TELEPORT_KEYRING_ACCOUNT
+  ).getPassword();
+  if (!stored) return null;
+  let privateKey;
+  try {
+    privateKey = createPrivateKey({
+      key: Buffer.from(stored, "base64"),
+      format: "der",
+      type: "pkcs8"
+    });
+  } catch {
+    throw new Error(
+      "ERR_TELEPORT_BAD_IDENTITY: stored teleport identity is unreadable \u2014 run `qring teleport keygen --force`"
+    );
+  }
+  return identityFrom(privateKey);
 }
 
 // src/cli/commands/quantum.ts
@@ -1693,15 +2198,71 @@ ${c.dim(`format: ${cmd.format} | entropy: ~${entropy} bits`)}`
     console.log();
   });
   const tp = program2.command("teleport").alias("tp").description("Encrypted secret sharing (quantum teleportation)");
-  tp.command("pack").description("Pack secrets into an encrypted bundle").option("-k, --keys <keys>", "Comma-separated key names to pack").option("-g, --global", "Pack global scope").option("-p, --project", "Pack project scope").option("--project-path <path>", "Explicit project path").action(async (cmd) => {
-    const opts = buildOpts(cmd);
-    const passphrase = await promptSecret(
-      `${SYMBOLS.lock} Enter passphrase for encryption: `
-    );
-    if (!passphrase) {
-      console.error(c.red("Passphrase required"));
+  tp.command("keygen").description(
+    "Create your teleport identity (X25519 keypair, private key in the OS keyring)"
+  ).option("--force", "Replace an existing identity").action((cmd) => {
+    let identity;
+    try {
+      identity = generateTeleportIdentity({ force: Boolean(cmd.force) });
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      console.error(c.red(`${SYMBOLS.cross} ${msg}`));
+      process.exit(1);
+    }
+    console.log(identity.recipient);
+    if (process.stdout.isTTY) {
+      console.log(
+        `${SYMBOLS.key} ${c.green("identity created")} ${c.dim(`(id ${identity.id})`)} \u2014 share the line above with anyone who should \`teleport pack --to\` you`
+      );
+    }
+  });
+  tp.command("identity").description("Print your public teleport recipient string").action(() => {
+    let identity;
+    try {
+      identity = loadTeleportIdentity();
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      console.error(c.red(`${SYMBOLS.cross} ${msg}`));
+      process.exit(1);
+    }
+    if (!identity) {
+      console.error(
+        c.red(
+          `${SYMBOLS.cross} No teleport identity found \u2014 run ${c.bold("qring teleport keygen")} first`
+        )
+      );
       process.exit(1);
     }
+    console.log(identity.recipient);
+    if (process.stdout.isTTY) {
+      console.log(c.dim(`recipient id: ${identity.id}`));
+    }
+  });
+  tp.command("pack").description("Pack secrets into an encrypted bundle").option("-k, --keys <keys>", "Comma-separated key names to pack").option(
+    "--to <recipient...>",
+    "Recipient(s) from `qring teleport identity` (repeatable or comma-separated); skips the passphrase"
+  ).option("-g, --global", "Pack global scope").option("-p, --project", "Pack project scope").option("--project-path <path>", "Explicit project path").action(async (cmd) => {
+    const opts = buildOpts(cmd);
+    const recipients = (cmd.to ?? []).flatMap((r) => r.split(",")).map((r) => r.trim()).filter((r) => r.length > 0);
+    for (const r of recipients) {
+      try {
+        parseRecipient(r);
+      } catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        console.error(c.red(`${SYMBOLS.cross} Bad recipient "${r}": ${msg}`));
+        process.exit(1);
+      }
+    }
+    let passphrase;
+    if (recipients.length === 0) {
+      passphrase = await promptSecret(
+        `${SYMBOLS.lock} Enter passphrase for encryption: `
+      );
+      if (!passphrase) {
+        console.error(c.red("Passphrase required (or pass --to <recipient>)"));
+        process.exit(1);
+      }
+    }
     const entries = listSecrets(opts);
     let keys;
     if (cmd.keys) {
