@akasecurity/ai-tc-claude-code 0.9.2 → 0.9.4

package/scripts/pre-tool-use.js

@@ -492,11 +492,11 @@ var require_ignore = __commonJS({
 });
 
 // ../../packages/plugin-sdk/src/config.ts
-import { existsSync as existsSync3 } from "fs";
-import { join as join6 } from "path";
+import { existsSync as existsSync4 } from "fs";
+import { join as join7 } from "path";
 
 // ../../packages/persistence/src/database.ts
-import { randomUUID as randomUUID8 } from "crypto";
+import { randomUUID as randomUUID9 } from "crypto";
 import { existsSync, renameSync as renameSync2, rmSync as rmSync2 } from "fs";
 import { join, sep } from "path";
 import { DatabaseSync } from "node:sqlite";
@@ -562,6 +562,22 @@ var SQLITE_MIGRATIONS = [
   {
     tag: "0014_drop_legacy_events_findings",
     sql: "-- Custom migration: drops the frozen legacy `events`/`findings` tables\n-- (superseded by audit_events/inspection_definitions/inspection_findings) and\n-- replaces them with read-only views of the same name.\n--\n-- persistence's migrations.ts applies this migration ONLY once the batched\n-- history backfill (see runLegacyHistoryBackfill) has fully drained both\n-- tables, and only after copying the live file aside \u2014 see\n-- backupBeforeLegacyDrop in packages/persistence/src/migrations.ts. A store\n-- still mid-copy keeps its real tables and this migration stays pending.\n--\n-- The views exist for skew: the `aka` CLI and the Claude Code plugin update\n-- independently against one shared store, so an older, already-installed\n-- binary can open a store a newer binary already dropped these tables on.\n-- Every already-shipped repository constructor prepares its SQL eagerly at\n-- open time, so a bare \"table not found\" would fail the WHOLE open, not just\n-- a findings-specific read \u2014 these views keep `prepare()` succeeding so an\n-- old binary's unrelated features keep working; its own reads stay truthful,\n-- and its rare (already fail-open) writes fail at run time instead.\n--\n-- The 0009/0010 expression indexes existed only over the legacy `events`\n-- table; DROP TABLE below would remove them implicitly, but they are\n-- dropped explicitly first so the intent reads clearly. IF EXISTS so a store\n-- that reached here with an index missing out of band (an adopted-tag store\n-- whose physical index was never built) does not throw a deterministic \"no\n-- such index\" out of the fail-open drop path.\nDROP INDEX IF EXISTS `idx_events_code_change_path`;\n--> statement-breakpoint\nDROP INDEX IF EXISTS `idx_events_session_id`;\n--> statement-breakpoint\n-- `findings.event_id` references `events.id` \u2014 drop the child first.\nDROP TABLE `findings`;\n--> statement-breakpoint\nDROP TABLE `events`;\n--> statement-breakpoint\n-- Legacy `events` shape, projected from audit_events: `kind`/`occurred_at`/\n-- `source_tool` become real columns again (source_tool round-trips through\n-- the attributes bag, the only place a capture-typed audit row keeps it);\n-- `metadata` is reconstructed as the old camelCase JSON object from the new\n-- snake_case attributes bag, with `root_session_id` folded back in as\n-- `sessionId` (the one legacy metadata key that became a column, never an\n-- attribute, on the new table). Constrained to the four capture kinds so\n-- structural rows (session/run/tool_call/llm_call/source_lookup/config_scan)\n-- never leak into a legacy reader's result set \u2014 the old `events` table\n-- never held them either.\nCREATE VIEW `events` AS\nSELECT\n  id,\n  json_extract(attributes, '$.source_tool') AS source_tool,\n  event_type AS kind,\n  started_at AS occurred_at,\n  content_hash,\n  content,\n  -- Plugin-local bookkeeping column that `ensureSyncedAtColumn` adds to the\n  -- real `events` table at open time. A pre-cutover binary runs that probe on\n  -- EVERY open; without this projection its `columnNames('events')` check\n  -- misses `synced_at` and issues `ALTER TABLE events ADD COLUMN` against this\n  -- view, which SQLite rejects (\"Cannot add a column to a view\") \u2014 a hard,\n  -- non-fail-open crash of the whole open, the exact skew failure these views\n  -- exist to prevent. Projecting it (always NULL; no reader consumes it)\n  -- short-circuits that ALTER.\n  NULL AS synced_at,\n  json_object(\n    'sessionId', root_session_id,\n    'repo', json_extract(attributes, '$.repo'),\n    'filePath', json_extract(attributes, '$.file_path'),\n    'toolName', json_extract(attributes, '$.tool_name'),\n    'gitignored', json_extract(attributes, '$.gitignored'),\n    'wholeFile', json_extract(attributes, '$.whole_file'),\n    'model', json_extract(attributes, '$.model'),\n    'turnIndex', json_extract(attributes, '$.turn_index'),\n    'correlationId', json_extract(attributes, '$.correlation_id'),\n    'traceId', json_extract(attributes, '$.trace_id'),\n    'exceptionIds', json_extract(attributes, '$.exception_ids')\n  ) AS metadata\nFROM audit_events\nWHERE event_type IN ('prompt', 'response', 'code_change', 'tool_use');\n--> statement-breakpoint\n-- A plain single-row INSERT (the old writer's shape \u2014 no ON CONFLICT) is\n-- accepted by prepare() against a view once an INSTEAD OF INSERT trigger\n-- exists, so it fails at run time instead of at open \u2014 landing in the same\n-- fail-open path the caller already wraps its write in.\nCREATE TRIGGER `trg_events_ro`\nINSTEAD OF INSERT ON `events`\nBEGIN SELECT RAISE(ABORT, 'events is read-only; write to audit_events instead'); END;\n--> statement-breakpoint\n-- Legacy `findings` shape: rule_id/category/severity come from the joined\n-- inspection_definitions row (the legacy table inlined them per-row; the\n-- generalized schema normalizes them out into the shared definition). A view\n-- has no rowid of its own, so the underlying table's rowid is re-exposed\n-- explicitly under that name \u2014 a legacy reader ordering by `f.rowid` would\n-- otherwise fail to resolve the column at all. Joined to audit_events for the\n-- same four-capture-kind constraint as the events view above (a finding\n-- attached to a tool_call/config_scan row never existed in the legacy table\n-- either \u2014 see the persistence findings repository's identical predicate).\nCREATE VIEW `findings` AS\nSELECT\n  f.id AS id,\n  f.rowid AS rowid,\n  f.audit_event_id AS event_id,\n  d.rule_id AS rule_id,\n  d.category AS category,\n  d.severity AS severity,\n  f.span_start AS span_start,\n  f.span_end AS span_end,\n  f.masked_match AS masked_match,\n  f.action_taken AS action_taken,\n  f.confidence AS confidence,\n  f.finding_key AS finding_key,\n  f.first_detected_at AS first_detected_at\nFROM inspection_findings f\nJOIN audit_events e ON e.id = f.audit_event_id\nJOIN inspection_definitions d ON d.id = f.inspection_definition_id\nWHERE e.event_type IN ('prompt', 'response', 'code_change', 'tool_use');\n--> statement-breakpoint\n-- Defense in depth only: SQLite refuses to plan ANY upsert against a view\n-- (\"cannot UPSERT a view\") no matter what trigger exists, so this can never\n-- rescue the real legacy writer, which always used\n-- `ON CONFLICT (finding_key) DO UPDATE` \u2014 that statement still fails at\n-- prepare() on an old binary, same as it would with no trigger at all. This\n-- only covers a plain-INSERT shape, should one ever exist.\nCREATE TRIGGER `trg_findings_ro`\nINSTEAD OF INSERT ON `findings`\nBEGIN SELECT RAISE(ABORT, 'findings is read-only; write to inspection_findings instead'); END;\n"
+  },
+  {
+    tag: "0015_busy_vengeance",
+    sql: "CREATE TABLE `secret_vault` (\n	`pointer_id` text PRIMARY KEY NOT NULL,\n	`value_fingerprint` text NOT NULL,\n	`fingerprint_key_version` integer NOT NULL,\n	`key_version` integer NOT NULL,\n	`category` text NOT NULL,\n	`rule_id` text NOT NULL,\n	`masked_match` text NOT NULL,\n	`provider` text,\n	`ciphertext` text NOT NULL,\n	`nonce` text NOT NULL,\n	`auth_tag` text NOT NULL,\n	`occurrence_count` integer DEFAULT 1 NOT NULL,\n	`first_seen` integer NOT NULL,\n	`last_seen` integer NOT NULL\n);\n--> statement-breakpoint\nCREATE UNIQUE INDEX `uq_secret_vault_value` ON `secret_vault` (`value_fingerprint`);--> statement-breakpoint\nCREATE TABLE `secret_vault_deref` (\n	`id` text PRIMARY KEY NOT NULL,\n	`pointer_id` text NOT NULL,\n	`at` integer NOT NULL,\n	`target` text NOT NULL,\n	`reason` text NOT NULL,\n	`outcome` text NOT NULL,\n	`grant_id` text,\n	`pointer_count` integer DEFAULT 1 NOT NULL\n);\n--> statement-breakpoint\nCREATE INDEX `idx_secret_vault_deref_pointer` ON `secret_vault_deref` (`pointer_id`);--> statement-breakpoint\nCREATE INDEX `idx_secret_vault_deref_reason_at` ON `secret_vault_deref` (`reason`,`at`);"
+  },
+  {
+    tag: "0016_breezy_zodiak",
+    sql: "ALTER TABLE `exceptions` ADD `capability` text DEFAULT 'suppress' NOT NULL;"
+  },
+  {
+    tag: "0017_rainy_kat_farrell",
+    sql: "CREATE TABLE `secret_vault_sighting` (\n	`id` text PRIMARY KEY NOT NULL,\n	`pointer_id` text NOT NULL,\n	`location` text NOT NULL,\n	`kind` text NOT NULL,\n	`first_seen` integer NOT NULL,\n	`last_seen` integer NOT NULL\n);\n--> statement-breakpoint\nCREATE UNIQUE INDEX `uq_secret_vault_sighting` ON `secret_vault_sighting` (`pointer_id`,`location`);"
+  },
+  {
+    tag: "0018_serious_tana_nile",
+    sql: "ALTER TABLE `secret_vault` ADD `format_version` integer DEFAULT 2 NOT NULL;"
   }
 ];
 
@@ -16218,6 +16234,7 @@ var ExceptionConditions = external_exports.object({
   sourceTool: external_exports.string().optional(),
   provider: external_exports.string().optional()
 }).strict();
+var ExceptionCapability = external_exports.enum(["suppress", "reveal_to_model"]);
 var DetectionException = external_exports.object({
   id: external_exports.guid(),
   ruleId: external_exports.string(),
@@ -16234,6 +16251,7 @@ var DetectionException = external_exports.object({
   keyVersion: external_exports.number().int().positive(),
   // maskMatch() preview of the approved value — never the raw value.
   maskedValue: external_exports.string(),
+  capability: ExceptionCapability.default("suppress"),
   scope: ExceptionScope,
   expiresAt: external_exports.iso.datetime().nullable(),
   maxUses: external_exports.number().int().positive().nullable(),
@@ -16257,6 +16275,7 @@ var ExceptionBundleEntry = DetectionException.pick({
   ruleId: true,
   valueFingerprint: true,
   keyVersion: true,
+  capability: true,
   expiresAt: true,
   maxUses: true,
   useCount: true,
@@ -17361,8 +17380,129 @@ var PatchInstalledPackRequest = external_exports.object({
   message: "At least one field must be provided"
 }).meta({ id: "PatchInstalledPackRequest" });
 
