@i4ctime/q-ring 0.9.8 → 0.11.0

package/dist/{chunk-JV4JFWV6.js → chunk-A4RZVP3P.js}

@@ -1,6 +1,54 @@
 #!/usr/bin/env node
 
+// src/version.ts
+import { readFileSync } from "fs";
+import { dirname, join } from "path";
+import { fileURLToPath } from "url";
+function readPackageVersion() {
+  try {
+    const here = dirname(fileURLToPath(import.meta.url));
+    const pkgPath = join(here, "..", "package.json");
+    const raw = readFileSync(pkgPath, "utf8");
+    const pkg = JSON.parse(raw);
+    return typeof pkg.version === "string" ? pkg.version : "0.0.0";
+  } catch {
+    return "0.0.0";
+  }
+}
+var PACKAGE_VERSION = readPackageVersion();
+
 // src/core/envelope.ts
+import { z } from "zod";
+var EntanglementLinkSchema = z.object({
+  service: z.string(),
+  key: z.string()
+});
+var SecretMetadataSchema = z.object({
+  createdAt: z.string(),
+  updatedAt: z.string(),
+  expiresAt: z.string().optional(),
+  ttlSeconds: z.number().optional(),
+  description: z.string().optional(),
+  tags: z.array(z.string()).optional(),
+  entangled: z.array(EntanglementLinkSchema).optional(),
+  accessCount: z.number(),
+  lastAccessedAt: z.string().optional(),
+  ephemeral: z.boolean().optional(),
+  rotationFormat: z.string().optional(),
+  rotationPrefix: z.string().optional(),
+  provider: z.string().optional(),
+  validationUrl: z.string().optional(),
+  requiresApproval: z.boolean().optional(),
+  jitProvider: z.string().optional(),
+  jitExpiresAt: z.string().optional()
+});
+var QuantumEnvelopeSchema = z.object({
+  v: z.literal(1),
+  value: z.string().optional(),
+  states: z.record(z.string(), z.string()).optional(),
+  defaultEnv: z.string().optional(),
+  meta: SecretMetadataSchema
+});
 function createEnvelope(value, opts) {
   const now = (/* @__PURE__ */ new Date()).toISOString();
   let expiresAt = opts?.expiresAt;
@@ -32,8 +80,9 @@ function createEnvelope(value, opts) {
 function parseEnvelope(raw) {
   try {
     const parsed = JSON.parse(raw);
-    if (parsed && typeof parsed === "object" && parsed.v === 1) {
-      return parsed;
+    const r = QuantumEnvelopeSchema.safeParse(parsed);
+    if (r.success) {
+      return r.data;
     }
   } catch {
   }
@@ -84,6 +133,15 @@ function checkDecay(envelope) {
   const now = Date.now();
   const expires = new Date(envelope.meta.expiresAt).getTime();
   const created = new Date(envelope.meta.createdAt).getTime();
+  if (!Number.isFinite(expires) || !Number.isFinite(created)) {
+    return {
+      isExpired: true,
+      isStale: true,
+      lifetimePercent: 100,
+      secondsRemaining: null,
+      timeRemaining: "invalid date"
+    };
+  }
   const totalLifetime = expires - created;
   const elapsed = now - created;
   const remaining = expires - now;
@@ -121,8 +179,8 @@ function recordAccess(envelope) {
 
 // src/core/collapse.ts
 import { execSync } from "child_process";
-import { existsSync, readFileSync } from "fs";
-import { join } from "path";
+import { existsSync, readFileSync as readFileSync2 } from "fs";
+import { join as join2 } from "path";
 var BRANCH_ENV_MAP = {
   main: "prod",
   master: "prod",
@@ -149,10 +207,10 @@ function detectGitBranch(cwd) {
   }
 }
 function readProjectConfig(projectPath) {
-  const configPath = join(projectPath ?? process.cwd(), ".q-ring.json");
+  const configPath = join2(projectPath ?? process.cwd(), ".q-ring.json");
   try {
     if (existsSync(configPath)) {
-      return JSON.parse(readFileSync(configPath, "utf8"));
+      return JSON.parse(readFileSync2(configPath, "utf8"));
     }
   } catch {
   }
@@ -188,12 +246,15 @@ function collapseEnvironment(ctx = {}) {
   }
   return null;
 }
+var MAX_BRANCH_GLOB_PATTERN_LEN = 200;
+var MAX_BRANCH_GLOB_REGEX_SOURCE = 400;
 function matchGlob(branchMap, branch) {
   for (const [pattern, env] of Object.entries(branchMap)) {
     if (!pattern.includes("*")) continue;
-    const regex = new RegExp(
-      "^" + pattern.replace(/\*/g, ".*") + "$"
-    );
+    if (pattern.length > MAX_BRANCH_GLOB_PATTERN_LEN) continue;
+    const source = "^" + pattern.replace(/\*/g, ".*") + "$";
+    if (source.length > MAX_BRANCH_GLOB_REGEX_SOURCE) continue;
+    const regex = new RegExp(source);
     if (regex.test(branch)) return env;
   }
   return void 0;
@@ -206,19 +267,35 @@ function mapEnvName(raw) {
 }
 
 // src/core/observer.ts
-import { existsSync as existsSync2, mkdirSync, appendFileSync, readFileSync as readFileSync2, openSync, fstatSync, readSync, closeSync } from "fs";
-import { join as join2 } from "path";
+import {
+  existsSync as existsSync2,
+  mkdirSync,
+  appendFileSync,
+  readFileSync as readFileSync3,
+  openSync,
+  fstatSync,
+  readSync,
+  closeSync,
+  statSync
+} from "fs";
+import { join as join3 } from "path";
 import { homedir } from "os";
 import { createHash } from "crypto";
 function getAuditDir() {
-  const dir = join2(homedir(), ".config", "q-ring");
+  if (process.env.QRING_AUDIT_DIR) {
+    if (!existsSync2(process.env.QRING_AUDIT_DIR)) {
+      mkdirSync(process.env.QRING_AUDIT_DIR, { recursive: true });
+    }
+    return process.env.QRING_AUDIT_DIR;
+  }
+  const dir = join3(homedir(), ".config", "q-ring");
   if (!existsSync2(dir)) {
     mkdirSync(dir, { recursive: true });
   }
   return dir;
 }
 function getAuditPath() {
-  return join2(getAuditDir(), "audit.jsonl");
+  return join3(getAuditDir(), "audit.jsonl");
 }
 function getLastLineHash() {
   const path = getAuditPath();
@@ -256,11 +333,24 @@ function logAudit(event) {
   } catch {
   }
 }
+var MAX_AUDIT_BYTES = 12 * 1024 * 1024;
 function queryAudit(query = {}) {