@@ -1719,12 +2280,13 @@ ${c.dim(`format: ${cmd.format} | entropy: ~${entropy} bits`)}`
       console.error(c.red("No secrets to pack"));
       process.exit(1);
     }
-    const bundle = teleportPack(secrets, passphrase);
+    const bundle = recipients.length > 0 ? teleportPackFor(secrets, recipients) : teleportPack(secrets, passphrase);
     process.stdout.write(bundle);
     if (process.stdout.isTTY) {
+      const to = recipients.length > 0 ? c.dim(` for ${recipients.length} recipient(s)`) : "";
       console.log(
         `
-${SYMBOLS.package} ${c.green("packed")} ${secrets.length} secret(s)`
+${SYMBOLS.package} ${c.green("packed")} ${secrets.length} secret(s)${to}`
       );
     }
   });
@@ -1736,20 +2298,73 @@ ${SYMBOLS.package} ${c.green("packed")} ${secrets.length} secret(s)`
       }
       bundle = Buffer.concat(chunks).toString("utf8").trim();
     }
-    const passphrase = await promptSecret(
-      `${SYMBOLS.lock} Enter passphrase for decryption: `
-    );
-    let payload;
+    let info;
     try {
-      payload = teleportUnpack(bundle, passphrase);
+      info = inspectTeleportBundle(bundle);
     } catch {
       console.error(
-        c.red(
-          `${SYMBOLS.cross} Failed to unpack: wrong passphrase or corrupted bundle`
-        )
+        c.red(`${SYMBOLS.cross} Failed to unpack: corrupted bundle`)
       );
       process.exit(1);
     }
+    let passphrase;
+    let identity = null;
+    if (info.v === 1) {
+      passphrase = await promptSecret(
+        `${SYMBOLS.lock} Enter passphrase for decryption: `
+      );
+    } else {
+      try {
+        identity = loadTeleportIdentity();
+      } catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        console.error(c.red(`${SYMBOLS.cross} ${msg}`));
+        process.exit(1);
+      }
+      if (cmd.dryRun) {
+        const mine = identity ? info.recipients.includes(identity.id) : false;
+        console.log(
+          `
+${SYMBOLS.package} ${c.bold("Recipient bundle")} addressed to ${info.recipients.length} recipient id(s):`
+        );
+        for (const id of info.recipients) {
+          const marker = identity && id === identity.id ? c.green(" (you)") : "";
+          console.log(`  ${SYMBOLS.key} ${id}${marker}`);
+        }
+        if (!identity) {
+          console.log(
+            c.dim(
+              `  no local identity \u2014 run ${c.bold("qring teleport keygen")} to create one`
+            )
+          );
+        } else if (!mine) {
+          console.log(
+            c.dim(`  your id ${identity.id} is not among them; unpack will fail`)
+          );
+        }
+        console.log();
+      }
+      if (!identity) {
+        console.error(
+          c.red(
+            `${SYMBOLS.cross} This bundle is addressed to recipient keys and you have no teleport identity \u2014 run ${c.bold("qring teleport keygen")} first`
+          )
+        );
+        process.exit(1);
+      }
+    }
+    let payload;
+    try {
+      payload = teleportUnpackAuto(bundle, {
+        passphrase,
+        identity: identity?.privateKey
+      });
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      const reason = msg.startsWith("ERR_TELEPORT_NOT_A_RECIPIENT") ? `this bundle is not addressed to your identity (${identity?.id})` : info.v === 1 ? "wrong passphrase or corrupted bundle" : "corrupted bundle or mismatched identity";
+      console.error(c.red(`${SYMBOLS.cross} Failed to unpack: ${reason}`));
+      process.exit(1);
+    }
     if (cmd.dryRun) {
       console.log(
         `
@@ -1937,6 +2552,51 @@ function registerValidationCommands(program2) {
       console.log(c.yellow(`${SYMBOLS.warning} ${result.message}`));
     }
   });
+  program2.command("rotate:due").description(
+    "List secrets whose rotation reminder is due soon or overdue (--all: every scheduled secret)"
