@akasecurity/ai-tc-claude-code 0.9.3 → 0.9.5

package/scripts/reconcile.js

@@ -492,13 +492,12 @@ var require_ignore = __commonJS({
 });
 
 // ../../packages/plugin-sdk/src/config.ts
-import { existsSync as existsSync4 } from "fs";
-import { join as join6 } from "path";
+import { existsSync as existsSync5 } from "fs";
+import { join as join8 } from "path";
 
 // ../../packages/persistence/src/database.ts
-import { randomUUID as randomUUID8 } from "crypto";
-import { existsSync, renameSync as renameSync2, rmSync as rmSync2 } from "fs";
-import { join, sep } from "path";
+import { randomUUID as randomUUID10 } from "crypto";
+import { join as join2, sep } from "path";
 import { DatabaseSync } from "node:sqlite";
 
 // ../../packages/schema/src/drizzle/sqlite-ddl.ts
@@ -562,6 +561,30 @@ var SQLITE_MIGRATIONS = [
   {
     tag: "0014_drop_legacy_events_findings",
     sql: "-- Custom migration: drops the frozen legacy `events`/`findings` tables\n-- (superseded by audit_events/inspection_definitions/inspection_findings) and\n-- replaces them with read-only views of the same name.\n--\n-- persistence's migrations.ts applies this migration ONLY once the batched\n-- history backfill (see runLegacyHistoryBackfill) has fully drained both\n-- tables, and only after copying the live file aside \u2014 see\n-- backupBeforeLegacyDrop in packages/persistence/src/migrations.ts. A store\n-- still mid-copy keeps its real tables and this migration stays pending.\n--\n-- The views exist for skew: the `aka` CLI and the Claude Code plugin update\n-- independently against one shared store, so an older, already-installed\n-- binary can open a store a newer binary already dropped these tables on.\n-- Every already-shipped repository constructor prepares its SQL eagerly at\n-- open time, so a bare \"table not found\" would fail the WHOLE open, not just\n-- a findings-specific read \u2014 these views keep `prepare()` succeeding so an\n-- old binary's unrelated features keep working; its own reads stay truthful,\n-- and its rare (already fail-open) writes fail at run time instead.\n--\n-- The 0009/0010 expression indexes existed only over the legacy `events`\n-- table; DROP TABLE below would remove them implicitly, but they are\n-- dropped explicitly first so the intent reads clearly. IF EXISTS so a store\n-- that reached here with an index missing out of band (an adopted-tag store\n-- whose physical index was never built) does not throw a deterministic \"no\n-- such index\" out of the fail-open drop path.\nDROP INDEX IF EXISTS `idx_events_code_change_path`;\n--> statement-breakpoint\nDROP INDEX IF EXISTS `idx_events_session_id`;\n--> statement-breakpoint\n-- `findings.event_id` references `events.id` \u2014 drop the child first.\nDROP TABLE `findings`;\n--> statement-breakpoint\nDROP TABLE `events`;\n--> statement-breakpoint\n-- Legacy `events` shape, projected from audit_events: `kind`/`occurred_at`/\n-- `source_tool` become real columns again (source_tool round-trips through\n-- the attributes bag, the only place a capture-typed audit row keeps it);\n-- `metadata` is reconstructed as the old camelCase JSON object from the new\n-- snake_case attributes bag, with `root_session_id` folded back in as\n-- `sessionId` (the one legacy metadata key that became a column, never an\n-- attribute, on the new table). Constrained to the four capture kinds so\n-- structural rows (session/run/tool_call/llm_call/source_lookup/config_scan)\n-- never leak into a legacy reader's result set \u2014 the old `events` table\n-- never held them either.\nCREATE VIEW `events` AS\nSELECT\n  id,\n  json_extract(attributes, '$.source_tool') AS source_tool,\n  event_type AS kind,\n  started_at AS occurred_at,\n  content_hash,\n  content,\n  -- Plugin-local bookkeeping column that `ensureSyncedAtColumn` adds to the\n  -- real `events` table at open time. A pre-cutover binary runs that probe on\n  -- EVERY open; without this projection its `columnNames('events')` check\n  -- misses `synced_at` and issues `ALTER TABLE events ADD COLUMN` against this\n  -- view, which SQLite rejects (\"Cannot add a column to a view\") \u2014 a hard,\n  -- non-fail-open crash of the whole open, the exact skew failure these views\n  -- exist to prevent. Projecting it (always NULL; no reader consumes it)\n  -- short-circuits that ALTER.\n  NULL AS synced_at,\n  json_object(\n    'sessionId', root_session_id,\n    'repo', json_extract(attributes, '$.repo'),\n    'filePath', json_extract(attributes, '$.file_path'),\n    'toolName', json_extract(attributes, '$.tool_name'),\n    'gitignored', json_extract(attributes, '$.gitignored'),\n    'wholeFile', json_extract(attributes, '$.whole_file'),\n    'model', json_extract(attributes, '$.model'),\n    'turnIndex', json_extract(attributes, '$.turn_index'),\n    'correlationId', json_extract(attributes, '$.correlation_id'),\n    'traceId', json_extract(attributes, '$.trace_id'),\n    'exceptionIds', json_extract(attributes, '$.exception_ids')\n  ) AS metadata\nFROM audit_events\nWHERE event_type IN ('prompt', 'response', 'code_change', 'tool_use');\n--> statement-breakpoint\n-- A plain single-row INSERT (the old writer's shape \u2014 no ON CONFLICT) is\n-- accepted by prepare() against a view once an INSTEAD OF INSERT trigger\n-- exists, so it fails at run time instead of at open \u2014 landing in the same\n-- fail-open path the caller already wraps its write in.