+// ../../packages/schema/src/zod/vault.ts
+var POINTER_FORMAT_VERSION = 2;
+var CATEGORY_ALTERNATION = DetectionCategory.options.join("|");
+var POINTER_TOKEN_PATTERN = new RegExp(
+  `\\[\\[aka:(?:${CATEGORY_ALTERNATION}):[A-Z2-7]{2,7}\\.[A-Z2-7]{26}\\.[A-Z2-7]{16}\\]\\]`
+);
+var POINTER_TOKEN_ANCHORED = new RegExp(`^${POINTER_TOKEN_PATTERN.source}$`);
+function pointerTokenScanner() {
+  return new RegExp(POINTER_TOKEN_PATTERN.source, "g");
+}
+var PointerToken = external_exports.string().regex(POINTER_TOKEN_ANCHORED);
+var ParsedPointer = external_exports.object({
+  category: DetectionCategory,
+  keyVersion: external_exports.number().int().positive(),
+  pointerId: external_exports.string(),
+  tag: external_exports.string()
+});
+var VaultEntry = external_exports.object({
+  pointerId: external_exports.string(),
+  // The keyed HMAC of the raw value under `exception.key`, and the epoch it was
+  // derived under. This is what a reveal-to-model grant matches on, and it rotates
+  // independently of the vault encryption key below.
+  valueFingerprint: external_exports.string().regex(/^[0-9a-f]{64}$/),
+  fingerprintKeyVersion: external_exports.number().int().positive(),
+  // The vault-key epoch this row's ciphertext was sealed under.
+  keyVersion: external_exports.number().int().positive(),
+  // Fixed at first mint and never updated: the same value detected later under a
+  // different rule's category keeps the category it was minted with, so one
+  // value always produces exactly one wire token.
+  category: DetectionCategory,
+  ruleId: external_exports.string(),
+  // Partial-reveal preview for badges and listings. Never the raw value.
+  maskedMatch: external_exports.string(),
+  provider: external_exports.string().optional(),
+  ciphertext: external_exports.string(),
+  nonce: external_exports.string(),
+  authTag: external_exports.string(),
+  // How many times this value has been detected on this machine — the reuse
+  // signal the vault dashboard reads. Distinct from VaultDeref.pointerCount.
+  occurrenceCount: external_exports.number().int().nonnegative(),
+  firstSeen: external_exports.string(),
+  lastSeen: external_exports.string()
+});
+var PointerDescriptor = external_exports.object({
+  category: DetectionCategory,
+  provider: external_exports.string().optional(),
+  maskedMatch: external_exports.string(),
+  occurrences: external_exports.number().int().nonnegative(),
+  firstSeen: external_exports.string(),
+  lastSeen: external_exports.string()
+});
+var PointerIdentity = external_exports.object({
+  ruleId: external_exports.string(),
+  valueFingerprint: external_exports.string().regex(/^[0-9a-f]{64}$/),
+  fingerprintKeyVersion: external_exports.number().int().positive()
+});
+var DetokenizeTarget = external_exports.enum(["human", "model"]);
+var VaultDerefReason = external_exports.enum([
+  "display",
+  "explicit-reveal",
+  "view-render",
+  "model-input",
+  "remediation",
+  "purge"
+]);
+var VaultDerefOutcome = external_exports.enum(["revealed", "refused", "unavailable"]);
+var BATCHED_DEREF_REASONS = ["display", "view-render"];
+function isBatchedDerefReason(reason) {
+  return BATCHED_DEREF_REASONS.includes(reason);
+}
+var VaultDeref = external_exports.object({
+  id: external_exports.guid(),
+  pointerId: external_exports.string(),
+  at: external_exports.string(),
+  target: DetokenizeTarget,
+  reason: VaultDerefReason,
+  outcome: VaultDerefOutcome,
+  // Present only on a model-target crossing that a reveal grant authorized.
+  grantId: external_exports.string().optional(),
+  // How many pointers ONE batched render resolved. 1 for unbatched rows. Named
+  // apart from VaultEntry.occurrenceCount, which counts detections of a value.
+  pointerCount: external_exports.number().int().positive().default(1)
+});
+var VaultSightingKind = external_exports.enum([
+  "prompt",
+  "tool-input",
+  "tool-output",
+  "file",
+  "transcript"
+]);
+var VaultSighting = external_exports.object({
+  location: external_exports.string(),
+  kind: VaultSightingKind,
+  firstSeen: external_exports.string(),
+  lastSeen: external_exports.string()
+});
+var VaultInventoryEntry = external_exports.object({
+  pointerId: external_exports.string(),
+  category: DetectionCategory,
+  provider: external_exports.string().optional(),
+  maskedMatch: external_exports.string(),
+  occurrences: external_exports.number().int().nonnegative(),
+  firstSeen: external_exports.string(),
+  lastSeen: external_exports.string(),
+  // The active reveal-to-model grant covering this value, when one exists —
+  // the inventory badges it, the row links to revocation.
+  revealGrantId: external_exports.string().nullable(),
+  sightings: external_exports.array(VaultSighting)
+});
+var VaultKeyCustody = external_exports.string();
+var VaultInlineReveal = external_exports.enum(["masked", "full", "off"]);
+var VAULT_EVENT_NOTE_MAX_POINTERS = 8;
+var VAULT_CONSENT_VERSION = 1;
+var VaultConsent = external_exports.object({
+  acknowledgedAt: external_exports.iso.datetime(),
+  version: external_exports.number().int().positive()
+});
+function isVaultConsentValid(consent) {
+  return consent?.version === VAULT_CONSENT_VERSION;
+}
+
 // ../../packages/schema/src/zod/local.ts
-var WORKSPACE_SETTINGS_SPEC_VERSION = 4;
+var WORKSPACE_SETTINGS_SPEC_VERSION = 5;
 var RunMode = external_exports.enum(["standalone"]);
 var SimpleDetectionPolicy = external_exports.enum(["redact", "warn"]);
 var HistoricalAccess = external_exports.enum(["full", "session-only"]);
@@ -17384,6 +17524,16 @@ var WorkspaceSettings = external_exports.object({
   // In-place egress extraction on the scan paths; disable to stop all Data
   // Shares writes.
   dataSharesInPlace: external_exports.boolean().default(true),
+  // Consent to keep a RECOVERABLE encrypted copy of detected values in the local
+  // vault, instead of destroying them. Absent by default: this is a custody
+  // change from one-way redaction, so it is never an assumed grant on upgrade.
+  // Revoking stops future vaulting; it does not erase what is already stored —
+  // purging the vault is the eraser.
+  vaultConsent: VaultConsent.optional(),
+  // Where the vault master key lives.
+  vaultKeyCustody: VaultKeyCustody.default("file"),
+  // How a pointer renders in assistant prose on screen (see VaultInlineReveal).
+  vaultInlineReveal: VaultInlineReveal.default("masked"),
   // Absent until /aka:setup completes; its presence is what "onboarded" means.
   onboardedAt: external_exports.iso.datetime().optional(),
   // Records that the user consented to sending findings to the model API for
@@ -19798,6 +19948,9 @@ var AmbiguousExceptionIdError = class extends Error {
 var ACTIVE_PREDICATE = `revoked_at IS NULL
      AND (expires_at IS NULL OR expires_at > :now)
      AND (max_uses IS NULL OR use_count < max_uses)`;
+var ACTIVE_REVEAL_GRANT_PREDICATE = `capability = 'reveal_to_model'
+     AND conditions IS NULL
+     AND ${ACTIVE_PREDICATE}`;
 var SqliteExceptionsRepository = class {
   constructor(db) {
     this.db = db;
@@ -19889,11 +20042,11 @@ var SqliteExceptionsRepository = class {
     this.db.prepare(
       `INSERT INTO exceptions (
              id, rule_id, category, value_fingerprint, key_version, masked_value,
-             scope, expires_at, max_uses, use_count, last_used_at, justification,
-             conditions, created_by, created_via, created_at, updated_at
+             capability, scope, expires_at, max_uses, use_count, last_used_at,
+             justification, conditions, created_by, created_via, created_at, updated_at
            ) VALUES (
              :id, :ruleId, :category, :valueFingerprint, :keyVersion, :maskedValue,
-             :scope, :expiresAt, :maxUses, 0, NULL, :justification,
+             :capability, :scope, :expiresAt, :maxUses, 0, NULL, :justification,
              :conditions, :createdBy, :createdVia, :now, :now
            )`
     ).run({
@@ -19903,6 +20056,7 @@ var SqliteExceptionsRepository = class {
       valueFingerprint: input.valueFingerprint,
       keyVersion: input.keyVersion,
       maskedValue: input.maskedValue,
+      capability: input.capability ?? "suppress",
       scope: input.scope,
       expiresAt: input.expiresAt === null ? null : isoToEpochMillis(input.expiresAt),
       maxUses: input.maxUses,
@@ -19996,6 +20150,7 @@ var SqliteExceptionsRepository = class {
         ruleId: row.rule_id,
         valueFingerprint: row.value_fingerprint,
         keyVersion: row.key_version,
+        capability: row.capability,
         expiresAt: row.expires_at === null ? null : epochMillisToIso(row.expires_at),
         maxUses: row.max_uses,
         useCount: row.use_count,
@@ -20050,6 +20205,35 @@ var SqliteExceptionsRepository = class {
       }))
     );
   }
+  /**
+   * The active reveal-to-model grant for a vaulted value's identity, or null.
+   * Matching is exact on (ruleId, valueFingerprint, keyVersion) — the same key
+   * suppression uses — plus the capability: a suppression grant must never
+   * authorize a reveal. Read-only: the caller does NOT consume here, because a
+   * revealed value re-enters the detection scan immediately afterward and the
+   * suppression match there claims the use — one crossing, one use.
+   *
+   * A grant with `conditions` NEVER matches here: the reveal path does not yet
+   * evaluate conditions, and a narrowing clause that is ignored would WIDEN the
+   * grant instead. Fail closed until reveal-side condition evaluation exists.
+   */
+  activeRevealGrant(ruleId, valueFingerprint, keyVersion, now = Date.now()) {
+    try {
+      const row = getRow(
+        this.db.prepare(
+          `SELECT id FROM exceptions
+            WHERE rule_id = :ruleId AND value_fingerprint = :valueFingerprint
+              AND key_version = :keyVersion
+              AND ${ACTIVE_REVEAL_GRANT_PREDICATE}
+            LIMIT 1`
+        ),
+        { ruleId, valueFingerprint, keyVersion, now }
+      );
+      return Promise.resolve(row ?? null);
+    } catch (err) {
+      return Promise.reject(err instanceof Error ? err : new Error(String(err)));
+    }
+  }
   /**
    * Retention sweep: delete TERMINAL rows (revoked, expired, or use-budget
    * exhausted) whose last transition is older than the retention window.
@@ -20077,6 +20261,7 @@ function parseExceptionRow(row) {
     valueFingerprint: row.value_fingerprint,
     keyVersion: row.key_version,
     maskedValue: row.masked_value,
+    capability: row.capability,
     scope: row.scope,
     expiresAt: row.expires_at === null ? null : epochMillisToIso(row.expires_at),
     maxUses: row.max_uses,
@@ -22242,6 +22427,287 @@ var SqliteScanLedgerRepository = class {
   }
 };
 
+// ../../packages/persistence/src/repositories/secret-vault.ts
+import { randomUUID as randomUUID7 } from "crypto";
+var SELECT_COLUMNS = `
+  pointer_id AS pointerId,
+  value_fingerprint AS valueFingerprint,
+  fingerprint_key_version AS fingerprintKeyVersion,
+  key_version AS keyVersion,
+  format_version AS formatVersion,
+  category,
+  rule_id AS ruleId,
+  masked_match AS maskedMatch,
+  provider,
+  ciphertext,
+  nonce,
+  auth_tag AS authTag,
+  occurrence_count AS occurrenceCount,
+  first_seen AS firstSeen,
+  last_seen AS lastSeen`;
+function toRow(raw) {
+  const { provider, ...rest } = raw;
+  return provider === null ? rest : { ...rest, provider };
+}
+var SqliteSecretVaultRepository = class {
+  constructor(db) {
+    this.db = db;
+    this.insertStmt = db.prepare(
+      `INSERT INTO secret_vault (
+         pointer_id, value_fingerprint, fingerprint_key_version, key_version,
+         format_version, category, rule_id, masked_match, provider,
+         ciphertext, nonce, auth_tag,
+         occurrence_count, first_seen, last_seen
+       ) VALUES (
+         :pointerId, :valueFingerprint, :fingerprintKeyVersion, :keyVersion,
+         :formatVersion, :category, :ruleId, :maskedMatch, :provider,
+         :ciphertext, :nonce, :authTag,
+         1, :now, :now
+       )`
+    );
+    this.bumpStmt = db.prepare(
+      `UPDATE secret_vault
+       SET occurrence_count = occurrence_count + 1, last_seen = :now
+       WHERE value_fingerprint = :valueFingerprint`
+    );
+    this.byPointerStmt = db.prepare(
+      `SELECT ${SELECT_COLUMNS} FROM secret_vault WHERE pointer_id = :pointerId`
+    );
+    this.byFingerprintStmt = db.prepare(
+      `SELECT ${SELECT_COLUMNS} FROM secret_vault WHERE value_fingerprint = :valueFingerprint`
+    );
+    this.listStmt = db.prepare(`SELECT ${SELECT_COLUMNS} FROM secret_vault ORDER BY first_seen`);
+    this.replaceCiphertextStmt = db.prepare(
+      `UPDATE secret_vault
+       SET key_version = :keyVersion, ciphertext = :ciphertext, nonce = :nonce, auth_tag = :authTag
+       WHERE pointer_id = :pointerId`
+    );
+    this.refreshFingerprintStmt = db.prepare(
+      `UPDATE secret_vault
+       SET value_fingerprint = :valueFingerprint, fingerprint_key_version = :fingerprintKeyVersion
+       WHERE pointer_id = :pointerId`
+    );
+    this.derefStmt = db.prepare(
+      `INSERT INTO secret_vault_deref (id, pointer_id, at, target, reason, outcome, grant_id, pointer_count)
+       VALUES (:id, :pointerId, :at, :target, :reason, :outcome, :grantId, :pointerCount)`
+    );
+  }
+  db;
+  insertStmt;
+  bumpStmt;
+  byPointerStmt;
+  byFingerprintStmt;
+  listStmt;
+  replaceCiphertextStmt;
+  refreshFingerprintStmt;
+  derefStmt;
+  /**
+   * Vault a value, or record another sighting of one already vaulted. Keyed on
+   * `valueFingerprint`, never on the caller's pointer id: a value seen again
+   * bumps `occurrence_count` and `last_seen` and comes back with its ORIGINAL
+   * pointer, category and ciphertext, so the same secret always resolves to one
+   * wire token. `minted` is true only when this call created the row.
+   *
+   * The read-then-write runs in one IMMEDIATE transaction so two concurrent
+   * writers cannot both decide they are minting.
+   */
+  upsert(input, now) {
+    let minted = false;
+    withTransaction(
+      this.db,
+      () => {
+        const existing = getRow(this.byFingerprintStmt, {
+          valueFingerprint: input.valueFingerprint
+        });
+        if (existing === void 0) {
+          this.insertStmt.run(
+            bindParams({
+              pointerId: input.pointerId,
+              valueFingerprint: input.valueFingerprint,
+              fingerprintKeyVersion: input.fingerprintKeyVersion,
+              keyVersion: input.keyVersion,
+              formatVersion: input.formatVersion ?? POINTER_FORMAT_VERSION,
+              category: input.category,
+              ruleId: input.ruleId,
+              maskedMatch: input.maskedMatch,
+              provider: input.provider,
+              ciphertext: input.ciphertext,
+              nonce: input.nonce,
+              authTag: input.authTag,
+              now
+            })
+          );
+          minted = true;
+          return;
+        }
+        this.bumpStmt.run({ valueFingerprint: input.valueFingerprint, now });
+      },
+      "IMMEDIATE"
+    );
+    const row = getRow(this.byFingerprintStmt, {
+      valueFingerprint: input.valueFingerprint
+    });
+    if (row === void 0) throw new Error("vault: row vanished immediately after write");
+    return { row: toRow(row), minted };
+  }
+  byPointerId(pointerId) {
+    const raw = getRow(this.byPointerStmt, { pointerId });
+    return raw === void 0 ? null : toRow(raw);
+  }
+  byValueFingerprint(fingerprint) {
+    const raw = getRow(this.byFingerprintStmt, { valueFingerprint: fingerprint });
+    return raw === void 0 ? null : toRow(raw);
+  }
+  /** Append one audit row. Carries no raw value and no ciphertext, by shape. */
+  recordDeref(entry) {
+    this.derefStmt.run(
+      bindParams({
+        id: entry.id,
+        pointerId: entry.pointerId,
+        at: entry.at,
+        target: entry.target,
+        reason: entry.reason,
+        outcome: entry.outcome,
+        grantId: entry.grantId,
+        pointerCount: entry.pointerCount ?? 1
+      })
+    );
+  }
+  listAll() {
+    return allRows(this.listStmt).map(toRow);
+  }
+  /** Re-seal an entry under a new key epoch, leaving its identity untouched. */
+  replaceCiphertext(pointerId, next) {
+    this.replaceCiphertextStmt.run({ pointerId, ...next });
+  }
+  /** Re-derive an entry's fingerprint under a new fingerprint-key epoch. */
+  refreshFingerprint(pointerId, next) {
+    this.refreshFingerprintStmt.run({ pointerId, ...next });
+  }
+  /**
+   * Destroy every vaulted value and report how many were destroyed. The deref
+   * audit is left alone on purpose — see the table note above.
+   */
+  purgeAll() {
+    let destroyed = 0;
+    withTransaction(
+      this.db,
+      () => {
+        destroyed = this.countEntries();
+        this.db.exec("DELETE FROM secret_vault");
+      },
+      "IMMEDIATE"
+    );
+    return destroyed;
+  }
+  /**
+   * Record (or re-stamp) one place a pointer has been written. One row per
+   * (pointer, location); a re-sighting bumps last_seen. Best-effort bookkeeping
+   * on hook paths — a failure must never affect the rewrite that triggered it,
+   * so callers wrap this, not the other way around.
+   */
+  recordSighting(entry, now) {
+    this.db.prepare(
+      `INSERT INTO secret_vault_sighting (id, pointer_id, location, kind, first_seen, last_seen)
+         VALUES (:id, :pointerId, :location, :kind, :now, :now)
+         ON CONFLICT (pointer_id, location) DO UPDATE SET last_seen = :now`
+    ).run({
+      id: randomUUID7(),
+      pointerId: entry.pointerId,
+      location: entry.location,
+      kind: entry.kind,
+      now
+    });
+  }
+  listSightings(pointerId) {
+    const rows = allRows(
+      this.db.prepare(
+        `SELECT location, kind, first_seen, last_seen FROM secret_vault_sighting
+          WHERE pointer_id = :pointerId ORDER BY last_seen DESC`
+      ),
+      { pointerId }
+    );
+    return rows.map((r) => ({
+      location: r.location,
+      kind: r.kind,
+      firstSeen: new Date(r.first_seen).toISOString(),
+      lastSeen: new Date(r.last_seen).toISOString()
+    }));
+  }
+  /**
+   * The dashboard inventory: every vaulted value's descriptor data joined with
+   * its sightings and the active reveal-to-model grant when one exists.
+   * Raw-free by construction — neither the fingerprint nor the ciphertext
+   * columns are selected.
+   */
+  listInventory(now = Date.now()) {
+    const rows = allRows(
+      this.db.prepare(
+        `SELECT v.pointer_id, v.category, v.rule_id, v.masked_match, v.provider,
+                v.occurrence_count, v.first_seen, v.last_seen,
+                (SELECT e.id FROM exceptions e
+                  WHERE e.rule_id = v.rule_id
+                    AND e.value_fingerprint = v.value_fingerprint
+                    AND e.key_version = v.fingerprint_key_version
+                    AND ${ACTIVE_REVEAL_GRANT_PREDICATE}
+                  LIMIT 1) AS grant_id
+           FROM secret_vault v
+          ORDER BY v.last_seen DESC`
+      ),
+      { now }
+    );
+    return rows.map((r) => ({
+      pointerId: r.pointer_id,
+      category: r.category,
+      ...r.provider === null ? {} : { provider: r.provider },
+      maskedMatch: r.masked_match,
+      occurrences: r.occurrence_count,
+      firstSeen: new Date(r.first_seen).toISOString(),
+      lastSeen: new Date(r.last_seen).toISOString(),
+      revealGrantId: r.grant_id,
+      sightings: this.listSightings(r.pointer_id)
+    }));
+  }
+  /**
+   * The de-reference trail, newest first. By default the batched, high-volume
+   * reasons (display, view-render) are hidden and counted instead — the rows
+   * that matter as a signal are the model crossings, and burying them under
+   * render noise would defeat the audit's purpose.
+   */
+  listDerefs(opts) {
+    const limit = opts?.limit ?? 200;
+    const where = opts?.includeBatched === true ? "" : `WHERE reason NOT IN ('display', 'view-render')`;
+    const rows = allRows(
+      this.db.prepare(
+        `SELECT id, pointer_id, at, target, reason, outcome, grant_id, pointer_count
+           FROM secret_vault_deref ${where}
+          ORDER BY at DESC, rowid DESC LIMIT :limit`
+      ),
+      { limit }
+    );
+    const hiddenBatched = opts?.includeBatched === true ? 0 : countScalar(
+      this.db,
+      `SELECT count(*) AS n FROM secret_vault_deref WHERE reason IN ('display', 'view-render')`
+    );
+    return {
+      rows: rows.map((r) => ({
+        id: r.id,
+        pointerId: r.pointer_id,
+        at: new Date(r.at).toISOString(),
+        target: r.target,
+        reason: r.reason,
+        outcome: r.outcome,
+        ...r.grant_id === null ? {} : { grantId: r.grant_id },
+        pointerCount: r.pointer_count
+      })),
+      hiddenBatched
+    };
+  }
+  countEntries() {
+    return countScalar(this.db, "SELECT COUNT(*) AS n FROM secret_vault");
+  }
+};
+
 // ../../packages/persistence/src/repositories/security.ts
 var DAY_MS4 = 864e5;
 var SEVERITIES = ["critical", "high", "medium", "low"];
@@ -22587,7 +23053,7 @@ var SqliteSecurityRepository = class {
 };
 
