@i4ctime/q-ring 0.17.6 → 0.18.0

package/dist/mcp.js

@@ -1,5 +1,6 @@
 #!/usr/bin/env node
 import {
+  Entry,
   PACKAGE_VERSION,
   checkDecay,
   checkExecPolicy,
@@ -33,6 +34,7 @@ import {
   registry,
   remember,
   removeHook,
+  rotationStatus,
   setAuditAgentLabel,
   setPolicyRoot,
   setSecret,
@@ -42,7 +44,7 @@ import {
   tunnelList,
   tunnelRead,
   verifyAuditChain
-} from "./chunk-VMDD5QTJ.js";
+} from "./chunk-NTCTVLSK.js";
 
 // src/mcp.ts
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
@@ -59,6 +61,8 @@ var TOOL_ANNOTATIONS = {
   get_secret: READ,
   list_secrets: READ,
   set_secret: hints(false, true, true, false),
+  promote_secret: hints(false, true, true, false),
+  diff_environments: hints(true, false, true, false),
   delete_secret: hints(false, true, true, false),
   has_secret: READ,
   export_secrets: READ,
@@ -327,8 +331,8 @@ function opts(params) {
     source: "mcp"
   };
 }
-function enforceToolPolicy(toolName, projectPath8) {
-  const decision = checkToolPolicy(toolName, projectPath8);
+function enforceToolPolicy(toolName, projectPath9) {
+  const decision = checkToolPolicy(toolName, projectPath9);
   if (!decision.allowed) {
     return text(`Policy Denied: ${decision.reason} (source: ${decision.policySource})`, true);
   }
@@ -475,6 +479,9 @@ function registerSecretTools(server2) {
       rotationPrefix: z2.string().optional().describe(
         "Literal prefix prepended on auto-rotation (only used with rotationFormat 'api-key' or 'token'). Example: 'sk-'."
       ),
+      rotateEveryDays: z2.number().int().min(1).max(3650).optional().describe(
+        "Rotation reminder interval in days (1-3650). `inspect_secret` then reports rotation state ok / due-soon / overdue, and the dashboard and `qring rotate:due` surface it. Purely a reminder \u2014 nothing rotates automatically. Omit to keep the existing interval."
+      ),
       teamId,
       orgId
     },
@@ -498,7 +505,8 @@ function registerSecretTools(server2) {
           description: params.description,
           tags: params.tags,
           rotationFormat: params.rotationFormat,
-          rotationPrefix: params.rotationPrefix
+          rotationPrefix: params.rotationPrefix,
+          rotateEveryDays: params.rotateEveryDays
         });
         return text(`[${params.scope ?? "global"}] ${params.key} set for env:${params.env}`);
       }
@@ -508,7 +516,8 @@ function registerSecretTools(server2) {
         description: params.description,
         tags: params.tags,
         rotationFormat: params.rotationFormat,
-        rotationPrefix: params.rotationPrefix
+        rotationPrefix: params.rotationPrefix,
+        rotateEveryDays: params.rotateEveryDays
       });
       return text(`[${params.scope ?? "global"}] ${params.key} saved`);
     }
@@ -644,7 +653,7 @@ function registerSecretTools(server2) {
     [
       "[secrets] Show full metadata for a single secret \u2014 env states, decay window, entanglement links, access counters \u2014 without ever revealing the value.",
       "Use when you need to understand the shape of a key before reading it or to debug 'why is this expired/stale'; prefer `get_secret` for the actual value, `list_secrets` for a many-key overview, and `audit_log` for the full access timeline.",
-      "Read-only; does not write a 'read' event since the value is not exposed. Returns pretty-printed JSON with fields: key, scope, type ('superposition'|'collapsed'), created, updated, accessCount, lastAccessed, environments, defaultEnv, decay { expired, stale, lifetimePercent, timeRemaining }, entangled, description, tags. Errors with not-found if the key is absent."
+      "Read-only; does not write a 'read' event since the value is not exposed. Returns pretty-printed JSON with fields: key, scope, type ('superposition'|'collapsed'), created, updated, accessCount, lastAccessed, environments, defaultEnv, decay { expired, stale, lifetimePercent, timeRemaining }, rotation { lastRotatedAt, ageDays, rotateEveryDays, dueAt, daysUntilDue, state: 'ok'|'due-soon'|'overdue'|'unscheduled' }, entangled, description, tags. Errors with not-found if the key is absent."
     ].join(" "),
     {
       key: z2.string().describe("Exact secret key name to inspect. Example: 'OPENAI_API_KEY'."),
@@ -682,6 +691,7 @@ function registerSecretTools(server2) {
           timeRemaining: decay.timeRemaining
         };
       }
+      info.rotation = rotationStatus(envelope.meta);
       if (envelope.meta.entangled?.length) {
         info.entangled = envelope.meta.entangled;
       }
@@ -821,6 +831,168 @@ function registerSecretTools(server2) {
   );
 }
 