+  ).option("-g, --global", "Global scope only").option("-p, --project", "Project scope only").option("--team <id>", "Team scope only").option("--org <id>", "Org scope only").option("--project-path <path>", "Explicit project path").option("--all", "Include scheduled secrets that are not yet due").option("--json", "Output as JSON").action((cmd) => {
+    const opts = buildOpts(cmd);
+    const entries = listSecrets(opts);
+    const scheduled = entries.filter((e) => e.envelope).map((e) => ({
+      key: safeStr(e.key),
+      scope: safeStr(e.scope),
+      rotation: rotationStatus(e.envelope.meta)
+    })).filter((e) => e.rotation.state !== "unscheduled").sort((a, b) => compareRotationUrgency(a.rotation, b.rotation));
+    const due = scheduled.filter(
+      (e) => e.rotation.state === "due-soon" || e.rotation.state === "overdue"
+    );
+    const shown = cmd.all ? scheduled : due;
+    if (emitJson(program2, cmd, {
+      entries: shown,
+      dueCount: due.length,
+      scheduledCount: scheduled.length
+    })) {
+      return;
+    }
+    if (shown.length === 0) {
+      console.log(
+        c.dim(
+          scheduled.length === 0 ? "No secrets have a rotation reminder (set one with: qring set KEY --rotate-every 90)" : `Nothing due \u2014 ${scheduled.length} scheduled secret(s) are on track`
+        )
+      );
+      return;
+    }
+    console.log(
+      c.bold(
+        `
+  ${SYMBOLS.shield} Rotation reminders (${due.length} due of ${scheduled.length} scheduled)
+`
+      )
+    );
+    const maxKeyLen = Math.max(...shown.map((e) => e.key.length));
+    for (const e of shown) {
+      const r = e.rotation;
+      console.log(
+        `  ${c.dim("[")}${scopeColor(e.scope)}${c.dim("]")}  ${c.bold(e.key.padEnd(maxKeyLen))}  ${rotationBadge(r.state)}  ${describeRotation(r)}  ${c.dim(`(last rotated ${r.ageDays}d ago, every ${r.rotateEveryDays}d)`)}`
+      );
+    }
+    console.log();
+  });
   program2.command("ci:validate").description(
     "CI-oriented batch validation of all secrets (exit code 1 on failure)"
   ).option("-g, --global", "Global scope").option("-p, --project", "Project scope").option("--project-path <path>", "Explicit project path").option("--json", "Output as JSON").action(async (cmd) => {
@@ -2611,7 +3271,7 @@ function registerToolingCommands(program2) {
     }
   });
   program2.command("status").description("Launch the quantum status dashboard in your browser").option("--port <port>", "Port to serve on", "9876").option("--no-open", "Don't auto-open the browser").action(async (cmd) => {
-    const { startDashboardServer } = await import("./dashboard-ZN3FPR73.js");
+    const { startDashboardServer } = await import("./dashboard-LICF6OZ5.js");
     const { exec } = await import("child_process");
     const { platform } = await import("os");
     const port = Number(cmd.port);
@@ -3865,7 +4525,29 @@ function setupEditor(opts) {
 
 // src/core/push.ts
 import { spawnSync } from "child_process";
-var PUSH_TARGETS = ["github", "vercel", "cloudflare"];
+import { mkdtempSync, rmSync, writeFileSync as writeFileSync6 } from "fs";
+import { tmpdir } from "os";
+import { join as join5 } from "path";
+var PUSH_TARGETS = [
+  "github",
+  "vercel",
+  "cloudflare",
+  "fly",
+  "railway",
+  "netlify"
+];
+function flyImportLine(key, value) {
+  return `${key}="""${value}"""
+`;
+}
+function dotenvLine(key, value) {
+  if (!/['\r\n]/.test(value)) return `${key}='${value}'
+`;
+  if (!/["\r\n]/.test(value) && !/\\[nr]/.test(value)) return `${key}="${value}"
+`;
+  return `${key}=${value}
+`;
+}
 var TARGETS = {
   github: {
     binary: "gh",
@@ -3882,12 +4564,62 @@ var TARGETS = {
     binary: "wrangler",
     args: (key) => [["secret", "put", key]],
     installHint: "install Wrangler: npm i -g wrangler (then `wrangler login`)"
+  },
+  fly: {
+    binary: "flyctl",
+    // `flyctl secrets set KEY=VALUE` is argv-only; `secrets import` reads
+    // NAME=VALUE lines from stdin instead, so the key travels there too.