 // ../../packages/persistence/src/repositories/shares.ts
-import { randomUUID as randomUUID7 } from "crypto";
+import { randomUUID as randomUUID8 } from "crypto";
 var MAX_EGRESS_CALL_SITES_PER_PROJECT = 5e3;
 var IN_CHUNK = 500;
 var KIND_ORDER = ["provider", "internal", "external", "ip"];
@@ -22843,7 +23309,7 @@ var SqliteSharesRepository = class {
                (id, destination_id, host, decision, created_at, updated_at)
              VALUES (:id, :destinationId, :host, :decision, :now, :now)`
         ).run({
-          id: randomUUID7(),
+          id: randomUUID8(),
           destinationId,
           host: dest.host,
           decision,
@@ -22992,7 +23458,7 @@ var SqliteSharesRepository = class {
       let destinationId = destIds.get(hit.host);
       if (destinationId === void 0) {
         destStmt.run({
-          id: randomUUID7(),
+          id: randomUUID8(),
           kind: hit.kind,
           name: hit.name,
           host: hit.host,
@@ -23008,7 +23474,7 @@ var SqliteSharesRepository = class {
       let endpointId = endpointIds.get(endpointKey);
       if (endpointId === void 0) {
         endpointStmt.run({
-          id: randomUUID7(),
+          id: randomUUID8(),
           destinationId,
           method: hit.method,
           transport: hit.transport,
@@ -23021,7 +23487,7 @@ var SqliteSharesRepository = class {
         endpointIds.set(endpointKey, endpointId);
       }
       siteStmt.run({
-        id: randomUUID7(),
+        id: randomUUID8(),
         endpointId,
         project: input.project,
         projectKey: input.projectKey,
@@ -23389,11 +23855,22 @@ function purgeSampleData(db) {
 function linkHost(input, hostId) {
   return hostId ? { ...input, hostId } : input;
 }
+function closeQuietly(db) {
+  try {
+    db.close();
+  } catch {
+  }
+}
 function openWithPragmas(file2) {
   const db = new DatabaseSync(file2);
-  db.exec("PRAGMA journal_mode = WAL");
-  db.exec("PRAGMA busy_timeout = 2000");
-  db.exec("PRAGMA foreign_keys = ON");
+  try {
+    db.exec("PRAGMA journal_mode = WAL");
+    db.exec("PRAGMA busy_timeout = 2000");
+    db.exec("PRAGMA foreign_keys = ON");
+  } catch (err) {
+    closeQuietly(db);
+    throw err;
+  }
   return db;
 }
 function backupLegacyStore(file2) {
@@ -23405,43 +23882,82 @@ function backupLegacyStore(file2) {
   }
   return backup;
 }
+function openAndInitialize(file2) {
+  let db = openWithPragmas(file2);
+  try {
+    if (isForeignSqliteLineage(db)) {
+      db.close();
+      const backup = backupLegacyStore(file2);
+      db = openWithPragmas(file2);
+      akaWarn(
+        `Detected an older, incompatible (tenant-bearing) ${DB_FILENAME}; backed it up to ${backup} and created a fresh store.`
+      );
+    }
+    applyMigrations(db, file2);
+    tightenPerms(file2);
+    const policies = new SqlitePoliciesRepository(db);
+    const installedPacks = new SqliteInstalledPacksRepository(db);
+    const repositories = {
+      events: new SqliteEventsRepository(db),
+      findings: new SqliteFindingsRepository(db),
+      policies,
+      installedPacks,
+      scanLedger: new SqliteScanLedgerRepository(db),
+      secretVault: new SqliteSecretVaultRepository(db),
+      exceptions: new SqliteExceptionsRepository(db),
+      resolutions: new SqliteResolutionsRepository(db),
+      ruleProbeCache: new SqliteRuleProbeCacheRepository(db),
+      security: new SqliteSecurityRepository(db),
+      detections: new SqliteDetectionsRepository(db),
+      shares: new SqliteSharesRepository(db),
+      policyCatalog: new SqlitePolicyCatalogRepository(installedPacks),
+      inventory: new SqliteInventoryRepository(db),
+      inventoryAssets: new SqliteInventoryAssetsRepository(db),
+      projectFiles: new SqliteProjectFilesRepository(db),
+      activity: new SqliteActivityRepository(db),
+      sourceProject: new SqliteSourceProjectRepository(db),
+      auditEvents: new SqliteAuditEventsRepository(db),
+      classifiedData: new SqliteClassifiedDataRepository(db),
+      inspectionDefinitions: new SqliteInspectionDefinitionsRepository(db),
+      inspectionFindings: new SqliteInspectionFindingsRepository(db),
+      configInventory: new SqliteConfigInventoryRepository(db)
+    };
+    policies.seedDefaults();
+    return { db, ...repositories };
+  } catch (err) {
+    closeQuietly(db);
+    throw err;
+  }
+}
 function openLocalDatabase(dir) {
   ensureDataDirSync(dir);
   const file2 = join(dir, DB_FILENAME);
-  let db = openWithPragmas(file2);
-  if (isForeignSqliteLineage(db)) {
-    db.close();
-    const backup = backupLegacyStore(file2);
-    db = openWithPragmas(file2);
-    akaWarn(
-      `Detected an older, incompatible (tenant-bearing) ${DB_FILENAME}; backed it up to ${backup} and created a fresh store.`
-    );
-  }
-  applyMigrations(db, file2);
-  tightenPerms(file2);
-  const events = new SqliteEventsRepository(db);
-  const findings = new SqliteFindingsRepository(db);
-  const policies = new SqlitePoliciesRepository(db);
-  const installedPacks = new SqliteInstalledPacksRepository(db);
-  const scanLedger = new SqliteScanLedgerRepository(db);
-  const exceptions = new SqliteExceptionsRepository(db);
-  const resolutions = new SqliteResolutionsRepository(db);
-  const ruleProbeCache = new SqliteRuleProbeCacheRepository(db);
-  const security = new SqliteSecurityRepository(db);
-  const detections = new SqliteDetectionsRepository(db);
-  const shares = new SqliteSharesRepository(db);
-  const policyCatalog = new SqlitePolicyCatalogRepository(installedPacks);
-  const inventory = new SqliteInventoryRepository(db);
-  const inventoryAssets = new SqliteInventoryAssetsRepository(db);
-  const projectFiles = new SqliteProjectFilesRepository(db);
-  const activity = new SqliteActivityRepository(db);
-  const sourceProject = new SqliteSourceProjectRepository(db);
-  const auditEvents = new SqliteAuditEventsRepository(db);
-  const classifiedData = new SqliteClassifiedDataRepository(db);
-  const inspectionDefinitions = new SqliteInspectionDefinitionsRepository(db);
-  const inspectionFindings = new SqliteInspectionFindingsRepository(db);
-  const configInventory = new SqliteConfigInventoryRepository(db);
-  policies.seedDefaults();
+  const {
+    db,
+    events,
+    findings,
+    policies,
+    installedPacks,
+    scanLedger,
+    secretVault,
+    exceptions,
+    resolutions,
+    ruleProbeCache,
+    security,
+    detections,
+    shares,
+    policyCatalog,
+    inventory,
+    inventoryAssets,
+    projectFiles,
+    activity,
+    sourceProject,
+    auditEvents,
+    classifiedData,
+    inspectionDefinitions,
+    inspectionFindings,
+    configInventory
+  } = openAndInitialize(file2);
   function recordCapture(event, detected) {
     failOpenTransaction(db, () => {
       const sessionId = event.metadata?.sessionId;
@@ -23532,7 +24048,7 @@ function openLocalDatabase(dir) {
         const definitionId = definitionIds.get(`${finding.ruleId}@${finding.version}`);
         if (!definitionId) continue;
         inspectionFindings.insertFinding({
-          id: randomUUID8(),
+          id: randomUUID9(),
           auditEventId: record2.scanEvent.id,
           inspectionDefinitionId: definitionId,
           span: finding.span,
@@ -23609,6 +24125,7 @@ function openLocalDatabase(dir) {
     policies,
     installedPacks,
     scanLedger,
+    secretVault,
     exceptions,
     resolutions,
     ruleProbeCache,
@@ -23641,6 +24158,26 @@ function openLocalDatabase(dir) {
   };
 }
 
+// ../../packages/persistence/src/exception-policy.ts
+var UserGrantPolicyProvider = class {
+  #exceptions;
+  constructor(exceptions) {
+    this.#exceptions = exceptions;
+  }
+  async decideReveal(identity) {
+    try {
+      const grant = await this.#exceptions.activeRevealGrant(
+        identity.ruleId,
+        identity.valueFingerprint,
+        identity.fingerprintKeyVersion
+      );
+      return grant === null ? { allow: false } : { allow: true, grantId: grant.id };
+    } catch {
+      return { allow: false };
+    }
+  }
+};
+
 // ../../packages/persistence/src/finding-key.ts
 import { createHash as createHash3 } from "crypto";
 function normalizeFilePath(filePath) {
@@ -23653,8 +24190,9 @@ function computeFindingKey(input) {
 
 // ../../packages/persistence/src/fingerprint.ts
 import { createHmac, randomBytes } from "crypto";
-import { readFileSync } from "fs";
+import { existsSync as existsSync2, readFileSync } from "fs";
 import { join as join2 } from "path";
+import { DatabaseSync as DatabaseSync2 } from "node:sqlite";
 var KEY_FILENAME = "exception.key";
 var KEY_MATERIAL_BYTES = 32;
 function keyFilePath(dataDir2) {
@@ -23678,6 +24216,50 @@ function parseKeyFile(raw) {
   }
   return { version: version2, material: bytes };
 }
+var KEY_VERSION_COLUMNS = {
+  exceptions: "key_version",
+  blocked_detections: "key_version",
+  secret_vault: "fingerprint_key_version"
+};
+var SQLITE_ERROR = 1;
+var FLOOR_BUSY_TIMEOUT_MS = 250;
+var FloorUnreadableError = class extends Error {
+  code = "floor-unreadable";
+  constructor(cause) {
+    super(
+      `cannot read the stored fingerprint key versions: ${cause instanceof Error ? cause.message : String(cause)}`,
+      { cause }
+    );
+    this.name = "FloorUnreadableError";
+  }
+};
+function storedKeyVersionFloor(dataDir2) {
+  const file2 = join2(dataDir2, DB_FILENAME);
+  if (!existsSync2(file2)) return 0;
+  let db;
+  try {
+    db = new DatabaseSync2(file2, { readOnly: true });
+    db.exec(`PRAGMA busy_timeout = ${String(FLOOR_BUSY_TIMEOUT_MS)}`);
+    let floor = 0;
+    for (const [table, column] of Object.entries(KEY_VERSION_COLUMNS)) {
+      try {
+        const row = getRow(
+          db.prepare(`SELECT MAX(${column}) AS v FROM ${table}`)
+        );
+        floor = Math.max(floor, row?.v ?? 0);
+      } catch (err) {
+        if (err.errcode !== SQLITE_ERROR) {
+          throw new FloorUnreadableError(err);
+        }
+      }
+    }
+    return floor;
+  } catch (err) {
+    throw err instanceof FloorUnreadableError ? err : new FloorUnreadableError(err);
+  } finally {
+    db?.close();
+  }
+}
 function writeKeyFile(dataDir2, key) {
   ensureDataDirSync(dataDir2);
   const file2 = keyFilePath(dataDir2);
@@ -23702,7 +24284,10 @@ function loadOrCreateFingerprintKey(dataDir2) {
     tightenFile(keyFilePath(dataDir2));
     return existing;
   }
-  return writeKeyFile(dataDir2, { version: 1, material: randomBytes(KEY_MATERIAL_BYTES) });
+  return writeKeyFile(dataDir2, {
+    version: storedKeyVersionFloor(dataDir2) + 1,
+    material: randomBytes(KEY_MATERIAL_BYTES)
+  });
 }
 function fingerprintValue(key, raw) {
   return createHmac("sha256", key.material).update(raw, "utf8").digest("hex");
@@ -23725,6 +24310,9 @@ function dataDir(base = defaultDataDir()) {
 function dbPath(base = defaultDataDir()) {
   return join3(dataDir(base), "aka.db");
 }
+function keysDir(base = defaultDataDir()) {
+  return join3(base, "keys");
+}
 function ensureLayoutDirSync(dir = defaultDataDir()) {
   ensureDataDirSync(dir);
 }
@@ -23766,44 +24354,905 @@ function readJson(file2) {
   return parseJsonObject(text) ?? null;
 }
 
