@i4ctime/q-ring 0.4.0 → 0.9.2

package/dist/{chunk-IGNU622R.js → chunk-5JBU7TWN.js}

@@ -23,7 +23,9 @@ function createEnvelope(value, opts) {
       accessCount: 0,
       rotationFormat: opts?.rotationFormat,
       rotationPrefix: opts?.rotationPrefix,
-      provider: opts?.provider
+      provider: opts?.provider,
+      requiresApproval: opts?.requiresApproval,
+      jitProvider: opts?.jitProvider
     }
   };
 }
@@ -204,9 +206,10 @@ function mapEnvName(raw) {
 }
 
 // src/core/observer.ts
-import { existsSync as existsSync2, mkdirSync, appendFileSync, readFileSync as readFileSync2 } from "fs";
+import { existsSync as existsSync2, mkdirSync, appendFileSync, readFileSync as readFileSync2, openSync, fstatSync, readSync, closeSync } from "fs";
 import { join as join2 } from "path";
 import { homedir } from "os";
+import { createHash } from "crypto";
 function getAuditDir() {
   const dir = join2(homedir(), ".config", "q-ring");
   if (!existsSync2(dir)) {
@@ -217,11 +220,36 @@ function getAuditDir() {
 function getAuditPath() {
   return join2(getAuditDir(), "audit.jsonl");
 }
+function getLastLineHash() {
+  const path = getAuditPath();
+  if (!existsSync2(path)) return void 0;
+  try {
+    const fd = openSync(path, "r");
+    const stat = fstatSync(fd);
+    if (stat.size === 0) {
+      closeSync(fd);
+      return void 0;
+    }
+    const tailSize = Math.min(stat.size, 8192);
+    const buf = Buffer.alloc(tailSize);
+    readSync(fd, buf, 0, tailSize, stat.size - tailSize);
+    closeSync(fd);
+    const tail = buf.toString("utf8");
+    const lines = tail.split("\n").filter((l) => l.trim());
+    if (lines.length === 0) return void 0;
+    const lastLine = lines[lines.length - 1];
+    return createHash("sha256").update(lastLine).digest("hex");
+  } catch {
+    return void 0;
+  }
+}
 function logAudit(event) {
+  const prevHash = getLastLineHash();
   const full = {
     ...event,
     timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-    pid: process.pid
+    pid: process.pid,
+    prevHash
   };
   try {
     appendFileSync(getAuditPath(), JSON.stringify(full) + "\n");
@@ -240,35 +268,99 @@ function queryAudit(query = {}) {
         return null;
       }
     }).filter((e) => e !== null);
-    if (query.key) {
-      events = events.filter((e) => e.key === query.key);
-    }
-    if (query.action) {
-      events = events.filter((e) => e.action === query.action);
-    }
+    if (query.key) events = events.filter((e) => e.key === query.key);
+    if (query.action) events = events.filter((e) => e.action === query.action);
+    if (query.source) events = events.filter((e) => e.source === query.source);
+    if (query.correlationId) events = events.filter((e) => e.correlationId === query.correlationId);
     if (query.since) {
       const since = new Date(query.since).getTime();
-      events = events.filter(
-        (e) => new Date(e.timestamp).getTime() >= since
-      );
+      events = events.filter((e) => new Date(e.timestamp).getTime() >= since);
     }
     events.sort(
       (a, b) => new Date(b.timestamp).getTime() - new Date(a.timestamp).getTime()
     );
-    if (query.limit) {
-      events = events.slice(0, query.limit);
-    }
+    if (query.limit) events = events.slice(0, query.limit);
     return events;
   } catch {
     return [];
   }
 }
+function verifyAuditChain() {
+  const path = getAuditPath();
+  if (!existsSync2(path)) {
+    return { totalEvents: 0, validEvents: 0, intact: true };
+  }
+  const lines = readFileSync2(path, "utf8").split("\n").filter((l) => l.trim());
+  if (lines.length === 0) {
+    return { totalEvents: 0, validEvents: 0, intact: true };
+  }
+  let validEvents = 0;
+  for (let i = 0; i < lines.length; i++) {
+    let event;
+    try {
+      event = JSON.parse(lines[i]);
+    } catch {
+      return {
+        totalEvents: lines.length,
+        validEvents,
+        brokenAt: i,
+        intact: false
+      };
+    }
+    if (i === 0) {
+      validEvents++;
+      continue;
+    }
+    const expectedHash = createHash("sha256").update(lines[i - 1]).digest("hex");
+    if (event.prevHash !== expectedHash) {
+      return {
+        totalEvents: lines.length,
+        validEvents,
+        brokenAt: i,
+        brokenEvent: event,
+        intact: false
+      };
+    }
+    validEvents++;
+  }
+  return { totalEvents: lines.length, validEvents, intact: true };
+}
+function exportAudit(opts = {}) {
+  const path = getAuditPath();
+  if (!existsSync2(path)) return opts.format === "json" ? "[]" : "";
+  const lines = readFileSync2(path, "utf8").split("\n").filter((l) => l.trim());