+    args: (_key, opts) => [["secrets", "import", ...opts.app ? ["--app", opts.app] : []]],
+    stdin: flyImportLine,
+    installHint: "install flyctl: https://fly.io/docs/flyctl/install/ (then `flyctl auth login`)"
+  },
+  railway: {
+    binary: "railway",
+    // Railway CLI >= 4 reads the value from stdin with `variable set KEY --stdin`
+    // (trailing newline trimmed); `--set KEY=VALUE` is the argv-only legacy form.
+    args: (key, opts) => [
+      [
+        "variable",
+        "set",
+        key,
+        "--stdin",
+        ...opts.service ? ["--service", opts.service] : [],
+        ...opts.railwayEnv ? ["--environment", opts.railwayEnv] : []
+      ]
+    ],
+    installHint: "install the Railway CLI: https://docs.railway.com/guides/cli (then `railway login`)"
+  },
+  netlify: {
+    binary: "netlify",
+    // `netlify env:set KEY VALUE` is argv-only and the CLI reads nothing from
+    // stdin, so the value goes through a 0600 dotenv temp file consumed by
+    // `env:import <file>` (which merges into the site's existing variables,
+    // in every deploy context — env:import has no --context flag).
+    args: (_key, opts, secretFile) => [
+      ["env:import", secretFile ?? "", ...opts.site ? ["--site", opts.site] : []]
+    ],
+    file: dotenvLine,
+    installHint: "install the Netlify CLI: https://docs.netlify.com/cli/get-started/ (then `netlify login` and `netlify link`)"
   }
 };
 function binaryAvailable(binary) {
   const probe = spawnSync(binary, ["--version"], { stdio: "ignore", shell: false });
   return !probe.error;
 }
+function withSecretFile(content, fn) {
+  const dir = mkdtempSync(join5(tmpdir(), "qring-push-"));
+  try {
+    const file = join5(dir, "secret.env");
+    writeFileSync6(file, content, { mode: 384, flag: "wx" });
+    return fn(file);
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+}
+function destination(opts) {
+  const where = opts.repo ?? opts.app ?? opts.site ?? opts.service;
+  return where ? ` (${where})` : "";
+}
 function resolvePushKeys(opts) {
   if (opts.keys?.length) return opts.keys;
   const config = readProjectConfig(opts.projectPath);
@@ -3925,19 +4657,22 @@ function pushSecrets(opts) {
       result.pushed.push(key);
       continue;
     }
-    let failedInvocation = null;
-    for (const args of target.args(key, opts)) {
-      const child = spawnSync(target.binary, args, {
-        input: value,
-        cwd: opts.projectPath,
-        encoding: "utf8",
-        shell: false
-      });
-      if (child.status !== 0) {
-        failedInvocation = child.stderr?.trim() || child.error?.message || `exit ${child.status}`;
-        break;
+    const input = target.file ? "" : target.stdin?.(key, value) ?? value;
+    const invoke = (secretFile) => {
+      for (const args of target.args(key, opts, secretFile)) {
+        const child = spawnSync(target.binary, args, {
+          input,
+          cwd: opts.projectPath,
+          encoding: "utf8",
+          shell: false
+        });
+        if (child.status !== 0) {
+          return child.stderr?.trim() || child.error?.message || `exit ${child.status}`;
+        }
       }
-    }
+      return null;