-// ../../packages/persistence/src/warn-era-cap.ts
-import { existsSync as existsSync2, writeFileSync as writeFileSync2 } from "fs";
-import { join as join5 } from "path";
-var MARKER = "warn-era-capped";
-function capWarnEraEnforcementOnce(db, policyMode, dataDir2) {
-  if (policyMode !== "warn") return { capped: 0, skipped: "not-warn" };
-  const marker = join5(dataDir2, MARKER);
-  if (existsSync2(marker)) return { capped: 0, skipped: "already-run" };
-  const capped = db.policies.capCategoryActions();
-  writeFileSync2(marker, `${new Date(Date.now()).toISOString()}
-`, { mode: DATA_FILE_MODE });
-  return { capped };
+// ../../packages/persistence/src/vault/crypto.ts
+import {
+  createCipheriv,
+  createDecipheriv,
+  createHmac as createHmac2,
+  hkdfSync,
+  timingSafeEqual
+} from "crypto";
+var POINTER_ID_BYTES = 16;
+var NONCE_BYTES = 12;
+var TAG_BYTES = 10;
+var SUBKEY_BYTES = 32;
+var HKDF_INFO_ENC = "aka:vault:enc:v1";
+var HKDF_INFO_SIGN = "aka:vault:sign:v1";
+var HKDF_SALT = "aka:vault:v1";
+var B32_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
+function base32Encode(bytes) {
+  let out = "";
+  let buffer = 0;
+  let bits = 0;
+  for (const byte of bytes) {
+    buffer = buffer << 8 | byte;
+    bits += 8;
+    while (bits >= 5) {
+      out += B32_ALPHABET.charAt(buffer >>> bits - 5 & 31);
+      bits -= 5;
+    }
+  }
+  if (bits > 0) out += B32_ALPHABET.charAt(buffer << 5 - bits & 31);
+  return out;
 }
-
-// ../../packages/plugin-sdk/src/provider-env.ts
-var DEFAULT_ANTHROPIC_HOST = "api.anthropic.com";
-var booleanish = external_exports.string().optional().transform((v) => {
-  if (v === void 0) return void 0;
-  const t = v.trim().toLowerCase();
-  if (t === "" || t === "false" || t === "0") return false;
-  return true;
-}).catch(void 0);
-var optionalBaseUrl = external_exports.preprocess((v) => {
-  if (typeof v === "string" && v.trim() === "") return void 0;
-  return v;
-}, external_exports.string().optional()).catch(void 0);
-var providerEnvShape = {
-  CLAUDE_CODE_USE_BEDROCK: booleanish,
-  CLAUDE_CODE_USE_VERTEX: booleanish,
-  ANTHROPIC_BASE_URL: optionalBaseUrl
-};
-var ProviderEnvSchema = external_exports.object(providerEnvShape);
-
-// ../../packages/plugin-sdk/src/provider.ts
-function hostOf(url2) {
+function base32Decode(text) {
+  const out = [];
+  let buffer = 0;
+  let bits = 0;
+  for (const char of text) {
+    const value = B32_ALPHABET.indexOf(char);
+    if (value < 0) throw new Error("base32: character outside the alphabet");
+    buffer = buffer << 5 | value;
+    bits += 5;
+    if (bits >= 8) {
+      out.push(buffer >>> bits - 8 & 255);
+      bits -= 8;
+    }
+  }
+  return Buffer.from(out);
+}
+function encodeKeyVersion(version2) {
+  if (!Number.isInteger(version2) || version2 < 1 || version2 > 4294967295) {
+    throw new Error("vault: key version out of range");
+  }
+  const bytes = [];
+  let remaining = version2;
+  while (remaining > 0) {
+    bytes.unshift(remaining & 255);
+    remaining = Math.floor(remaining / 256);
+  }
+  return base32Encode(Uint8Array.from(bytes));
+}
+function decodeKeyVersion(encoded) {
+  const bytes = base32Decode(encoded);
+  if (bytes.length === 0 || bytes.length > 4) throw new Error("vault: bad key version encoding");
+  let version2 = 0;
+  for (const byte of bytes) version2 = version2 * 256 + byte;
+  if (version2 < 1) throw new Error("vault: bad key version");
+  return version2;
+}
+function deriveSubkeys(master) {
+  const derive = (info) => Buffer.from(hkdfSync("sha256", master, HKDF_SALT, info, SUBKEY_BYTES));
+  return { enc: derive(HKDF_INFO_ENC), sign: derive(HKDF_INFO_SIGN) };
+}
+function bindingInput(keyVersion, pointerId, category, formatVersion = POINTER_FORMAT_VERSION) {
+  if (pointerId.length !== POINTER_ID_BYTES) {
+    throw new Error("vault: pointer id must be 16 bytes");
+  }
+  const head = Buffer.alloc(6);
+  head.writeUInt16BE(formatVersion, 0);
+  head.writeUInt32BE(keyVersion, 2);
+  return Buffer.concat([head, Buffer.from(pointerId), Buffer.from(category, "utf8")]);
+}
+function seal(encKey, plaintext, aad, nonce) {
+  const cipher = createCipheriv("aes-256-gcm", encKey, nonce);
+  cipher.setAAD(aad);
+  const ciphertext = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
+  return { ciphertext, nonce, authTag: cipher.getAuthTag() };
+}
+function open(encKey, sealed, aad) {
   try {
-    const host = new URL(url2).host;
-    if (host !== "") return host;
+    const decipher = createDecipheriv("aes-256-gcm", encKey, sealed.nonce);
+    decipher.setAAD(aad);
+    decipher.setAuthTag(sealed.authTag);
+    return Buffer.concat([decipher.update(sealed.ciphertext), decipher.final()]).toString("utf8");
+  } catch {
+    return null;
+  }
+}
+function signPointer(signKey, keyVersion, pointerId, category) {
+  return createHmac2("sha256", signKey).update(bindingInput(keyVersion, pointerId, category, POINTER_FORMAT_VERSION)).digest().subarray(0, TAG_BYTES);
+}
+function verifyPointerTag(signKey, keyVersion, pointerId, category, tag) {
+  if (tag.length !== TAG_BYTES) return false;
+  const expected = signPointer(signKey, keyVersion, pointerId, category);
+  return timingSafeEqual(expected, Buffer.from(tag));
+}
+function formatPointer(category, keyVersion, pointerId, tag) {
+  return `[[aka:${category}:${encodeKeyVersion(keyVersion)}.${base32Encode(pointerId)}.${base32Encode(tag)}]]`;
+}
+
+// ../../packages/persistence/src/vault/key-provider.ts
+import { execFileSync } from "child_process";
+import { randomBytes as randomBytes2 } from "crypto";
+import {
+  chmodSync as chmodSync2,
+  mkdirSync as mkdirSync2,
+  readFileSync as readFileSync3,
+  renameSync as renameSync4,
+  rmSync as rmSync3,
+  statSync,
+  writeFileSync as writeFileSync2
+} from "fs";
+import { join as join5 } from "path";
+var VaultKeyEpochMissingError = class extends Error {
+  version;
+  constructor(version2) {
+    super(`vault: key epoch ${String(version2)} is not present in the keyring`);
+    this.name = "VaultKeyEpochMissingError";
+    this.version = version2;
+  }
+};
+var VAULT_KEY_FILENAME = "vault.key";
+var KEY_MATERIAL_BYTES2 = 32;
+var KEYCHAIN_SERVICE = "aka-vault";
+var KEYCHAIN_ACCOUNT = "keyring";
+function parseKeyring(raw) {
+  const parsed = JSON.parse(raw);
+  if (typeof parsed !== "object" || parsed === null) {
+    throw new Error("vault key file is corrupt: not a JSON object");
+  }
+  const { current, keys } = parsed;
+  if (typeof current !== "number" || !Number.isInteger(current) || current < 1) {
+    throw new Error("vault key file is corrupt: bad current version");
+  }
+  if (typeof keys !== "object" || keys === null || Array.isArray(keys)) {
+    throw new Error("vault key file is corrupt: bad keys map");
+  }
+  const map2 = /* @__PURE__ */ new Map();
+  for (const [rawVersion, rawMaterial] of Object.entries(keys)) {
+    const version2 = Number(rawVersion);
+    if (!Number.isInteger(version2) || version2 < 1) {
+      throw new Error("vault key file is corrupt: bad key version");
+    }
+    if (typeof rawMaterial !== "string") {
+      throw new Error("vault key file is corrupt: bad key material");
+    }
+    const bytes = Buffer.from(rawMaterial, "base64");
+    if (bytes.length !== KEY_MATERIAL_BYTES2) {
+      throw new Error("vault key file is corrupt: bad key material length");
+    }
+    map2.set(version2, bytes);
+  }
+  if (!map2.has(current)) {
+    throw new Error("vault key file is corrupt: current version has no material");
+  }
+  return { current, keys: map2 };
+}
+function serializeKeyring(keyring) {
+  const keys = {};
+  for (const version2 of [...keyring.keys.keys()].sort((a, b) => a - b)) {
+    const material = keyring.keys.get(version2);
+    if (material) keys[String(version2)] = material.toString("base64");
+  }
+  return JSON.stringify({ current: keyring.current, keys });
+}
+function mintKeyring() {
+  return { current: 1, keys: /* @__PURE__ */ new Map([[1, randomBytes2(KEY_MATERIAL_BYTES2)]]) };
+}
+function withNextEpoch(keyring) {
+  const next = Math.max(...keyring.keys.keys()) + 1;
+  const keys = new Map(keyring.keys);
+  keys.set(next, randomBytes2(KEY_MATERIAL_BYTES2));
+  return { current: next, keys };
+}
+function currentOf(keyring) {
+  const material = keyring.keys.get(keyring.current);
+  if (!material) throw new VaultKeyEpochMissingError(keyring.current);
+  return { material, version: keyring.current };
+}
+function epochOf(keyring, version2) {
+  const material = keyring.keys.get(version2);
+  if (!material) throw new VaultKeyEpochMissingError(version2);
+  return { material, version: version2 };
+}
+function asAsync(work) {
+  try {
+    return Promise.resolve(work());
+  } catch (err) {
+    return Promise.reject(err instanceof Error ? err : new Error(String(err)));
+  }
+}
+function asError(err) {
+  return err instanceof Error ? err : new Error(String(err));
+}
+var ROTATION_LOCK_STALE_MS = 6e4;
+var LOCK_OWNER_FILE = "owner";
+var ROTATION_IN_PROGRESS = "vault: a key rotation is already in progress";
+function claimRotationLock(lock, owner) {
+  try {
+    mkdirSync2(lock);
+  } catch (err) {
+    if (err.code === "EEXIST") return false;
+    throw asError(err);
+  }
+  try {
+    writeFileSync2(join5(lock, LOCK_OWNER_FILE), `${owner}
+`, { mode: DATA_FILE_MODE });
+    return true;
+  } catch (err) {
+    rmSync3(lock, { recursive: true, force: true });
+    throw asError(err);
+  }
+}
+function acquireRotationLock(keysDir2) {
+  const lock = join5(keysDir2, `${VAULT_KEY_FILENAME}.lock`);
+  const owner = randomBytes2(16).toString("hex");
+  if (claimRotationLock(lock, owner)) return { lock, owner };
+  let held;
+  try {
+    held = statSync(lock);
+  } catch {
+    throw new Error(ROTATION_IN_PROGRESS);
+  }
+  if (Date.now() - held.mtimeMs < ROTATION_LOCK_STALE_MS) throw new Error(ROTATION_IN_PROGRESS);
+  const aside = `${lock}.stale.${owner}`;
+  try {
+    const now = statSync(lock);
+    if (now.ino !== held.ino || now.mtimeMs !== held.mtimeMs) {
+      throw new Error(ROTATION_IN_PROGRESS);
+    }
+    renameSync4(lock, aside);
+  } catch (err) {
+    if (err instanceof Error && err.message === ROTATION_IN_PROGRESS) throw err;
+    throw new Error(ROTATION_IN_PROGRESS, { cause: err });
+  }
+  rmSync3(aside, { recursive: true, force: true });
+  if (!claimRotationLock(lock, owner)) throw new Error(ROTATION_IN_PROGRESS);
+  return { lock, owner };
+}
+function releaseRotationLock(lease) {
+  try {
+    if (readFileSync3(join5(lease.lock, LOCK_OWNER_FILE), "utf8").trim() !== lease.owner) return;
+  } catch {
+    return;
+  }
+  rmSync3(lease.lock, { recursive: true, force: true });
+}
+function withRotationLock(keysDir2, work) {
+  ensureDataDirSync(keysDir2);
+  const lease = acquireRotationLock(keysDir2);
+  try {
+    return work();
+  } finally {
+    releaseRotationLock(lease);
+  }
+}
+var FileKeyProvider = class {
+  #keysDir;
+  constructor(keysDir2) {
+    this.#keysDir = keysDir2;
+  }
+  get filePath() {
+    return join5(this.#keysDir, VAULT_KEY_FILENAME);
+  }
+  loadOrCreate() {
+    return asAsync(() => {
+      const existing = this.#read();
+      if (!existing) return currentOf(this.#createExclusive());
+      tightenFileMode(this.filePath);
+      return currentOf(existing);
+    });
+  }
+  rotate() {
+    return asAsync(
+      () => withRotationLock(this.#keysDir, () => {
+        const existing = this.#read();
+        if (!existing) return currentOf(this.#createExclusive());
+        return currentOf(this.#write(withNextEpoch(existing)));
+      })
+    );
+  }
+  materialFor(version2) {
+    return asAsync(() => {
+      const existing = this.#read();
+      if (!existing) throw new VaultKeyEpochMissingError(version2);
+      return epochOf(existing, version2);
+    });
+  }
+  /** The keyring, or null when the file is ABSENT. A corrupt file throws. */
+  #read() {
+    let raw;
+    try {
+      raw = readFileSync3(this.filePath, "utf8");
+    } catch (err) {
+      if (err.code === "ENOENT") return null;
+      throw err instanceof Error ? err : new Error(String(err));
+    }
+    return parseKeyring(raw);
+  }
+  /**
+   * First mint: the keyring is created at its FINAL path with a
+   * creation-exclusive write, so two processes racing a fresh machine cannot
+   * each mint a different epoch 1 — with tmp + rename the loser's replace
+   * would orphan everything the winner had already sealed. On EEXIST the
+   * loser re-reads and adopts the winner's keyring; it minted nothing.
+   * Atomic replace is unnecessary here: nothing can be mid-read of a file
+   * that did not exist, and a torn exclusive write parses as corrupt on the
+   * next read and fails secure rather than being re-minted over.
+   */
+  #createExclusive() {
+    ensureDataDirSync(this.#keysDir);
+    const keyring = mintKeyring();
+    try {
+      writeFileSync2(this.filePath, `${serializeKeyring(keyring)}
+`, {
+        flag: "wx",
+        mode: DATA_FILE_MODE
+      });
+    } catch (err) {
+      if (err.code !== "EEXIST") throw asError(err);
+      const winner = this.#read();
+      if (!winner) {
+        throw new Error("vault: key file vanished during first mint", { cause: err });
+      }
+      return winner;
+    }
+    tightenFileMode(this.filePath);
+    return keyring;
+  }
+  /**
+   * Atomic tmp + rename so a crash mid-write cannot truncate the keyring.
+   * Used only for rotation, under the rotation lock — first creation goes
+   * through the creation-exclusive path instead.
+   */
+  #write(keyring) {
+    ensureDataDirSync(this.#keysDir);
+    const file2 = this.filePath;
+    const tmp = `${file2}.tmp`;
+    writeFileSync2(tmp, `${serializeKeyring(keyring)}
+`, { mode: DATA_FILE_MODE });
+    renameSync4(tmp, file2);
+    tightenFileMode(file2);
+    return keyring;
+  }
+};
+function tightenFileMode(file2) {
+  try {
+    chmodSync2(file2, DATA_FILE_MODE);
+  } catch {
+  }
+}
+var runSecurity = (args) => execFileSync("/usr/bin/security", args, {
+  encoding: "utf8",
+  stdio: ["ignore", "pipe", "ignore"]
+});
+var SECURITY_ITEM_NOT_FOUND = 44;
+var KeychainKeyProvider = class {
+  #keysDir;
+  #exec;
+  constructor(keysDir2, exec = runSecurity) {
+    if (exec === runSecurity && process.platform !== "darwin") {
+      throw new Error(
+        `keychain custody is not available on this platform (${process.platform}); use file custody`
+      );
+    }
+    this.#keysDir = keysDir2;
+    this.#exec = exec;
+  }
+  /** Where a fallback file provider for the same vault would keep its keyring. */
+  get keysDir() {
+    return this.#keysDir;
+  }
+  loadOrCreate() {
+    return asAsync(() => {
+      const existing = this.#read();
+      if (existing) return currentOf(existing);
+      return currentOf(this.#create(mintKeyring()));
+    });
+  }
+  rotate() {
+    return asAsync(
+      () => withRotationLock(this.#keysDir, () => {
+        const existing = this.#read();
+        if (!existing) return currentOf(this.#create(mintKeyring()));
+        return currentOf(this.#replace(withNextEpoch(existing)));
+      })
+    );
+  }
+  materialFor(version2) {
+    return asAsync(() => {
+      const existing = this.#read();
+      if (!existing) throw new VaultKeyEpochMissingError(version2);
+      return epochOf(existing, version2);
+    });
+  }
+  /** The keyring, or null when no item exists yet. A corrupt item throws. */
+  #read() {
+    let raw;
+    try {
+      raw = this.#exec([
+        "find-generic-password",
+        "-s",
+        KEYCHAIN_SERVICE,
+        "-a",
+        KEYCHAIN_ACCOUNT,
+        "-w"
+      ]);
+    } catch (err) {
+      if (err.status === SECURITY_ITEM_NOT_FOUND) return null;
+      throw new Error(
+        `vault: keychain read failed (${err instanceof Error ? err.message : String(err)}); refusing to treat the failure as an absent keyring`,
+        { cause: err }
+      );
+    }
+    const body = raw.trim();
+    if (body.length === 0) return null;
+    return parseKeyring(body);
+  }
+  /**
+   * First mint: a plain `add-generic-password` (no `-U`) fails when an item
+   * already exists, so a concurrent first mint cannot overwrite the winner's
+   * keyring — the loser re-reads and adopts it instead.
+   */
+  #create(keyring) {
+    const args = [
+      "add-generic-password",
+      "-s",
+      KEYCHAIN_SERVICE,
+      "-a",
+      KEYCHAIN_ACCOUNT,
+      "-w",
+      serializeKeyring(keyring)
+    ];
+    try {
+      this.#exec(args);
+    } catch (err) {
+      const winner = this.#read();
+      if (winner) return winner;
+      throw asError(err);
+    }
+    return keyring;
+  }
+  // `-U` updates the item in place, deliberately replacing the stored map with
+  // one that contains it — used only for rotation, under the rotation lock.
+  #replace(keyring) {
+    this.#exec([
+      "add-generic-password",
+      "-U",
+      "-s",
+      KEYCHAIN_SERVICE,
+      "-a",
+      KEYCHAIN_ACCOUNT,
+      "-w",
+      serializeKeyring(keyring)
+    ]);
+    return keyring;
+  }
+};
+function createKeyProvider(custody, keysDir2) {
+  if (custody === "keychain") return new KeychainKeyProvider(keysDir2);
+  return new FileKeyProvider(keysDir2);
+}
+
+// ../../packages/persistence/src/vault/vault.ts
+import { randomBytes as randomBytes3, randomUUID as randomUUID10 } from "crypto";
+var CONSENT_ABSENT = /* @__PURE__ */ Symbol("aka.vault.consentAbsent");
+var UNAVAILABLE = /* @__PURE__ */ Symbol("aka.vault.unavailable");