+  let events = lines.map((l) => {
+    try {
+      return JSON.parse(l);
+    } catch {
+      return null;
+    }
+  }).filter((e) => e !== null);
+  if (opts.since) {
+    const since = new Date(opts.since).getTime();
+    events = events.filter((e) => new Date(e.timestamp).getTime() >= since);
+  }
+  if (opts.until) {
+    const until = new Date(opts.until).getTime();
+    events = events.filter((e) => new Date(e.timestamp).getTime() <= until);
+  }
+  if (opts.format === "json") {
+    return JSON.stringify(events, null, 2);
+  }
+  if (opts.format === "csv") {
+    const header = "timestamp,action,key,scope,env,source,pid,correlationId,detail";
+    const rows = events.map(
+      (e) => `${e.timestamp},${e.action},${e.key ?? ""},${e.scope ?? ""},${e.env ?? ""},${e.source},${e.pid},${e.correlationId ?? ""},${(e.detail ?? "").replace(/,/g, ";")}`
+    );
+    return [header, ...rows].join("\n");
+  }
+  return events.map((e) => JSON.stringify(e)).join("\n");
+}
 function detectAnomalies(key) {
   const recent = queryAudit({
     key,
     action: "read",
     since: new Date(Date.now() - 36e5).toISOString()
-    // last hour
   });
   const anomalies = [];
   if (key && recent.length > 50) {
@@ -289,11 +381,19 @@ function detectAnomalies(key) {
       events: nightAccess
     });
   }
+  const verification = verifyAuditChain();
+  if (!verification.intact) {
+    anomalies.push({
+      type: "tampered",
+      description: `Audit chain broken at event #${verification.brokenAt}`,
+      events: verification.brokenEvent ? [verification.brokenEvent] : []
+    });
+  }
   return anomalies;
 }
 
 // src/core/entanglement.ts
-import { existsSync as existsSync3, readFileSync as readFileSync3, writeFileSync, mkdirSync as mkdirSync2 } from "fs";
+import { existsSync as existsSync3, readFileSync as readFileSync3, writeFileSync as writeFileSync2, mkdirSync as mkdirSync2 } from "fs";
 import { join as join3 } from "path";
 import { homedir as homedir2 } from "os";
 function getRegistryPath() {
@@ -314,38 +414,38 @@ function loadRegistry() {
     return { pairs: [] };
   }
 }
-function saveRegistry(registry) {
-  writeFileSync(getRegistryPath(), JSON.stringify(registry, null, 2));
+function saveRegistry(registry2) {
+  writeFileSync2(getRegistryPath(), JSON.stringify(registry2, null, 2));
 }
 function entangle(source, target) {
-  const registry = loadRegistry();
-  const exists = registry.pairs.some(
+  const registry2 = loadRegistry();
+  const exists = registry2.pairs.some(
     (p) => p.source.service === source.service && p.source.key === source.key && p.target.service === target.service && p.target.key === target.key
   );
   if (!exists) {
-    registry.pairs.push({
+    registry2.pairs.push({
       source,
       target,
       createdAt: (/* @__PURE__ */ new Date()).toISOString()
     });
-    registry.pairs.push({
+    registry2.pairs.push({
       source: target,
       target: source,
       createdAt: (/* @__PURE__ */ new Date()).toISOString()
     });
-    saveRegistry(registry);
+    saveRegistry(registry2);
   }
 }
 function disentangle(source, target) {
-  const registry = loadRegistry();
-  registry.pairs = registry.pairs.filter(
+  const registry2 = loadRegistry();
+  registry2.pairs = registry2.pairs.filter(
     (p) => !(p.source.service === source.service && p.source.key === source.key && p.target.service === target.service && p.target.key === target.key || p.source.service === target.service && p.source.key === target.key && p.target.service === source.service && p.target.key === source.key)
   );
-  saveRegistry(registry);
+  saveRegistry(registry2);
 }
 function findEntangled(source) {
-  const registry = loadRegistry();
-  return registry.pairs.filter(
+  const registry2 = loadRegistry();
+  return registry2.pairs.filter(
     (p) => p.source.service === source.service && p.source.key === source.key
   ).map((p) => p.target);
 }
@@ -357,9 +457,9 @@ function listEntanglements() {
 import { Entry, findCredentials } from "@napi-rs/keyring";
 
 // src/utils/hash.ts
-import { createHash } from "crypto";
+import { createHash as createHash2 } from "crypto";
 function hashProjectPath(projectPath) {
-  return createHash("sha256").update(projectPath).digest("hex").slice(0, 12);
+  return createHash2("sha256").update(projectPath).digest("hex").slice(0, 12);
 }
 
 // src/core/scope.ts
@@ -371,36 +471,133 @@ function projectService(projectPath) {
   const hash = hashProjectPath(projectPath);
   return `${SERVICE_PREFIX}:project:${hash}`;
 }
+function teamService(teamId) {