   const path = getAuditPath();
   if (!existsSync2(path)) return [];
   try {
-    const lines = readFileSync2(path, "utf8").split("\n").filter((l) => l.trim());
+    const st = statSync(path);
+    const readStart = st.size > MAX_AUDIT_BYTES ? st.size - MAX_AUDIT_BYTES : 0;
+    const readLen = st.size > MAX_AUDIT_BYTES ? MAX_AUDIT_BYTES : st.size;
+    const buf = Buffer.alloc(readLen);
+    const fd = openSync(path, "r");
+    readSync(fd, buf, 0, readLen, readStart);
+    closeSync(fd);
+    let text = buf.toString("utf8");
+    if (readStart > 0) {
+      const firstNl = text.indexOf("\n");
+      if (firstNl !== -1) text = text.slice(firstNl + 1);
+    }
+    const lines = text.split("\n").filter((l) => l.trim());
     let events = lines.map((line) => {
       try {
         return JSON.parse(line);
@@ -290,7 +380,7 @@ function verifyAuditChain() {
   if (!existsSync2(path)) {
     return { totalEvents: 0, validEvents: 0, intact: true };
   }
-  const lines = readFileSync2(path, "utf8").split("\n").filter((l) => l.trim());
+  const lines = readFileSync3(path, "utf8").split("\n").filter((l) => l.trim());
   if (lines.length === 0) {
     return { totalEvents: 0, validEvents: 0, intact: true };
   }
@@ -328,7 +418,7 @@ function verifyAuditChain() {
 function exportAudit(opts = {}) {
   const path = getAuditPath();
   if (!existsSync2(path)) return opts.format === "json" ? "[]" : "";
-  const lines = readFileSync2(path, "utf8").split("\n").filter((l) => l.trim());
+  const lines = readFileSync3(path, "utf8").split("\n").filter((l) => l.trim());
   let events = lines.map((l) => {
     try {
       return JSON.parse(l);
@@ -393,15 +483,15 @@ function detectAnomalies(key) {
 }
 
 // src/core/entanglement.ts
-import { existsSync as existsSync3, readFileSync as readFileSync3, writeFileSync as writeFileSync2, mkdirSync as mkdirSync2 } from "fs";
-import { join as join3 } from "path";
+import { existsSync as existsSync3, readFileSync as readFileSync4, writeFileSync, mkdirSync as mkdirSync2 } from "fs";
+import { join as join4 } from "path";
 import { homedir as homedir2 } from "os";
 function getRegistryPath() {
-  const dir = join3(homedir2(), ".config", "q-ring");
+  const dir = join4(homedir2(), ".config", "q-ring");
   if (!existsSync3(dir)) {
     mkdirSync2(dir, { recursive: true });
   }
-  return join3(dir, "entanglement.json");
+  return join4(dir, "entanglement.json");
 }
 function loadRegistry() {
   const path = getRegistryPath();
@@ -409,13 +499,15 @@ function loadRegistry() {
     return { pairs: [] };
   }
   try {
-    return JSON.parse(readFileSync3(path, "utf8"));
+    return JSON.parse(readFileSync4(path, "utf8"));
   } catch {
     return { pairs: [] };
   }
 }
 function saveRegistry(registry2) {
-  writeFileSync2(getRegistryPath(), JSON.stringify(registry2, null, 2));
+  writeFileSync(getRegistryPath(), JSON.stringify(registry2, null, 2), {
+    mode: 384
+  });
 }
 function entangle(source, target) {
   const registry2 = loadRegistry();
@@ -453,74 +545,19 @@ function listEntanglements() {
   return loadRegistry().pairs;
 }
 
-// src/core/keyring.ts
-import { Entry, findCredentials } from "@napi-rs/keyring";
-
-// src/utils/hash.ts
-import { createHash as createHash2 } from "crypto";
-function hashProjectPath(projectPath) {
-  return createHash2("sha256").update(projectPath).digest("hex").slice(0, 12);
-}
-
-// src/core/scope.ts
-var SERVICE_PREFIX = "q-ring";
-function globalService() {
-  return `${SERVICE_PREFIX}:global`;
-}
-function projectService(projectPath) {
-  const hash = hashProjectPath(projectPath);
-  return `${SERVICE_PREFIX}:project:${hash}`;
-}
-function teamService(teamId) {
-  return `${SERVICE_PREFIX}:team:${teamId}`;
-}
-function orgService(orgId) {
-  return `${SERVICE_PREFIX}:org:${orgId}`;
-}
-function resolveScope(opts) {
-  const { scope, projectPath, teamId, orgId } = opts;
-  if (scope === "global") {
-    return [{ scope: "global", service: globalService() }];
-  }
-  if (scope === "project") {
-    if (!projectPath) throw new Error("Project path is required for project scope");
-    return [{ scope: "project", service: projectService(projectPath), projectPath }];
-  }
-  if (scope === "team") {
-    if (!teamId) throw new Error("Team ID is required for team scope");
-    return [{ scope: "team", service: teamService(teamId), teamId }];
-  }
-  if (scope === "org") {
-    if (!orgId) throw new Error("Org ID is required for org scope");
-    return [{ scope: "org", service: orgService(orgId), orgId }];
-  }
-  const chain = [];
-  if (projectPath) {
-    chain.push({ scope: "project", service: projectService(projectPath), projectPath });
-  }
-  if (teamId) {
-    chain.push({ scope: "team", service: teamService(teamId), teamId });
-  }
-  if (orgId) {
-    chain.push({ scope: "org", service: orgService(orgId), orgId });
-  }
-  chain.push({ scope: "global", service: globalService() });
-  return chain;
-}
-
 // src/core/hooks.ts
-import { existsSync as existsSync4, readFileSync as readFileSync4, writeFileSync as writeFileSync3, mkdirSync as mkdirSync3 } from "fs";
-import { join as join4 } from "path";
+import { existsSync as existsSync4, readFileSync as readFileSync5, writeFileSync as writeFileSync2, mkdirSync as mkdirSync3 } from "fs";
+import { join as join5 } from "path";
 import { homedir as homedir3 } from "os";
-import { exec, spawn } from "child_process";
+import { execFile, spawn } from "child_process";
 import { randomUUID } from "crypto";
 
 // src/utils/http-request.ts
 import { request as httpsRequest } from "https";