+var VAULT_PURGE_POINTER_ID = "*";
+function parsePointer(token) {
+  if (!POINTER_TOKEN_ANCHORED.test(token)) return null;
+  const body = token.slice("[[aka:".length, -"]]".length);
+  const colon = body.indexOf(":");
+  if (colon < 0) return null;
+  const category = body.slice(0, colon);
+  const [kv, id, tag] = body.slice(colon + 1).split(".");
+  if (kv === void 0 || id === void 0 || tag === void 0) return null;
+  try {
+    const keyVersion = decodeKeyVersion(kv);
+    const pointerId = base32Decode(id);
+    const tagBytes = base32Decode(tag);
+    if (encodeKeyVersion(keyVersion) !== kv || base32Encode(pointerId) !== id || base32Encode(tagBytes) !== tag) {
+      return null;
+    }
+    return { category, keyVersion, pointerId, tag: tagBytes };
+  } catch {
+    return null;
+  }
+}
+var SecretVault = class {
+  #repo;
+  #keys;
+  #fingerprintKey;
+  #isConsented;
+  #verifyGrant;
+  #now;
+  constructor(deps) {
+    this.#repo = deps.repo;
+    this.#keys = deps.keys;
+    this.#fingerprintKey = deps.fingerprintKey;
+    this.#isConsented = deps.isConsented;
+    this.#verifyGrant = deps.verifyGrant;
+    this.#now = deps.now ?? (() => Date.now());
+  }
+  /**
+   * Store a value and return the pointer that stands for it. The same value
+   * always yields the same pointer on this machine — one row, one pointer id,
+   * one category — which is what makes dedup and reuse counting work.
+   */
+  async tokenize(raw, meta3) {
+    if (!this.#isConsented()) return CONSENT_ABSENT;
+    const valueFingerprint = fingerprintValue(this.#fingerprintKey, raw);
+    const existing = this.#repo.byValueFingerprint(valueFingerprint);
+    const now = this.#now();
+    if (existing) {
+      this.#repo.upsert({ ...existing, provider: existing.provider ?? void 0 }, now);
+      return await this.#emitToken(existing.keyVersion, existing.pointerId, existing.category);
+    }
+    const { material, version: version2 } = await this.#keys.loadOrCreate();
+    const subkeys = deriveSubkeys(material);
+    const pointerId = randomBytes3(POINTER_ID_BYTES);
+    const aad = bindingInput(version2, pointerId, meta3.category, POINTER_FORMAT_VERSION);
+    const sealed = seal(subkeys.enc, raw, aad, randomBytes3(NONCE_BYTES));
+    const { row } = this.#repo.upsert(
+      {
+        pointerId: base32Encode(pointerId),
+        valueFingerprint,
+        fingerprintKeyVersion: this.#fingerprintKey.version,
+        keyVersion: version2,
+        // Recorded so the row stays OPENABLE if the wire-format constant ever
+        // moves: it is part of this row's AEAD AAD. It is not a tag input —
+        // tags are pinned to the constant on both sides.
+        formatVersion: POINTER_FORMAT_VERSION,
+        category: meta3.category,
+        ruleId: meta3.ruleId,
+        maskedMatch: meta3.maskedMatch,
+        provider: meta3.provider,
+        ciphertext: sealed.ciphertext.toString("base64"),
+        nonce: sealed.nonce.toString("base64"),
+        authTag: sealed.authTag.toString("base64")
+      },
+      now
+    );
+    return await this.#emitToken(row.keyVersion, row.pointerId, row.category);
+  }
+  /**
+   * Resolve a pointer back to its value, for a human or (with a grant) for the
+   * model. Every call that gets as far as an identified row writes an audit row.
+   */
+  async detokenize(token, opts) {
+    const parsed = parsePointer(token);
+    if (!parsed) return UNAVAILABLE;
+    let signKey;
+    try {
+      const epoch = await this.#keys.materialFor(parsed.keyVersion);
+      signKey = deriveSubkeys(epoch.material).sign;
+    } catch {
+      return UNAVAILABLE;
+    }
+    if (!verifyPointerTag(signKey, parsed.keyVersion, parsed.pointerId, parsed.category, parsed.tag)) {
+      return UNAVAILABLE;
+    }
+    const pointerId = base32Encode(parsed.pointerId);
+    const row = this.#repo.byPointerId(pointerId);
+    if (!row) {
+      this.#audit(pointerId, opts, "unavailable");
+      return UNAVAILABLE;
+    }
+    if (row.category !== parsed.category) return UNAVAILABLE;
+    if (opts.target === "model") {
+      const grantId = opts.grantId;
+      const verify = this.#verifyGrant;
+      if (verify === void 0 || grantId === void 0 || grantId === "") {
+        this.#audit(pointerId, opts, "refused");
+        return UNAVAILABLE;
+      }
+      let covered;
+      try {
+        covered = await verify(grantId, {
+          ruleId: row.ruleId,
+          valueFingerprint: row.valueFingerprint,
+          fingerprintKeyVersion: row.fingerprintKeyVersion
+        });
+      } catch {
+        covered = false;
+      }
+      if (!covered) {
+        this.#audit(pointerId, opts, "refused");
+        return UNAVAILABLE;
+      }
+    }
+    let raw;
+    try {
+      const epoch = await this.#keys.materialFor(row.keyVersion);
+      raw = open(
+        deriveSubkeys(epoch.material).enc,
+        {
+          ciphertext: Buffer.from(row.ciphertext, "base64"),
+          nonce: Buffer.from(row.nonce, "base64"),
+          authTag: Buffer.from(row.authTag, "base64")
+        },
+        // Sealed under the ROW's epoch and format version. Rotation may have
+        // moved the epoch past the one this token names, and a format bump may
+        // have moved the constant past the generation this row was sealed
+        // under — the AAD follows the row in both cases, never the token.
+        bindingInput(row.keyVersion, parsed.pointerId, row.category, row.formatVersion)
+      );
+    } catch {
+      raw = null;
+    }
+    if (raw === null) {
+      this.#audit(pointerId, opts, "unavailable");
+      return UNAVAILABLE;
+    }
+    this.#audit(pointerId, opts, "revealed");
+    return raw;
+  }
+  /**
+   * Owner-surface reveal by row id: the dashboard shows a row the owner can
+   * already see and asks for its value. There is no wire token here to verify —
+   * the tag exists to stop FORGED tokens arriving in untrusted text, and a row
+   * id selected server-side from the owner's own store is not that — so this
+   * loads the row directly, opens its ciphertext under the row's epoch, and
+   * audits exactly like a human-target de-reference. Never callable with
+   * target 'model': the wire-token path with its grant gate is the only road
+   * raw travels toward the model.
+   */
+  async revealEntry(pointerId, opts) {
+    const row = this.#repo.byPointerId(pointerId);
+    if (!row) {
+      this.#audit(pointerId, { target: "human", reason: opts.reason }, "unavailable");
+      return UNAVAILABLE;
+    }
+    const raw = await this.#openRow(row);
+    if (raw === null) {
+      this.#audit(pointerId, { target: "human", reason: opts.reason }, "unavailable");
+      return UNAVAILABLE;
+    }
+    this.#audit(pointerId, { target: "human", reason: opts.reason }, "revealed");
+    return raw;
+  }
+  /** Badge and listing data. No raw value, no fingerprint, and no audit row. */
+  async describePointer(token) {
+    const row = await this.#rowFor(token);
+    if (!row) return null;
+    return {
+      category: row.category,
+      ...row.provider === void 0 ? {} : { provider: row.provider },
+      maskedMatch: row.maskedMatch,
+      occurrences: row.occurrenceCount,
+      firstSeen: new Date(row.firstSeen).toISOString(),
+      lastSeen: new Date(row.lastSeen).toISOString()
+    };
+  }
+  /**
+   * The raw-free row identity a reveal grant matches on. Deliberately not fed to
+   * view surfaces: the keyed fingerprint is a correlation key and must not reach
+   * a presentation layer.
+   */
+  async resolvePointerIdentity(token) {
+    const row = await this.#rowFor(token);
+    if (!row) return null;
+    return {
+      ruleId: row.ruleId,
+      valueFingerprint: row.valueFingerprint,
+      fingerprintKeyVersion: row.fingerprintKeyVersion
+    };
+  }
+  /**
+   * Mint the next vault key epoch and re-encrypt every entry under it. Pointers
+   * already emitted keep verifying: their tag is checked against the historical
+   * epoch they name, which the key provider retains.
+   *
+   * Safe to interrupt — each row carries the epoch its ciphertext is sealed
+   * under, so a half-finished pass leaves every row openable.
+   *
+   * The rotation lock covers only the keyring mint inside `rotate()`; the
+   * re-seal pass below runs unlocked. Two concurrent rotations therefore
+   * serialize on the keyring but interleave over the rows, so a slower pass can
+   * re-seal a row back to an epoch a faster one already moved past, and
+   * `reEncrypted` can double-count. No value is lost either way — every epoch is
+   * retained and every row stays openable — but "after rotation every row sits
+   * at the newest epoch" does not hold under concurrency. Holding the lock
+   * across the whole pass requires an async-aware lock, since a callback that
+   * awaits would release the lock at its first suspension.
+   */
+  async rotateVaultKey() {
+    const next = await this.#keys.rotate();
+    const nextEnc = deriveSubkeys(next.material).enc;
+    let reEncrypted = 0;
+    for (const row of this.#repo.listAll()) {
+      if (row.keyVersion === next.version) continue;
+      const pointerId = base32Decode(row.pointerId);
+      let raw;
+      try {
+        const epoch = await this.#keys.materialFor(row.keyVersion);
+        raw = open(
+          deriveSubkeys(epoch.material).enc,
+          {
+            ciphertext: Buffer.from(row.ciphertext, "base64"),
+            nonce: Buffer.from(row.nonce, "base64"),
+            authTag: Buffer.from(row.authTag, "base64")
+          },
+          bindingInput(row.keyVersion, pointerId, row.category, row.formatVersion)
+        );
+      } catch {
+        raw = null;
+      }
+      if (raw === null) continue;
+      const sealed = seal(
+        nextEnc,
+        raw,
+        bindingInput(next.version, pointerId, row.category, row.formatVersion),
+        randomBytes3(NONCE_BYTES)
+      );
+      this.#repo.replaceCiphertext(row.pointerId, {
+        keyVersion: next.version,
+        ciphertext: sealed.ciphertext.toString("base64"),
+        nonce: sealed.nonce.toString("base64"),
+        authTag: sealed.authTag.toString("base64")
+      });
+      reEncrypted += 1;
+    }
+    return { version: next.version, reEncrypted };
+  }
+  /**
+   * Re-key every entry's value fingerprint after the exception key rotates,
+   * PRESERVING each pointer id. Unlike grants — where rotation is invalidation,
+   * because the raw values are gone — the vault still holds the values, so
+   * determinism, dedup, and every outstanding pointer survive the rotation.
+   *
+   * Every fingerprint-key rotation must run this: a row left at the old epoch
+   * still resolves, but the same value detected again fingerprints under the
+   * NEW key, misses the dedup lookup, and mints a second row and a second
+   * pointer — one value, two tokens in circulation.
+   *
+   * Per-row best-effort: a row that cannot open, or whose refreshed
+   * fingerprint collides with a row already refreshed, is skipped rather than
+   * aborting the pass — one damaged entry must not strand the re-key of every
+   * other. A skipped row keeps resolving under its old fingerprint epoch.
+   */
+  async refreshFingerprints(next) {
+    let refreshed = 0;
+    for (const row of this.#repo.listAll()) {
+      try {
+        const raw = await this.#openRow(row);
+        if (raw === null) continue;
+        this.#repo.refreshFingerprint(row.pointerId, {
+          valueFingerprint: fingerprintValue(next, raw),
+          fingerprintKeyVersion: next.version
+        });
+        refreshed += 1;
+      } catch {
+        continue;
+      }
+    }
+    return refreshed;
+  }
+  /**
+   * Destroy every entry, making all outstanding pointers permanently
+   * unresolvable.
+   *
+   * The count comes from `purgeAll` rather than a separate `countEntries` —
+   * `purgeAll` counts inside the same transaction that deletes, so the audit row
+   * reports what was actually destroyed. Counting beforehand would let a
+   * concurrent write land between the two statements and put a number in the
+   * durable record that never matched reality.
+   */
+  purgeVault() {
+    const destroyed = this.#repo.purgeAll();
+    this.#repo.recordDeref({
+      id: randomUUID10(),
+      pointerId: VAULT_PURGE_POINTER_ID,
+      at: this.#now(),
+      target: "human",
+      reason: "purge",
+      outcome: "unavailable",
+      pointerCount: Math.max(destroyed, 1)
+    });
+    return destroyed;
+  }
+  // Sign under the epoch the token names — which for a re-detected value is the
+  // epoch its row currently sits at rather than whatever is current.
+  //
+  // The row's format version is NOT a tag input. It binds the row's ciphertext
+  // (it is part of the AEAD AAD, so an old row stays openable) but never the
+  // wire tag, which verification checks against POINTER_FORMAT_VERSION without
+  // knowing any row. Signing a token here under a row's own generation is what
+  // would make the vault emit tokens it then refuses.
+  async #emitToken(keyVersion, pointerIdB32, category) {
+    const pointerId = base32Decode(pointerIdB32);
+    const epoch = await this.#keys.materialFor(keyVersion);
+    const signKey = deriveSubkeys(epoch.material).sign;
+    return formatPointer(
+      category,
+      keyVersion,
+      pointerId,
+      signPointer(signKey, keyVersion, pointerId, category)
+    );
+  }
+  async #openRow(row) {
+    try {
+      const epoch = await this.#keys.materialFor(row.keyVersion);
+      return open(
+        deriveSubkeys(epoch.material).enc,
+        {
+          ciphertext: Buffer.from(row.ciphertext, "base64"),
+          nonce: Buffer.from(row.nonce, "base64"),
+          authTag: Buffer.from(row.authTag, "base64")
+        },
+        bindingInput(row.keyVersion, base32Decode(row.pointerId), row.category, row.formatVersion)
+      );
+    } catch {
+      return null;
+    }
+  }
+  // Shared lookup for the read-only surfaces. It verifies the tag exactly as
+  // detokenize does: a descriptor is not raw, but a token nobody can vouch for
+  // should not resolve to anything at all — otherwise a fabricated pointer, or a
+  // lookalike planted in a file, would still yield a category and a masked
+  // preview. Verifying needs the historical epoch's key, which is why these
+  // surfaces are async.
+  async #rowFor(token) {
+    const parsed = parsePointer(token);
+    if (!parsed) return null;
+    try {
+      const epoch = await this.#keys.materialFor(parsed.keyVersion);
+      const signKey = deriveSubkeys(epoch.material).sign;
+      if (!verifyPointerTag(signKey, parsed.keyVersion, parsed.pointerId, parsed.category, parsed.tag)) {
+        return null;
+      }
+    } catch {
+      return null;
+    }
+    const row = this.#repo.byPointerId(base32Encode(parsed.pointerId));
+    if (row?.category !== parsed.category) return null;
+    return row;
+  }
+  #audit(pointerId, opts, outcome) {
+    this.#repo.recordDeref({
+      id: randomUUID10(),
+      pointerId,
+      at: this.#now(),
+      target: opts.target,
+      reason: opts.reason,
+      outcome,
+      ...opts.grantId === void 0 ? {} : { grantId: opts.grantId },
+      // Only the batched reasons carry a count above one; a model crossing is
+      // always its own row.
+      pointerCount: isBatchedDerefReason(opts.reason) ? opts.pointerCount ?? 1 : 1
+    });
+  }
+};
+
+// ../../packages/persistence/src/warn-era-cap.ts
+import { existsSync as existsSync3, writeFileSync as writeFileSync3 } from "fs";
+import { join as join6 } from "path";
+var MARKER = "warn-era-capped";
+function capWarnEraEnforcementOnce(db, policyMode, dataDir2) {
+  if (policyMode !== "warn") return { capped: 0, skipped: "not-warn" };
+  const marker = join6(dataDir2, MARKER);
+  if (existsSync3(marker)) return { capped: 0, skipped: "already-run" };
+  const capped = db.policies.capCategoryActions();
+  writeFileSync3(marker, `${new Date(Date.now()).toISOString()}
+`, { mode: DATA_FILE_MODE });
+  return { capped };
+}
+
+// ../../packages/plugin-sdk/src/provider-env.ts
+var DEFAULT_ANTHROPIC_HOST = "api.anthropic.com";
+var booleanish = external_exports.string().optional().transform((v) => {
+  if (v === void 0) return void 0;
+  const t = v.trim().toLowerCase();
+  if (t === "" || t === "false" || t === "0") return false;
+  return true;
+}).catch(void 0);
+var optionalBaseUrl = external_exports.preprocess((v) => {
+  if (typeof v === "string" && v.trim() === "") return void 0;
+  return v;
+}, external_exports.string().optional()).catch(void 0);
+var providerEnvShape = {
+  CLAUDE_CODE_USE_BEDROCK: booleanish,
+  CLAUDE_CODE_USE_VERTEX: booleanish,
+  ANTHROPIC_BASE_URL: optionalBaseUrl
+};
+var ProviderEnvSchema = external_exports.object(providerEnvShape);
+
+// ../../packages/plugin-sdk/src/provider.ts
+function hostOf(url2) {
+  try {
+    const host = new URL(url2).host;
+    if (host !== "") return host;
   } catch {
   }
   try {
@@ -23832,8 +25281,8 @@ function resolveProvider() {
 function loadConfig(base = defaultDataDir()) {
   try {
     ensureLayoutDirSync(base);
-    const settingsFile = join6(settingsDir(base), "settings.json");
-    if (existsSync3(settingsFile)) tightenFile(settingsFile);
+    const settingsFile = join7(settingsDir(base), "settings.json");
+    if (existsSync4(settingsFile)) tightenFile(settingsFile);
   } catch {
   }
   migrateLegacyLayout(base);
@@ -23856,9 +25305,9 @@ function resolveProviderSafe() {
 }
 