+  return `${SERVICE_PREFIX}:team:${teamId}`;
+}
+function orgService(orgId) {
+  return `${SERVICE_PREFIX}:org:${orgId}`;
+}
 function resolveScope(opts) {
-  const { scope, projectPath } = opts;
+  const { scope, projectPath, teamId, orgId } = opts;
   if (scope === "global") {
     return [{ scope: "global", service: globalService() }];
   }
   if (scope === "project") {
-    if (!projectPath) {
-      throw new Error("Project path is required for project scope");
-    }
-    return [
-      { scope: "project", service: projectService(projectPath), projectPath }
-    ];
+    if (!projectPath) throw new Error("Project path is required for project scope");
+    return [{ scope: "project", service: projectService(projectPath), projectPath }];
+  }
+  if (scope === "team") {
+    if (!teamId) throw new Error("Team ID is required for team scope");
+    return [{ scope: "team", service: teamService(teamId), teamId }];
   }
+  if (scope === "org") {
+    if (!orgId) throw new Error("Org ID is required for org scope");
+    return [{ scope: "org", service: orgService(orgId), orgId }];
+  }
+  const chain = [];
   if (projectPath) {
-    return [
-      { scope: "project", service: projectService(projectPath), projectPath },
-      { scope: "global", service: globalService() }
-    ];
+    chain.push({ scope: "project", service: projectService(projectPath), projectPath });
+  }
+  if (teamId) {
+    chain.push({ scope: "team", service: teamService(teamId), teamId });
+  }
+  if (orgId) {
+    chain.push({ scope: "org", service: orgService(orgId), orgId });
   }
-  return [{ scope: "global", service: globalService() }];
+  chain.push({ scope: "global", service: globalService() });
+  return chain;
 }
 
 // src/core/hooks.ts
-import { existsSync as existsSync4, readFileSync as readFileSync4, writeFileSync as writeFileSync2, mkdirSync as mkdirSync3 } from "fs";
+import { existsSync as existsSync4, readFileSync as readFileSync4, writeFileSync as writeFileSync3, mkdirSync as mkdirSync3 } from "fs";
 import { join as join4 } from "path";
 import { homedir as homedir3 } from "os";
 import { exec } from "child_process";
+import { randomUUID } from "crypto";
+import { lookup } from "dns/promises";
+
+// src/utils/http-request.ts
 import { request as httpsRequest } from "https";
 import { request as httpRequest } from "http";
-import { randomUUID } from "crypto";
+var DEFAULT_TIMEOUT_MS = 1e4;
+var DEFAULT_MAX_RESPONSE_BYTES = 65536;
+function httpRequest_(opts) {
+  const {
+    url,
+    method = "GET",
+    headers = {},
+    body,
+    timeoutMs = DEFAULT_TIMEOUT_MS,
+    maxResponseBytes = DEFAULT_MAX_RESPONSE_BYTES
+  } = opts;
+  return new Promise((resolve, reject) => {
+    const parsed = new URL(url);
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+      reject(new Error(`Unsupported URL protocol: ${parsed.protocol}`));
+      return;
+    }
+    const reqFn = parsed.protocol === "https:" ? httpsRequest : httpRequest;
+    const reqHeaders = { ...headers };
+    if (body && !reqHeaders["Content-Length"]) {
+      reqHeaders["Content-Length"] = Buffer.byteLength(body);
+    }
+    const req = reqFn(
+      url,
+      { method, headers: reqHeaders, timeout: timeoutMs },
+      (res) => {
+        const chunks = [];
+        let totalBytes = 0;
+        let truncated = false;
+        res.on("data", (chunk) => {
+          totalBytes += chunk.length;
+          if (totalBytes > maxResponseBytes) {
+            truncated = true;
+            res.destroy();
+            return;
+          }
+          chunks.push(chunk);
+        });
+        let settled = false;
+        const settle = (result) => {
+          if (!settled) {
+            settled = true;
+            resolve(result);
+          }
+        };
+        const fail = (err) => {
+          if (!settled) {
+            settled = true;
+            reject(err);
+          }
+        };
+        res.on("error", (err) => fail(new Error(`Response error: ${err.message}`)));
+        res.on("end", () => {
+          settle({
+            statusCode: res.statusCode ?? 0,
+            body: Buffer.concat(chunks).toString("utf8"),
+            truncated
+          });
+        });
+        res.on("close", () => {
+          settle({
+            statusCode: res.statusCode ?? 0,
+            body: Buffer.concat(chunks).toString("utf8"),
+            truncated
+          });
+        });
+      }
+    );
+    req.on("error", (err) => reject(new Error(`Network error: ${err.message}`)));
+    req.on("timeout", () => {
+      req.destroy();