+// src/mcp/tools/environments.ts
+import { z as z3 } from "zod";
+
+// src/core/promote.ts
+var PromoteConflictError = class extends Error {
+  code = "ERR_PROMOTE_CONFLICT";
+  constructor(key, to) {
+    super(
+      `"${key}" already has a different value for env "${to}" \u2014 pass force to overwrite it`
+    );
+  }
+};
+function assertEnvName(env3, label) {
+  if (!/^[A-Za-z0-9_.-]{1,64}$/.test(env3)) {
+    throw new Error(`${label} environment name "${env3}" is invalid (letters, digits, _ . - only)`);
+  }
+}
+function promoteSecret(key, opts2) {
+  assertEnvName(opts2.from, "source");
+  assertEnvName(opts2.to, "target");
+  if (opts2.from === opts2.to) {
+    throw new Error(`source and target environment are both "${opts2.from}"`);
+  }
+  const found = getEnvelope(key, opts2);
+  if (!found) throw new Error(`Secret "${key}" not found`);
+  const { envelope, scope: scope8 } = found;
+  const states = envelope.states;
+  if (!states) {
+    throw new Error(
+      `"${key}" has a single value, not per-environment states \u2014 set one with: qring set ${key} --env ${opts2.from}`
+    );
+  }
+  const source = states[opts2.from];
+  if (source === void 0) {
+    const available = Object.keys(states).join(", ") || "none";
+    throw new Error(`"${key}" has no value for env "${opts2.from}" (available: ${available})`);
+  }
+  const current = states[opts2.to];
+  const previous = current === void 0 ? "absent" : current === source ? "same" : "different";
+  if (previous === "same") {
+    return { key, scope: scope8, from: opts2.from, to: opts2.to, previous, changed: false };
+  }
+  if (previous === "different" && !opts2.force) {
+    throw new PromoteConflictError(key, opts2.to);
+  }
+  const nextStates = { ...states, [opts2.to]: source };
+  setSecret(key, "", {
+    ...opts2,
+    scope: scope8,
+    states: nextStates,
+    defaultEnv: envelope.defaultEnv
+  });
+  return { key, scope: scope8, from: opts2.from, to: opts2.to, previous, changed: true };
+}
+function diffEnvironments(opts2) {
+  assertEnvName(opts2.a, "first");
+  assertEnvName(opts2.b, "second");
+  const wanted = opts2.keys ? new Set(opts2.keys) : null;
+  const entries = [];
+  for (const entry of listSecrets(opts2)) {
+    if (wanted && !wanted.has(entry.key)) continue;
+    const states = entry.envelope?.states;
+    let status;
+    if (!states) {
+      status = "collapsed";
+    } else {
+      const va = states[opts2.a];
+      const vb = states[opts2.b];
+      if (va === void 0 && vb === void 0) continue;
+      if (va === void 0) status = "only-b";
+      else if (vb === void 0) status = "only-a";
+      else status = va === vb ? "same" : "different";
+    }
+    entries.push({ key: entry.key, scope: entry.scope, status });
+  }
+  const summary = {
+    same: 0,
+    different: 0,
+    "only-a": 0,
+    "only-b": 0,
+    collapsed: 0
+  };
+  for (const e of entries) summary[e.status] += 1;
+  const drift = summary.different + summary["only-a"] + summary["only-b"] > 0;
+  return { a: opts2.a, b: opts2.b, entries, summary, drift };
+}
+
+// src/mcp/tools/environments.ts
+var { teamId: teamId2, orgId: orgId2, scope: scope2, projectPath: projectPath2 } = commonSchemas;
+function registerEnvironmentTools(server2) {
+  server2.tool(
+    "promote_secret",
+    [
+      "[secrets] Copy one secret's value from a source environment to a target environment (superposition states), e.g. staging \u2192 prod, without the value ever leaving the keyring.",
+      "Use when an environment must match another for a single key; use `diff_environments` first to see what differs. Refuses to overwrite a differing target unless `force` is true; a target that already matches is a no-op.",
+      "Mutates the keyring (one 'write' audit event, hooks fire) only when the target changes. Returns { key, scope, from, to, previous: 'absent'|'same'|'different', changed }. Never returns the value."
+    ].join(" "),
+    {
+      key: z3.string().describe("Secret key name. Example: 'DATABASE_URL'."),
+      from: z3.string().describe("Source environment state. Example: 'staging'."),
+      to: z3.string().describe("Target environment state. Example: 'prod'."),
+      force: z3.boolean().default(false).describe("Overwrite a differing target value. Default false \u2192 the call fails with ERR_PROMOTE_CONFLICT instead."),
+      scope: scope2.default("global"),
+      projectPath: projectPath2,
+      teamId: teamId2,
+      orgId: orgId2
+    },
+    toolAnnotations("promote_secret"),
+    async (params) => {
+      const toolBlock = enforceToolPolicy("promote_secret", params.projectPath);
+      if (toolBlock) return toolBlock;
+      try {
+        const result = promoteSecret(params.key, {
+          ...opts(params),
+          from: params.from,
+          to: params.to,
+          force: params.force
+        });
+        return text(JSON.stringify({ ok: true, data: result }, null, 2));
+      } catch (err) {
+        const code = err instanceof PromoteConflictError ? err.code : "ERR_PROMOTE";
+        const message = err instanceof Error ? err.message : String(err);
+        return text(JSON.stringify({ ok: false, code, error: message }), true);
+      }
+    }
+  );
+  server2.tool(
+    "diff_environments",
+    [
+      "[secrets] Compare two environments across the visible secrets and report, per key, whether the values are the same, different, or present on only one side \u2014 statuses only, never values.",
+      "Use before a deploy or promotion to see environment drift; follow up with `promote_secret` per key. A single-value (collapsed) secret applies to every environment and is reported as 'collapsed'.",
+      "Read-only apart from a 'list' audit event. Returns { a, b, entries: [{ key, scope, status }], summary, drift }."
+    ].join(" "),
+    {
+      envA: z3.string().describe("First environment. Example: 'staging'."),
+      envB: z3.string().describe("Second environment. Example: 'prod'."),
+      keys: z3.array(z3.string()).optional().describe("Restrict the comparison to these keys."),
+      scope: scope2.optional(),
+      projectPath: projectPath2,
+      teamId: teamId2,
+      orgId: orgId2
+    },
+    toolAnnotations("diff_environments"),
+    async (params) => {
+      const toolBlock = enforceToolPolicy("diff_environments", params.projectPath);
+      if (toolBlock) return toolBlock;
+      try {
+        const result = diffEnvironments({
+          ...opts(params),
+          a: params.envA,
+          b: params.envB,
+          keys: params.keys
+        });
+        return text(JSON.stringify({ ok: true, data: result }, null, 2));
+      } catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        return text(JSON.stringify({ ok: false, error: message }), true);
+      }
+    }
+  );
+}
+
 // src/core/validate.ts
 function makeRequest(url, headers, timeoutMs = 1e4) {
   return httpRequest({ url, method: "GET", headers, timeoutMs });
@@ -1114,11 +1286,11 @@ async function ciValidateBatch(secrets) {
 
 // src/core/context.ts
 function getProjectContext(opts2 = {}) {
-  const projectPath8 = opts2.projectPath ?? process.cwd();
-  const envResult = collapseEnvironment({ projectPath: projectPath8 });
+  const projectPath9 = opts2.projectPath ?? process.cwd();
+  const envResult = collapseEnvironment({ projectPath: projectPath9 });
   const secretsList = listSecrets({
     ...opts2,
-    projectPath: projectPath8,
+    projectPath: projectPath9,
     silent: true
   });
   let expiredCount = 0;
@@ -1148,7 +1320,7 @@ function getProjectContext(opts2 = {}) {
     };
   });
   let manifest = null;
-  const config = readProjectConfig(projectPath8);
+  const config = readProjectConfig(projectPath9);
   if (config?.secrets) {
     const declaredKeys = Object.keys(config.secrets);
     const existingKeys = new Set(secrets.map((s) => s.key));
@@ -1163,7 +1335,7 @@ function getProjectContext(opts2 = {}) {
     timestamp: e.timestamp
   }));
   return {
-    projectPath: projectPath8,
+    projectPath: projectPath9,
     environment: envResult ? { env: envResult.env, source: envResult.source } : null,
     secrets,
     totalSecrets: secrets.length,
@@ -1179,7 +1351,7 @@ function getProjectContext(opts2 = {}) {
 }
 
 // src/mcp/tools/project.ts
-var { teamId: teamId2, orgId: orgId2, scope: scope2, projectPath: projectPath2, env: env2 } = commonSchemas;
+var { teamId: teamId3, orgId: orgId3, scope: scope3, projectPath: projectPath3, env: env2 } = commonSchemas;
 function registerProjectTools(server2) {
   server2.tool(
     "check_project",
@@ -1189,7 +1361,7 @@ function registerProjectTools(server2) {
       "Read-only; does not mutate the keyring or audit log materially beyond a 'list' read. Returns JSON `{ total, present, missing, expired, stale, ready, secrets: [...] }` where `ready` is true only when nothing is missing or expired. Errors with 'No secrets manifest found in .q-ring.json' if the project has no manifest."
     ].join(" "),
     {
-      projectPath: projectPath2
+      projectPath: projectPath3
     },
     toolAnnotations("check_project"),
     async (params) => {
@@ -1261,7 +1433,7 @@ function registerProjectTools(server2) {
       "Reads values (records 'read' audit events) and collapses superposition for the requested env. Returns the raw `.env` text, with `# MISSING (required): KEY` / `# EXPIRED: KEY` / `# STALE: KEY` warnings appended as comments. Missing keys appear as commented-out `# KEY=` placeholders so the file remains a valid drop-in."
     ].join(" "),
     {
-      projectPath: projectPath2,
+      projectPath: projectPath3,
       env: env2
     },
     toolAnnotations("env_generate"),
@@ -1313,7 +1485,7 @@ ${warnings.map((w) => `# ${w}`).join("\n")}` : output;
       "Read-only; checks the QRING_ENV env var, NODE_ENV, the project's `.q-ring.json`, and the current git branch in priority order. Returns JSON `{ env, source }` (e.g. `{ env: 'dev', source: 'NODE_ENV' }`), or a plain message indicating that no env could be detected."
     ].join(" "),
     {
-      projectPath: projectPath2
+      projectPath: projectPath3
     },
     toolAnnotations("detect_environment"),
     async (params) => {
@@ -1336,10 +1508,10 @@ ${warnings.map((w) => `# ${w}`).join("\n")}` : output;
       "Read-only and value-safe \u2014 no plaintext secret values are ever included. Returns a single pretty-printed JSON document; shape is intentionally broad and may grow over time, so read defensively."
     ].join(" "),
     {
-      scope: scope2,
-      projectPath: projectPath2,
-      teamId: teamId2,
-      orgId: orgId2
+      scope: scope3,
+      projectPath: projectPath3,
+      teamId: teamId3,
+      orgId: orgId3
     },
     toolAnnotations("get_project_context"),
     async (params) => {
@@ -1352,7 +1524,7 @@ ${warnings.map((w) => `# ${w}`).join("\n")}` : output;
 }
 