 // ../../packages/plugin-sdk/src/config-inventory.ts
-import { readdirSync, readFileSync as readFileSync4, realpathSync, statSync as statSync2 } from "fs";
+import { readdirSync, readFileSync as readFileSync5, realpathSync, statSync as statSync3 } from "fs";
 import { homedir as homedir2 } from "os";
-import { basename as basename2, join as join8 } from "path";
+import { basename as basename2, join as join9 } from "path";
 
 // ../../packages/detections/src/egress/registry.ts
 var EXTRACTOR_VERSION = "1";
@@ -24646,12 +26095,12 @@ function redact(text, findings) {
   const regions = [];
   for (const f of sorted) {
     const rank = SEVERITY_RANK2[f.severity];
-    const open = regions[regions.length - 1];
-    if (open && f.span.start < open.end) {
-      open.end = Math.max(open.end, f.span.end);
-      if (rank > open.rank) {
-        open.rank = rank;
-        open.category = f.category;
+    const open2 = regions[regions.length - 1];
+    if (open2 && f.span.start < open2.end) {
+      open2.end = Math.max(open2.end, f.span.end);
+      if (rank > open2.rank) {
+        open2.rank = rank;
+        open2.category = f.category;
       }
     } else {
       regions.push({ start: f.span.start, end: f.span.end, category: f.category, rank });
@@ -24680,6 +26129,24 @@ function maskMatch(raw) {
   return `${raw.charAt(0)}${"*".repeat(6)}${raw.charAt(raw.length - 1)}`;
 }
 
+// ../../packages/detections/src/pointer-shield.ts
+function shieldPointers(text) {
+  const spans = [];
+  let out = null;
+  for (const match of text.matchAll(pointerTokenScanner())) {
+    spans.push({ start: match.index, end: match.index + match[0].length });
+    out ??= text;
+    out = out.slice(0, match.index) + " ".repeat(match[0].length) + out.slice(match.index + match[0].length);
+  }
+  return { text: out ?? text, spans };
+}
+function dropShieldedFindings(findings, spans) {
+  if (spans.length === 0) return findings;
+  return findings.filter(
+    (finding) => !spans.some((s) => finding.span.start < s.end && finding.span.end > s.start)
+  );
+}
+
 // ../../packages/detections/src/posture/config-posture.ts
 var RULE_VERSION = "1";
 var KNOWN_TOOLS = /* @__PURE__ */ new Set([
@@ -26876,8 +28343,8 @@ function bundledDetections() {
 }
 
 // ../../packages/plugin-sdk/src/repo.ts
-import { existsSync as existsSync4, readFileSync as readFileSync3, statSync } from "fs";
-import { basename, dirname, isAbsolute, join as join7, sep as sep2 } from "path";
+import { existsSync as existsSync5, readFileSync as readFileSync4, statSync as statSync2 } from "fs";
+import { basename, dirname, isAbsolute, join as join8, sep as sep2 } from "path";
 function resolveRepo(cwd) {
   try {
     const root = findGitRoot(cwd);
@@ -26892,36 +28359,36 @@ function resolveRepo(cwd) {
 function findGitRoot(start) {
   let dir = start;
   for (; ; ) {
-    if (existsSync4(join7(dir, ".git"))) return dir;
+    if (existsSync5(join8(dir, ".git"))) return dir;
     const parent = dirname(dir);
     if (parent === dir) return void 0;
     dir = parent;
   }
 }
 function resolveGitContext(root) {
-  const dotGit = join7(root, ".git");
+  const dotGit = join8(root, ".git");
   try {
-    if (statSync(dotGit).isDirectory()) {
-      return { configPath: join7(dotGit, "config"), headRoot: root };
+    if (statSync2(dotGit).isDirectory()) {
+      return { configPath: join8(dotGit, "config"), headRoot: root };
     }
   } catch {
     return void 0;
   }
   const target = /^gitdir:\s*(.+?)\s*$/m.exec(safeRead(dotGit) ?? "")?.[1];
   if (!target) return void 0;
-  const gitdir = isAbsolute(target) ? target : join7(root, target);
-  if (existsSync4(join7(gitdir, "config"))) {
-    return { configPath: join7(gitdir, "config"), headRoot: root };
+  const gitdir = isAbsolute(target) ? target : join8(root, target);
+  if (existsSync5(join8(gitdir, "config"))) {
+    return { configPath: join8(gitdir, "config"), headRoot: root };
   }
-  const commonRaw = safeRead(join7(gitdir, "commondir"))?.trim();
+  const commonRaw = safeRead(join8(gitdir, "commondir"))?.trim();
   if (!commonRaw) return void 0;
-  const commonGitDir = isAbsolute(commonRaw) ? commonRaw : join7(gitdir, commonRaw);
+  const commonGitDir = isAbsolute(commonRaw) ? commonRaw : join8(gitdir, commonRaw);
   const headRoot = basename(commonGitDir) === ".git" ? dirname(commonGitDir) : root;
-  return { configPath: join7(commonGitDir, "config"), headRoot };
+  return { configPath: join8(commonGitDir, "config"), headRoot };
 }
 function safeRead(path) {
   try {
-    return readFileSync3(path, "utf8");
+    return readFileSync4(path, "utf8");
   } catch {
     return void 0;
   }
@@ -26959,13 +28426,13 @@ function slugFromUrl(url2) {
 }
 
 // ../../packages/plugin-sdk/src/events.ts
-import { createHash as createHash4, randomUUID as randomUUID9 } from "crypto";
+import { createHash as createHash4, randomUUID as randomUUID11 } from "crypto";
 function contentHashOf(text) {
   return createHash4("sha256").update(text).digest("hex");
 }
 function buildIngestEvent(input) {
   return {
-    id: randomUUID9(),
+    id: randomUUID11(),
     sourceTool: input.sourceTool,
     kind: input.kind,
     occurredAt: input.occurredAt ?? (/* @__PURE__ */ new Date()).toISOString(),
@@ -26976,7 +28443,7 @@ function buildIngestEvent(input) {
     // SDK boot in the fail-open hook path). Preserve any id the caller already set.
     metadata: {
       ...input.metadata,
-      correlationId: input.metadata?.correlationId ?? randomUUID9()
+      correlationId: input.metadata?.correlationId ?? randomUUID11()
     }
   };
 }
@@ -26985,8 +28452,8 @@ function buildIngestEvent(input) {
 import { arch, hostname as hostname3, platform, release } from "os";
 
 // ../../packages/plugin-sdk/src/nudge.ts
-import { mkdirSync as mkdirSync2, readFileSync as readFileSync5, writeFileSync as writeFileSync3 } from "fs";
-import { join as join9 } from "path";
+import { mkdirSync as mkdirSync3, readFileSync as readFileSync6, writeFileSync as writeFileSync4 } from "fs";
+import { join as join10 } from "path";
 
 // ../../packages/plugin-sdk/src/paths.ts
 import { readdirSync as readdirSync2, realpathSync as realpathSync2 } from "fs";
@@ -26994,8 +28461,8 @@ import { basename as basename3, dirname as dirname2, sep as sep3 } from "path";
 
 // ../../packages/plugin-sdk/src/project-files.ts
 var import_ignore = __toESM(require_ignore(), 1);
-import { existsSync as existsSync5, readdirSync as readdirSync3, readFileSync as readFileSync6 } from "fs";
-import { basename as basename4, join as join10, relative, sep as sep4 } from "path";
+import { existsSync as existsSync6, readdirSync as readdirSync3, readFileSync as readFileSync7 } from "fs";
+import { basename as basename4, join as join11, relative, sep as sep4 } from "path";
 
 // ../../packages/plugin-sdk/src/rule-quarantine.ts
 var PASS_BUDGET_MS = 2e3;
@@ -27051,7 +28518,7 @@ async function filterUnsafeRules(rules, gateway, opts) {
 }
 
 // ../../packages/plugin-sdk/src/runtime.ts
-import { randomUUID as randomUUID10 } from "crypto";
+import { randomUUID as randomUUID12 } from "crypto";
 var ENFORCEMENT_CEILING_ENABLED = false;
 var ACTION_PRIORITY = ["block", "redact", "warn", "log", "allow"];
 function entryIsActive(entry, now) {
@@ -27154,7 +28621,12 @@ function createPluginRuntime(gateway, settings, opts) {
     if (worst === "block") return { action: "block", text: null, findings };
     if (worst === "redact") {
       const redactFindings = findings.filter((f) => actionFor(f) === "redact");
-      return { action: "redact", text: redact(text, redactFindings), findings };
+      return {
+        action: "redact",
+        text: redact(text, redactFindings),
+        findings,
+        enforcedFindings: redactFindings
+      };
     }
     return { action: worst, text, findings };
   }
@@ -27195,9 +28667,17 @@ function createPluginRuntime(gateway, settings, opts) {
         else groups.set(pair, [finding]);
       }
       const now = Date.now();
+      const preAuthorized = new Set(ctx.preAuthorizedGrantIds ?? []);
       for (const [pair, group] of groups) {
         const entry = entries.get(pair);
-        if (!entry || !entryIsActive(entry, now) || !conditionsMatch(entry.conditions, ctx)) {
+        if (!entry) continue;
+        if (preAuthorized.has(entry.id)) {
+          if (!conditionsMatch(entry.conditions, ctx)) continue;
+          for (const finding of group) excepted.add(finding);
+          exceptionIds.push(entry.id);
+          continue;
+        }
+        if (!entryIsActive(entry, now) || !conditionsMatch(entry.conditions, ctx)) {
           continue;
         }
         let consumed = false;
@@ -27229,7 +28709,7 @@ function createPluginRuntime(gateway, settings, opts) {
         const pair = `${finding.ruleId}:${fp}`;
         if (seen.has(pair)) continue;
         seen.add(pair);
-        const reference = randomUUID10().replaceAll("-", "").slice(0, 6);
+        const reference = randomUUID12().replaceAll("-", "").slice(0, 6);
         const maskedValue = maskMatch(finding.rawMatch);
         try {
           await gateway.recordBlockedDetection({
@@ -27253,7 +28733,8 @@ function createPluginRuntime(gateway, settings, opts) {
   async function evaluate(text, context, ctx) {
     try {
       await ensureInitialized();
-      const findings = scan(text, rules, context);
+      const shielded = shieldPointers(text);
+      const findings = dropShieldedFindings(scan(shielded.text, rules, context), shielded.spans);
       const fpCache = /* @__PURE__ */ new Map();
       const { excepted, exceptionIds } = await applyExceptions(findings, ctx, fpCache);
       const decision = decide(findings, text, excepted);
@@ -27276,7 +28757,11 @@ function createPluginRuntime(gateway, settings, opts) {
     const { decision, excepted, exceptionIds } = await evaluate(
       input.text,
       filePath ? { filePath } : void 0,
-      { sourceTool: input.sourceTool, metadata: input.metadata }
+      {
+        sourceTool: input.sourceTool,
+        metadata: input.metadata,
+        preAuthorizedGrantIds: opts2.preAuthorizedGrantIds
+      }
     );
     if (opts2.persist === "with-findings" && decision.findings.length === 0) return decision;
     try {
@@ -27306,7 +28791,7 @@ function createPluginRuntime(gateway, settings, opts) {
           valueFingerprint: findingKeyFingerprintKey ? fingerprintOf(findingKeyFingerprintKey, match, findingKeyFpCache) : maskedMatch
         }) : void 0;
         return {
-          id: randomUUID10(),
+          id: randomUUID12(),
           eventId: event.id,
           ruleId: match.ruleId,
           category: match.category,
@@ -27332,7 +28817,7 @@ function createPluginRuntime(gateway, settings, opts) {
       const sorted = [...rules].sort((a, b) => a.id.localeCompare(b.id));
       return contentHashOf(JSON.stringify(sorted));
     } catch {
-      return `unresolved-${randomUUID10()}`;
+      return `unresolved-${randomUUID12()}`;
     }
   }
   async function close() {
@@ -27345,8 +28830,380 @@ function createPluginRuntime(gateway, settings, opts) {
 var THIRTY_DAYS_MS = 30 * 24 * 60 * 60 * 1e3;
 