-import { request as httpRequest } from "http";
+import { request as httpRequestPlain } from "http";
 var DEFAULT_TIMEOUT_MS = 1e4;
 var DEFAULT_MAX_RESPONSE_BYTES = 65536;
-function httpRequest_(opts) {
+function httpRequest(opts) {
   const {
     url,
     method = "GET",
@@ -535,7 +572,7 @@ function httpRequest_(opts) {
       reject(new Error(`Unsupported URL protocol: ${parsed.protocol}`));
       return;
     }
-    const reqFn = parsed.protocol === "https:" ? httpsRequest : httpRequest;
+    const reqFn = parsed.protocol === "https:" ? httpsRequest : httpRequestPlain;
     const reqHeaders = { ...headers };
     if (body && !reqHeaders["Content-Length"]) {
       reqHeaders["Content-Length"] = Buffer.byteLength(body);
@@ -598,6 +635,19 @@ function httpRequest_(opts) {
 
 // src/core/ssrf.ts
 import { lookup } from "dns/promises";
+import * as dns from "dns";
+import { isIPv4, isIPv6 } from "net";
+function lookupAddressesSync(hostname2) {
+  const lookupSync2 = dns.lookupSync;
+  return lookupSync2(hostname2, { all: true });
+}
+function isHostnameIpLiteral(hostname2) {
+  if (isIPv4(hostname2)) return true;
+  if (hostname2.startsWith("[") && hostname2.endsWith("]")) {
+    return isIPv6(hostname2.slice(1, -1));
+  }
+  return isIPv6(hostname2);
+}
 function isPrivateIP(ip) {
   const octet = "(?:25[0-5]|2[0-4]\\d|1?\\d{1,2})";
   const ipv4Re = new RegExp(`^::ffff:(${octet}\\.${octet}\\.${octet}\\.${octet})$`, "i");
@@ -618,40 +668,64 @@ async function checkSSRF(url) {
   if (process.env.Q_RING_ALLOW_PRIVATE_HOOKS === "1") return null;
   try {
     const parsed = new URL(url);
-    const hostname = parsed.hostname.replace(/^\[|\]$/g, "");
-    if (isPrivateIP(hostname)) {
-      return `Blocked: URL resolves to private address (${hostname}). Set Q_RING_ALLOW_PRIVATE_HOOKS=1 to override.`;
+    const hostname2 = parsed.hostname.replace(/^\[|\]$/g, "");
+    if (isPrivateIP(hostname2)) {
+      return `Blocked: URL resolves to private address (${hostname2}). Set Q_RING_ALLOW_PRIVATE_HOOKS=1 to override.`;
     }
-    const results = await lookup(hostname, { all: true });
+    const results = await lookup(hostname2, { all: true });
     for (const { address } of results) {
       if (isPrivateIP(address)) {
-        return `Blocked: URL "${hostname}" resolves to private address ${address}. Set Q_RING_ALLOW_PRIVATE_HOOKS=1 to override.`;
+        return `Blocked: URL "${hostname2}" resolves to private address ${address}. Set Q_RING_ALLOW_PRIVATE_HOOKS=1 to override.`;
       }
     }
   } catch {
   }
   return null;
 }
-function checkSSRFSync(url) {
+function checkJitHttpProvisionUrl(url) {
   if (process.env.Q_RING_ALLOW_PRIVATE_HOOKS === "1") return null;
   try {
     const parsed = new URL(url);
-    const hostname = parsed.hostname.replace(/^\[|\]$/g, "");
-    if (isPrivateIP(hostname)) {
-      return `Blocked: URL resolves to private address (${hostname}). Set Q_RING_ALLOW_PRIVATE_HOOKS=1 to override.`;
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+      return "Blocked: JIT HTTP provider only allows http: or https: URLs.";
+    }
+    const hostname2 = parsed.hostname.replace(/^\[|\]$/g, "");
+    if (!hostname2) {
+      return "Blocked: empty hostname in JIT URL.";
+    }
+    if (isPrivateIP(hostname2)) {
+      return `Blocked: URL resolves to private address (${hostname2}). Set Q_RING_ALLOW_PRIVATE_HOOKS=1 to override.`;
+    }
+    if (isHostnameIpLiteral(hostname2)) {
+      return null;
+    }
+    let results;
+    try {
+      results = lookupAddressesSync(hostname2);
+    } catch {
+      return `Blocked: DNS resolution failed for "${hostname2}" (JIT HTTP provisioning fails closed).`;
+    }
+    if (!results.length) {
+      return `Blocked: DNS returned no addresses for "${hostname2}".`;
+    }
+    for (const { address } of results) {
+      if (isPrivateIP(address)) {
+        return `Blocked: URL "${hostname2}" resolves to private address ${address}. Set Q_RING_ALLOW_PRIVATE_HOOKS=1 to override.`;
+      }
     }
   } catch {
+    return "Blocked: malformed JIT HTTP URL.";
   }
   return null;
 }
 
 // src/core/hooks.ts
 function getRegistryPath2() {
-  const dir = join4(homedir3(), ".config", "q-ring");
+  const dir = join5(homedir3(), ".config", "q-ring");
   if (!existsSync4(dir)) {
     mkdirSync3(dir, { recursive: true });
   }
-  return join4(dir, "hooks.json");
+  return join5(dir, "hooks.json");
 }
 function loadRegistry2() {
   const path = getRegistryPath2();
@@ -659,13 +733,15 @@ function loadRegistry2() {
     return { hooks: [] };
   }
   try {
-    return JSON.parse(readFileSync4(path, "utf8"));
+    return JSON.parse(readFileSync5(path, "utf8"));
   } catch {
     return { hooks: [] };
   }
 }
 function saveRegistry2(registry2) {
-  writeFileSync3(getRegistryPath2(), JSON.stringify(registry2, null, 2));
+  writeFileSync2(getRegistryPath2(), JSON.stringify(registry2, null, 2), {
+    mode: 384
+  });
 }
 function registerHook(entry) {
   const registry2 = loadRegistry2();
@@ -721,6 +797,14 @@ function matchesHook(hook, payload, tags) {
   if (m.scope && m.scope !== payload.scope) return false;
   return true;
 }
+var SAFE_PGREP_NAME = /^[a-zA-Z0-9._:/-]{1,256}$/;
+function shellRunner() {
+  if (process.platform === "win32") {
+    const comspec = process.env.ComSpec ?? "cmd.exe";
+    return { file: comspec, args: ["/d", "/s", "/c"] };
+  }
+  return { file: "/bin/sh", args: ["-c"] };
+}
 function executeShell(command, payload) {
   return new Promise((resolve) => {
     const env = {
@@ -729,13 +813,33 @@ function executeShell(command, payload) {