 // src/mcp/tools/tunnel.ts
-import { z as z3 } from "zod";
+import { z as z4 } from "zod";
 function registerTunnelTools(server2) {
   server2.tool(
     "tunnel_create",
@@ -1362,11 +1534,11 @@ function registerTunnelTools(server2) {
       "Mutates only in-memory state \u2014 the value never touches disk and is lost on server restart. Subject to tool policy. Returns JSON `{ ok, data: { id } }` where `id` is an opaque string to pass to `tunnel_read`/`tunnel_destroy`."
     ].join(" "),
     {
-      value: z3.string().describe("The plaintext value to tunnel. Held only in process memory; never logged."),
-      ttlSeconds: z3.number().optional().describe(
+      value: z4.string().describe("The plaintext value to tunnel. Held only in process memory; never logged."),
+      ttlSeconds: z4.number().optional().describe(
         "Auto-destroy the tunnel after this many seconds. Omit for no time limit (then a `maxReads` is highly recommended)."
       ),
-      maxReads: z3.number().optional().describe(
+      maxReads: z4.number().optional().describe(
         "Self-destruct after this many successful `tunnel_read` calls. Use 1 for true one-shot delivery."
       )
     },
@@ -1389,7 +1561,7 @@ function registerTunnelTools(server2) {
       "Increments the read counter and may auto-destroy the tunnel if `maxReads` was set. Returns JSON `{ ok, data: { id, value } }` on success, or an error 'Tunnel \"...\" not found or expired' if the tunnel has been destroyed, hit its TTL, or never existed."
     ].join(" "),
     {
-      id: z3.string().describe("The opaque tunnel ID returned by `tunnel_create`. Case-sensitive.")
+      id: z4.string().describe("The opaque tunnel ID returned by `tunnel_create`. Case-sensitive.")
     },
     toolAnnotations("tunnel_read"),
     async (params) => {
@@ -1437,7 +1609,7 @@ function registerTunnelTools(server2) {
       "Mutates in-memory state only. Returns 'Destroyed ID' on success or a not-found error if the ID is unknown or already gone."
     ].join(" "),
     {
-      id: z3.string().describe("The opaque tunnel ID to destroy.")
+      id: z4.string().describe("The opaque tunnel ID to destroy.")
     },
     toolAnnotations("tunnel_destroy"),
     async (params) => {
@@ -1453,46 +1625,80 @@ function registerTunnelTools(server2) {
 }
 
 // src/mcp/tools/teleport.ts
-import { z as z5 } from "zod";
+import { z as z6 } from "zod";
 