+      reject(new Error("Request timed out"));
+    });
+    if (body) req.write(body);
+    req.end();
+  });
+}
+
+// src/core/hooks.ts
 function getRegistryPath2() {
   const dir = join4(homedir3(), ".config", "q-ring");
   if (!existsSync4(dir)) {
@@ -419,26 +616,26 @@ function loadRegistry2() {
     return { hooks: [] };
   }
 }
-function saveRegistry2(registry) {
-  writeFileSync2(getRegistryPath2(), JSON.stringify(registry, null, 2));
+function saveRegistry2(registry2) {
+  writeFileSync3(getRegistryPath2(), JSON.stringify(registry2, null, 2));
 }
 function registerHook(entry) {
-  const registry = loadRegistry2();
+  const registry2 = loadRegistry2();
   const hook = {
     ...entry,
     id: randomUUID().slice(0, 8),
     createdAt: (/* @__PURE__ */ new Date()).toISOString()
   };
-  registry.hooks.push(hook);
-  saveRegistry2(registry);
+  registry2.hooks.push(hook);
+  saveRegistry2(registry2);
   return hook;
 }
 function removeHook(id) {
-  const registry = loadRegistry2();
-  const before = registry.hooks.length;
-  registry.hooks = registry.hooks.filter((h) => h.id !== id);
-  if (registry.hooks.length < before) {
-    saveRegistry2(registry);
+  const registry2 = loadRegistry2();
+  const before = registry2.hooks.length;
+  registry2.hooks = registry2.hooks.filter((h) => h.id !== id);
+  if (registry2.hooks.length < before) {
+    saveRegistry2(registry2);
     return true;
   }
   return false;
@@ -446,22 +643,6 @@ function removeHook(id) {
 function listHooks() {
   return loadRegistry2().hooks;
 }
-function enableHook(id) {
-  const registry = loadRegistry2();
-  const hook = registry.hooks.find((h) => h.id === id);
-  if (!hook) return false;
-  hook.enabled = true;
-  saveRegistry2(registry);
-  return true;
-}
-function disableHook(id) {
-  const registry = loadRegistry2();
-  const hook = registry.hooks.find((h) => h.id === id);
-  if (!hook) return false;
-  hook.enabled = false;
-  saveRegistry2(registry);
-  return true;
-}
 function matchesHook(hook, payload, tags) {
   if (!hook.enabled) return false;
   const m = hook.match;
@@ -495,44 +676,76 @@ function executeShell(command, payload) {
     });
   });
 }
-function executeHttp(url, payload) {
-  return new Promise((resolve) => {
+function isPrivateIP(ip) {
+  const octet = "(?:25[0-5]|2[0-4]\\d|1?\\d{1,2})";
+  const ipv4Re = new RegExp(`^::ffff:(${octet}\\.${octet}\\.${octet}\\.${octet})$`, "i");
+  const ipv4Mapped = ip.match(ipv4Re);
+  if (ipv4Mapped) return isPrivateIP(ipv4Mapped[1]);
+  if (/^127\./.test(ip)) return true;
+  if (/^10\./.test(ip)) return true;
+  if (/^172\.(1[6-9]|2\d|3[01])\./.test(ip)) return true;
+  if (/^192\.168\./.test(ip)) return true;
+  if (/^169\.254\./.test(ip)) return true;
+  if (ip === "0.0.0.0") return true;
+  if (ip === "::1" || ip === "::") return true;
+  if (/^f[cd][0-9a-f]{2}:/i.test(ip)) return true;
+  if (/^fe80:/i.test(ip)) return true;
+  return false;
+}
+async function checkSSRF(url) {
+  if (process.env.Q_RING_ALLOW_PRIVATE_HOOKS === "1") return null;
+  try {
+    const parsed = new URL(url);
+    const hostname = parsed.hostname.replace(/^\[|\]$/g, "");
+    if (isPrivateIP(hostname)) {
+      return `Blocked: hook URL resolves to private address (${hostname}). Set Q_RING_ALLOW_PRIVATE_HOOKS=1 to override.`;
+    }
+    const results = await lookup(hostname, { all: true });
+    for (const { address } of results) {
+      if (isPrivateIP(address)) {
+        return `Blocked: hook URL "${hostname}" resolves to private address ${address}. Set Q_RING_ALLOW_PRIVATE_HOOKS=1 to override.`;
+      }
+    }
+  } catch {
+  }
+  return null;
+}
+async function executeHttp(url, payload) {
+  const ssrfBlock = await checkSSRF(url);
+  if (ssrfBlock) {
+    logAudit({
+      action: "policy_deny",
+      key: payload.key,
+      scope: payload.scope,
+      source: payload.source,
+      detail: `hook SSRF blocked: ${url}`
+    });
+    return { hookId: "", success: false, message: ssrfBlock };
+  }
+  try {
     const body = JSON.stringify(payload);
-    const parsedUrl = new URL(url);
-    const reqFn = parsedUrl.protocol === "https:" ? httpsRequest : httpRequest;
-    const req = reqFn(
+    const res = await httpRequest_({
       url,
-      {
-        method: "POST",
-        headers: {
-          "Content-Type": "application/json",
-          "Content-Length": Buffer.byteLength(body),
-          "User-Agent": "q-ring-hooks/1.0"
-        },
-        timeout: 1e4
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        "User-Agent": "q-ring-hooks/1.0"
       },
-      (res) => {
-        let data = "";