       QRING_HOOK_ACTION: payload.action,
       QRING_HOOK_SCOPE: payload.scope
     };
-    exec(command, { timeout: 3e4, env }, (err, stdout, stderr) => {
-      if (err) {
-        resolve({ hookId: "", success: false, message: `Shell error: ${err.message}` });
-      } else {
-        resolve({ hookId: "", success: true, message: stdout.trim() || "OK" });
+    const { file, args } = shellRunner();
+    execFile(
+      file,
+      [...args, command],
+      {
+        timeout: 3e4,
+        env,
+        windowsHide: true,
+        maxBuffer: 4 * 1024 * 1024,
+        encoding: "utf8"
+      },
+      (err, stdout) => {
+        if (err) {
+          resolve({
+            hookId: "",
+            success: false,
+            message: `Shell error: ${err.message}`
+          });
+        } else {
+          resolve({
+            hookId: "",
+            success: true,
+            message: (stdout ?? "").trim() || "OK"
+          });
+        }
       }
-    });
+    );
   });
 }
 async function executeHttp(url, payload) {
@@ -752,7 +856,7 @@ async function executeHttp(url, payload) {
   }
   try {
     const body = JSON.stringify(payload);
-    const res = await httpRequest_({
+    const res = await httpRequest({
       url,
       method: "POST",
       headers: {
@@ -777,24 +881,48 @@ async function executeHttp(url, payload) {
 }
 function executeSignal(target, signal = "SIGHUP") {
   return new Promise((resolve) => {
-    const pid = parseInt(target, 10);
-    if (!isNaN(pid)) {
+    const trimmed = target.trim();
+    if (/^\d+$/.test(trimmed)) {
+      const pid = parseInt(trimmed, 10);
       try {
         process.kill(pid, signal);
-        resolve({ hookId: "", success: true, message: `Signal ${signal} sent to PID ${pid}` });
+        resolve({
+          hookId: "",
+          success: true,
+          message: `Signal ${signal} sent to PID ${pid}`
+        });
       } catch (err) {
-        resolve({ hookId: "", success: false, message: `Signal error: ${err instanceof Error ? err.message : String(err)}` });
+        resolve({
+          hookId: "",
+          success: false,
+          message: `Signal error: ${err instanceof Error ? err.message : String(err)}`
+        });
       }
       return;
     }
-    const child = spawn("pgrep", ["-f", target], { timeout: 5e3, stdio: ["ignore", "pipe", "pipe"] });
+    if (!SAFE_PGREP_NAME.test(trimmed)) {
+      resolve({
+        hookId: "",
+        success: false,
+        message: "Signal target must be a numeric PID, or a process name matching /^[a-zA-Z0-9._:/-]{1,256}$/ (no spaces or shell metacharacters)."
+      });
+      return;
+    }
+    const child = spawn("pgrep", ["-f", trimmed], {
+      timeout: 5e3,
+      stdio: ["ignore", "pipe", "pipe"]
+    });
     let stdout = "";
     child.stdout.on("data", (d) => {
       stdout += d.toString();
     });
     child.on("close", (code) => {
       if (code !== 0 || !stdout.trim()) {
-        resolve({ hookId: "", success: false, message: `Process "${target}" not found` });
+        resolve({
+          hookId: "",
+          success: false,
+          message: `Process "${trimmed}" not found`
+        });
         return;
       }
       const pids = stdout.trim().split("\n").map((p) => parseInt(p.trim(), 10)).filter((p) => !isNaN(p));
@@ -806,10 +934,18 @@ function executeSignal(target, signal = "SIGHUP") {
         } catch {
         }
       }
-      resolve({ hookId: "", success: sent > 0, message: `Signal ${signal} sent to ${sent} process(es)` });
+      resolve({
+        hookId: "",
+        success: sent > 0,
+        message: `Signal ${signal} sent to ${sent} process(es)`
+      });
     });
     child.on("error", () => {
-      resolve({ hookId: "", success: false, message: `Process "${target}" not found` });
+      resolve({
+        hookId: "",
+        success: false,
+        message: `Process "${trimmed}" not found`
+      });
     });
   });
 }
@@ -866,35 +1002,52 @@ async function fireHooks(payload, tags) {
 }
 
 // src/core/approval.ts
-import { existsSync as existsSync5, readFileSync as readFileSync5, writeFileSync as writeFileSync4, mkdirSync as mkdirSync4 } from "fs";
-import { join as join5 } from "path";
+import { existsSync as existsSync5, readFileSync as readFileSync6, writeFileSync as writeFileSync3, mkdirSync as mkdirSync4 } from "fs";
+import { join as join6 } from "path";
 import { homedir as homedir4 } from "os";
-import { createHmac, randomBytes } from "crypto";
+import { createHmac, randomBytes, timingSafeEqual } from "crypto";
 function getHmacSecret() {
-  const secretPath = join5(homedir4(), ".config", "q-ring", ".approval-key");
-  const dir = join5(homedir4(), ".config", "q-ring");
-  if (!existsSync5(dir)) mkdirSync4(dir, { recursive: true });
+  const dir = join6(homedir4(), ".config", "q-ring");
+  const secretPath = join6(dir, ".approval-key");
+  if (!existsSync5(dir)) mkdirSync4(dir, { recursive: true, mode: 448 });
   if (existsSync5(secretPath)) {
-    return readFileSync5(secretPath, "utf8").trim();
+    return readFileSync6(secretPath, "utf8").trim();
   }
   const secret = randomBytes(32).toString("hex");
-  writeFileSync4(secretPath, secret, { mode: 384 });
+  writeFileSync3(secretPath, secret, { mode: 384 });
   return secret;
 }
 function computeHmac(entry) {
-  const payload = `${entry.id}|${entry.key}|${entry.scope}|${entry.reason}|${entry.grantedBy}|${entry.grantedAt}|${entry.expiresAt}`;
+  const payload = [
+    entry.id,
+    entry.key,
+    entry.scope,
+    entry.reason,