 // src/core/teleport.ts
 import {
   randomBytes as randomBytes2,
   createCipheriv,
   createDecipheriv,
+  createHash,
+  createPrivateKey,
+  createPublicKey,
+  diffieHellman,
+  generateKeyPairSync,
+  hkdfSync,
   pbkdf2Sync
 } from "crypto";
-import { z as z4 } from "zod";
+import { z as z5 } from "zod";
 var ALGORITHM = "aes-256-gcm";
 var KEY_LENGTH = 32;
 var IV_LENGTH = 12;
 var SALT_LENGTH = 32;
 var PBKDF2_ITERATIONS = 21e4;
 var LEGACY_PBKDF2_ITERATIONS = 1e5;
-var TeleportBundleSchema = z4.object({
-  v: z4.literal(1),
-  data: z4.string(),
-  salt: z4.string(),
-  iv: z4.string(),
-  tag: z4.string(),
-  createdAt: z4.string(),
-  count: z4.number(),
-  iter: z4.number().optional()
+var TeleportBundleSchema = z5.object({
+  v: z5.literal(1),
+  data: z5.string(),
+  salt: z5.string(),
+  iv: z5.string(),
+  tag: z5.string(),
+  createdAt: z5.string(),
+  count: z5.number(),
+  iter: z5.number().optional()
 });
-var TeleportPayloadSchema = z4.object({
-  secrets: z4.array(
-    z4.object({
-      key: z4.string(),
-      value: z4.string(),
-      scope: z4.string().optional()
+var TeleportPayloadSchema = z5.object({
+  secrets: z5.array(
+    z5.object({
+      key: z5.string(),
+      value: z5.string(),
+      scope: z5.string().optional()
     })
   ),
-  exportedAt: z4.string(),
-  exportedBy: z4.string().optional()
+  exportedAt: z5.string(),
+  exportedBy: z5.string().optional()
 });
 function deriveKey(passphrase, salt, iterations = PBKDF2_ITERATIONS) {
   return pbkdf2Sync(passphrase, salt, iterations, KEY_LENGTH, "sha512");
 }
+function decodeBundle(encoded) {
+  let bundleJson;
+  try {
+    bundleJson = Buffer.from(encoded, "base64").toString("utf8");
+  } catch {
+    throw new Error("ERR_TELEPORT_CORRUPT: invalid base64 bundle");
+  }
+  try {
+    return JSON.parse(bundleJson);
+  } catch {
+    throw new Error("ERR_TELEPORT_CORRUPT: bundle is not valid JSON");
+  }
+}
+function parsePayload(decrypted) {
+  let rawPayload;
+  try {
+    rawPayload = JSON.parse(decrypted.toString("utf8"));
+  } catch {
+    throw new Error("ERR_TELEPORT_CORRUPT: decrypted payload is not valid JSON");
+  }
+  const payload = TeleportPayloadSchema.safeParse(rawPayload);
+  if (!payload.success) {
+    throw new Error(
+      `ERR_TELEPORT_CORRUPT: invalid payload (${payload.error.message})`
+    );
+  }
+  return payload.data;
+}
 function teleportPack(secrets, passphrase) {
   const payload = {
     secrets,
@@ -1521,18 +1727,7 @@ function teleportPack(secrets, passphrase) {
   return Buffer.from(JSON.stringify(bundle)).toString("base64");
 }
 function teleportUnpack(encoded, passphrase) {
-  let bundleJson;
-  try {
-    bundleJson = Buffer.from(encoded, "base64").toString("utf8");
-  } catch {
-    throw new Error("ERR_TELEPORT_CORRUPT: invalid base64 bundle");
-  }
-  let rawBundle;
-  try {
-    rawBundle = JSON.parse(bundleJson);
-  } catch {
-    throw new Error("ERR_TELEPORT_CORRUPT: bundle is not valid JSON");
-  }
+  const rawBundle = decodeBundle(encoded);
   const parsedBundle = TeleportBundleSchema.safeParse(rawBundle);
   if (!parsedBundle.success) {
     throw new Error(
@@ -1556,47 +1751,336 @@ function teleportUnpack(encoded, passphrase) {
   } catch {
     throw new Error("ERR_TELEPORT_BAD_PASSPHRASE: decryption failed (wrong passphrase or corrupt data)");
   }
-  let rawPayload;
+  return parsePayload(decrypted);
+}
+var RECIPIENT_PREFIX = "qring1";
+var RECIPIENT_RE = /^qring1([A-Za-z0-9_-]{43})$/;
+var X25519_RAW_LENGTH = 32;
+var V2_AAD = "qring-teleport-v2";
+var V2_WRAP_INFO = "qring-teleport-v2-wrap";
+var TELEPORT_KEYRING_SERVICE = "q-ring-teleport";
+var TELEPORT_KEYRING_ACCOUNT = "identity";
+var TeleportBundleV2Schema = z5.object({
+  v: z5.literal(2),
+  createdAt: z5.string(),
+  count: z5.number(),
+  ephemeral: z5.string(),
+  recipients: z5.array(
+    z5.object({
+      id: z5.string(),
+      wrap: z5.string(),
+      iv: z5.string(),
+      tag: z5.string()
+    })
+  ).min(1),
+  iv: z5.string(),
+  tag: z5.string(),
+  data: z5.string()
+});
+function rawPublicKey(key) {
+  const jwk = key.export({ format: "jwk" });
+  if (jwk.kty !== "OKP" || jwk.crv !== "X25519" || typeof jwk.x !== "string") {
+    throw new Error("ERR_TELEPORT_BAD_RECIPIENT: not an X25519 public key");
+  }
+  const raw = Buffer.from(jwk.x, "base64url");
+  if (raw.length !== X25519_RAW_LENGTH) {
+    throw new Error("ERR_TELEPORT_BAD_RECIPIENT: not an X25519 public key");
+  }
+  return raw;
+}
+function publicKeyFromRaw(raw) {
+  return createPublicKey({
+    key: { kty: "OKP", crv: "X25519", x: raw.toString("base64url") },
+    format: "jwk"
+  });
+}
+function formatRecipient(publicKey) {
+  const raw = Buffer.isBuffer(publicKey) ? publicKey : rawPublicKey(publicKey);
+  if (raw.length !== X25519_RAW_LENGTH) {
+    throw new Error("ERR_TELEPORT_BAD_RECIPIENT: public key must be 32 raw bytes");
+  }
+  return `${RECIPIENT_PREFIX}${raw.toString("base64url")}`;
+}
+function parseRecipient(str) {
+  const trimmed = typeof str === "string" ? str.trim() : "";
+  const match = RECIPIENT_RE.exec(trimmed);
+  if (!match) {
+    throw new Error(
+      `ERR_TELEPORT_BAD_RECIPIENT: expected "${RECIPIENT_PREFIX}" followed by a base64url X25519 public key (run \`qring teleport identity\` on the recipient's machine to get one)`
+    );
+  }
+  const raw = Buffer.from(match[1], "base64url");
+  if (raw.length !== X25519_RAW_LENGTH) {
+    throw new Error(
+      "ERR_TELEPORT_BAD_RECIPIENT: recipient key does not decode to 32 bytes"
+    );
+  }
+  return raw;
+}
+function recipientId(rawPub) {
+  return createHash("sha256").update(rawPub).digest("hex").slice(0, 8);
+}
+function deriveWrapKey(shared, ephemeralPub, recipientPub) {
+  return Buffer.from(
+    hkdfSync(
+      "sha256",
+      shared,
+      Buffer.concat([ephemeralPub, recipientPub]),
+      V2_WRAP_INFO,
+      KEY_LENGTH
+    )
+  );
+}
+function teleportPackFor(secrets, recipients) {
+  const seen = /* @__PURE__ */ new Map();
+  for (const r of recipients) {
+    const raw = parseRecipient(r);
+    seen.set(recipientId(raw), raw);
+  }
+  if (seen.size === 0) {
+    throw new Error("ERR_TELEPORT_NO_RECIPIENTS: at least one recipient is required");
+  }
+  const payload = {
+    secrets,
+    exportedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  const plaintext = JSON.stringify(payload);
+  const cek = randomBytes2(KEY_LENGTH);
+  const iv = randomBytes2(IV_LENGTH);
+  const cipher = createCipheriv(ALGORITHM, cek, iv);
+  cipher.setAAD(Buffer.from(V2_AAD, "utf8"));
+  const encrypted = Buffer.concat([
+    cipher.update(plaintext, "utf8"),
+    cipher.final()
+  ]);
+  const tag = cipher.getAuthTag();
+  const ephemeral = generateKeyPairSync("x25519");
+  const ephemeralPub = rawPublicKey(ephemeral.publicKey);
+  const wrapped = [];
+  for (const [id, recipientPub] of seen) {
+    const shared = diffieHellman({
+      privateKey: ephemeral.privateKey,
+      publicKey: publicKeyFromRaw(recipientPub)
+    });
+    const wrapKey = deriveWrapKey(shared, ephemeralPub, recipientPub);
+    shared.fill(0);
+    const wrapIv = randomBytes2(IV_LENGTH);
+    const wrapCipher = createCipheriv(ALGORITHM, wrapKey, wrapIv);
+    wrapCipher.setAAD(Buffer.from(id, "utf8"));
+    const wrap = Buffer.concat([wrapCipher.update(cek), wrapCipher.final()]);
+    const wrapTag = wrapCipher.getAuthTag();
+    wrapKey.fill(0);
+    wrapped.push({
+      id,
+      wrap: wrap.toString("base64"),
+      iv: wrapIv.toString("base64"),
+      tag: wrapTag.toString("base64")
+    });
+  }
+  cek.fill(0);
+  const bundle = {
+    v: 2,
+    createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+    count: secrets.length,
+    ephemeral: ephemeralPub.toString("base64url"),
+    recipients: wrapped,
+    iv: iv.toString("base64"),
+    tag: tag.toString("base64"),
+    data: encrypted.toString("base64")
+  };
+  return Buffer.from(JSON.stringify(bundle)).toString("base64");
+}
+function toPrivateKey(identity) {
+  if (typeof identity !== "string") return identity;
   try {
-    rawPayload = JSON.parse(decrypted.toString("utf8"));
+    return createPrivateKey(identity);
   } catch {
-    throw new Error("ERR_TELEPORT_CORRUPT: decrypted payload is not valid JSON");
+    throw new Error("ERR_TELEPORT_BAD_IDENTITY: private key is not a valid PEM");
   }
-  const payload = TeleportPayloadSchema.safeParse(rawPayload);
-  if (!payload.success) {
+}
+function teleportUnpackWith(encoded, identity) {
+  const privateKey = toPrivateKey(identity);
+  const rawBundle = decodeBundle(encoded);
+  const parsedBundle = TeleportBundleV2Schema.safeParse(rawBundle);
+  if (!parsedBundle.success) {
     throw new Error(
-      `ERR_TELEPORT_CORRUPT: invalid payload (${payload.error.message})`
+      `ERR_TELEPORT_CORRUPT: invalid bundle shape (${parsedBundle.error.message})`
     );
   }
-  return payload.data;
+  const bundle = parsedBundle.data;
+  const myPub = rawPublicKey(createPublicKey(privateKey));
+  const myId = recipientId(myPub);
+  const mine = bundle.recipients.filter((r) => r.id === myId);
+  if (mine.length === 0) {
+    const ids = bundle.recipients.map((r) => r.id).join(", ");
+    throw new Error(
+      `ERR_TELEPORT_NOT_A_RECIPIENT: bundle is addressed to [${ids}], not to ${myId}`
+    );
+  }
+  const ephemeralPub = Buffer.from(bundle.ephemeral, "base64url");
+  if (ephemeralPub.length !== X25519_RAW_LENGTH) {
+    throw new Error("ERR_TELEPORT_CORRUPT: ephemeral key is not 32 bytes");
+  }
+  let ephemeralKey;
+  try {
+    ephemeralKey = publicKeyFromRaw(ephemeralPub);
+  } catch {
+    throw new Error("ERR_TELEPORT_CORRUPT: ephemeral key is not a valid X25519 point");
+  }
+  const shared = diffieHellman({ privateKey, publicKey: ephemeralKey });
+  const wrapKey = deriveWrapKey(shared, ephemeralPub, myPub);
+  shared.fill(0);
+  let cek = null;
+  for (const entry of mine) {
+    try {
+      const decipher = createDecipheriv(
+        ALGORITHM,
+        wrapKey,
+        Buffer.from(entry.iv, "base64")
+      );
+      decipher.setAAD(Buffer.from(entry.id, "utf8"));
+      decipher.setAuthTag(Buffer.from(entry.tag, "base64"));
+      cek = Buffer.concat([
+        decipher.update(Buffer.from(entry.wrap, "base64")),
+        decipher.final()
+      ]);
+      break;
+    } catch {
+      cek = null;
+    }
+  }
+  wrapKey.fill(0);
+  if (cek === null || cek.length !== KEY_LENGTH) {
+    cek?.fill(0);
+    throw new Error(
+      "ERR_TELEPORT_CORRUPT: could not unwrap content key (tampered bundle or mismatched identity)"
+    );
+  }
+  let decrypted;
+  try {
+    const decipher = createDecipheriv(
+      ALGORITHM,
+      cek,
+      Buffer.from(bundle.iv, "base64")
+    );
+    decipher.setAAD(Buffer.from(V2_AAD, "utf8"));
+    decipher.setAuthTag(Buffer.from(bundle.tag, "base64"));
+    decrypted = Buffer.concat([
+      decipher.update(Buffer.from(bundle.data, "base64")),
+      decipher.final()
+    ]);
+  } catch {
+    throw new Error("ERR_TELEPORT_CORRUPT: payload authentication failed (tampered bundle)");
+  } finally {
+    cek.fill(0);
+  }
+  return parsePayload(decrypted);
+}
+function inspectTeleportBundle(encoded) {
+  const raw = decodeBundle(encoded);
+  const v1 = TeleportBundleSchema.safeParse(raw);
+  if (v1.success) return { v: 1, count: v1.data.count };
+  const v2 = TeleportBundleV2Schema.safeParse(raw);
+  if (v2.success) {
+    return {
+      v: 2,
+      count: v2.data.count,
+      recipients: v2.data.recipients.map((r) => r.id)
+    };
+  }
+  const version = raw !== null && typeof raw === "object" && "v" in raw ? String(raw.v) : "unknown";
+  throw new Error(
+    `ERR_TELEPORT_CORRUPT: unsupported or malformed bundle (v=${version})`
+  );
+}
+function teleportUnpackAuto(encoded, creds) {
+  const info = inspectTeleportBundle(encoded);
+  if (info.v === 1) {
+    if (creds.passphrase === void 0) {
+      throw new Error(
+        "ERR_TELEPORT_PASSPHRASE_REQUIRED: this is a passphrase (v1) bundle"
+      );
+    }
+    return teleportUnpack(encoded, creds.passphrase);
+  }
+  if (creds.identity === void 0) {
+    throw new Error(
+      "ERR_TELEPORT_NO_IDENTITY: this bundle is addressed to recipient keys \u2014 run `qring teleport keygen` to create yours"
+    );
+  }
+  return teleportUnpackWith(encoded, creds.identity);
+}
+function identityFrom(privateKey) {
+  const raw = rawPublicKey(createPublicKey(privateKey));
+  return { privateKey, recipient: formatRecipient(raw), id: recipientId(raw) };
+}
+function loadTeleportIdentity() {
+  const stored = new Entry(
+    TELEPORT_KEYRING_SERVICE,
+    TELEPORT_KEYRING_ACCOUNT
+  ).getPassword();
+  if (!stored) return null;
+  let privateKey;
+  try {
+    privateKey = createPrivateKey({
+      key: Buffer.from(stored, "base64"),
+      format: "der",
+      type: "pkcs8"
+    });
+  } catch {
+    throw new Error(
+      "ERR_TELEPORT_BAD_IDENTITY: stored teleport identity is unreadable \u2014 run `qring teleport keygen --force`"
+    );
+  }
+  return identityFrom(privateKey);
 }
 