\nCREATE TRIGGER `trg_events_ro`\nINSTEAD OF INSERT ON `events`\nBEGIN SELECT RAISE(ABORT, 'events is read-only; write to audit_events instead'); END;\n--> statement-breakpoint\n-- Legacy `findings` shape: rule_id/category/severity come from the joined\n-- inspection_definitions row (the legacy table inlined them per-row; the\n-- generalized schema normalizes them out into the shared definition). A view\n-- has no rowid of its own, so the underlying table's rowid is re-exposed\n-- explicitly under that name \u2014 a legacy reader ordering by `f.rowid` would\n-- otherwise fail to resolve the column at all. Joined to audit_events for the\n-- same four-capture-kind constraint as the events view above (a finding\n-- attached to a tool_call/config_scan row never existed in the legacy table\n-- either \u2014 see the persistence findings repository's identical predicate).\nCREATE VIEW `findings` AS\nSELECT\n  f.id AS id,\n  f.rowid AS rowid,\n  f.audit_event_id AS event_id,\n  d.rule_id AS rule_id,\n  d.category AS category,\n  d.severity AS severity,\n  f.span_start AS span_start,\n  f.span_end AS span_end,\n  f.masked_match AS masked_match,\n  f.action_taken AS action_taken,\n  f.confidence AS confidence,\n  f.finding_key AS finding_key,\n  f.first_detected_at AS first_detected_at\nFROM inspection_findings f\nJOIN audit_events e ON e.id = f.audit_event_id\nJOIN inspection_definitions d ON d.id = f.inspection_definition_id\nWHERE e.event_type IN ('prompt', 'response', 'code_change', 'tool_use');\n--> statement-breakpoint\n-- Defense in depth only: SQLite refuses to plan ANY upsert against a view\n-- (\"cannot UPSERT a view\") no matter what trigger exists, so this can never\n-- rescue the real legacy writer, which always used\n-- `ON CONFLICT (finding_key) DO UPDATE` \u2014 that statement still fails at\n-- prepare() on an old binary, same as it would with no trigger at all. This\n-- only covers a plain-INSERT shape, should one ever exist.\nCREATE TRIGGER `trg_findings_ro`\nINSTEAD OF INSERT ON `findings`\nBEGIN SELECT RAISE(ABORT, 'findings is read-only; write to inspection_findings instead'); END;\n"
+  },
+  {
+    tag: "0015_busy_vengeance",
+    sql: "CREATE TABLE `secret_vault` (\n	`pointer_id` text PRIMARY KEY NOT NULL,\n	`value_fingerprint` text NOT NULL,\n	`fingerprint_key_version` integer NOT NULL,\n	`key_version` integer NOT NULL,\n	`category` text NOT NULL,\n	`rule_id` text NOT NULL,\n	`masked_match` text NOT NULL,\n	`provider` text,\n	`ciphertext` text NOT NULL,\n	`nonce` text NOT NULL,\n	`auth_tag` text NOT NULL,\n	`occurrence_count` integer DEFAULT 1 NOT NULL,\n	`first_seen` integer NOT NULL,\n	`last_seen` integer NOT NULL\n);\n--> statement-breakpoint\nCREATE UNIQUE INDEX `uq_secret_vault_value` ON `secret_vault` (`value_fingerprint`);--> statement-breakpoint\nCREATE TABLE `secret_vault_deref` (\n	`id` text PRIMARY KEY NOT NULL,\n	`pointer_id` text NOT NULL,\n	`at` integer NOT NULL,\n	`target` text NOT NULL,\n	`reason` text NOT NULL,\n	`outcome` text NOT NULL,\n	`grant_id` text,\n	`pointer_count` integer DEFAULT 1 NOT NULL\n);\n--> statement-breakpoint\nCREATE INDEX `idx_secret_vault_deref_pointer` ON `secret_vault_deref` (`pointer_id`);--> statement-breakpoint\nCREATE INDEX `idx_secret_vault_deref_reason_at` ON `secret_vault_deref` (`reason`,`at`);"
+  },
+  {
+    tag: "0016_breezy_zodiak",
+    sql: "ALTER TABLE `exceptions` ADD `capability` text DEFAULT 'suppress' NOT NULL;"
+  },
+  {
+    tag: "0017_rainy_kat_farrell",
+    sql: "CREATE TABLE `secret_vault_sighting` (\n	`id` text PRIMARY KEY NOT NULL,\n	`pointer_id` text NOT NULL,\n	`location` text NOT NULL,\n	`kind` text NOT NULL,\n	`first_seen` integer NOT NULL,\n	`last_seen` integer NOT NULL\n);\n--> statement-breakpoint\nCREATE UNIQUE INDEX `uq_secret_vault_sighting` ON `secret_vault_sighting` (`pointer_id`,`location`);"
+  },
+  {
+    tag: "0018_serious_tana_nile",
+    sql: "ALTER TABLE `secret_vault` ADD `format_version` integer DEFAULT 2 NOT NULL;"
+  },
+  {
+    tag: "0019_audit_started_at_index",
+    sql: "CREATE INDEX `idx_audit_started_at` ON `audit_events` (`started_at`);"
+  },
+  {
+    tag: "0020_secret_vault_pagination_indexes",
+    sql: "CREATE INDEX `idx_secret_vault_last_seen` ON `secret_vault` (`last_seen`,`pointer_id`);--> statement-breakpoint\nCREATE INDEX `idx_secret_vault_reuse` ON `secret_vault` (`occurrence_count`,`pointer_id`);--> statement-breakpoint\nCREATE INDEX `idx_secret_vault_deref_at` ON `secret_vault_deref` (`at`,`id`);--> statement-breakpoint\nCREATE INDEX `idx_secret_vault_deref_signal` ON `secret_vault_deref` (`at`,`id`) WHERE `reason` NOT IN ('display', 'view-render');"
   }
 ];
 