-        res.on("data", (chunk) => data += chunk);
-        res.on("end", () => {
-          resolve({
-            hookId: "",
-            success: (res.statusCode ?? 0) >= 200 && (res.statusCode ?? 0) < 300,
-            message: `HTTP ${res.statusCode}`
-          });
-        });
-      }
-    );
-    req.on("error", (err) => {
-      resolve({ hookId: "", success: false, message: `HTTP error: ${err.message}` });
-    });
-    req.on("timeout", () => {
-      req.destroy();
-      resolve({ hookId: "", success: false, message: "HTTP timeout" });
+      body,
+      timeoutMs: 1e4
     });
-    req.write(body);
-    req.end();
-  });
+    return {
+      hookId: "",
+      success: res.statusCode >= 200 && res.statusCode < 300,
+      message: `HTTP ${res.statusCode}`
+    };
+  } catch (err) {
+    return {
+      hookId: "",
+      success: false,
+      message: err instanceof Error ? err.message : "HTTP error"
+    };
+  }
 }
 function executeSignal(target, signal = "SIGHUP") {
   return new Promise((resolve) => {
@@ -616,6 +829,279 @@ async function fireHooks(payload, tags) {
   return hookResults;
 }
 
+// src/core/approval.ts
+import { existsSync as existsSync5, readFileSync as readFileSync5, writeFileSync as writeFileSync4, mkdirSync as mkdirSync4 } from "fs";
+import { join as join5 } from "path";
+import { homedir as homedir4 } from "os";
+import { createHmac, randomBytes } from "crypto";
+function getHmacSecret() {
+  const secretPath = join5(homedir4(), ".config", "q-ring", ".approval-key");
+  const dir = join5(homedir4(), ".config", "q-ring");
+  if (!existsSync5(dir)) mkdirSync4(dir, { recursive: true });
+  if (existsSync5(secretPath)) {
+    return readFileSync5(secretPath, "utf8").trim();
+  }
+  const secret = randomBytes(32).toString("hex");
+  writeFileSync4(secretPath, secret, { mode: 384 });
+  return secret;
+}
+function computeHmac(entry) {
+  const payload = `${entry.id}|${entry.key}|${entry.scope}|${entry.reason}|${entry.grantedBy}|${entry.grantedAt}|${entry.expiresAt}`;
+  return createHmac("sha256", getHmacSecret()).update(payload).digest("hex");
+}
+function verifyHmac(entry) {
+  const expected = computeHmac(entry);
+  return expected === entry.hmac;
+}
+function getRegistryPath3() {
+  const dir = join5(homedir4(), ".config", "q-ring");
+  if (!existsSync5(dir)) {
+    mkdirSync4(dir, { recursive: true });
+  }
+  return join5(dir, "approvals.json");
+}
+function loadRegistry3() {
+  const path = getRegistryPath3();
+  if (!existsSync5(path)) {
+    return { approvals: [] };
+  }
+  try {
+    return JSON.parse(readFileSync5(path, "utf8"));
+  } catch {
+    return { approvals: [] };
+  }
+}
+function hasApproval(key, scope) {
+  const registry2 = loadRegistry3();
+  const entry = registry2.approvals.find(
+    (a) => a.key === key && a.scope === scope
+  );
+  if (!entry) return false;
+  if (new Date(entry.expiresAt).getTime() < Date.now()) return false;
+  if (!verifyHmac(entry)) return false;
+  return true;
+}
+
+// src/core/provision.ts
+import { execFileSync, spawnSync } from "child_process";
+var ProvisionRegistry = class {
+  providers = /* @__PURE__ */ new Map();
+  register(provider) {
+    this.providers.set(provider.name, provider);
+  }
+  get(name) {
+    return this.providers.get(name);
+  }
+  listProviders() {
+    return [...this.providers.values()];
+  }
+};
+var awsStsProvider = {
+  name: "aws-sts",
+  description: "AWS STS AssumeRole (requires existing local AWS CLI credentials)",
+  provision(configRaw) {
+    let config;
+    try {
+      config = JSON.parse(configRaw);
+    } catch {
+      throw new Error('aws-sts requires valid JSON config (e.g. {"roleArn":"arn:aws:..."})');
+    }
+    const roleArn = config.roleArn;
+    const sessionName = config.sessionName || "q-ring-agent";
+    const duration = config.durationSeconds || 3600;
+    if (!roleArn) throw new Error("aws-sts requires roleArn in config");
+    try {
+      const output = execFileSync("aws", [
+        "sts",
+        "assume-role",
+        "--role-arn",
+        roleArn,
+        "--role-session-name",
+        sessionName,
+        "--duration-seconds",
+        String(duration),
+        "--output",
+        "json"
+      ], { encoding: "utf8" });
+      const parsed = JSON.parse(output);
+      const creds = parsed.Credentials;
+      const value = JSON.stringify({
+        AWS_ACCESS_KEY_ID: creds.AccessKeyId,
+        AWS_SECRET_ACCESS_KEY: creds.SecretAccessKey,
+        AWS_SESSION_TOKEN: creds.SessionToken
+      });
+      return {
+        value,
+        expiresAt: creds.Expiration