 // src/mcp/tools/teleport.ts
-var { teamId: teamId3, orgId: orgId3, scope: scope3, projectPath: projectPath3 } = commonSchemas;
+var { teamId: teamId4, orgId: orgId4, scope: scope4, projectPath: projectPath4 } = commonSchemas;
 function registerTeleportTools(server2) {
   server2.tool(
     "teleport_pack",
     [
       "[teleport] Encrypt one or more secrets into a single AES-256-GCM bundle string that can be safely transferred between machines.",
       "Use to hand off a curated set of credentials to another developer or environment; prefer `export_secrets` for plaintext .env output (single machine, trusted) and `tunnel_create` for ephemeral one-shot delivery on the same machine.",
-      "Reads each secret value (records 'export' audit events) and produces a base64-encoded ciphertext. The bundle is unreadable without the same passphrase via `teleport_unpack`. Returns the bundle string directly. Errors with 'No secrets to pack' if the filter matched zero secrets."
+      "Two modes, exactly one required: `passphrase` (v1, symmetric \u2014 receiver needs the same string) or `recipients` (v2, public-key \u2014 each receiver's `qring1...` string from `qring teleport identity`; no shared secret, only the listed identities can open it).",
+      "Reads each secret value (records 'export' audit events) and produces a base64-encoded ciphertext. Returns the bundle string directly. Errors with 'No secrets to pack' if the filter matched zero secrets."
     ].join(" "),
     {
-      keys: z5.array(z5.string()).optional().describe(
+      keys: z6.array(z6.string()).optional().describe(
         "Whitelist of exact key names to include. Omit to pack every secret in the requested scope."
       ),
-      passphrase: z5.string().describe(
-        "Symmetric passphrase used to derive the AES-256-GCM key. The receiver must supply the same string to `teleport_unpack`. Pick something high-entropy and share it out-of-band."
+      passphrase: z6.string().optional().describe(
+        "Symmetric passphrase used to derive the AES-256-GCM key (v1 bundle). The receiver must supply the same string to `teleport_unpack`. Pick something high-entropy and share it out-of-band. Mutually exclusive with `recipients`."
       ),
-      scope: scope3,
-      projectPath: projectPath3,
-      teamId: teamId3,
-      orgId: orgId3
+      recipients: z6.array(z6.string()).optional().describe(
+        "Recipient public keys (`qring1...` strings, one per teammate) for a v2 recipient pack. The bundle can only be opened by the matching private keys, which each receiver created with `qring teleport keygen`. Mutually exclusive with `passphrase`."
+      ),
+      scope: scope4,
+      projectPath: projectPath4,
+      teamId: teamId4,
+      orgId: orgId4
     },
     toolAnnotations("teleport_pack"),
     async (params) => {
       const toolBlock = enforceToolPolicy("teleport_pack", params.projectPath);
       if (toolBlock) return toolBlock;
+      const recipients = (params.recipients ?? []).flatMap((r) => r.split(",")).map((r) => r.trim()).filter((r) => r.length > 0);
+      const hasPassphrase = typeof params.passphrase === "string" && params.passphrase.length > 0;
+      if (hasPassphrase === recipients.length > 0) {
+        return text(
+          "teleport_pack needs exactly one of `passphrase` (v1) or `recipients` (v2)",
+          true
+        );
+      }
+      for (const r of recipients) {
+        try {
+          parseRecipient(r);
+        } catch (err) {
+          const msg = err instanceof Error ? err.message : String(err);
+          return text(`Bad recipient "${r}": ${msg}`, true);
+        }
+      }
       const o = opts(params);
       const entries = listSecrets(o);
       const secrets = [];
@@ -1608,7 +2092,7 @@ function registerTeleportTools(server2) {
         }
       }
       if (secrets.length === 0) return text("No secrets to pack", true);
-      const bundle = teleportPack(secrets, params.passphrase);
+      const bundle = recipients.length > 0 ? teleportPackFor(secrets, recipients) : teleportPack(secrets, params.passphrase);
       return text(bundle);
     }
   );
@@ -1616,21 +2100,22 @@ function registerTeleportTools(server2) {
     "teleport_unpack",
     [
       "[teleport] Decrypt a bundle produced by `teleport_pack` and import each contained secret into the local keyring.",
-      "Use on the receiving machine after a packer hands you the bundle and passphrase out-of-band; prefer `dryRun=true` first to preview what will be written.",
-      "When dryRun is false this mutates the keyring (one 'write' event per imported secret) at the requested scope. Bad passphrase or tampered bundle returns JSON `{ ok: false, error: { message } }` with `isError: true`. On success returns 'Imported N secret(s) from teleport bundle'; in dryRun mode returns 'Would import N secrets:' followed by a `KEY [scope]` listing."
+      "Use on the receiving machine after a packer hands you the bundle; prefer `dryRun=true` first to preview what will be written.",
+      "Passphrase (v1) bundles need `passphrase`. Recipient (v2) bundles need no input: this machine's teleport identity is read from the OS keyring (create one with `qring teleport keygen`; the private key is never returned).",
+      "When dryRun is false this mutates the keyring (one 'write' event per imported secret) at the requested scope. Bad passphrase, missing identity, not-a-recipient or tampered bundle returns JSON `{ ok: false, error: { message } }` with `isError: true`. On success returns 'Imported N secret(s) from teleport bundle'; in dryRun mode returns 'Would import N secrets:' followed by a `KEY [scope]` listing (v2 also lists the recipient ids the bundle is addressed to)."
     ].join(" "),
     {
-      bundle: z5.string().describe(
+      bundle: z6.string().describe(
         "Base64-encoded ciphertext returned by `teleport_pack`. Pass through whitespace untouched if possible."
       ),
-      passphrase: z5.string().describe(
-        "The same passphrase that was used to pack this bundle. Bad passphrases return an authentication error rather than wrong plaintext."
+      passphrase: z6.string().optional().describe(
+        "The passphrase used to pack a v1 bundle. Omit for v2 recipient bundles (decrypted with this machine's keyring identity). Bad passphrases return an authentication error rather than wrong plaintext."
       ),
-      scope: scope3.default("global"),
-      projectPath: projectPath3,
-      teamId: teamId3,
-      orgId: orgId3,
-      dryRun: z5.boolean().optional().default(false).describe(
+      scope: scope4.default("global"),
+      projectPath: projectPath4,
+      teamId: teamId4,
+      orgId: orgId4,
+      dryRun: z6.boolean().optional().default(false).describe(
         "If true, decrypt and report what would be written but do not mutate the keyring. Useful for verifying bundle contents before commit."
       )
     },
@@ -1639,11 +2124,34 @@ function registerTeleportTools(server2) {
       const toolBlock = enforceToolPolicy("teleport_unpack", params.projectPath);
       if (toolBlock) return toolBlock;
       try {
-        const payload = teleportUnpack(params.bundle, params.passphrase);
+        const info = inspectTeleportBundle(params.bundle);
+        let header = "";
+        let identity = null;
+        if (info.v === 2) {
+          identity = loadTeleportIdentity();
+          if (!identity) {
+            throw new Error(
+              "ERR_TELEPORT_NO_IDENTITY: this bundle is addressed to recipient keys and this machine has no teleport identity \u2014 run `qring teleport keygen` first"
+            );
+          }
+          const ids = info.recipients.map((id) => id === identity.id ? `${id} (you)` : id).join(", ");
+          header = `Addressed to recipient id(s): ${ids}
+`;
+        } else if (params.passphrase === void 0) {
+          throw new Error(
+            "ERR_TELEPORT_PASSPHRASE_REQUIRED: this is a passphrase (v1) bundle \u2014 pass `passphrase`"
+          );
+        }
+        const payload = teleportUnpackAuto(params.bundle, {
+          passphrase: params.passphrase,
+          identity: identity?.privateKey
+        });
         if (params.dryRun) {
           const preview = payload.secrets.map((s) => `${s.key} [${s.scope ?? "global"}]`).join("\n");
-          return text(`Would import ${payload.secrets.length} secrets:
-${preview}`);
+          return text(
+            `${header}Would import ${payload.secrets.length} secrets:
+${preview}`
+          );
         }
         const o = opts(params);
         for (const s of payload.secrets) {
@@ -1659,8 +2167,8 @@ ${preview}`);
 }
 