 // ../../packages/plugin-sdk/src/throttle.ts
-import { mkdirSync as mkdirSync3, statSync as statSync3, writeFileSync as writeFileSync4 } from "fs";
-import { join as join11 } from "path";
+import { mkdirSync as mkdirSync4, statSync as statSync4, writeFileSync as writeFileSync5 } from "fs";
+import { join as join12 } from "path";
+
+// ../../packages/plugin-sdk/src/tokenize.ts
+function redactedPlaceholder(category) {
+  return `[REDACTED:${category.toUpperCase()}]`;
+}
+var POINTER_UNAVAILABLE_TEXT = "[unavailable]";
+var SEVERITY_RANK3 = { critical: 3, high: 2, medium: 1, low: 0 };
+function groupSpans(text, findings) {
+  const sorted = [...findings].filter((f) => f.span.start >= 0 && f.span.end <= text.length && f.span.start < f.span.end).sort((a, b) => a.span.start - b.span.start || b.span.end - a.span.end);
+  const groups = [];
+  for (const finding of sorted) {
+    const last = groups[groups.length - 1];
+    if (last && finding.span.start < last.end) {
+      last.end = Math.max(last.end, finding.span.end);
+      if ((SEVERITY_RANK3[finding.severity] ?? 0) > (SEVERITY_RANK3[last.severity] ?? 0)) {
+        last.category = finding.category;
+        last.severity = finding.severity;
+      }
+      delete last.finding;
+      continue;
+    }
+    groups.push({
+      start: finding.span.start,
+      end: finding.span.end,
+      finding,
+      category: finding.category,
+      severity: finding.severity
+    });
+  }
+  return groups;
+}
+var NULL_RESOLVER = () => Promise.resolve(null);
+var SecretVaultGlue = class {
+  #vault;
+  revealGrantResolver;
+  // Set only when THIS glue opened the store, so a glue over an injected vault
+  // never closes a handle it does not own.
+  #release;
+  constructor(vault, revealGrantResolver = NULL_RESOLVER, release2) {
+    this.#vault = vault;
+    this.revealGrantResolver = revealGrantResolver;
+    this.#release = release2;
+  }
+  close() {
+    const release2 = this.#release;
+    this.#release = void 0;
+    try {
+      release2?.();
+    } catch {
+    }
+  }
+  async tokenizeValue(raw, meta3) {
+    try {
+      const result = await this.#vault.tokenize(raw, meta3);
+      return typeof result === "string" ? result : redactedPlaceholder(meta3.category);
+    } catch {
+      return redactedPlaceholder(meta3.category);
+    }
+  }
+  async tokenizeText(text, opts) {
+    try {
+      const findings = opts?.findings ?? this.#selfScan(text);
+      if (findings === null) return { text: "[REDACTED]", pointers: [], degraded: [] };
+      if (findings.length === 0) return { text, pointers: [], degraded: [] };
+      const groups = groupSpans(text, findings);
+      const pointers = [];
+      const degraded = [];
+      let out = text;
+      for (const group of [...groups].reverse()) {
+        const original = text.slice(group.start, group.end);
+        const finding = group.finding;
+        let replacement;
+        if (finding === void 0) {
+          replacement = redactedPlaceholder(group.category);
+          degraded.unshift({ category: group.category });
+        } else if (original !== finding.rawMatch) {
+          replacement = redactedPlaceholder(group.category);
+          degraded.unshift({ category: group.category });
+        } else {
+          replacement = await this.tokenizeValue(finding.rawMatch, {
+            ruleId: finding.ruleId,
+            category: finding.category,
+            maskedMatch: maskMatch(finding.rawMatch)
+          });
+          if (replacement.startsWith("[[aka:")) pointers.unshift(replacement);
+          else degraded.unshift({ category: finding.category });
+        }
+        out = out.slice(0, group.start) + replacement + out.slice(group.end);
+      }
+      if (opts?.sighting && pointers.length > 0) {
+        for (const pointer of pointers) {
+          try {
+            const id = pointer.split(".")[1];
+            if (id !== void 0) this.#vault.recordSighting?.(id, opts.sighting);
+          } catch {
+          }
+        }
+      }
+      return { text: out, pointers, degraded };
+    } catch {
+      return { text: "[REDACTED]", pointers: [], degraded: [] };
+    }
+  }
+  async detokenizeText(text, opts) {
+    try {
+      const matches = [...text.matchAll(pointerTokenScanner())];
+      if (matches.length === 0) return { text, revealed: 0 };
+      const occurrences = /* @__PURE__ */ new Map();
+      for (const match of matches) {
+        occurrences.set(match[0], (occurrences.get(match[0]) ?? 0) + 1);
+      }
+      const resolved = /* @__PURE__ */ new Map();
+      for (const [pointer, count] of occurrences) {
+        try {
+          const value = await this.#vault.detokenize(pointer, {
+            target: "human",
+            reason: opts.reason,
+            pointerCount: count
+          });
+          resolved.set(pointer, typeof value === "string" ? value : null);
+        } catch {
+          resolved.set(pointer, null);
+        }
+      }
+      let out = text;
+      let revealed = 0;
+      for (const match of [...matches].reverse()) {
+        const value = resolved.get(match[0]);
+        const replacement = value ?? POINTER_UNAVAILABLE_TEXT;
+        if (value !== null && value !== void 0) revealed += 1;
+        out = out.slice(0, match.index) + replacement + out.slice(match.index + match[0].length);
+      }
+      return { text: out, revealed };
+    } catch {
+      return { text, revealed: 0 };
+    }
+  }
+  // Scan with the bundled packs, as the mask path does. Pointers already in the
+  // text are blanked first so a pointer is never re-tokenized. Returns null
+  // when the registry or the scan itself failed — the caller must then treat
+  // the whole text as unclassifiable.
+  #selfScan(text) {
+    try {
+      registerBundledPacks();
+      const shielded = shieldPointers(text);
+      return dropShieldedFindings(scan(shielded.text, getLoadedRules()), shielded.spans);
+    } catch {
+      return null;
+    }
+  }
+  async describePointerSafe(token) {
+    try {
+      return await this.#vault.describePointer(token);
+    } catch {
+      return null;
+    }
+  }
+  async probeModelPointers(text, opts) {
+    const granted = /* @__PURE__ */ new Map();
+    const ungranted = [];
+    try {
+      for (const pointer of new Set([...text.matchAll(pointerTokenScanner())].map((m) => m[0]))) {
+        try {
+          const grantId = await opts.resolveGrant(pointer);
+          if (grantId === null) ungranted.push(pointer);
+          else granted.set(pointer, grantId);
+        } catch {
+          ungranted.push(pointer);
+        }
+      }
+      return { granted, ungranted };
+    } catch {
+      return { granted: /* @__PURE__ */ new Map(), ungranted };
+    }
+  }
+  async substituteModelPointers(text, opts) {
+    try {
+      const matches = [...text.matchAll(pointerTokenScanner())];
+      if (matches.length === 0) return { text, revealed: [], unresolved: [], grantIds: [] };
+      const resolved = /* @__PURE__ */ new Map();
+      for (const pointer of new Set(matches.map((m) => m[0]))) {
+        try {
+          const grantId = await opts.resolveGrant(pointer);
+          if (grantId === null) {
+            await this.#vault.detokenize(pointer, { target: "model", reason: "model-input" });
+            resolved.set(pointer, null);
+            continue;
+          }
+          const value = await this.#vault.detokenize(pointer, {
+            target: "model",
+            reason: "model-input",
+            grantId
+          });
+          resolved.set(pointer, typeof value === "string" ? { value, grantId } : null);
+        } catch {
+          resolved.set(pointer, null);
+        }
+      }
+      const spentGrants = /* @__PURE__ */ new Set();
+      for (const entry of resolved.values()) {
+        if (entry === null || spentGrants.has(entry.grantId)) continue;
+        spentGrants.add(entry.grantId);
+        try {
+          await this.#vault.consumeGrant?.(entry.grantId);
+        } catch {
+        }
+      }
+      let out = text;
+      const revealed = /* @__PURE__ */ new Set();
+      const unresolved = /* @__PURE__ */ new Set();
+      for (const match of [...matches].reverse()) {
+        const entry = resolved.get(match[0]);
+        if (entry === null || entry === void 0) {
+          unresolved.add(match[0]);
+          continue;
+        }
+        revealed.add(match[0]);
+        out = out.slice(0, match.index) + entry.value + out.slice(match.index + match[0].length);
+      }
+      return {
+        text: out,
+        revealed: [...revealed],
+        unresolved: [...unresolved],
+        grantIds: [...spentGrants]
+      };
+    } catch {
+      return { text, revealed: [], unresolved: [], grantIds: [] };
+    }
+  }
+};
+function hasPointer(text) {
+  return pointerTokenScanner().test(text);
+}
+function createVaultGlue(options) {
+  if (options?.vault) return new SecretVaultGlue(options.vault, options.revealResolver);
+  const base = options?.base ?? defaultDataDir();
+  try {
+    const dir = dataDir(base);
+    const db = openLocalDatabase(dir);
+    const settings = readWorkspaceSettings(base);
+    const provider = options?.policyProvider ?? new UserGrantPolicyProvider(db.exceptions);
+    const vault = new SecretVault({
+      repo: db.secretVault,
+      keys: createKeyProvider(settings.vaultKeyCustody, keysDir(base)),
+      fingerprintKey: loadOrCreateFingerprintKey(dir),
+      // Read live so a revocation applies to the very next call, not the next
+      // process.
+      isConsented: () => isVaultConsentValid(readWorkspaceSettings(base).vaultConsent),
+      // This is the one construction site that reveals to the model, so it is
+      // the one that supplies the last gate. The decision is re-taken from the
+      // ROW's identity at the moment of crossing, which closes the window
+      // between resolving a grant and spending it: a grant revoked in between
+      // refuses here.
+      //
+      // The re-decision is on the identity alone, never on the grant id
+      // matching the one the resolver returned. ExceptionPolicyProvider
+      // promises no id stability across calls — a provider deciding from
+      // external policy may well mint a fresh id each time — so comparing ids
+      // would silently refuse every crossing for such a provider while looking
+      // like a security check. `allow` for this row is the whole question.
+      verifyGrant: async (_grantId, identity) => {
+        const decision = await provider.decideReveal(identity);
+        return decision.allow;
+      }
+    });
+    const vaultWithSightings = {
+      tokenize: (raw, meta3) => vault.tokenize(raw, meta3),
+      detokenize: (token, opts) => vault.detokenize(token, opts),
+      describePointer: (token) => vault.describePointer(token),
+      resolvePointerIdentity: (token) => vault.resolvePointerIdentity(token),
+      recordSighting: (pointerId, sighting) => {
+        db.secretVault.recordSighting({ pointerId, ...sighting }, Date.now());
+      },
+      consumeGrant: (grantId) => db.exceptions.consume(grantId)
+    };
+    const revealGrantResolver = async (pointer) => {
+      try {
+        const identity = await vault.resolvePointerIdentity(pointer);
+        if (identity === null) return null;
+        const decision = await provider.decideReveal(identity);
+        return decision.allow ? decision.grantId : null;
+      } catch {
+        return null;
+      }
+    };
+    return new SecretVaultGlue(vaultWithSightings, revealGrantResolver, () => {
+      db.close();
+    });
+  } catch {
+    return new SecretVaultGlue(UNOPENABLE_VAULT);
+  }
+}
+var UNOPENABLE_VAULT = {
+  tokenize: () => Promise.resolve(/* @__PURE__ */ Symbol("aka.vault.unopenable")),
+  detokenize: () => Promise.resolve(/* @__PURE__ */ Symbol("aka.vault.unopenable")),
+  describePointer: () => Promise.resolve(null),
+  resolvePointerIdentity: () => Promise.resolve(null)
+};
+
+// src/protocol/marker.ts
+import { randomBytes as randomBytes4 } from "crypto";
+import { mkdirSync as mkdirSync5, readFileSync as readFileSync8, renameSync as renameSync5, writeFileSync as writeFileSync6 } from "fs";
+import { join as join13 } from "path";
+var MARKER_FILE = "protocol-marker";
+function mintMarker() {
+  return randomBytes4(8).toString("hex");
+}
+function sessionProtocolMarker(dataDir2, sessionId) {
+  if (!sessionId) return mintMarker();
+  const path = join13(dataDir2, MARKER_FILE);
+  try {
+    const stored = JSON.parse(readFileSync8(path, "utf8"));
+    if (stored.sessionId === sessionId && typeof stored.marker === "string" && /^[0-9a-f]{16}$/.test(stored.marker)) {
+      return stored.marker;
+    }
+  } catch {
+  }
+  const marker = mintMarker();
+  try {
+    mkdirSync5(dataDir2, { recursive: true, mode: DATA_DIR_MODE });
+    const tmp = join13(dataDir2, `${MARKER_FILE}.tmp`);
+    writeFileSync6(tmp, JSON.stringify({ sessionId, marker }), { mode: DATA_FILE_MODE });
+    renameSync5(tmp, path);
+  } catch {
+  }
+  return marker;
+}
+
+// src/protocol/notes.ts
+function countOf(n, noun) {
+  return `${String(n)} ${noun}${n === 1 ? "" : "s"}`;
+}
+function uniqueCategories(items) {
+  return [...new Set(items.map((item) => item.category))].join(", ");
+}
+function eventNote(opts) {
+  const { pointers, degraded } = opts.realized;
+  if (pointers.length === 0 && degraded.length === 0) return null;
+  const parts = [];
+  if (pointers.length > 0) {
+    const shown = pointers.slice(0, VAULT_EVENT_NOTE_MAX_POINTERS);
+    const listed = shown.map((p) => `${p.token} (${p.category}${p.provider ? `/${p.provider}` : ""})`).join(", ");
+    const hidden = pointers.length - shown.length;
+    const overflow = hidden > 0 ? ` \u2026 and ${String(hidden)} more` : "";
+    parts.push(
+      `AKA replaced ${countOf(pointers.length, "value")} before this ran \u2014 ${listed}${overflow}. Use each pointer verbatim; the raw values are not available to you. Never fabricate or alter a pointer.`
+    );
+  }
+  if (degraded.length > 0) {
+    const many = degraded.length > 1;
+    parts.push(
+      `AKA removed ${countOf(degraded.length, "value")} (${uniqueCategories(degraded)}) before this ran. The vault was unavailable so ${many ? "they were" : "it was"} redacted irreversibly \u2014 no pointer exists for ${many ? "them" : "it"}. Do not invent one, and do not ask the user for the ${many ? "values" : "value"}.`
+    );
+  }
+  return `[AKA ${opts.marker}] ${opts.surface}: ${parts.join(" ")}`;
+}
+function userDisclosure(opts) {
+  const { pointers, degraded } = opts.realized;
+  if (pointers.length === 0 && degraded.length === 0) return null;
+  const sentences = [];
+  if (pointers.length > 0) {
+    sentences.push(
+      `AKA replaced ${countOf(pointers.length, "value")} (${uniqueCategories(pointers)}) in this ${opts.surface} \u2014 kept recoverable in your local vault \u2014 see the AKA dashboard or \`aka vault show\`.`
+    );
+  }
+  if (degraded.length > 0) {
+    sentences.push(
+      `AKA removed ${countOf(degraded.length, "value")} (${uniqueCategories(degraded)}) from this ${opts.surface} \u2014 redacted irreversibly \u2014 the vault was unavailable.`
+    );
+  }
+  return sentences.join(" ");
+}
 