+      };
+    } catch (err) {
+      throw new Error(`AWS STS provision failed: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
+};
+var httpProvider = {
+  name: "http",
+  description: "Generic HTTP token endpoint using Node.js http/https",
+  provision(configRaw) {
+    let config;
+    try {
+      config = JSON.parse(configRaw);
+    } catch {
+      throw new Error("http provider requires valid JSON config");
+    }
+    const url = config.url;
+    const method = config.method || "POST";
+    const valuePath = config.valuePath || "token";
+    const expiresInSeconds = config.expiresInSeconds || 3600;
+    if (!url) throw new Error("http provider requires url in config");
+    const headers = {
+      "User-Agent": "q-ring-jit/1.0",
+      ...config.headers ?? {}
+    };
+    let bodyStr;
+    if (config.body) {
+      headers["Content-Type"] = "application/json";
+      bodyStr = JSON.stringify(config.body);
+    }
+    const scriptConfig = JSON.stringify({ url, method, headers, bodyStr });
+    const script = `
+const cfg = JSON.parse(process.env.__QRING_HTTP_CFG);
+const parsedUrl = new URL(cfg.url);
+const http = require(parsedUrl.protocol === "https:" ? "node:https" : "node:http");
+const req = http.request(cfg.url, { method: cfg.method, headers: cfg.headers, timeout: 30000 }, (res) => {
+  let body = "";
+  res.on("data", (chunk) => body += chunk);
+  res.on("end", () => process.stdout.write(body));
+});
+req.on("error", (e) => { process.stderr.write(e.message); process.exit(1); });
+if (cfg.bodyStr) req.write(cfg.bodyStr);
+req.end();
+`;
+    try {
+      const result = spawnSync("node", ["-e", script], {
+        encoding: "utf8",
+        timeout: 35e3,
+        env: { ...process.env, __QRING_HTTP_CFG: scriptConfig }
+      });
+      if (result.status !== 0) {
+        throw new Error(result.stderr || "HTTP request failed");
+      }
+      const parsed = JSON.parse(result.stdout);
+      let val = parsed;
+      for (const key of valuePath.split(".")) {
+        val = val[key];
+      }
+      return {
+        value: String(val),
+        expiresAt: new Date(Date.now() + expiresInSeconds * 1e3).toISOString()
+      };
+    } catch (err) {
+      throw new Error(`HTTP provision failed: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
+};
+var registry = new ProvisionRegistry();
+registry.register(awsStsProvider);
+registry.register(httpProvider);
+
+// src/core/policy.ts
+var cachedPolicy = null;
+function loadPolicy(projectPath) {
+  const pp = projectPath ?? process.cwd();
+  if (cachedPolicy && cachedPolicy.path === pp) {
+    return cachedPolicy.policy;
+  }
+  const config = readProjectConfig(pp);
+  const policy = config?.policy ?? {};
+  cachedPolicy = { path: pp, policy };
+  return policy;
+}
+function checkToolPolicy(toolName, projectPath) {
+  const policy = loadPolicy(projectPath);
+  if (!policy.mcp) return { allowed: true, policySource: "no-policy" };
+  if (policy.mcp.denyTools?.includes(toolName)) {
+    return {
+      allowed: false,
+      reason: `Tool "${toolName}" is denied by project policy`,
+      policySource: ".q-ring.json policy.mcp.denyTools"
+    };
+  }
+  if (policy.mcp.allowTools && !policy.mcp.allowTools.includes(toolName)) {
+    return {
+      allowed: false,
+      reason: `Tool "${toolName}" is not in the allowlist`,
+      policySource: ".q-ring.json policy.mcp.allowTools"
+    };
+  }
+  return { allowed: true, policySource: ".q-ring.json" };
+}
+function checkKeyReadPolicy(key, tags, projectPath) {
+  const policy = loadPolicy(projectPath);
+  if (!policy.mcp) return { allowed: true, policySource: "no-policy" };
+  if (policy.mcp.deniedKeys?.includes(key)) {
+    return {
+      allowed: false,
+      reason: `Key "${key}" is denied by project policy`,
+      policySource: ".q-ring.json policy.mcp.deniedKeys"
+    };
+  }
+  if (policy.mcp.readableKeys && !policy.mcp.readableKeys.includes(key)) {
+    return {
+      allowed: false,
+      reason: `Key "${key}" is not in the readable keys allowlist`,
+      policySource: ".q-ring.json policy.mcp.readableKeys"
+    };
+  }
+  if (tags && policy.mcp.deniedTags) {
+    const blocked = tags.find((t) => policy.mcp.deniedTags.includes(t));
+    if (blocked) {
+      return {
+        allowed: false,
+        reason: `Tag "${blocked}" is denied by project policy`,
+        policySource: ".q-ring.json policy.mcp.deniedTags"
+      };
+    }
+  }
+  return { allowed: true, policySource: ".q-ring.json" };
+}
+function checkExecPolicy(command, projectPath) {
+  const policy = loadPolicy(projectPath);