+    entry.grantedBy,
+    entry.grantedAt,
+    entry.expiresAt,
+    entry.workspace ?? "",
+    entry.sessionId ?? ""
+  ].join("|");
   return createHmac("sha256", getHmacSecret()).update(payload).digest("hex");
 }
 function verifyHmac(entry) {
   const expected = computeHmac(entry);
-  return expected === entry.hmac;
+  const a = Buffer.from(expected, "utf8");
+  const b = Buffer.from(entry.hmac, "utf8");
+  if (a.length !== b.length) return false;
+  try {
+    return timingSafeEqual(a, b);
+  } catch {
+    return false;
+  }
 }
 function getRegistryPath3() {
-  const dir = join5(homedir4(), ".config", "q-ring");
+  const dir = join6(homedir4(), ".config", "q-ring");
   if (!existsSync5(dir)) {
-    mkdirSync4(dir, { recursive: true });
+    mkdirSync4(dir, { recursive: true, mode: 448 });
   }
-  return join5(dir, "approvals.json");
+  return join6(dir, "approvals.json");
 }
 function loadRegistry3() {
   const path = getRegistryPath3();
@@ -902,13 +1055,13 @@ function loadRegistry3() {
     return { approvals: [] };
   }
   try {
-    return JSON.parse(readFileSync5(path, "utf8"));
+    return JSON.parse(readFileSync6(path, "utf8"));
   } catch {
     return { approvals: [] };
   }
 }
 function saveRegistry3(registry2) {
-  writeFileSync4(getRegistryPath3(), JSON.stringify(registry2, null, 2), { mode: 384 });
+  writeFileSync3(getRegistryPath3(), JSON.stringify(registry2, null, 2), { mode: 384 });
 }
 function cleanup(registry2) {
   const now = Date.now();
@@ -974,8 +1127,192 @@ function listApprovals() {
   }));
 }
 
+// src/core/policy.ts
+var cachedPolicy = null;
+function loadPolicy(projectPath) {
+  const pp = projectPath ?? process.cwd();
+  if (cachedPolicy && cachedPolicy.path === pp) {
+    return cachedPolicy.policy;
+  }
+  const config = readProjectConfig(pp);
+  const policy = config?.policy ?? {};
+  cachedPolicy = { path: pp, policy };
+  return policy;
+}
+function checkSecretLifecyclePolicy(input, projectPath) {
+  const policy = loadPolicy(projectPath);
+  if (!policy.secrets) return { allowed: true, policySource: "no-policy" };
+  const s = policy.secrets;
+  if (s.maxTtlSeconds != null && input.ttlSeconds != null && input.ttlSeconds > s.maxTtlSeconds) {
+    return {
+      allowed: false,
+      reason: `TTL ${input.ttlSeconds}s exceeds policy maximum ${s.maxTtlSeconds}s`,
+      policySource: ".q-ring.json policy.secrets.maxTtlSeconds"
+    };
+  }
+  if (s.requireApprovalForTags?.length && input.tags?.length) {
+    const hit = input.tags.find((t) => s.requireApprovalForTags.includes(t));
+    if (hit && !input.requiresApproval) {
+      return {
+        allowed: false,
+        reason: `Tag "${hit}" requires explicit approval metadata (set requiresApproval / --requires-approval)`,
+        policySource: ".q-ring.json policy.secrets.requireApprovalForTags"
+      };
+    }
+  }
+  if (s.requireRotationFormatForTags?.length && input.tags?.length) {
+    const hit = input.tags.find((t) => s.requireRotationFormatForTags.includes(t));
+    if (hit && !input.rotationFormat) {
+      return {
+        allowed: false,
+        reason: `Tag "${hit}" requires a rotationFormat to be set`,
+        policySource: ".q-ring.json policy.secrets.requireRotationFormatForTags"
+      };
+    }
+  }
+  return { allowed: true, policySource: ".q-ring.json" };
+}
+function checkKeyReadPolicy(key, tags, projectPath) {
+  const policy = loadPolicy(projectPath);
+  if (!policy.mcp) return { allowed: true, policySource: "no-policy" };
+  if (policy.mcp.deniedKeys?.includes(key)) {
+    return {
+      allowed: false,
+      reason: `Key "${key}" is denied by project policy`,
+      policySource: ".q-ring.json policy.mcp.deniedKeys"
+    };
+  }
+  if (policy.mcp.readableKeys && !policy.mcp.readableKeys.includes(key)) {
+    return {
+      allowed: false,
+      reason: `Key "${key}" is not in the readable keys allowlist`,
+      policySource: ".q-ring.json policy.mcp.readableKeys"
+    };
+  }
+  if (tags && policy.mcp.deniedTags) {
+    const blocked = tags.find((t) => policy.mcp.deniedTags.includes(t));
+    if (blocked) {
+      return {
+        allowed: false,
+        reason: `Tag "${blocked}" is denied by project policy`,
+        policySource: ".q-ring.json policy.mcp.deniedTags"
+      };
+    }
+  }
+  return { allowed: true, policySource: ".q-ring.json" };
+}
+function checkExecPolicy(command, projectPath) {
+  const policy = loadPolicy(projectPath);
+  if (!policy.exec) return { allowed: true, policySource: "no-policy" };
+  if (policy.exec.denyCommands) {
+    const denied = policy.exec.denyCommands.find((d) => command.includes(d));
+    if (denied) {
+      return {
+        allowed: false,
+        reason: `Command containing "${denied}" is denied by project policy`,
+        policySource: ".q-ring.json policy.exec.denyCommands"
+      };
+    }
+  }
+  if (policy.exec.allowCommands) {
+    const allowed = policy.exec.allowCommands.some((a) => command.startsWith(a));
+    if (!allowed) {
+      return {
+        allowed: false,
+        reason: `Command "${command}" is not in the exec allowlist`,
+        policySource: ".q-ring.json policy.exec.allowCommands"
+      };
+    }
+  }
+  return { allowed: true, policySource: ".q-ring.json" };
+}
+function getExecMaxRuntime(projectPath) {
+  return loadPolicy(projectPath).exec?.maxRuntimeSeconds;
+}
+function getPolicySummary(projectPath) {
+  const policy = loadPolicy(projectPath);
+  return {
+    hasMcpPolicy: !!policy.mcp,
+    hasExecPolicy: !!policy.exec,
+    hasSecretPolicy: !!policy.secrets,
+    details: policy