@@ -15299,7 +15322,17 @@ var Finding = external_exports.object({
 }).meta({ id: "Finding" });
 var DetectedFinding = Finding.meta({ id: "DetectedFinding" });
 var FindingAction = external_exports.enum(["blocked", "redacted", "warned", "allowed", "quarantined", "monitored"]).meta({ id: "FindingAction" });
-var FindingProvider = external_exports.enum(["claudecode", "claudedesktop", "cursor", "copilot", "chatgpt", "api"]).meta({ id: "FindingProvider" });
+var FindingProvider = external_exports.enum([
+  "claudecode",
+  "claudedesktop",
+  "cursor",
+  "copilot",
+  "chatgpt",
+  "claudeai",
+  "codex",
+  "antigravity",
+  "api"
+]).meta({ id: "FindingProvider" });
 var FindingCategory = external_exports.enum([
   "secret",
   "pii",
@@ -15353,7 +15386,16 @@ var FindingInstance = external_exports.object({
   confidence: external_exports.number().min(0).max(1),
   // Lifecycle status (see FindingStatus). Optional so legacy callers/rows
   // that predate the resolution feature stay valid.
-  status: FindingStatus.optional()
+  status: FindingStatus.optional(),
+  // The audit event this finding was captured from. Optional so callers that
+  // do not project it stay valid. An at-rest finding is content-addressed by
+  // finding_key and its row is upserted on re-detection, so this names the
+  // MOST RECENT detection event, not the first.
+  eventId: external_exports.string().optional(),
+  // The session that event belongs to, when it has one — the seam a
+  // per-instance "view session" link needs. Absent for events captured
+  // outside a session.
+  sessionId: external_exports.string().optional()
 }).meta({ id: "FindingInstance" });
 var FindingGroup = external_exports.object({
   id: external_exports.string(),
@@ -15397,7 +15439,11 @@ var FindingFacets = external_exports.object({
   // for every instance, so every group lands in a bucket; a status-less
   // group (possible only for callers whose rows carry no statuses) is
   // counted under no value.
-  status: external_exports.array(FindingFacetItem)
+  status: external_exports.array(FindingFacetItem),
+  // Host tool (attributes.tool_name). Present only on the instance-level
+  // reads, which can filter by it; the grouped read omits the dimension
+  // because a group spans tools.
+  tool: external_exports.array(FindingFacetItem).optional()
 }).meta({ id: "FindingFacets" });
 var DEFAULT_GROUPED_FINDINGS_LIMIT = 50;
 var ListGroupedFindingsQuery = external_exports.object({
@@ -15415,6 +15461,16 @@ var ListGroupedFindingsQuery = external_exports.object({
   // Scope to findings whose event carries this session id (the Activity page's
   // session → findings drilldown). Findings without a session never match.
   sessionId: external_exports.string().optional(),
+  // Inclusive lower bound on the parent event's timestamp, so a caller arriving
+  // from a time-scoped page (Activity's range) can carry that scope. Absent
+  // means all time — this list has no default window.
+  from: external_exports.iso.datetime().optional(),
+  // A group or instance id that must appear in the page even when the cursor
+  // has already advanced past its sort position. This is what keeps the
+  // Findings page's one-shot ?finding= deep link resolving once the list
+  // paginates: the target group is appended out of sort order rather than
+  // scanning forward for it. Never affects totals, facets or the cursor.
+  includeId: external_exports.string().optional(),
   groupBy: external_exports.literal("type").optional(),
   limit: external_exports.coerce.number().int().min(1).max(100).optional(),
   cursor: external_exports.string().optional()
@@ -15459,15 +15515,110 @@ var FindingInstanceDetail = FindingInstance.extend({
   detection: FindingDetectionRef,
   policy: FindingPolicyRef
 }).meta({ id: "FindingInstanceDetail" });
+var DEFAULT_FLAT_FINDINGS_LIMIT = 50;
+var ListFindingInstancesQuery = external_exports.object({
+  severity: external_exports.array(Severity).optional(),
+  // Rule ids, the same vocabulary the grouped list's `subtype` carries.
+  subtype: external_exports.array(external_exports.string()).optional(),
+  provider: external_exports.array(FindingProvider).optional(),
+  action: external_exports.array(FindingAction).optional(),
+  // Matches each instance's OWN derived status (deriveFindingStatus), unlike
+  // the grouped query's group-level fold.
+  status: external_exports.array(FindingStatus).optional(),
+  // Exact host-tool names (attributes.tool_name, e.g. 'Bash'). A real filter,
+  // where the free-text `q` can only match the rendered "via Bash" label.
+  tool: external_exports.array(external_exports.string()).optional(),
+  // Exact repository / file-path matches, for the drill-down out of the
+  // locations view. A row whose event carries no repo/file matches neither.
+  repo: external_exports.string().optional(),
+  file: external_exports.string().optional(),
+  q: external_exports.string().optional(),
+  sessionId: external_exports.string().optional(),
+  from: external_exports.iso.datetime().optional(),
+  limit: external_exports.coerce.number().int().min(1).max(200).optional(),
+  cursor: external_exports.string().optional()
+});
+var ListFindingInstancesResponse = external_exports.object({
+  // Instances matching the filters across the whole scope, not just this
+  // page — cursor-independent, like the grouped list's totals.
+  totals: external_exports.object({ findings: external_exports.number().int().nonnegative() }),
+  // Counts in INSTANCES here, where the grouped response counts groups. Each
+  // dimension still excludes its own filter.
+  facets: FindingFacets,
+  items: external_exports.array(FindingInstanceDetail),
+  nextCursor: external_exports.string().nullable()
+}).meta({ id: "ListFindingInstancesResponse" });
+var FindingLocationFile = external_exports.object({
+  // Empty when the instances carried no file path (a prompt or a tool call
+  // with no file attribution).
+  file: external_exports.string(),
+  instanceCount: external_exports.number().int().nonnegative(),
+  maxSeverity: Severity,
+  latestDetectedAt: external_exports.iso.datetime(),
+  // Folded from the instances' derived statuses with the same
+  // open-dominates precedence a group uses.
+  status: FindingStatus.optional(),
+  // Distinct rules seen at this location, capped — the row shows them as
+  // chips, and the count is what conveys scale.
+  ruleIds: external_exports.array(external_exports.string())
+}).meta({ id: "FindingLocationFile" });
+var FindingLocationRepo = external_exports.object({
+  /** Empty when the instances carried no repo attribute. */
+  repo: external_exports.string(),
+  instanceCount: external_exports.number().int().nonnegative(),
+  maxSeverity: Severity,
+  latestDetectedAt: external_exports.iso.datetime(),
+  status: FindingStatus.optional(),
+  files: external_exports.array(FindingLocationFile)
+}).meta({ id: "FindingLocationRepo" });
+var ListFindingLocationsQuery = external_exports.object({
+  severity: external_exports.array(Severity).optional(),
+  subtype: external_exports.array(external_exports.string()).optional(),
+  provider: external_exports.array(FindingProvider).optional(),
+  action: external_exports.array(FindingAction).optional(),
+  // Per-instance, as in ListFindingInstancesQuery: a location keeps the
+  // instances that match, and folds its status from those.
+  status: external_exports.array(FindingStatus).optional(),
+  tool: external_exports.array(external_exports.string()).optional(),
+  q: external_exports.string().optional(),
+  sessionId: external_exports.string().optional(),
+  from: external_exports.iso.datetime().optional(),
+  limit: external_exports.coerce.number().int().min(1).max(500).optional()
+});
+var ListFindingLocationsResponse = external_exports.object({
+  totals: external_exports.object({
+    findings: external_exports.number().int().nonnegative(),
+    repos: external_exports.number().int().nonnegative(),
+    files: external_exports.number().int().nonnegative()
+  }),
+  /** Sorted by max severity, then most recent. */
+  items: external_exports.array(FindingLocationRepo),
+  /** Whether `limit` truncated the repo list. */
+  hasMore: external_exports.boolean()
+}).meta({ id: "ListFindingLocationsResponse" });
 