+  if (!policy.exec) return { allowed: true, policySource: "no-policy" };
+  if (policy.exec.denyCommands) {
+    const denied = policy.exec.denyCommands.find((d) => command.includes(d));
+    if (denied) {
+      return {
+        allowed: false,
+        reason: `Command containing "${denied}" is denied by project policy`,
+        policySource: ".q-ring.json policy.exec.denyCommands"
+      };
+    }
+  }
+  if (policy.exec.allowCommands) {
+    const allowed = policy.exec.allowCommands.some((a) => command.startsWith(a));
+    if (!allowed) {
+      return {
+        allowed: false,
+        reason: `Command "${command}" is not in the exec allowlist`,
+        policySource: ".q-ring.json policy.exec.allowCommands"
+      };
+    }
+  }
+  return { allowed: true, policySource: ".q-ring.json" };
+}
+function getExecMaxRuntime(projectPath) {
+  return loadPolicy(projectPath).exec?.maxRuntimeSeconds;
+}
+function getPolicySummary(projectPath) {
+  const policy = loadPolicy(projectPath);
+  return {
+    hasMcpPolicy: !!policy.mcp,
+    hasExecPolicy: !!policy.exec,
+    hasSecretPolicy: !!policy.secrets,
+    details: policy
+  };
+}
+
 // src/core/keyring.ts
 function readEnvelope(service, key) {
   const entry = new Entry(service, key);
@@ -633,29 +1119,104 @@ function resolveEnv(opts) {
   const result = collapseEnvironment({ projectPath: opts.projectPath });
   return result?.env;
 }
+function resolveTemplates(value, opts, seen) {
+  if (!value.includes("{{") || !value.includes("}}")) return value;
+  return value.replace(/\{\{([^}]+)\}\}/g, (match, refKeyRaw) => {
+    const refKey = refKeyRaw.trim();
+    const refValue = getSecret(refKey, { ...opts, _seen: seen });
+    if (refValue === null) {
+      throw new Error(`Template resolution failed: referenced secret "${refKey}" not found`);
+    }
+    return refValue;
+  });
+}
+function resolveTemplatesOffline(value, rawValues, seen) {
+  if (!value.includes("{{") || !value.includes("}}")) return value;
+  return value.replace(/\{\{([^}]+)\}\}/g, (match, refKeyRaw) => {
+    const refKey = refKeyRaw.trim();
+    if (seen.has(refKey)) {
+      throw new Error(`Circular dependency detected: ${[...seen].join(" -> ")} -> ${refKey}`);
+    }
+    const rawRef = rawValues.get(refKey);
+    if (rawRef === void 0) {
+      throw new Error(`Template resolution failed: referenced secret "${refKey}" not found`);
+    }
+    const nextSeen = new Set(seen);
+    nextSeen.add(refKey);
+    return resolveTemplatesOffline(rawRef, rawValues, nextSeen);
+  });
+}
 function getSecret(key, opts = {}) {
   const scopes = resolveScope(opts);
   const env = resolveEnv(opts);
   const source = opts.source ?? "cli";
+  const seen = opts._seen ?? /* @__PURE__ */ new Set();
+  if (source === "mcp") {
+    const policyDecision = checkKeyReadPolicy(key, void 0, opts.projectPath);
+    if (!policyDecision.allowed) {
+      throw new Error(`Policy Denied: ${policyDecision.reason}`);
+    }
+  }
+  if (seen.has(key)) {
+    throw new Error(`Circular dependency detected: ${[...seen].join(" -> ")} -> ${key}`);
+  }
+  const nextSeen = new Set(seen);
+  nextSeen.add(key);
   for (const { service, scope } of scopes) {
     const envelope = readEnvelope(service, key);
     if (!envelope) continue;
     const decay = checkDecay(envelope);
     if (decay.isExpired) {
-      logAudit({
-        action: "read",
-        key,
-        scope,
-        source,
-        detail: "blocked: secret expired (quantum decay)"
-      });
+      if (!opts.silent) {
+        logAudit({
+          action: "read",
+          key,
+          scope,
+          source,
+          detail: "blocked: secret expired (quantum decay)"
+        });
+      }
       continue;
     }
-    const value = collapseValue(envelope, env);
+    if (envelope.meta.requiresApproval && source === "mcp") {
+      if (!hasApproval(key, scope)) {
+        if (!opts.silent) {
+          logAudit({
+            action: "read",
+            key,
+            scope,
+            source,
+            detail: "blocked: requires user approval"
+          });
+        }
+        throw new Error(`Access Denied: This secret requires user approval. Please ask the user to run 'qring approve ${key}'`);
+      }
+    }
+    let value = collapseValue(envelope, env);
     if (value === null) continue;
-    const updated = recordAccess(envelope);
-    writeEnvelope(service, key, updated);
-    logAudit({ action: "read", key, scope, env, source });
+    if (envelope.meta.jitProvider) {
+      const provider = registry.get(envelope.meta.jitProvider);