+  };
+}
+
+// src/core/keyring.ts
+import { mkdirSync as mkdirSync5, writeFileSync as writeFileSync4, unlinkSync } from "fs";
+import { homedir as homedir5 } from "os";
+import { join as join7 } from "path";
+import { Entry, findCredentials } from "@napi-rs/keyring";
+
+// src/utils/hash.ts
+import { createHash as createHash2 } from "crypto";
+function hashProjectPath(projectPath) {
+  return createHash2("sha256").update(projectPath).digest("hex").slice(0, 12);
+}
+
+// src/core/scope.ts
+var SERVICE_PREFIX = "q-ring";
+function globalService() {
+  return `${SERVICE_PREFIX}:global`;
+}
+function projectService(projectPath) {
+  const hash = hashProjectPath(projectPath);
+  return `${SERVICE_PREFIX}:project:${hash}`;
+}
+function teamService(teamId) {
+  return `${SERVICE_PREFIX}:team:${teamId}`;
+}
+function orgService(orgId) {
+  return `${SERVICE_PREFIX}:org:${orgId}`;
+}
+function resolveScope(opts) {
+  const { scope, projectPath, teamId, orgId } = opts;
+  if (scope === "global") {
+    return [{ scope: "global", service: globalService() }];
+  }
+  if (scope === "project") {
+    if (!projectPath) throw new Error("Project path is required for project scope");
+    return [{ scope: "project", service: projectService(projectPath), projectPath }];
+  }
+  if (scope === "team") {
+    if (!teamId) throw new Error("Team ID is required for team scope");
+    return [{ scope: "team", service: teamService(teamId), teamId }];
+  }
+  if (scope === "org") {
+    if (!orgId) throw new Error("Org ID is required for org scope");
+    return [{ scope: "org", service: orgService(orgId), orgId }];
+  }
+  const chain = [];
+  if (projectPath) {
+    chain.push({ scope: "project", service: projectService(projectPath), projectPath });
+  }
+  if (teamId) {
+    chain.push({ scope: "team", service: teamService(teamId), teamId });
+  }
+  if (orgId) {
+    chain.push({ scope: "org", service: orgService(orgId), orgId });
+  }
+  chain.push({ scope: "global", service: globalService() });
+  return chain;
+}
+
 // src/core/provision.ts
 import { execFileSync, spawnSync } from "child_process";
+import { z as z2 } from "zod";
+var AwsStsConfigSchema = z2.object({
+  roleArn: z2.string(),
+  sessionName: z2.string().optional(),
+  durationSeconds: z2.number().optional()
+});
+var HttpJitConfigSchema = z2.object({
+  url: z2.string(),
+  method: z2.string().optional(),
+  valuePath: z2.string().optional(),
+  expiresInSeconds: z2.number().optional(),
+  headers: z2.record(z2.string(), z2.string()).optional(),
+  body: z2.unknown().optional()
+});
 var ProvisionRegistry = class {
   providers = /* @__PURE__ */ new Map();
   register(provider) {
@@ -992,16 +1329,20 @@ var awsStsProvider = {
   name: "aws-sts",
   description: "AWS STS AssumeRole (requires existing local AWS CLI credentials)",
   provision(configRaw) {
-    let config;
+    let raw;
     try {
-      config = JSON.parse(configRaw);
+      raw = JSON.parse(configRaw);
     } catch {
       throw new Error('aws-sts requires valid JSON config (e.g. {"roleArn":"arn:aws:..."})');
     }
+    const parsed = AwsStsConfigSchema.safeParse(raw);
+    if (!parsed.success) {
+      throw new Error(`aws-sts invalid config: ${parsed.error.message}`);
+    }
+    const config = parsed.data;
     const roleArn = config.roleArn;
     const sessionName = config.sessionName || "q-ring-agent";
     const duration = config.durationSeconds || 3600;
-    if (!roleArn) throw new Error("aws-sts requires roleArn in config");
     try {
       const output = execFileSync("aws", [
         "sts",
@@ -1015,8 +1356,8 @@ var awsStsProvider = {
         "--output",
         "json"
       ], { encoding: "utf8" });
-      const parsed = JSON.parse(output);
-      const creds = parsed.Credentials;
+      const parsed2 = JSON.parse(output);
+      const creds = parsed2.Credentials;
       const value = JSON.stringify({
         AWS_ACCESS_KEY_ID: creds.AccessKeyId,
         AWS_SECRET_ACCESS_KEY: creds.SecretAccessKey,
@@ -1035,18 +1376,23 @@ var httpProvider = {
   name: "http",
   description: "Generic HTTP token endpoint using Node.js http/https",
   provision(configRaw) {
-    let config;
+    let raw;
     try {
-      config = JSON.parse(configRaw);
+      raw = JSON.parse(configRaw);
     } catch {
       throw new Error("http provider requires valid JSON config");
     }
+    const parsed = HttpJitConfigSchema.safeParse(raw);
+    if (!parsed.success) {
+      throw new Error(`http provider invalid config: ${parsed.error.message}`);
+    }
+    const config = parsed.data;
     const url = config.url;
     const method = config.method || "POST";
     const valuePath = config.valuePath || "token";
     const expiresInSeconds = config.expiresInSeconds || 3600;
     if (!url) throw new Error("http provider requires url in config");
-    const ssrfBlock = checkSSRFSync(url);
+    const ssrfBlock = checkJitHttpProvisionUrl(url);
     if (ssrfBlock) throw new Error(`SSRF blocked: ${ssrfBlock}`);
     const headers = {
       "User-Agent": "q-ring-jit/1.0",
@@ -1080,8 +1426,8 @@ req.end();
       if (result.status !== 0) {
         throw new Error(result.stderr || "HTTP request failed");
       }
-      const parsed = JSON.parse(result.stdout);
-      let val = parsed;
+      const parsed2 = JSON.parse(result.stdout);
+      let val = parsed2;
       for (const key of valuePath.split(".")) {
         val = val[key];
       }
@@ -1098,86 +1444,33 @@ var registry = new ProvisionRegistry();
 registry.register(awsStsProvider);
 registry.register(httpProvider);
 
-// src/core/policy.ts