 // ../../packages/schema/src/zod/harness-map.ts
-var Harness = external_exports.enum(["claudecode", "cursor", "copilot", "codex", "windsurf", "claudedesktop", "chatgpt", "api"]).meta({ id: "Harness" });
+var Harness = external_exports.enum([
+  "claudecode",
+  "cursor",
+  "copilot",
+  "codex",
+  "antigravity",
+  "windsurf",
+  "claudedesktop",
+  "chatgpt",
+  "claudeai",
+  "api"
+]).meta({ id: "Harness" });
 var TOOL_TO_HARNESS = {
   "claude-code": "claudecode",
   "claude-desktop": "claudedesktop",
   "github-copilot": "copilot",
   cursor: "cursor",
-  chatgpt: "chatgpt"
+  chatgpt: "chatgpt",
+  codex: "codex",
+  antigravity: "antigravity",
+  "claude-ai": "claudeai"
 };
 function harnessFromTool(tool) {
   return TOOL_TO_HARNESS[tool] ?? tool;
@@ -15928,7 +16079,18 @@ var ActivityOverviewResponse = external_exports.object({
 // ../../packages/schema/src/zod/event.ts
 var EventKind = external_exports.enum(["prompt", "response", "code_change", "tool_use"]).meta({ id: "EventKind" });
 var CAPTURE_EVENT_TYPES_SQL = EventKind.options.map((k) => `'${k}'`).join(",");
-var SourceTool = external_exports.enum(["claude-code", "claude-desktop", "cursor", "chatgpt", "github-copilot", "cli", "unknown"]).meta({ id: "SourceTool" });
+var SourceTool = external_exports.enum([
+  "claude-code",
+  "claude-desktop",
+  "cursor",
+  "chatgpt",
+  "claude-ai",
+  "github-copilot",
+  "codex",
+  "antigravity",
+  "cli",
+  "unknown"
+]).meta({ id: "SourceTool" });
 var EventMetadata = external_exports.object({
   sessionId: external_exports.string().optional(),
   repo: external_exports.string().optional(),
@@ -15999,7 +16161,7 @@ var TrustLevel = external_exports.enum(["known-good", "risky", "unapproved"]).me
 var Flag = external_exports.enum(["update", "stale", "conflict", "unknown", "change", "untracked", "risk", "findings"]).meta({ id: "Flag" });
 var Visibility = external_exports.enum(["public", "private"]).meta({ id: "Visibility" });
 var HarnessEventKind = external_exports.enum(["block", "redact", "warn"]).meta({ id: "HarnessEventKind" });
-var HarnessId = external_exports.enum(["claudecode", "cursor", "codex"]).meta({ id: "HarnessId" });
+var HarnessId = external_exports.enum(["claudecode", "cursor", "codex", "antigravity"]).meta({ id: "HarnessId" });
 var AccessCounts = external_exports.object({
   open: external_exports.number().int().nonnegative(),
   approved: external_exports.number().int().nonnegative(),
@@ -16221,6 +16383,7 @@ var ExceptionConditions = external_exports.object({
   sourceTool: external_exports.string().optional(),
   provider: external_exports.string().optional()
 }).strict();
+var ExceptionCapability = external_exports.enum(["suppress", "reveal_to_model"]);
 var DetectionException = external_exports.object({
   id: external_exports.guid(),
   ruleId: external_exports.string(),
@@ -16237,6 +16400,7 @@ var DetectionException = external_exports.object({
   keyVersion: external_exports.number().int().positive(),
   // maskMatch() preview of the approved value — never the raw value.
   maskedValue: external_exports.string(),
+  capability: ExceptionCapability.default("suppress"),
   scope: ExceptionScope,
   expiresAt: external_exports.iso.datetime().nullable(),
   maxUses: external_exports.number().int().positive().nullable(),
@@ -16260,11 +16424,13 @@ var ExceptionBundleEntry = DetectionException.pick({
   ruleId: true,
   valueFingerprint: true,
   keyVersion: true,
+  capability: true,
   expiresAt: true,
   maxUses: true,
   useCount: true,
   conditions: true
 });
+var ExceptionDescriptor = DetectionException.omit({ valueFingerprint: true });
 