 // src/mcp/tools/audit.ts
-import { z as z6 } from "zod";
-var { teamId: teamId4, orgId: orgId4, scope: scope4, projectPath: projectPath4 } = commonSchemas;
+import { z as z7 } from "zod";
+var { teamId: teamId5, orgId: orgId5, scope: scope5, projectPath: projectPath5 } = commonSchemas;
 function registerAuditTools(server2) {
   server2.tool(
     "audit_log",
@@ -1670,8 +2178,8 @@ function registerAuditTools(server2) {
       "Read-only. Returns one line per event in chronological order, formatted `timestamp | action | key | [scope] | env:NAME | detail`. Returns 'No audit events found' when the filter matches nothing."
     ].join(" "),
     {
-      key: z6.string().optional().describe("Limit to events touching this exact key. Omit for the full log."),
-      action: z6.enum([
+      key: z7.string().optional().describe("Limit to events touching this exact key. Omit for the full log."),
+      action: z7.enum([
         "read",
         "write",
         "delete",
@@ -1691,10 +2199,10 @@ function registerAuditTools(server2) {
       ]).optional().describe(
         "Limit to a single action verb (e.g. 'read' to see only reads). Omit for all actions."
       ),
-      agent: z6.string().optional().describe(
+      agent: z7.string().optional().describe(
         "Limit to events stamped with this agent label (clientInfo name@version). Omit for all agents."
       ),
-      limit: z6.number().optional().default(20).describe(
+      limit: z7.number().optional().default(20).describe(
         "Maximum events to return, newest first. Defaults to 20. Increase for deeper investigations."
       )
     },
@@ -1728,7 +2236,7 @@ function registerAuditTools(server2) {
       "Read-only; never mutates secrets or the audit log. Returns one line per finding formatted `[type] description`, or 'No anomalies detected' when the log looks clean."
     ].join(" "),
     {
-      key: z6.string().optional().describe(
+      key: z7.string().optional().describe(
         "If provided, narrow the scan to this exact key. Omit to scan across every key in the audit log."
       )
     },
@@ -1750,10 +2258,10 @@ function registerAuditTools(server2) {
       "Read-only \u2014 never writes. Returns a multi-line text summary: header counts (Total / Healthy / Stale / Expired / No decay / Anomalies), then per-secret `EXPIRED:` / `STALE:` issue lines, then per-anomaly `[type] description` lines."
     ].join(" "),
     {
-      scope: scope4,
-      projectPath: projectPath4,
-      teamId: teamId4,
-      orgId: orgId4
+      scope: scope5,
+      projectPath: projectPath5,
+      teamId: teamId5,
+      orgId: orgId5
     },
     toolAnnotations("health_check"),
     async (params) => {
@@ -1821,13 +2329,13 @@ function registerAuditTools(server2) {
       "Read-only. Returns the rendered text directly (no JSON wrapper). 'jsonl' is one event per line; 'json' is a single array; 'csv' is a header row plus events. Time filters are applied to the event timestamps before formatting."
     ].join(" "),
     {
-      since: z6.string().optional().describe(
+      since: z7.string().optional().describe(
         "Inclusive lower bound on event timestamp, ISO 8601. Example: '2026-04-01T00:00:00Z'. Omit for no lower bound."
       ),
-      until: z6.string().optional().describe(
+      until: z7.string().optional().describe(
         "Inclusive upper bound on event timestamp, ISO 8601. Omit for now/no upper bound."
       ),
-      format: z6.enum(["jsonl", "json", "csv"]).optional().default("jsonl").describe(
+      format: z7.enum(["jsonl", "json", "csv"]).optional().default("jsonl").describe(
         "Output format. 'jsonl' (default) is most stream-friendly; 'json' is a single array; 'csv' is spreadsheet-friendly."
       )
     },
@@ -1848,8 +2356,8 @@ function registerAuditTools(server2) {
 }
 
 // src/mcp/tools/validation.ts
-import { z as z7 } from "zod";
-var { teamId: teamId5, orgId: orgId5, scope: scope5, projectPath: projectPath5 } = commonSchemas;
+import { z as z8 } from "zod";
+var { teamId: teamId6, orgId: orgId6, scope: scope6, projectPath: projectPath6 } = commonSchemas;
 function registerValidationTools(server2) {
   server2.tool(
     "validate_secret",
@@ -1859,16 +2367,16 @@ function registerValidationTools(server2) {
       "Side effects: makes one outbound network request per call (may incur tiny provider-side rate-limit cost). Records 'read' for the underlying secret value in the audit log; the value itself is never logged. Returns JSON `{ valid, provider, status?, message?, rateLimit?, ... }` (provider-specific shape)."
     ].join(" "),
     {
-      key: z7.string().describe(
+      key: z8.string().describe(
         "The exact key whose value should be tested upstream. Example: 'OPENAI_API_KEY'."
       ),
-      provider: z7.string().optional().describe(
+      provider: z8.string().optional().describe(
         "Force a specific provider id. Built-ins include 'openai', 'stripe', 'github', 'aws', 'http'. Omit to auto-detect from the value's prefix or the secret's stored provider hint."
       ),
-      scope: scope5,
-      projectPath: projectPath5,
-      teamId: teamId5,
-      orgId: orgId5
+      scope: scope6,
+      projectPath: projectPath6,
+      teamId: teamId6,
+      orgId: orgId6
     },
     toolAnnotations("validate_secret"),
     async (params) => {
@@ -1910,14 +2418,14 @@ function registerValidationTools(server2) {
       "Mutates the keyring with the newly-issued value if rotation succeeds (one 'write' audit event), and makes outbound network requests against the provider's rotation API. Returns JSON `{ rotated, newValue?, message?, ... }`. If `rotated` is false, the existing value is left untouched."
     ].join(" "),
     {
-      key: z7.string().describe("Exact key to rotate. Must already exist in the keyring."),
-      provider: z7.string().optional().describe(
+      key: z8.string().describe("Exact key to rotate. Must already exist in the keyring."),
+      provider: z8.string().optional().describe(
         "Force a specific provider id (see `list_providers`). Omit to auto-detect from the current value or the secret's stored provider hint."
       ),
-      scope: scope5,
-      projectPath: projectPath5,
-      teamId: teamId5,
-      orgId: orgId5
+      scope: scope6,
+      projectPath: projectPath6,
+      teamId: teamId6,
+      orgId: orgId6
     },
     toolAnnotations("rotate_secret"),
     async (params) => {
@@ -1944,10 +2452,10 @@ function registerValidationTools(server2) {
       "Side effects: one outbound request per validatable secret (cost scales with N). Reads each secret value (records 'read' audit events). Returns JSON `{ total, valid, invalid, results: [...] }` listing per-key status, provider, and error messages where applicable. Returns 'No secrets to validate' if nothing in scope has a provider mapping."
     ].join(" "),
     {
-      scope: scope5,
-      projectPath: projectPath5,
-      teamId: teamId5,
-      orgId: orgId5
+      scope: scope6,
+      projectPath: projectPath6,
+      teamId: teamId6,
+      orgId: orgId6
     },
     toolAnnotations("ci_validate_secrets"),
     async (params) => {
@@ -1976,7 +2484,7 @@ function registerValidationTools(server2) {
 }
 