+    };
+    const failedInvocation = target.file ? withSecretFile(target.file(key, value), invoke) : invoke();
     if (failedInvocation) {
       result.failed.push({ key, error: failedInvocation });
       continue;
@@ -3949,7 +4684,7 @@ function pushSecrets(opts) {
         key,
         env: opts.env,
         source: opts.source ?? "cli",
-        detail: `${opts.canaryKeys?.includes(key) ? "canary honeytoken " : ""}pushed to ${opts.target}${opts.repo ? ` (${opts.repo})` : ""}`
+        detail: `${opts.canaryKeys?.includes(key) ? "canary honeytoken " : ""}pushed to ${opts.target}${destination(opts)}`
       });
     }
   }
@@ -4013,8 +4748,11 @@ ${SYMBOLS.zap} ${c.bold("qring run")} ${c.dim("(dry run)")}`);
     `Push manifest secrets to a deployment platform via its own CLI (${PUSH_TARGETS.join(", ")}) \u2014 values travel over stdin, never argv`
   ).option("-k, --keys <keys>", "Comma-separated keys (default: .q-ring.json manifest)").option("--project-path <path>", "Explicit project path").option("-e, --env <env>", "Environment context for superposition collapse").option("--repo <owner/name>", "GitHub repository (github target)").option(
     "--vercel-env <envs>",
-    "Comma-separated Vercel environments (default: production)"
-  ).option("--dry-run", "Show what would be pushed without pushing").option("--json", "Output as JSON").action((targetArg, cmd) => {
+    "Comma-separated Vercel environments (vercel target; default: production)"
+  ).option("--app <name>", "fly.io app (fly target; default: the app in fly.toml)").option("--service <name>", "Railway service name or ID (railway target; default: linked service)").option(
+    "--railway-env <name>",
+    "Railway environment name or ID (railway target; default: linked environment)"
+  ).option("--site <id>", "Netlify site name or ID (netlify target; default: linked site)").option("--dry-run", "Show what would be pushed without pushing").option("--json", "Output as JSON").action((targetArg, cmd) => {
     if (!PUSH_TARGETS.includes(targetArg)) {
       console.error(
         c.red(`${SYMBOLS.cross} Unknown target "${targetArg}" \u2014 expected one of: ${PUSH_TARGETS.join(", ")}`)
@@ -4029,6 +4767,10 @@ ${SYMBOLS.zap} ${c.bold("qring run")} ${c.dim("(dry run)")}`);
         env: cmd.env,
         repo: cmd.repo,
         vercelEnvs: cmd.vercelEnv?.split(",").map((e) => e.trim()),
+        app: cmd.app,
+        service: cmd.service,
+        railwayEnv: cmd.railwayEnv,
+        site: cmd.site,
         dryRun: cmd.dryRun === true,
         source: "cli"
       });
@@ -4119,71 +4861,80 @@ function pick(charset, length) {
   for (let i = 0; i < length; i++) out += charset[randomInt2(charset.length)];
   return out;
 }
+function dodgingPlaceholders(generate) {
+  return () => {
+    for (let attempt = 0; attempt < 32; attempt++) {
+      const value = generate();
+      if (!isPlaceholderValue(value)) return value;
+    }
+    throw new Error("canary generator kept producing placeholder-like values");
+  };
+}
 var CANARY_FORMATS = {
   aws: {
     name: "aws",
     description: "AWS access key id (AKIA\u2026)",
-    generate: () => `AKIA${pick(UPPER_NUM, 16)}`