-var cachedPolicy = null;
-function loadPolicy(projectPath) {
-  const pp = projectPath ?? process.cwd();
-  if (cachedPolicy && cachedPolicy.path === pp) {
-    return cachedPolicy.policy;
-  }
-  const config = readProjectConfig(pp);
-  const policy = config?.policy ?? {};
-  cachedPolicy = { path: pp, policy };
-  return policy;
-}
-function checkKeyReadPolicy(key, tags, projectPath) {
-  const policy = loadPolicy(projectPath);
-  if (!policy.mcp) return { allowed: true, policySource: "no-policy" };
-  if (policy.mcp.deniedKeys?.includes(key)) {
-    return {
-      allowed: false,
-      reason: `Key "${key}" is denied by project policy`,
-      policySource: ".q-ring.json policy.mcp.deniedKeys"
-    };
-  }
-  if (policy.mcp.readableKeys && !policy.mcp.readableKeys.includes(key)) {
-    return {
-      allowed: false,
-      reason: `Key "${key}" is not in the readable keys allowlist`,
-      policySource: ".q-ring.json policy.mcp.readableKeys"
-    };
-  }
-  if (tags && policy.mcp.deniedTags) {
-    const blocked = tags.find((t) => policy.mcp.deniedTags.includes(t));
-    if (blocked) {
-      return {
-        allowed: false,
-        reason: `Tag "${blocked}" is denied by project policy`,
-        policySource: ".q-ring.json policy.mcp.deniedTags"
-      };
-    }
-  }
-  return { allowed: true, policySource: ".q-ring.json" };
-}
-function checkExecPolicy(command, projectPath) {
-  const policy = loadPolicy(projectPath);
-  if (!policy.exec) return { allowed: true, policySource: "no-policy" };
-  if (policy.exec.denyCommands) {
-    const denied = policy.exec.denyCommands.find((d) => command.includes(d));
-    if (denied) {
-      return {
-        allowed: false,
-        reason: `Command containing "${denied}" is denied by project policy`,
-        policySource: ".q-ring.json policy.exec.denyCommands"
-      };
-    }
-  }
-  if (policy.exec.allowCommands) {
-    const allowed = policy.exec.allowCommands.some((a) => command.startsWith(a));
-    if (!allowed) {
-      return {
-        allowed: false,
-        reason: `Command "${command}" is not in the exec allowlist`,
-        policySource: ".q-ring.json policy.exec.allowCommands"
-      };
+// src/core/keyring.ts
+function withJitEnvelopeLock(service, key, fn) {
+  const dir = join7(homedir5(), ".config", "q-ring", "jit-locks");
+  mkdirSync5(dir, { recursive: true });
+  const safe = Buffer.from(`${service}\0${key}`, "utf8").toString("base64url");
+  const lockPath = join7(dir, `${safe}.lock`);
+  const deadline = Date.now() + 8e3;
+  while (Date.now() < deadline) {
+    try {
+      writeFileSync4(lockPath, `${process.pid}
+`, { flag: "wx", mode: 384 });
+      try {
+        return fn();
+      } finally {
+        try {
+          unlinkSync(lockPath);
+        } catch {
+        }
+      }
+    } catch {
+      const start = Date.now();
+      while (Date.now() - start < 15) {
+      }
     }
   }
-  return { allowed: true, policySource: ".q-ring.json" };
+  throw new Error("Could not acquire JIT envelope lock (timeout)");
 }
-function getExecMaxRuntime(projectPath) {
-  return loadPolicy(projectPath).exec?.maxRuntimeSeconds;
-}
-function getPolicySummary(projectPath) {
-  const policy = loadPolicy(projectPath);
-  return {
-    hasMcpPolicy: !!policy.mcp,
-    hasExecPolicy: !!policy.exec,
-    hasSecretPolicy: !!policy.secrets,
-    details: policy
-  };
-}
-
-// src/core/keyring.ts
 function readEnvelope(service, key) {
   const entry = new Entry(service, key);
   const raw = entry.getPassword();
@@ -1196,7 +1489,7 @@ function resolveEnv(opts) {
 }
 function resolveTemplates(value, opts, seen) {
   if (!value.includes("{{") || !value.includes("}}")) return value;
-  return value.replace(/\{\{([^}]+)\}\}/g, (match, refKeyRaw) => {
+  return value.replace(/\{\{([^}]+)\}\}/g, (_match, refKeyRaw) => {
     const refKey = refKeyRaw.trim();
     const refValue = getSecret(refKey, { ...opts, _seen: seen });
     if (refValue === null) {
@@ -1207,7 +1500,7 @@ function resolveTemplates(value, opts, seen) {
 }
 function resolveTemplatesOffline(value, rawValues, seen) {
   if (!value.includes("{{") || !value.includes("}}")) return value;
-  return value.replace(/\{\{([^}]+)\}\}/g, (match, refKeyRaw) => {
+  return value.replace(/\{\{([^}]+)\}\}/g, (_match, refKeyRaw) => {
     const refKey = refKeyRaw.trim();
     if (seen.has(refKey)) {
       throw new Error(`Circular dependency detected: ${[...seen].join(" -> ")} -> ${refKey}`);
@@ -1277,11 +1570,27 @@ function getSecret(key, opts = {}) {
           isExpired = new Date(envelope.meta.jitExpiresAt).getTime() <= Date.now();
         }
         if (isExpired) {
-          const result = provider.provision(value);
-          envelope.states = envelope.states ?? {};
-          envelope.states["jit"] = result.value;
-          envelope.meta.jitExpiresAt = result.expiresAt;
-          writeEnvelope(service, key, envelope);
+          const jitConfigSource = value;
+          withJitEnvelopeLock(service, key, () => {
+            const latest = readEnvelope(service, key);
+            if (!latest?.meta.jitProvider) return;
+            let innerExpired = true;
+            if (latest.states && latest.states["jit"] && latest.meta.jitExpiresAt) {
+              innerExpired = new Date(latest.meta.jitExpiresAt).getTime() <= Date.now();
+            }
+            if (!innerExpired) {
+              envelope.states = latest.states;
+              envelope.meta.jitExpiresAt = latest.meta.jitExpiresAt;
+              return;
+            }
+            const result = provider.provision(jitConfigSource);