 // src/mcp/tools/hooks.ts
-import { z as z8 } from "zod";
+import { z as z9 } from "zod";
 function registerHookTools(server2) {
   server2.tool(
     "register_hook",
@@ -1986,33 +2494,33 @@ function registerHookTools(server2) {
       "Mutates the hook registry on disk. At least one match criterion (`key`, `keyPattern`, or `tag`) is required \u2014 calls without any return an error. Returns JSON of the registered hook entry including its assigned `id` (use that `id` with `remove_hook`)."
     ].join(" "),
     {
-      type: z8.enum(["shell", "http", "signal"]).describe(
+      type: z9.enum(["shell", "http", "signal"]).describe(
         "Hook delivery mechanism. 'shell' runs a local command, 'http' POSTs JSON to a URL, 'signal' sends an OS signal to a named process."
       ),
-      key: z8.string().optional().describe(
+      key: z9.string().optional().describe(
         "Trigger only on this exact key name. Pick at most one of `key` / `keyPattern` / `tag` (or combine for stricter matching)."
       ),
-      keyPattern: z8.string().optional().describe("Trigger on any key matching this glob pattern. Examples: 'DB_*', 'STRIPE_*'."),
-      tag: z8.string().optional().describe(
+      keyPattern: z9.string().optional().describe("Trigger on any key matching this glob pattern. Examples: 'DB_*', 'STRIPE_*'."),
+      tag: z9.string().optional().describe(
         "Trigger on any secret carrying this exact tag. Combinable with key/keyPattern as an AND filter."
       ),
-      scope: z8.enum(["global", "project"]).optional().describe(
+      scope: z9.enum(["global", "project"]).optional().describe(
         "Restrict the hook to secrets in this scope. Omit to fire across both global and project secrets."
       ),
-      actions: z8.array(z8.enum(["write", "delete", "rotate"])).optional().default(["write", "delete", "rotate"]).describe("Which lifecycle actions trigger this hook. Defaults to all three."),
-      command: z8.string().optional().describe(
+      actions: z9.array(z9.enum(["write", "delete", "rotate"])).optional().default(["write", "delete", "rotate"]).describe("Which lifecycle actions trigger this hook. Defaults to all three."),
+      command: z9.string().optional().describe(
         "Required when type='shell'. The literal shell command to run; q-ring exposes the matching key as $QRING_HOOK_KEY and action as $QRING_HOOK_ACTION."
       ),
-      url: z8.string().optional().describe(
+      url: z9.string().optional().describe(
         "Required when type='http'. Full URL to POST a JSON body `{ id, key, scope, action, timestamp }` to (the value itself is never sent)."
       ),
-      signalTarget: z8.string().optional().describe(
+      signalTarget: z9.string().optional().describe(
         "Required when type='signal'. Either a numeric PID or a process name resolvable via `ps`."
       ),
-      signalName: z8.string().optional().default("SIGHUP").describe(
+      signalName: z9.string().optional().default("SIGHUP").describe(
         "Signal name to send (e.g. 'SIGHUP', 'SIGUSR1'). Defaults to SIGHUP, which most daemons treat as 'reload config'."
       ),
-      description: z8.string().optional().describe(
+      description: z9.string().optional().describe(
         "Free-text human-readable description, surfaced by `list_hooks` and the dashboard."
       )
     },
@@ -2066,7 +2574,7 @@ function registerHookTools(server2) {
       "Mutates the hook registry only \u2014 does not touch secret values, audit log, or env states. Idempotent in spirit: removing an already-absent id returns a not-found error rather than partial work. Returns 'Removed hook ID' on success."
     ].join(" "),
     {
-      id: z8.string().describe(
+      id: z9.string().describe(
         "Hook id returned by `register_hook` or visible in `list_hooks` (opaque string)."
       )
     },
@@ -2084,7 +2592,7 @@ function registerHookTools(server2) {
 }
 
 // src/mcp/tools/tooling.ts
-import { z as z9 } from "zod";
+import { z as z10 } from "zod";
 
 // src/utils/colors.ts
 var enabled = process.stdout.isTTY !== false && !process.env.NO_COLOR;
@@ -2270,9 +2778,9 @@ var RedactionTransform = class extends Transform {
     callback();
   }
 };
-function enforceExecPolicy(profile, command, args, projectPath8) {
+function enforceExecPolicy(profile, command, args, projectPath9) {
   const fullCommand = [command, ...args].join(" ");
-  const policyDecision = checkExecPolicy(fullCommand, projectPath8);
+  const policyDecision = checkExecPolicy(fullCommand, projectPath9);
   if (!policyDecision.allowed) {
     throw new Error(`Policy Denied: ${policyDecision.reason}`);
   }
@@ -2647,7 +3155,7 @@ function lintFiles(files, opts2 = {}) {
 }
 