 // ../../packages/schema/src/zod/rule.ts
 var MatcherType = external_exports.enum(["keyword", "regex", "validator"]).meta({ id: "MatcherType" });
@@ -17075,6 +17241,35 @@ var EgressWriteSummary = external_exports.object({
   droppedFiles: external_exports.array(external_exports.string()).default([])
 }).meta({ id: "EgressWriteSummary" });
 
+// ../../packages/schema/src/zod/exception-action.ts
+var confirmation = external_exports.string().optional();
+var ApproveBlockedInput = external_exports.object({
+  reference: external_exports.string(),
+  scope: external_exports.string(),
+  reason: external_exports.string(),
+  confirmation
+});
+var AddExceptionInput = external_exports.object({
+  ruleId: external_exports.string(),
+  value: external_exports.string(),
+  scope: external_exports.string(),
+  reason: external_exports.string(),
+  confirmation
+});
+var GrantRevealInput = external_exports.object({
+  pointer: external_exports.string(),
+  scope: external_exports.string(),
+  justification: external_exports.string(),
+  confirmation
+});
+var RevokeExceptionInput = external_exports.object({
+  id: external_exports.string(),
+  reason: external_exports.string()
+});
+var RotateKeyInput = external_exports.object({
+  confirmation: external_exports.string()
+});
+
 // ../../packages/schema/src/zod/findings-group-build.ts
 function toApiAction(dbVal) {
   const map2 = {
@@ -17130,6 +17325,8 @@ function buildFindingGroups(rows, opts = {}) {
         repo: r.repo,
         file: r.file,
         ...r.toolName === void 0 ? {} : { toolName: r.toolName },
+        ...r.eventId === void 0 ? {} : { eventId: r.eventId },
+        ...r.sessionId === void 0 ? {} : { sessionId: r.sessionId },
         action: toApiAction(effectiveDbAction),
         detectedAt: r.occurredAt,
         confidence: r.confidence,
@@ -17261,14 +17458,17 @@ function applyFindingFilters(groups, opts) {
 }
 var SEVERITY_ORDER = { critical: 0, high: 1, medium: 2, low: 3 };
 var SEVERITY_RANK = SEVERITY_ORDER;
+function compareFindingGroupOrder(a, b) {
+  const rankA = SEVERITY_RANK[a.severity] ?? -1;
+  const rankB = SEVERITY_RANK[b.severity] ?? -1;
+  const severityDiff = rankA - rankB;
+  if (severityDiff !== 0) return severityDiff;
+  const recencyDiff = b.latestDetectedAt.localeCompare(a.latestDetectedAt);
+  if (recencyDiff !== 0) return recencyDiff;
+  return a.id.localeCompare(b.id);
+}
 function sortFindingGroups(groups) {
-  return [...groups].sort((a, b) => {
-    const rankA = SEVERITY_RANK[a.severity] ?? -1;
-    const rankB = SEVERITY_RANK[b.severity] ?? -1;
-    const severityDiff = rankA - rankB;
-    if (severityDiff !== 0) return severityDiff;
-    return b.latestDetectedAt.localeCompare(a.latestDetectedAt);
-  });
+  return [...groups].sort(compareFindingGroupOrder);
 }
 function computeFindingFacets(allGroups, opts) {
   const forSeverity = applyFindingFilters(allGroups, {
@@ -17324,15 +17524,158 @@ function computeFindingFacets(allGroups, opts) {
   for (const g of forStatus) {
     if (g.status !== void 0) statusMap.set(g.status, (statusMap.get(g.status) ?? 0) + 1);
   }
-  const toItems = (m) => [...m.entries()].map(([value, count]) => ({ value, count }));
+  const toItems2 = (m) => [...m.entries()].map(([value, count]) => ({ value, count }));
+  return {
+    severity: toItems2(severityMap),
+    provider: toItems2(providerMap),
+    action: toItems2(actionMap),
+    subtype: toItems2(subtypeMap),
+    status: toItems2(statusMap)
+  };
+}
+
+// ../../packages/schema/src/zod/findings-flat-build.ts
+function rowHaystack(row) {
+  return [
+    row.ruleId,
+    row.category,
+    row.maskedMatch,
+    row.repo,
+    row.file,
+    row.toolName ? `via ${row.toolName}` : "",
+    row.id
+  ].join(" ").toLowerCase();
+}
+function matchesDimension(row, opts, dimension) {
+  switch (dimension) {
+    case "severity":
+      return !opts.severity?.length || opts.severity.includes(row.severity);
+    case "subtype":
+      return !opts.subtype?.length || opts.subtype.includes(row.ruleId);
+    case "providers":
+      return !opts.providers?.length || opts.providers.includes(toApiProvider(row.sourceTool));
+    case "actions":
+      return !opts.actions?.length || opts.actions.includes(toApiAction(row.actionTaken));
+    case "statuses":
+      return !opts.statuses?.length || row.status !== void 0 && opts.statuses.includes(row.status);
+    case "tools":
+      return !opts.tools?.length || row.toolName !== void 0 && opts.tools.includes(row.toolName);
+    case "repo":
+      return opts.repo === void 0 || opts.repo === "" || row.repo === opts.repo;
+    case "file":
+      return opts.file === void 0 || opts.file === "" || row.file === opts.file;
+    case "q":
+      return !opts.q || rowHaystack(row).includes(opts.q.toLowerCase());
+  }
+}
+var DIMENSIONS = [
+  "severity",
+  "subtype",
+  "providers",
+  "actions",
+  "statuses",
+  "tools",
+  "repo",
+  "file",
+  "q"
+];
+function matchesInstanceFilters(row, opts, except) {
+  for (const dimension of DIMENSIONS) {
+    if (dimension === except) continue;
+    if (!matchesDimension(row, opts, dimension)) return false;
+  }
+  return true;
+}
+function toItems(counts) {
+  return [...counts.entries()].map(([value, count]) => ({ value, count })).sort((a, b) => b.count - a.count || a.value.localeCompare(b.value));
+}
+function bump(counts, value) {
+  counts.set(value, (counts.get(value) ?? 0) + 1);
+}
+function createInstanceFacetAccumulator(opts) {
+  const severity = /* @__PURE__ */ new Map();
+  const subtype = /* @__PURE__ */ new Map();
+  const provider = /* @__PURE__ */ new Map();
+  const action = /* @__PURE__ */ new Map();
+  const status = /* @__PURE__ */ new Map();
+  const tool = /* @__PURE__ */ new Map();
+  return {
+    add(row) {
+      if (matchesInstanceFilters(row, opts, "severity")) bump(severity, row.severity);
+      if (matchesInstanceFilters(row, opts, "subtype")) bump(subtype, row.ruleId);
+      if (matchesInstanceFilters(row, opts, "providers")) {
+        bump(provider, toApiProvider(row.sourceTool));
+      }
+      if (matchesInstanceFilters(row, opts, "actions")) bump(action, toApiAction(row.actionTaken));
+      if (row.status !== void 0 && matchesInstanceFilters(row, opts, "statuses")) {
+        bump(status, row.status);
+      }
+      if (row.toolName !== void 0 && matchesInstanceFilters(row, opts, "tools")) {
+        bump(tool, row.toolName);
+      }
+    },
+    facets: () => ({
+      severity: toItems(severity),
+      subtype: toItems(subtype),
+      provider: toItems(provider),
+      action: toItems(action),
+      status: toItems(status),
+      tool: toItems(tool)
+    })
+  };
+}
+function toInstanceDetail(row) {
+  const category = toApiCategory(row.category);
   return {
-    severity: toItems(severityMap),
-    provider: toItems(providerMap),
-    action: toItems(actionMap),
-    subtype: toItems(subtypeMap),
-    status: toItems(statusMap)
+    id: row.id,
+    provider: toApiProvider(row.sourceTool),
+    repo: row.repo,
+    file: row.file,
+    ...row.toolName === void 0 ? {} : { toolName: row.toolName },
+    eventId: row.eventId,
+    ...row.sessionId === void 0 ? {} : { sessionId: row.sessionId },
+    action: toApiAction(row.actionTaken),
+    detectedAt: row.occurredAt,
+    confidence: row.confidence,
+    ...row.status === void 0 ? {} : { status: row.status },
+    groupId: row.ruleId,
+    category,
+    subtype: row.ruleId,
+    severity: row.severity,
+    match: { maskedValue: row.maskedMatch, contextPrefix: "" },
+    detection: { id: row.ruleId, name: null },
+    policy: { id: `category:${category}`, name: category }
+  };
+}
+var SEVERITY_ORDER2 = {
+  critical: 0,
+  high: 1,
+  medium: 2,
+  low: 3
+};
+function newLocationAccumulator() {
+  return {
+    instanceCount: 0,
+    // Sorts after every known severity, so the first row always wins the
+    // comparison below rather than an unknown value pinning the location.
+    maxSeverityRank: Number.MAX_SAFE_INTEGER,
+    maxSeverity: "low",
+    latestDetectedAt: "",
+    statuses: [],
+    ruleIds: /* @__PURE__ */ new Set()
   };
 }
+function addToLocation(acc, row) {
+  acc.instanceCount += 1;
+  const rank = SEVERITY_ORDER2[row.severity] ?? Number.MAX_SAFE_INTEGER - 1;
+  if (rank < acc.maxSeverityRank) {
+    acc.maxSeverityRank = rank;
+    acc.maxSeverity = row.severity;
+  }
+  if (row.occurredAt > acc.latestDetectedAt) acc.latestDetectedAt = row.occurredAt;
+  acc.statuses.push(row.status);
+  acc.ruleIds.add(row.ruleId);
+}
 
 // ../../packages/schema/src/zod/installed-pack.ts
 var InstalledPack = external_exports.object({
@@ -17364,8 +17707,172 @@ var PatchInstalledPackRequest = external_exports.object({
   message: "At least one field must be provided"
 }).meta({ id: "PatchInstalledPackRequest" });
 