 // src/hooks/paths.ts
 function stringAtPath(root, path) {
@@ -27381,6 +29238,41 @@ function replaceAtPath(root, path, value) {
   return { ...record2, [head]: replaceAtPath(record2[head], rest, value) };
 }
 
+// src/hooks/pointer-substitution.ts
+async function decideInputPointers(fields, substitute) {
+  const outcomes = [];
+  for (const field of fields) {
+    if (!hasPointer(field.text)) continue;
+    let text = field.text;
+    let revealed = [];
+    let unresolved = [];
+    let failed = false;
+    try {
+      ({ text, revealed, unresolved } = await substitute(field.text));
+    } catch {
+      failed = true;
+    }
+    if (field.executable) {
+      if (failed || unresolved.length > 0 || revealed.length === 0) {
+        outcomes.push({ path: field.path, disposition: "deny" });
+      } else {
+        outcomes.push({ path: field.path, disposition: "deref", text });
+      }
+    } else if (!failed && revealed.length > 0) {
+      outcomes.push({ path: field.path, disposition: "deref", text });
+    } else {
+      outcomes.push({ path: field.path, disposition: "keep" });
+    }
+  }
+  return outcomes;
+}
+function denyPointerMessage(toolName) {
+  return `A vault pointer in a ${toolName} command cannot execute as text, and AKA does not substitute the raw value without an active reveal exception. Ask the user to grant one (aka exception approve) or remove the pointer.`;
+}
+function denyUnresolvedPointerMessage(toolName) {
+  return `A vault pointer in a ${toolName} command is covered by a reveal exception but its value could not be resolved, so the command was not run rather than executed with the pointer as literal text. The entry may have been purged; check the vault.`;
+}
+
 // src/present.ts
 var fg = (hex3) => (text) => {
   const r = Number.parseInt(hex3.slice(1, 3), 16);
@@ -27430,7 +29322,11 @@ function exceptionPointer(references) {
 
 // src/hooks/pre-tool-use-decision.ts
 var EXECUTABLE_REDACT_NOTE = "Masking inside an executable command would silently change what runs, so a redact policy blocks it instead.";
-function decidePreToolUse(toolName, toolInput, scanned) {
+function pointerCategory(token) {
+  const match = /^\[\[aka:([a-z_]+):/.exec(token);
+  return match?.[1] ?? "secret";
+}
+async function decidePreToolUse(toolName, toolInput, scanned, tokenizeField) {
   const blockedRules = /* @__PURE__ */ new Set();
   const warnedRules = /* @__PURE__ */ new Set();
   const redactedRules = /* @__PURE__ */ new Set();
@@ -27438,7 +29334,8 @@ function decidePreToolUse(toolName, toolInput, scanned) {
   const redactedReferences = [];
   let escalated = false;
   let updatedInput = null;
-  for (const { spec, result } of scanned) {
+  const realized = { pointers: [], degraded: [] };
+  for (const { spec, text, result } of scanned) {
     const escalate = result.action === "redact" && spec.executable;
     if (escalate) escalated = true;
     const action = escalate ? "block" : result.action;
@@ -27448,8 +29345,21 @@ function decidePreToolUse(toolName, toolInput, scanned) {
     } else if (action === "redact") {
       for (const finding of result.findings) redactedRules.add(finding.ruleId);
       if (result.blockedReferences) redactedReferences.push(...result.blockedReferences);
-      if (result.text !== null) {
-        updatedInput = replaceAtPath(updatedInput ?? toolInput, spec.path, result.text);
+      let rewritten = result.text;
+      const enforced = result.enforcedFindings ?? [];
+      if (tokenizeField && enforced.length > 0) {
+        try {
+          const tokenized = await tokenizeField(text, enforced);
+          rewritten = tokenized.text;
+          for (const token of tokenized.pointers) {
+            realized.pointers.push({ token, category: pointerCategory(token) });
+          }
+          realized.degraded.push(...tokenized.degraded);
+        } catch {
+        }
+      }
+      if (rewritten !== null) {
+        updatedInput = replaceAtPath(updatedInput ?? toolInput, spec.path, rewritten);
       }
     } else if (action === "warn") {
       for (const finding of result.findings) warnedRules.add(finding.ruleId);
@@ -27457,31 +29367,41 @@ function decidePreToolUse(toolName, toolInput, scanned) {
   }
   if (blockedRules.size > 0) {
     return {
-      hookSpecificOutput: {
-        hookEventName: "PreToolUse",
-        permissionDecision: "deny",
-        permissionDecisionReason: blockMessage({
-          subject: `${toolName} call`,
-          ruleIds: [...blockedRules].join(", "),
-          blockedRef: blockedReferences[0],
-          note: escalated ? EXECUTABLE_REDACT_NOTE : void 0
-        })
-      }
+      output: {
+        hookSpecificOutput: {
+          hookEventName: "PreToolUse",
+          permissionDecision: "deny",
+          permissionDecisionReason: blockMessage({
+            subject: `${toolName} call`,
+            ruleIds: [...blockedRules].join(", "),
+            blockedRef: blockedReferences[0],
+            note: escalated ? EXECUTABLE_REDACT_NOTE : void 0
+          })
+        }
+      },
+      realized: null
     };
   }
   if (redactedRules.size > 0) {
+    const tokenized = realized.pointers.length > 0 || realized.degraded.length > 0;
     return {
-      hookSpecificOutput: {
-        hookEventName: "PreToolUse",
-        permissionDecision: "allow",
-        updatedInput: updatedInput ?? { ...toolInput }
+      output: {
+        hookSpecificOutput: {
+          hookEventName: "PreToolUse",
+          permissionDecision: "allow",
+          updatedInput: updatedInput ?? { ...toolInput }
+        },
+        systemMessage: `AKA redacted sensitive content in ${toolName} input \u2014 flagged ${[...redactedRules].join(", ")}.${exceptionPointer(redactedReferences)}`
       },
-      systemMessage: `AKA redacted sensitive content in ${toolName} input \u2014 flagged ${[...redactedRules].join(", ")}.${exceptionPointer(redactedReferences)}`
+      realized: tokenized ? realized : null
     };
   }
   if (warnedRules.size > 0) {
     return {
-      systemMessage: `AKA flagged sensitive content in ${toolName} input (${[...warnedRules].join(", ")}).`
+      output: {
+        systemMessage: `AKA flagged sensitive content in ${toolName} input (${[...warnedRules].join(", ")}).`
+      },
+      realized: null
     };
   }
   return null;
@@ -27621,11 +29541,11 @@ function baseMetadata(input) {
 }
 
 // src/hooks/store-health.ts
-import { mkdirSync as mkdirSync4, readFileSync as readFileSync7, writeFileSync as writeFileSync5 } from "fs";
-import { join as join12 } from "path";
+import { mkdirSync as mkdirSync6, readFileSync as readFileSync9, writeFileSync as writeFileSync7 } from "fs";
+import { join as join14 } from "path";
 
 // ../../packages/plugin-runtime/src/standalone-gateway.ts
-import { randomUUID as randomUUID11 } from "crypto";
+import { randomUUID as randomUUID13 } from "crypto";
 
 // ../../packages/plugin-runtime/src/recorder.ts
 var PLUGIN_RECORDER_BINARY = "plugin";
@@ -27787,7 +29707,7 @@ var StandaloneDataGateway = class {
     const customKeywords = [...new Set(policies.flatMap((p) => p.customKeywords ?? []))];
     const installed = this.installedScanRules();
     const rulePolicies = installed ? [...installed.ruleActions].map(([ruleId, action]) => ({
-      id: randomUUID11(),
+      id: randomUUID13(),
       scope: "global",
       target: { ruleId },
       action,
@@ -27940,7 +29860,7 @@ function resolveDataGateway(config2, meta3, gatewayFactory = standaloneGatewayFa
 }
 
 // ../../packages/plugin-runtime/src/handle-session-start.ts
-import { randomUUID as randomUUID12 } from "crypto";
+import { randomUUID as randomUUID14 } from "crypto";
 var EXCEPTION_RETENTION_MS = 90 * 24 * 60 * 60 * 1e3;
 
 // src/hooks/store-health.ts
@@ -27957,14 +29877,14 @@ function storeUnavailableMessage(dbPath2) {
 }
 function claimStoreUnavailableWarning(dataDir2, sessionId) {
   if (!sessionId) return true;
-  const path = join12(dataDir2, STORE_WARNING_MARKER);
+  const path = join14(dataDir2, STORE_WARNING_MARKER);
   try {
-    if (readFileSync7(path, "utf8") === sessionId) return false;
+    if (readFileSync9(path, "utf8") === sessionId) return false;
   } catch {
   }
   try {
-    mkdirSync4(dataDir2, { recursive: true, mode: DATA_DIR_MODE });
-    writeFileSync5(path, sessionId, { mode: DATA_FILE_MODE });
+    mkdirSync6(dataDir2, { recursive: true, mode: DATA_DIR_MODE });
+    writeFileSync7(path, sessionId, { mode: DATA_FILE_MODE });
   } catch {
   }
   return true;
@@ -27981,9 +29901,64 @@ async function main() {
   const fields = scannableInputFields(toolName, toolInput);
   if (fields.length === 0) return;
   const config2 = loadConfig();
+  const sessionId = getString(input, "session_id");
+  const consented = isVaultConsentValid(config2.settings.vaultConsent);
+  const vaultGlue = consented ? createVaultGlue() : null;
+  const pointerFields = [];
+  for (const spec of fields) {
+    const text = stringAtPath(toolInput, spec.path);
+    if (text !== void 0 && text !== "") {
+      pointerFields.push({ path: spec.path, text, executable: spec.executable });
+    }
+  }
+  const spentGrantIds = [];
+  let denyForPointer = false;
+  if (vaultGlue) {
+    for (const field of pointerFields.filter((f) => f.executable)) {
+      const probe = await vaultGlue.probeModelPointers(field.text, {
+        resolveGrant: vaultGlue.revealGrantResolver
+      });
+      if (probe.ungranted.length > 0) denyForPointer = true;
+    }
+  } else {
+    denyForPointer = pointerFields.some((f) => f.executable && pointerTokenScanner().test(f.text));
+  }
+  const pointerOutcomes = denyForPointer ? [] : await decideInputPointers(pointerFields, async (text) => {
+    if (!vaultGlue) {
+      return {
+        text,
+        revealed: [],
+        unresolved: [...text.matchAll(pointerTokenScanner())].map((m) => m[0]),
+        grantIds: []
+      };
+    }
+    const result = await vaultGlue.substituteModelPointers(text, {
+      resolveGrant: vaultGlue.revealGrantResolver
+    });
+    spentGrantIds.push(...result.grantIds);
+    return result;
+  });
+  const unresolvedAfterGrant = pointerOutcomes.some((o) => o.disposition === "deny");
+  if (denyForPointer || unresolvedAfterGrant) {
+    await emit({
+      hookSpecificOutput: {
+        hookEventName: "PreToolUse",
+        permissionDecision: "deny",
+        permissionDecisionReason: denyForPointer ? denyPointerMessage(toolName) : denyUnresolvedPointerMessage(toolName)
+      }
+    });
+    return;
+  }
+  let effectiveInput = toolInput;
+  let derefHappened = false;
+  for (const outcome of pointerOutcomes) {
+    if (outcome.disposition !== "deref" || outcome.text === void 0) continue;
+    effectiveInput = replaceAtPath(effectiveInput, outcome.path, outcome.text);
+    derefHappened = true;
+  }
   const gateway = openGatewayOrNull(config2);
   if (gateway === null) {
-    if (claimStoreUnavailableWarning(config2.dataDir, getString(input, "session_id"))) {
+    if (claimStoreUnavailableWarning(config2.dataDir, sessionId)) {
       await emit({ systemMessage: storeUnavailableMessage(config2.dbPath) });
     }
     return;
@@ -27997,7 +29972,7 @@ async function main() {
   const scanned = [];
   try {
     for (const spec of fields) {
-      const text = stringAtPath(toolInput, spec.path);
+      const text = stringAtPath(effectiveInput, spec.path);
       if (text === void 0 || text === "") continue;
       const result = await runtime.capture(
         { kind, sourceTool: "claude-code", text, metadata },
@@ -28007,15 +29982,83 @@ async function main() {
         // every Bash command and one call per string leaf of every MCP payload,
         // and 'always' would copy that whole stream into the store to trail the
         // enforcement decisions that are the point of the kind.
-        kind === "tool_use" ? { persist: "with-findings" } : {}
+        {
+          ...kind === "tool_use" ? { persist: "with-findings" } : {},
+          // Grants this call's pointer crossing already spent: suppression
+          // applies without charging a second use.
+          ...spentGrantIds.length > 0 ? { preAuthorizedGrantIds: spentGrantIds } : {}
+        }
       );
-      scanned.push({ spec, result });
+      scanned.push({ spec, text, result });
     }
   } finally {
     await runtime.close();
   }
-  const output = decidePreToolUse(toolName, toolInput, scanned);
-  if (output) await emit(output);
+  const decision = await decidePreToolUse(
+    toolName,
+    effectiveInput,
+    scanned,
+    vaultGlue ? (text, findings) => vaultGlue.tokenizeText(text, {
+      findings,
+      sighting: filePath ? { location: filePath, kind: "file" } : { location: `${toolName} input`, kind: "tool-input" }
+    }) : void 0
+  );
+  const revealNote = `AKA revealed granted vault value(s) to this ${toolName} call \u2014 the reveal exception you approved authorized it.`;
+  if (decision) {
+    const output = withProtocolNotes(
+      decision.output,
+      decision.realized,
+      toolName,
+      config2,
+      sessionId,
+      vaultGlue
+    );
+    if (derefHappened && !("hookSpecificOutput" in output)) {
+      await emit({
+        hookSpecificOutput: {
+          hookEventName: "PreToolUse",
+          permissionDecision: "allow",
+          updatedInput: effectiveInput
+        },
+        systemMessage: `${output.systemMessage} ${revealNote}`
+      });
+      return;
+    }
+    await emit(output);
+    return;
+  }
+  if (derefHappened) {
+    await emit({
+      hookSpecificOutput: {
+        hookEventName: "PreToolUse",
+        permissionDecision: "allow",
+        updatedInput: effectiveInput
+      },
+      systemMessage: revealNote
+    });
+  }
+}
+function withProtocolNotes(output, realized, toolName, config2, sessionId, vaultGlue) {
+  if (!vaultGlue || realized === null || !("hookSpecificOutput" in output)) return output;
+  if (!("updatedInput" in output.hookSpecificOutput) || !("systemMessage" in output)) {
+    return output;
+  }
+  try {
+    const surface = `${toolName} input`;
+    const marker = sessionProtocolMarker(config2.dataDir, sessionId);
+    const note = eventNote({ marker, surface, realized });
+    const disclosure = userDisclosure({ surface, realized });
+    return {
+      ...output,
+      hookSpecificOutput: {
+        ...output.hookSpecificOutput,
+        ...note === null ? {} : { additionalContext: note }
+      },
+      systemMessage: disclosure ?? output.systemMessage
+    };
+  } catch {
+    return output;
+  }
 }
 try {
   await main();