 // src/mcp/tools/tooling.ts
-var { teamId: teamId6, orgId: orgId6, scope: scope6, projectPath: projectPath6 } = commonSchemas;
+var { teamId: teamId7, orgId: orgId7, scope: scope7, projectPath: projectPath7 } = commonSchemas;
 function registerToolingTools(server2) {
   server2.tool(
     "exec_with_secrets",
@@ -2657,25 +3165,25 @@ function registerToolingTools(server2) {
       "Spawns a real child process \u2014 has whatever side effects the command itself causes (writes, network, exec). Subject to BOTH tool policy and exec policy (allowlist/denylist). Returns a text body with `Exit code: N` then `STDOUT:` and `STDERR:` blocks; both streams are scrubbed against the secret values that were injected."
     ].join(" "),
     {
-      command: z9.string().describe(
+      command: z10.string().describe(
         "Executable name or full command to run. Example: 'pnpm', 'node', '/usr/bin/env'. Must be allowed by exec policy."
       ),
-      args: z9.array(z9.string()).optional().describe(
+      args: z10.array(z10.string()).optional().describe(
         "Positional arguments passed to `command`. Example: ['run', 'db:migrate']. Each element is passed verbatim with no extra shell parsing."
       ),
-      keys: z9.array(z9.string()).optional().describe(
+      keys: z10.array(z10.string()).optional().describe(
         "Whitelist of exact key names to inject. Omit to inject every secret in scope (subject to `tags`)."
       ),
-      tags: z9.array(z9.string()).optional().describe(
+      tags: z10.array(z10.string()).optional().describe(
         "Inject only secrets carrying at least one of these tags. Combinable with `keys` as an AND filter."
       ),
-      profile: z9.enum(["unrestricted", "restricted", "ci"]).optional().default("restricted").describe(
+      profile: z10.enum(["unrestricted", "restricted", "ci"]).optional().default("restricted").describe(
         "Exec sandbox profile. 'restricted' (default) denies network-tool binaries (curl, wget, ssh, scp, nc, netcat, ncat) AND common interpreters/shells (python, node, deno, bun, perl, ruby, php, sh, bash, zsh) \u2014 since those could otherwise egress the injected secrets \u2014 strips proxy env vars, and caps runtime at 30s. It still is NOT a real OS sandbox (it does not restrict PATH, and some allowed binary could in principle make network calls); for genuinely untrusted commands use OS-level isolation (containers, network namespaces). 'ci' allows network and interpreters with a 300s cap and blocks a few destructive commands; 'unrestricted' inherits the full server environment. Define a custom profile in .q-ring.json to allow specific interpreters with secrets."
       ),
-      scope: scope6,
-      projectPath: projectPath6,
-      teamId: teamId6,
-      orgId: orgId6
+      scope: scope7,
+      projectPath: projectPath7,
+      teamId: teamId7,
+      orgId: orgId7
     },
     toolAnnotations("exec_with_secrets"),
     async (params) => {
@@ -2717,7 +3225,7 @@ ${result.stderr}`);
       "Read-only \u2014 never modifies source files. Honors `.gitignore`. Returns JSON array of `{ file, line, key, value, kind }` findings, or 'No hardcoded secrets found in the specified directory.' when clean. False positives are possible \u2014 review before treating as ground truth."
     ].join(" "),
     {
-      dirPath: z9.string().describe(
+      dirPath: z10.string().describe(
         "Directory to scan, absolute or relative to the server cwd. The scan recurses into subdirectories."
       )
     },
@@ -2744,14 +3252,14 @@ ${result.stderr}`);
       "With `fix: false` this is read-only. With `fix: true` this MUTATES the listed source files in place (review with git diff!) and writes one new secret per finding to the keyring. Returns a JSON array of `{ file, line, key, value, kind }` findings, or 'No hardcoded secrets found in the specified files.'."
     ].join(" "),
     {
-      files: z9.array(z9.string()).describe("Absolute or relative paths to lint. Non-existent paths surface as scan errors."),
-      fix: z9.boolean().optional().default(false).describe(
+      files: z10.array(z10.string()).describe("Absolute or relative paths to lint. Non-existent paths surface as scan errors."),
+      fix: z10.boolean().optional().default(false).describe(
         "If true, rewrite the source files to read `process.env.KEY` and store the extracted value in the keyring. If false (default), only report findings."
       ),
-      scope: scope6,
-      projectPath: projectPath6,
-      teamId: teamId6,
-      orgId: orgId6
+      scope: scope7,
+      projectPath: projectPath7,
+      teamId: teamId7,
+      orgId: orgId7
     },
     toolAnnotations("lint_files"),
     async (params) => {
@@ -2780,10 +3288,10 @@ ${result.stderr}`);
       "Read-only; uses the most recent ~500 audit events. Returns JSON `{ total, expired, stale, neverAccessed: [...], noRotationFormat: [...], mostAccessed: [{ key, reads }] }`. `neverAccessed` and `noRotationFormat` are good candidates for cleanup or for adding rotation hints."
     ].join(" "),
     {
-      scope: scope6,
-      projectPath: projectPath6,
-      teamId: teamId6,
-      orgId: orgId6
+      scope: scope7,
+      projectPath: projectPath7,
+      teamId: teamId7,
+      orgId: orgId7
     },
     toolAnnotations("analyze_secrets"),
     async (params) => {
@@ -2818,7 +3326,7 @@ ${result.stderr}`);
       "Side effect: binds an HTTP server on the requested port (one process-wide instance \u2014 re-running returns the existing URL instead of starting a second server). Never exposes secret values. Returns the URL string to open in a browser."
     ].join(" "),
     {
-      port: z9.number().optional().default(9876).describe(
+      port: z10.number().optional().default(9876).describe(
         "TCP port to listen on (default 9876). Pick another port if 9876 is already in use; the call fails if binding errors."
       )
     },
@@ -2829,7 +3337,7 @@ ${result.stderr}`);
       if (dashboardInstance) {
         return text(`Dashboard already running at ${dashboardInstance.url}`);
       }
-      const { startDashboardServer } = await import("./dashboard-K7LYTWSL.js");
+      const { startDashboardServer } = await import("./dashboard-OEHI6OOD.js");
       dashboardInstance = startDashboardServer({ port: params.port });
       return text(
         `Dashboard started at ${dashboardInstance.url}
@@ -2845,10 +3353,10 @@ Open this URL in a browser to see live quantum status. The token is required for
       "With `autoRotate=false` (default) this is read-only. With `autoRotate=true` it OVERWRITES expired secret values in the keyring with generated replacements \u2014 credential changes that may break upstream integrations until they are propagated. Subject to tool policy. Returns a JSON report of per-project findings and any rotations performed."
     ].join(" "),
     {
-      autoRotate: z9.boolean().optional().default(false).describe(
+      autoRotate: z10.boolean().optional().default(false).describe(
         "If true, replace expired secrets with newly generated values (using each secret's `rotationFormat`/`rotationPrefix`). Only enable when intentional rotation is desired \u2014 this is destructive on the upstream side."
       ),
-      projectPaths: z9.array(z9.string()).optional().describe(
+      projectPaths: z10.array(z10.string()).optional().describe(
         "List of absolute project roots to scan. Defaults to `[server.cwd]` when omitted."
       )
     },
@@ -2866,7 +3374,7 @@ Open this URL in a browser to see live quantum status. The token is required for
 }
 
 // src/mcp/tools/agent.ts
-import { z as z10 } from "zod";
+import { z as z11 } from "zod";
 function registerAgentTools(server2) {
   server2.tool(
     "agent_remember",
@@ -2876,10 +3384,10 @@ function registerAgentTools(server2) {
       `Mutates the encrypted memory store. Idempotent: rewriting the same key with a new value simply overwrites. Returns 'Remembered "KEY"' on success.`
     ].join(" "),
     {
-      key: z10.string().describe(
+      key: z11.string().describe(
         "Memory key (free-form string). Convention: lowercase dotted namespaces, e.g. 'project.lastDeploy'."
       ),
-      value: z10.string().describe(
+      value: z11.string().describe(
         "Plain-string value to store. JSON-stringify structured data on the caller side if needed."
       )
     },
@@ -2899,7 +3407,7 @@ function registerAgentTools(server2) {
       "Read-only. With a `key` argument: returns JSON `{ ok, data: { key, value } }` or a not-found error. Without `key`: returns a JSON listing of every stored key (no values), or 'Agent memory is empty'."
     ].join(" "),
     {
-      key: z10.string().optional().describe("Memory key to read. Omit to list every stored key (without values).")
+      key: z11.string().optional().describe("Memory key to read. Omit to list every stored key (without values).")
     },
     toolAnnotations("agent_recall"),
     async (params) => {
@@ -2923,7 +3431,7 @@ function registerAgentTools(server2) {
       `Destructive: there is no recycle bin. Returns 'Forgot "KEY"' on success or a not-found error if the key was already absent.`
     ].join(" "),
     {
-      key: z10.string().describe("Memory key to delete.")
+      key: z11.string().describe("Memory key to delete.")
     },
     toolAnnotations("agent_forget"),
     async (params) => {
@@ -2939,8 +3447,8 @@ function registerAgentTools(server2) {
 }
 
 // src/mcp/tools/policy.ts
-import { z as z11 } from "zod";
-var { projectPath: projectPath7 } = commonSchemas;
+import { z as z12 } from "zod";
+var { projectPath: projectPath8 } = commonSchemas;
 function registerPolicyTools(server2) {
   server2.tool(
     "check_policy",
@@ -2950,15 +3458,15 @@ function registerPolicyTools(server2) {
       "Read-only. Returns JSON `{ allowed, reason?, policySource }` describing the decision. Returns an error 'Missing required parameter for the selected action type' if the matching argument for the chosen `action` is not supplied."
     ].join(" "),
     {
-      action: z11.enum(["tool", "key_read", "exec"]).describe(
+      action: z12.enum(["tool", "key_read", "exec"]).describe(
         "Which policy surface to query. 'tool' = MCP tool gate (needs `toolName`); 'key_read' = secret read gate (needs `key`); 'exec' = exec_with_secrets command gate (needs `command`)."
       ),
-      toolName: z11.string().optional().describe("Tool id to evaluate, e.g. 'rotate_secret'. Required when `action` is 'tool'."),
-      key: z11.string().optional().describe("Secret key name to evaluate. Required when `action` is 'key_read'."),
-      command: z11.string().optional().describe(
+      toolName: z12.string().optional().describe("Tool id to evaluate, e.g. 'rotate_secret'. Required when `action` is 'tool'."),
+      key: z12.string().optional().describe("Secret key name to evaluate. Required when `action` is 'key_read'."),
+      command: z12.string().optional().describe(
         "Command to evaluate against the exec allowlist/denylist. Required when `action` is 'exec'."
       ),
-      projectPath: projectPath7
+      projectPath: projectPath8
     },
     toolAnnotations("check_policy"),
     async (params) => {
@@ -2985,7 +3493,7 @@ function registerPolicyTools(server2) {
       "Read-only. Returns pretty-printed JSON; missing policy file returns an empty/default summary rather than an error so callers can branch on the counts."
     ].join(" "),
     {
-      projectPath: projectPath7
+      projectPath: projectPath8
     },
     toolAnnotations("get_policy_summary"),
     async (params) => {
@@ -3062,6 +3570,7 @@ function registerMcpResources(server2) {
 function registerMcpTools(server2) {
   registerMcpResources(server2);
   registerSecretTools(server2);
+  registerEnvironmentTools(server2);
   registerProjectTools(server2);
   registerTunnelTools(server2);
   registerTeleportTools(server2);