+            latest.states = latest.states ?? {};
+            latest.states["jit"] = result.value;
+            latest.meta.jitExpiresAt = result.expiresAt;
+            writeEnvelope(service, key, latest);
+            envelope.states = latest.states;
+            envelope.meta.jitExpiresAt = latest.meta.jitExpiresAt;
+          });
         }
         value = envelope.states["jit"];
       }
@@ -1323,6 +1632,20 @@ function setSecret(key, value, opts = {}) {
   const prov = opts.provider ?? existing?.meta.provider;
   const reqApp = opts.requiresApproval ?? existing?.meta.requiresApproval;
   const jitProv = opts.jitProvider ?? existing?.meta.jitProvider;
+  const mergedTags = opts.tags ?? existing?.meta.tags;
+  const ttlForPolicy = opts.ttlSeconds ?? existing?.meta.ttlSeconds;
+  const life = checkSecretLifecyclePolicy(
+    {
+      tags: mergedTags,
+      ttlSeconds: ttlForPolicy,
+      rotationFormat: rotFmt,
+      requiresApproval: !!reqApp
+    },
+    opts.projectPath
+  );
+  if (!life.allowed) {
+    throw new Error(life.reason ?? "Secret lifecycle policy denied");
+  }
   if (opts.states) {
     envelope = createEnvelope("", {
       states: opts.states,
@@ -1639,7 +1962,125 @@ function tunnelList() {
   return result;
 }
 
+// src/core/memory.ts
+import { existsSync as existsSync6, readFileSync as readFileSync7, writeFileSync as writeFileSync5, mkdirSync as mkdirSync6 } from "fs";
+import { join as join8 } from "path";
+import { homedir as homedir6, hostname, userInfo } from "os";
+import { createCipheriv, createDecipheriv, createHash as createHash3, randomBytes as randomBytes3 } from "crypto";
+import { Entry as Entry2 } from "@napi-rs/keyring";
+var MEMORY_FILE = "agent-memory.enc";
+var KEYRING_SERVICE = "qring-memory-key";
+var KEYRING_ACCOUNT = "encryption-key";
+function getMemoryDir() {
+  const dir = join8(homedir6(), ".config", "q-ring");
+  if (!existsSync6(dir)) {
+    mkdirSync6(dir, { recursive: true });
+  }
+  return dir;
+}
+function getMemoryPath() {
+  return join8(getMemoryDir(), MEMORY_FILE);
+}
+function deriveLegacyKey() {
+  const fingerprint = `qring-memory:${hostname()}:${userInfo().username}`;
+  return createHash3("sha256").update(fingerprint).digest();
+}
+function getOrCreateKey() {
+  try {
+    const entry = new Entry2(KEYRING_SERVICE, KEYRING_ACCOUNT);
+    const stored = entry.getPassword();
+    if (stored) return Buffer.from(stored, "base64");
+    const key = randomBytes3(32);
+    entry.setPassword(key.toString("base64"));
+    return key;
+  } catch {
+    console.warn("[q-ring] OS keyring unavailable for memory key \u2014 falling back to machine-derived key");
+    return deriveLegacyKey();
+  }
+}
+function encryptWith(data, key) {
+  const iv = randomBytes3(12);
+  const cipher = createCipheriv("aes-256-gcm", key, iv);
+  const encrypted = Buffer.concat([cipher.update(data, "utf8"), cipher.final()]);
+  const tag = cipher.getAuthTag();
+  return `${iv.toString("base64")}:${tag.toString("base64")}:${encrypted.toString("base64")}`;
+}
+function decryptWith(blob, key) {
+  const parts = blob.split(":");
+  if (parts.length !== 3) throw new Error("Invalid encrypted format");
+  const iv = Buffer.from(parts[0], "base64");
+  const tag = Buffer.from(parts[1], "base64");
+  const encrypted = Buffer.from(parts[2], "base64");
+  const decipher = createDecipheriv("aes-256-gcm", key, iv);
+  decipher.setAuthTag(tag);
+  return decipher.update(encrypted) + decipher.final("utf8");
+}
+function encrypt(data) {
+  return encryptWith(data, getOrCreateKey());
+}
+function decrypt(blob) {
+  const key = getOrCreateKey();
+  try {
+    return decryptWith(blob, key);
+  } catch {
+    const legacy = deriveLegacyKey();
+    const plain = decryptWith(blob, legacy);
+    writeFileSync5(getMemoryPath(), encryptWith(plain, key), "utf8");
+    return plain;
+  }
+}
+function loadStore() {
+  const path = getMemoryPath();
+  if (!existsSync6(path)) {
+    return { entries: {} };
+  }
+  try {
+    const raw = readFileSync7(path, "utf8");
+    const decrypted = decrypt(raw);
+    return JSON.parse(decrypted);
+  } catch {
+    return { entries: {} };
+  }
+}
+function saveStore(store) {
+  const json = JSON.stringify(store);
+  const encrypted = encrypt(json);
+  writeFileSync5(getMemoryPath(), encrypted, "utf8");
+}
+function remember(key, value) {
+  const store = loadStore();
+  store.entries[key] = {
+    value,
+    updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  saveStore(store);
+}
+function recall(key) {
+  const store = loadStore();
+  return store.entries[key]?.value ?? null;
+}
+function listMemory() {
+  const store = loadStore();
+  return Object.entries(store.entries).map(([key, entry]) => ({
+    key,
+    updatedAt: entry.updatedAt
+  }));
+}
+function forget(key) {
+  const store = loadStore();
+  if (key in store.entries) {
+    delete store.entries[key];
+    saveStore(store);
+    return true;
+  }
+  return false;
+}
+function clearMemory() {
+  saveStore({ entries: {} });
+}
+
 export {
+  PACKAGE_VERSION,
   checkDecay,
   readProjectConfig,
   collapseEnvironment,
@@ -1649,7 +2090,7 @@ export {
   exportAudit,
   detectAnomalies,
   listEntanglements,
-  httpRequest_,
+  httpRequest,
   checkSSRF,
   registerHook,
   removeHook,
@@ -1676,6 +2117,11 @@ export {
   tunnelCreate,
   tunnelRead,
   tunnelDestroy,
-  tunnelList
+  tunnelList,
+  remember,
+  recall,
+  listMemory,
+  forget,
+  clearMemory
 };
-//# sourceMappingURL=chunk-JV4JFWV6.js.map
+//# sourceMappingURL=chunk-A4RZVP3P.js.map