+    generate: dodgingPlaceholders(() => `AKIA${pick(UPPER_NUM, 16)}`)
   },
   "aws-secret": {
     name: "aws-secret",
     description: "AWS secret access key (40-char base64)",
-    generate: () => pick(BASE64, 40)
+    generate: dodgingPlaceholders(() => pick(BASE64, 40))
   },
   github: {
     name: "github",
     description: "GitHub classic personal access token (ghp_\u2026)",
-    generate: () => `ghp_${pick(ALNUM, 36)}`
+    generate: dodgingPlaceholders(() => `ghp_${pick(ALNUM, 36)}`)
   },
   "github-pat": {
     name: "github-pat",
     description: "GitHub fine-grained personal access token (github_pat_\u2026)",
-    generate: () => `github_pat_${pick(ALNUM, 22)}_${pick(ALNUM, 59)}`
+    generate: dodgingPlaceholders(() => `github_pat_${pick(ALNUM, 22)}_${pick(ALNUM, 59)}`)
   },
   openai: {
     name: "openai",
     description: "OpenAI API key (sk-\u2026)",
-    generate: () => `sk-${pick(ALNUM, 48)}`
+    generate: dodgingPlaceholders(() => `sk-${pick(ALNUM, 48)}`)
   },
   "openai-project": {
     name: "openai-project",
     description: "OpenAI project API key (sk-proj-\u2026)",
-    generate: () => `sk-proj-${pick(URLSAFE, 74)}T3BlbkFJ${pick(URLSAFE, 74)}`
+    generate: dodgingPlaceholders(() => `sk-proj-${pick(URLSAFE, 74)}T3BlbkFJ${pick(URLSAFE, 74)}`)
   },
   anthropic: {
     name: "anthropic",
     description: "Anthropic API key (sk-ant-api03-\u2026)",
-    generate: () => `sk-ant-api03-${pick(URLSAFE, 91)}AA`
+    generate: dodgingPlaceholders(() => `sk-ant-api03-${pick(URLSAFE, 91)}AA`)
   },
   stripe: {
     name: "stripe",
     description: "Stripe live secret key (sk_live_\u2026)",
-    generate: () => `sk_live_${pick(ALNUM, 24)}`
+    generate: dodgingPlaceholders(() => `sk_live_${pick(ALNUM, 24)}`)
   },
   gitlab: {
     name: "gitlab",
     description: "GitLab personal access token (glpat-\u2026)",
-    generate: () => `glpat-${pick(URLSAFE, 20)}`
+    generate: dodgingPlaceholders(() => `glpat-${pick(URLSAFE, 20)}`)
   },
   slack: {
     name: "slack",
     description: "Slack bot token (xoxb-\u2026)",
-    generate: () => `xoxb-${pick(DIGITS, 12)}-${pick(DIGITS, 13)}-${pick(ALNUM, 24)}`
+    generate: dodgingPlaceholders(() => `xoxb-${pick(DIGITS, 12)}-${pick(DIGITS, 13)}-${pick(ALNUM, 24)}`)
   },
   google: {
     name: "google",
     description: "Google API key (AIza\u2026)",
-    generate: () => `AIza${pick(URLSAFE, 35)}`
+    generate: dodgingPlaceholders(() => `AIza${pick(URLSAFE, 35)}`)
   },
   npm: {
     name: "npm",
     description: "npm access token (npm_\u2026)",
-    generate: () => `npm_${pick(ALNUM, 36)}`
+    generate: dodgingPlaceholders(() => `npm_${pick(ALNUM, 36)}`)
   },
   generic: {
     name: "generic",
     description: "Generic high-entropy API key",
-    generate: () => generateSecret({ format: "api-key", prefix: "qk_", length: 40 })
+    generate: dodgingPlaceholders(() => generateSecret({ format: "api-key", prefix: "qk_", length: 40 }))
   }
 };
 var DEFAULT_CANARY_FORMAT = "generic";
@@ -4924,11 +5675,10 @@ function registerMcpCommands(program2) {
 }
 
 // src/cli/commands/doctor.ts