+// ../../packages/schema/src/zod/vault.ts
+var POINTER_FORMAT_VERSION = 2;
+var CATEGORY_ALTERNATION = DetectionCategory.options.join("|");
+var POINTER_TOKEN_PATTERN = new RegExp(
+  `\\[\\[aka:(?:${CATEGORY_ALTERNATION}):[A-Z2-7]{2,7}\\.[A-Z2-7]{26}\\.[A-Z2-7]{16}\\]\\]`
+);
+var POINTER_TOKEN_ANCHORED = new RegExp(`^${POINTER_TOKEN_PATTERN.source}$`);
+function pointerTokenScanner() {
+  return new RegExp(POINTER_TOKEN_PATTERN.source, "g");
+}
+var PointerToken = external_exports.string().regex(POINTER_TOKEN_ANCHORED);
+var ParsedPointer = external_exports.object({
+  category: DetectionCategory,
+  keyVersion: external_exports.number().int().positive(),
+  pointerId: external_exports.string(),
+  tag: external_exports.string()
+});
+var VaultEntry = external_exports.object({
+  pointerId: external_exports.string(),
+  // The keyed HMAC of the raw value under `exception.key`, and the epoch it was
+  // derived under. This is what a reveal-to-model grant matches on, and it rotates
+  // independently of the vault encryption key below.
+  valueFingerprint: external_exports.string().regex(/^[0-9a-f]{64}$/),
+  fingerprintKeyVersion: external_exports.number().int().positive(),
+  // The vault-key epoch this row's ciphertext was sealed under.
+  keyVersion: external_exports.number().int().positive(),
+  // Fixed at first mint and never updated: the same value detected later under a
+  // different rule's category keeps the category it was minted with, so one
+  // value always produces exactly one wire token.
+  category: DetectionCategory,
+  ruleId: external_exports.string(),
+  // Partial-reveal preview for badges and listings. Never the raw value.
+  maskedMatch: external_exports.string(),
+  provider: external_exports.string().optional(),
+  ciphertext: external_exports.string(),
+  nonce: external_exports.string(),
+  authTag: external_exports.string(),
+  // How many times this value has been detected on this machine — the reuse
+  // signal the vault dashboard reads. Distinct from VaultDeref.pointerCount.
+  occurrenceCount: external_exports.number().int().nonnegative(),
+  firstSeen: external_exports.string(),
+  lastSeen: external_exports.string()
+});
+var PointerDescriptor = external_exports.object({
+  category: DetectionCategory,
+  provider: external_exports.string().optional(),
+  maskedMatch: external_exports.string(),
+  occurrences: external_exports.number().int().nonnegative(),
+  firstSeen: external_exports.string(),
+  lastSeen: external_exports.string()
+});
+var PointerIdentity = external_exports.object({
+  ruleId: external_exports.string(),
+  valueFingerprint: external_exports.string().regex(/^[0-9a-f]{64}$/),
+  fingerprintKeyVersion: external_exports.number().int().positive()
+});
+var DetokenizeTarget = external_exports.enum(["human", "model"]);
+var VaultDerefReason = external_exports.enum([
+  "display",
+  "explicit-reveal",
+  "view-render",
+  "model-input",
+  "remediation",
+  "purge"
+]);
+var VaultDerefOutcome = external_exports.enum(["revealed", "refused", "unavailable"]);
+var BATCHED_DEREF_REASONS = ["display", "view-render"];
+function isBatchedDerefReason(reason) {
+  return BATCHED_DEREF_REASONS.includes(reason);
+}
+var VaultDeref = external_exports.object({
+  id: external_exports.guid(),
+  pointerId: external_exports.string(),
+  at: external_exports.string(),
+  target: DetokenizeTarget,
+  reason: VaultDerefReason,
+  outcome: VaultDerefOutcome,
+  // Present only on a model-target crossing that a reveal grant authorized.
+  grantId: external_exports.string().optional(),
+  // How many pointers ONE batched render resolved. 1 for unbatched rows. Named
+  // apart from VaultEntry.occurrenceCount, which counts detections of a value.
+  pointerCount: external_exports.number().int().positive().default(1)
+});
+var VaultSightingKind = external_exports.enum([
+  "prompt",
+  "tool-input",
+  "tool-output",
+  "file",
+  "transcript"
+]);
+var VaultSighting = external_exports.object({
+  location: external_exports.string(),
+  kind: VaultSightingKind,
+  firstSeen: external_exports.string(),
+  lastSeen: external_exports.string()
+});
+var VaultInventoryEntry = external_exports.object({
+  pointerId: external_exports.string(),
+  category: DetectionCategory,
+  provider: external_exports.string().optional(),
+  maskedMatch: external_exports.string(),
+  occurrences: external_exports.number().int().nonnegative(),
+  firstSeen: external_exports.string(),
+  lastSeen: external_exports.string(),
+  // The active reveal-to-model grant covering this value, when one exists —
+  // the inventory badges it, the row links to revocation.
+  revealGrantId: external_exports.string().nullable(),
+  sightings: external_exports.array(VaultSighting)
+});
+var DEFAULT_VAULT_INVENTORY_LIMIT = 50;
+var DEFAULT_VAULT_DEREFS_LIMIT = 50;
+var MAX_VAULT_PAGE_LIMIT = 200;
+var ListVaultInventoryQuery = external_exports.object({
+  limit: external_exports.coerce.number().int().min(1).max(MAX_VAULT_PAGE_LIMIT).optional(),
+  // Opaque; names the last row of the page just served.
+  cursor: external_exports.string().optional()
+});
+var ListVaultInventoryResponse = external_exports.object({
+  // Vaulted values across the whole store, not just this page — cursor-
+  // independent, so paging never changes what the count claims.
+  totals: external_exports.object({ values: external_exports.number().int().nonnegative() }),
+  items: external_exports.array(VaultInventoryEntry),
+  // `null` once the last page is reached.
+  nextCursor: external_exports.string().nullable()
+});
+var ListVaultReuseQuery = external_exports.object({
+  limit: external_exports.coerce.number().int().min(1).max(MAX_VAULT_PAGE_LIMIT).optional(),
+  cursor: external_exports.string().optional()
+});
+var ListVaultReuseResponse = external_exports.object({
+  // Reused values across the whole store — the number the section's claim
+  // ("values detected in more than one place") is about.
+  totals: external_exports.object({ reused: external_exports.number().int().nonnegative() }),
+  items: external_exports.array(VaultInventoryEntry),
+  nextCursor: external_exports.string().nullable()
+});
+var ListVaultDerefsQuery = external_exports.object({
+  // Include the batched, high-volume reasons (display, view-render). Omitted
+  // hides them and counts them into `hiddenBatched` instead, so the model
+  // crossings stay visible. A real boolean, not `z.stringbool()`: this arrives
+  // over a Server Action, which preserves the type, never as a URL param.
+  includeBatched: external_exports.boolean().optional(),
+  limit: external_exports.coerce.number().int().min(1).max(MAX_VAULT_PAGE_LIMIT).optional(),
+  cursor: external_exports.string().optional()
+});
+var ListVaultDerefsResponse = external_exports.object({
+  items: external_exports.array(VaultDeref),
+  nextCursor: external_exports.string().nullable(),
+  // Display/view-render rows the query hid, over the WHOLE trail rather than
+  // this page — it is the count the "N hidden" line and its toggle speak for.
+  // Always 0 when `includeBatched` was set, since nothing was hidden.
+  hiddenBatched: external_exports.number().int().nonnegative()
+});
+var VaultKeyCustody = external_exports.string();
+var VaultInlineReveal = external_exports.enum(["masked", "full", "off"]);
+var VAULT_CONSENT_VERSION = 1;
+var VaultConsent = external_exports.object({
+  acknowledgedAt: external_exports.iso.datetime(),
+  version: external_exports.number().int().positive()
+});
+function isVaultConsentValid(consent) {
+  return consent?.version === VAULT_CONSENT_VERSION;
+}
+
 // ../../packages/schema/src/zod/local.ts
-var WORKSPACE_SETTINGS_SPEC_VERSION = 4;
+var WORKSPACE_SETTINGS_SPEC_VERSION = 5;
 var RunMode = external_exports.enum(["standalone"]);
 var SimpleDetectionPolicy = external_exports.enum(["redact", "warn"]);
 var HistoricalAccess = external_exports.enum(["full", "session-only"]);
@@ -17387,6 +17894,16 @@ var WorkspaceSettings = external_exports.object({
   // In-place egress extraction on the scan paths; disable to stop all Data
   // Shares writes.
   dataSharesInPlace: external_exports.boolean().default(true),
+  // Consent to keep a RECOVERABLE encrypted copy of detected values in the local
+  // vault, instead of destroying them. Absent by default: this is a custody
+  // change from one-way redaction, so it is never an assumed grant on upgrade.
+  // Revoking stops future vaulting; it does not erase what is already stored —
+  // purging the vault is the eraser.
+  vaultConsent: VaultConsent.optional(),
+  // Where the vault master key lives.
+  vaultKeyCustody: VaultKeyCustody.default("file"),
+  // How a pointer renders in assistant prose on screen (see VaultInlineReveal).
+  vaultInlineReveal: VaultInlineReveal.default("masked"),
   // Absent until /aka:setup completes; its presence is what "onboarded" means.
   onboardedAt: external_exports.iso.datetime().optional(),
   // Records that the user consented to sending findings to the model API for
@@ -17719,7 +18236,7 @@ var TopSourcesQuery = external_exports.object({
   // Omit for both kinds.
   kind: external_exports.enum(SOURCE_KINDS).optional()
 });
-var Provider = external_exports.enum(["claudecode", "cursor", "codex", "chatgpt", "copilot", "api"]).meta({ id: "Provider" });
+var Provider = external_exports.enum(["claudecode", "cursor", "codex", "antigravity", "claudeai", "chatgpt", "copilot", "api"]).meta({ id: "Provider" });
 var ScanCoverageProvider = external_exports.object({
   provider: Provider,
   // Percent of that provider's traffic scanned in the window. 0 when unsupported.
@@ -17972,6 +18489,195 @@ function captureId(sessionId, contentHash, filePath = null) {
   );
 }
 