+      if (provider) {
+        let isExpired = true;
+        if (envelope.states && envelope.states["jit"] && envelope.meta.jitExpiresAt) {
+          isExpired = new Date(envelope.meta.jitExpiresAt).getTime() <= Date.now();
+        }
+        if (isExpired) {
+          const result = provider.provision(value);
+          envelope.states = envelope.states ?? {};
+          envelope.states["jit"] = result.value;
+          envelope.meta.jitExpiresAt = result.expiresAt;
+          writeEnvelope(service, key, envelope);
+        }
+        value = envelope.states["jit"];
+      }
+    }
+    value = resolveTemplates(value, { ...opts, _seen: nextSeen }, nextSeen);
+    if (!opts.silent) {
+      const updated = recordAccess(envelope);
+      writeEnvelope(service, key, updated);
+      logAudit({ action: "read", key, scope, env, source });
+    }
     return value;
   }
   return null;
@@ -678,6 +1239,8 @@ function setSecret(key, value, opts = {}) {
   const rotFmt = opts.rotationFormat ?? existing?.meta.rotationFormat;
   const rotPfx = opts.rotationPrefix ?? existing?.meta.rotationPrefix;
   const prov = opts.provider ?? existing?.meta.provider;
+  const reqApp = opts.requiresApproval ?? existing?.meta.requiresApproval;
+  const jitProv = opts.jitProvider ?? existing?.meta.jitProvider;
   if (opts.states) {
     envelope = createEnvelope("", {
       states: opts.states,
@@ -689,7 +1252,9 @@ function setSecret(key, value, opts = {}) {
       entangled: existing?.meta.entangled,
       rotationFormat: rotFmt,
       rotationPrefix: rotPfx,
-      provider: prov
+      provider: prov,
+      requiresApproval: reqApp,
+      jitProvider: jitProv
     });
   } else {
     envelope = createEnvelope(value, {
@@ -700,7 +1265,9 @@ function setSecret(key, value, opts = {}) {
       entangled: existing?.meta.entangled,
       rotationFormat: rotFmt,
       rotationPrefix: rotPfx,
-      provider: prov
+      provider: prov,
+      requiresApproval: reqApp,
+      jitProvider: jitProv
     });
   }
   if (existing) {
@@ -788,6 +1355,12 @@ function listSecrets(opts = {}) {
       scope: "project"
     });
   }
+  if ((!opts.scope || opts.scope === "team") && opts.teamId) {
+    services.push({ service: teamService(opts.teamId), scope: "team" });
+  }
+  if ((!opts.scope || opts.scope === "org") && opts.orgId) {
+    services.push({ service: orgService(opts.orgId), scope: "org" });
+  }
   const results = [];
   const seen = /* @__PURE__ */ new Set();
   for (const { service, scope } of services) {
@@ -828,19 +1401,30 @@ function exportSecrets(opts = {}) {
       (e) => opts.tags.some((t) => e.envelope?.meta.tags?.includes(t))
     );
   }
-  const merged = /* @__PURE__ */ new Map();
+  const rawValues = /* @__PURE__ */ new Map();
   const globalEntries = entries.filter((e) => e.scope === "global");
+  const orgEntries = entries.filter((e) => e.scope === "org");
+  const teamEntries = entries.filter((e) => e.scope === "team");
   const projectEntries = entries.filter((e) => e.scope === "project");
-  for (const entry of [...globalEntries, ...projectEntries]) {
+  for (const entry of [...globalEntries, ...orgEntries, ...teamEntries, ...projectEntries]) {
     if (entry.envelope) {
       const decay = checkDecay(entry.envelope);
       if (decay.isExpired) continue;
       const value = collapseValue(entry.envelope, env);
       if (value !== null) {
-        merged.set(entry.key, value);
+        rawValues.set(entry.key, value);
       }
     }
   }
+  const merged = /* @__PURE__ */ new Map();
+  for (const [key, value] of rawValues) {
+    try {
+      const resolved = resolveTemplatesOffline(value, rawValues, /* @__PURE__ */ new Set([key]));
+      merged.set(key, resolved);
+    } catch (err) {
+      console.warn(`Warning: skipped exporting ${key} due to template error: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
   logAudit({ action: "export", source, detail: `format=${format}` });
   if (format === "json") {
     const obj = {};
@@ -960,14 +1544,21 @@ export {
   collapseEnvironment,
   logAudit,
   queryAudit,
+  verifyAuditChain,
+  exportAudit,
   detectAnomalies,
   listEntanglements,
+  httpRequest_,
   registerHook,
   removeHook,
   listHooks,
-  enableHook,
-  disableHook,
   fireHooks,
+  registry,
+  checkToolPolicy,
+  checkKeyReadPolicy,
+  checkExecPolicy,
+  getExecMaxRuntime,
+  getPolicySummary,
   getSecret,
   getEnvelope,
   setSecret,
@@ -982,4 +1573,4 @@ export {
   tunnelDestroy,
   tunnelList
 };
-//# sourceMappingURL=chunk-IGNU622R.js.map
+//# sourceMappingURL=chunk-5JBU7TWN.js.map