-import { existsSync as existsSync6, readFileSync as readFileSync8, writeFileSync as writeFileSync6, rmSync } from "fs";
-import { join as join5, delimiter } from "path";
-import { homedir as homedir2 } from "os";
+import { existsSync as existsSync6, readFileSync as readFileSync8, writeFileSync as writeFileSync7, rmSync as rmSync2 } from "fs";
+import { join as join6, delimiter } from "path";
 function auditDir() {
-  return process.env.QRING_AUDIT_DIR ?? join5(homedir2(), ".config", "q-ring");
+  return process.env.QRING_AUDIT_DIR ?? configDir();
 }
 function checkNode() {
   const major = Number(process.versions.node.split(".")[0]);
@@ -4940,8 +5690,8 @@ function checkNode() {
 }
 async function checkKeyringBackend() {
   try {
-    const { Entry } = await import("@napi-rs/keyring");
-    const probe = new Entry("q-ring-doctor-probe", "PROBE");
+    const { Entry: Entry2 } = await import("@napi-rs/keyring");
+    const probe = new Entry2("q-ring-doctor-probe", "PROBE");
     probe.setPassword("ok");
     const read = probe.getPassword();
     probe.deletePassword();
@@ -4968,9 +5718,9 @@ async function checkKeyringBackend() {
 function checkAuditLog() {
   const dir = auditDir();
   try {
-    const probeFile = join5(dir, ".doctor-probe");
-    writeFileSync6(probeFile, "ok");
-    rmSync(probeFile);
+    const probeFile = join6(dir, ".doctor-probe");
+    writeFileSync7(probeFile, "ok");
+    rmSync2(probeFile);
   } catch (err) {
     return {
       name: "audit log",
@@ -4996,7 +5746,7 @@ function checkAuditLog() {
   };
 }
 function checkManifest(projectPath) {
-  const manifestPath = join5(projectPath, ".q-ring.json");
+  const manifestPath = join6(projectPath, ".q-ring.json");
   if (!existsSync6(manifestPath)) {
     return {
       name: "project manifest",
@@ -5054,11 +5804,11 @@ function checkMcpBinary() {
   for (const dir of (process.env.PATH ?? "").split(delimiter)) {
     if (!dir) continue;
     for (const ext of exts) {
-      if (existsSync6(join5(dir, `qring-mcp${ext}`))) {
+      if (existsSync6(join6(dir, `qring-mcp${ext}`))) {
         return {
           name: "qring-mcp binary",
           status: "ok",
-          detail: `found at ${join5(dir, `qring-mcp${ext}`)}`
+          detail: `found at ${join6(dir, `qring-mcp${ext}`)}`
         };
       }
     }
@@ -5242,7 +5992,7 @@ var COMMAND_GROUPS = [
   {
     name: "Project",
     symbol: SYMBOLS.package,
-    commands: ["context", "check", "env", "env:generate", "wizard"]
+    commands: ["context", "check", "env", "env:generate", "promote", "diff", "wizard"]
   },
   {
     name: "Quantum",
@@ -5258,7 +6008,7 @@ var COMMAND_GROUPS = [
   {
     name: "Validation & Rotation",
     symbol: SYMBOLS.shield,
-    commands: ["validate", "rotate", "ci:validate"]
+    commands: ["validate", "rotate", "rotate:due", "ci:validate"]
   },
   {
     name: "Dev Tooling",
@@ -5403,6 +6153,7 @@ function createProgram() {
   program2.createHelp = () => new GroupedHelp();
   registerSecretsCommands(program2);
   registerProjectCommands(program2);
+  registerEnvironmentCommands(program2);
   registerQuantumCommands(program2);
   registerValidationCommands(program2);
   registerToolingCommands(program2);