+// ../../packages/persistence/src/internal/snapshot.ts
+import { randomUUID } from "crypto";
+import { existsSync, readdirSync, renameSync as renameSync2, rmSync as rmSync2, statSync } from "fs";
+import { basename, dirname, join } from "path";
+
+// ../../packages/persistence/src/paths.ts
+import {
+  chmodSync,
+  linkSync,
+  lstatSync,
+  mkdirSync,
+  renameSync,
+  rmSync,
+  writeFileSync
+} from "fs";
+import { threadId } from "worker_threads";
+var DATA_DIR_MODE = 448;
+var DATA_FILE_MODE = 384;
+var DB_FILENAME = "aka.db";
+function isSymlink(path) {
+  try {
+    return lstatSync(path).isSymbolicLink();
+  } catch {
+    return false;
+  }
+}
+function chmodBestEffort(path, mode) {
+  if (isSymlink(path)) return;
+  try {
+    chmodSync(path, mode);
+  } catch {
+  }
+}
+function tightenDir(dir) {
+  chmodBestEffort(dir, DATA_DIR_MODE);
+}
+function ensureDataDirSync(dir) {
+  mkdirSync(dir, { recursive: true, mode: DATA_DIR_MODE });
+  tightenDir(dir);
+}
+function dbSidecars(file2) {
+  return [`${file2}-wal`, `${file2}-shm`, `${file2}-journal`];
+}
+function tightenFile(file2) {
+  chmodBestEffort(file2, DATA_FILE_MODE);
+}
+function tightenPerms(file2) {
+  for (const path of [file2, ...dbSidecars(file2)]) chmodBestEffort(path, DATA_FILE_MODE);
+}
+function classifyOccupant(file2) {
+  try {
+    if (lstatSync(file2).isSymbolicLink()) return { kind: "symlink" };
+    return { kind: "gone" };
+  } catch (err) {
+    if (err.code === "ENOENT") return { kind: "gone" };
+    return { kind: "unknown", cause: err };
+  }
+}
+var KeyUnclaimableError = class extends Error {
+  code = "key-unclaimable";
+  // `cause` is installed only when there IS one. Passing { cause: undefined }
+  // defines the property anyway, so an error carrying nothing would still answer
+  // `'cause' in err` — a present-but-empty field reads as a diagnosis that was
+  // captured and then lost, which is worse than its plain absence.
+  constructor(message, cause) {
+    super(message, cause === void 0 ? void 0 : { cause });
+    this.name = "KeyUnclaimableError";
+  }
+};
+function createOwnerOnlyFileSync(file2, data) {
+  const tmp = `${file2}.${String(process.pid)}.${String(threadId)}.new`;
+  try {
+    rmSync(tmp, { force: true });
+  } catch {
+  }
+  let created;
+  try {
+    writeFileSync(tmp, data, { mode: DATA_FILE_MODE, flag: "wx" });
+    created = publishByLink(tmp, file2, data);
+  } finally {
+    try {
+      rmSync(tmp, { force: true });
+    } catch {
+    }
+  }
+  if (created) tightenFile(file2);
+  return created;
+}
+var LINK_UNSUPPORTED = /* @__PURE__ */ new Set(["EPERM", "ENOSYS", "ENOTSUP", "EOPNOTSUPP", "EINVAL"]);
+function publishByLink(tmp, file2, data) {
+  try {
+    linkSync(tmp, file2);
+    return true;
+  } catch (err) {
+    const code = err.code;
+    if (code === "EEXIST") return false;
+    if (!LINK_UNSUPPORTED.has(code ?? "")) throw err;
+  }
+  try {
+    writeFileSync(file2, data, { mode: DATA_FILE_MODE, flag: "wx" });
+    return true;
+  } catch (err) {
+    if (err.code === "EEXIST") return false;
+    throw err;
+  }
+}
+
+// ../../packages/persistence/src/internal/snapshot.ts
+function backupPath(file2, tag) {
+  return `${file2}.${tag}.${String(Date.now())}.${randomUUID().slice(0, 8)}.bak`;
+}
+var STALE_PARTIAL_MS = 5 * 6e4;
+function reapStalePartials(file2) {
+  const dir = dirname(file2);
+  const prefix = `${basename(file2)}.`;
+  let entries;
+  try {
+    entries = readdirSync(dir);
+  } catch {
+    return;
+  }
+  for (const name of entries) {
+    if (!name.startsWith(prefix) || !name.endsWith(".bak.partial")) continue;
+    const partial2 = join(dir, name);
+    try {
+      if (Date.now() - statSync(partial2).mtimeMs > STALE_PARTIAL_MS) {
+        rmSync2(partial2, { force: true });
+      }
+    } catch {
+    }
+  }
+}
+function snapshotStore(db, backup) {
+  const partial2 = `${backup}.partial`;
+  try {
+    rmSync2(partial2, { force: true });
+    db.prepare("VACUUM INTO ?").run(partial2);
+    tightenFile(partial2);
+    renameSync2(partial2, backup);
+  } catch (error51) {
+    try {
+      rmSync2(partial2, { force: true });
+    } catch {
+    }
+    throw error51;
+  }
+}
+function moveStoreAside(file2, backup) {
+  const undo = [];
+  renameSync2(file2, backup);
+  undo.push([backup, file2]);
+  try {
+    for (const sidecar of dbSidecars(file2)) {
+      const moved = `${backup}${sidecar.slice(file2.length)}`;
+      try {
+        renameSync2(sidecar, moved);
+        undo.push([moved, sidecar]);
+      } catch {
+        rmSync2(sidecar, { force: true });
+      }
+    }
+  } catch (error51) {
+    for (const [from, to] of undo.reverse()) {
+      try {
+        renameSync2(from, to);
+      } catch {
+      }
+    }
+    throw error51;
+  }
+  tightenPerms(backup);
+}
+function discardStore(file2, backup) {
+  try {
+    rmSync2(file2, { force: true });
+    for (const sidecar of dbSidecars(file2)) {
+      rmSync2(sidecar, { force: true });
+    }
+  } catch (error51) {
+    if (existsSync(file2)) {
+      try {
+        rmSync2(backup, { force: true });
+      } catch {
+      }
+    }
+    throw error51;
+  }
+}
+
 // ../../packages/persistence/src/internal/sql-text.ts
 function escapeLikePattern(s) {
   return s.replace(/\\/g, "\\\\").replace(/%/g, "\\%").replace(/_/g, "\\_");
@@ -18113,44 +18819,12 @@ function mapRowsTolerant(rows, map2) {
   return out;
 }
 
-// ../../packages/persistence/src/paths.ts
-import { chmodSync, lstatSync, mkdirSync, renameSync, rmSync, writeFileSync } from "fs";
-var DATA_DIR_MODE = 448;
-var DATA_FILE_MODE = 384;
-var DB_FILENAME = "aka.db";
-function chmodBestEffort(path, mode) {
-  try {
-    chmodSync(path, mode);
-  } catch {
-  }
+// ../../packages/persistence/src/migrations.ts
+function describeObject(object2) {
+  return object2.kind === "column" ? `column ${object2.table}.${object2.name}` : `table ${object2.name}`;
 }
-function tightenDir(dir) {
-  chmodBestEffort(dir, DATA_DIR_MODE);
-}
-function ensureDataDirSync(dir) {
-  mkdirSync(dir, { recursive: true, mode: DATA_DIR_MODE });
-  tightenDir(dir);
-}
-function dbSidecars(file2) {
-  return [`${file2}-wal`, `${file2}-shm`, `${file2}-journal`];
-}
-function tightenFile(file2) {
-  try {
-    if (lstatSync(file2).isSymbolicLink()) return;
-  } catch {
-  }
-  chmodBestEffort(file2, DATA_FILE_MODE);
-}
-function tightenPerms(file2) {
-  for (const path of [file2, ...dbSidecars(file2)]) chmodBestEffort(path, DATA_FILE_MODE);
-}
-
-// ../../packages/persistence/src/migrations.ts
-function describeObject(object2) {
-  return object2.kind === "column" ? `column ${object2.table}.${object2.name}` : `table ${object2.name}`;
-}
-function splitStatements(sql) {
-  return sql.split(/-->\s*statement-breakpoint/).map((s) => s.trim()).filter((s) => s.length > 0);
+function splitStatements(sql) {
+  return sql.split(/-->\s*statement-breakpoint/).map((s) => s.trim()).filter((s) => s.length > 0);
 }
 function createdIndexName(statement) {
   const body = statement.replace(/^(?:\s*--[^\n]*\n?)+/, "").trimStart();
@@ -18260,9 +18934,9 @@ function applyLegacyDropMigration(db, file2) {
   }
 }
 function backupBeforeLegacyDrop(db, file2) {
-  const backup = `${file2}.pre-drop.${String(Date.now())}.bak`;
-  db.prepare("VACUUM INTO ?").run(backup);
-  tightenFile(backup);
+  reapStalePartials(file2);
+  const backup = backupPath(file2, "pre-drop");
+  snapshotStore(db, backup);
   return backup;
 }
 var TOKEN_USAGE_COLUMNS = [
@@ -18606,6 +19280,25 @@ function parseJsonObject(s) {
   return void 0;
 }
 
+// ../../packages/persistence/src/internal/keyset-cursor.ts
+function encodeKeysetCursor(payload) {
+  return Buffer.from(JSON.stringify(payload)).toString("base64url");
+}
+function decodeKeysetCursor(cursor) {
+  const parsed = parseJsonObject(Buffer.from(cursor, "base64url").toString("utf8"));
+  if (parsed !== void 0 && "startedAtMs" in parsed && "id" in parsed && // `Number.isInteger`, not `typeof === 'number'`. Every timestamp this
+  // resumes from is epoch millis, and a payload carrying ±Infinity or a
+  // fraction binds cleanly rather than failing — returning an EMPTY page with
+  // a null cursor, which a caller reads as "end of list". That is the one
+  // outcome a cursor that does not decode must never produce, since the
+  // documented behaviour above is to restart from the top. (`1e999` is valid
+  // JSON and parses to Infinity; a bare `NaN` is not, so it cannot arrive.)
+  Number.isInteger(parsed.startedAtMs) && typeof parsed.id === "string") {
+    return parsed;
+  }
+  return null;
+}
+
 // ../../packages/persistence/src/repositories/activity.ts
 var DAY_MS = 864e5;
 var LIVE_ACTIVITY_WINDOW_MS = 30 * 6e4;
@@ -18651,16 +19344,6 @@ function utcWindow(nowMs) {
   const startMs = Math.floor(nowMs / DAY_MS) * DAY_MS;
   return { startMs, endMs: startMs + DAY_MS };
 }
-function encodeCursor(payload) {
-  return Buffer.from(JSON.stringify(payload)).toString("base64url");
-}
-function decodeCursor(cursor) {
-  const parsed = parseJsonObject(Buffer.from(cursor, "base64url").toString("utf8"));
-  if (parsed !== void 0 && "startedAtMs" in parsed && "id" in parsed && typeof parsed.startedAtMs === "number" && typeof parsed.id === "string") {
-    return parsed;
-  }
-  return null;
-}
 var DB_EVENT_TYPE_TO_KIND = {
   session: "session",
   prompt: "prompt",
@@ -18805,7 +19488,7 @@ var SqliteActivityRepository = class {
     return Promise.resolve({ sessionsToday, liveNow, toolCallsToday, findingsToday, egressToday });
   }
   listSessions(query) {
-    const cursor = query.cursor ? decodeCursor(query.cursor) : null;
+    const cursor = query.cursor ? decodeKeysetCursor(query.cursor) : null;
     const toMs = query.to ? isoToEpochMillis(query.to) : this.now();
     const fromMs = query.from ? isoToEpochMillis(query.from) : void 0;
     const conditions = [SESSION_ROOT];
@@ -18879,7 +19562,7 @@ var SqliteActivityRepository = class {
       )
     );
     const last = page[page.length - 1];
-    const nextCursor = hasMore && last ? encodeCursor({ startedAtMs: last.started_at, id: last.id }) : null;
+    const nextCursor = hasMore && last ? encodeKeysetCursor({ startedAtMs: last.started_at, id: last.id }) : null;
     return Promise.resolve({ items, nextCursor, emptyCount });
   }
   getSession(sessionId) {
@@ -19752,7 +20435,7 @@ var SqliteEventsRepository = class {
 };
 
 // ../../packages/persistence/src/repositories/exceptions.ts
-import { randomUUID } from "crypto";
+import { randomUUID as randomUUID2 } from "crypto";
 
 // ../../packages/persistence/src/internal/sqlite-errors.ts
 var SQLITE_CONSTRAINT_UNIQUE = 2067;
@@ -19784,9 +20467,13 @@ var AmbiguousExceptionIdError = class extends Error {
 var ACTIVE_PREDICATE = `revoked_at IS NULL
      AND (expires_at IS NULL OR expires_at > :now)
      AND (max_uses IS NULL OR use_count < max_uses)`;
+var ACTIVE_REVEAL_GRANT_PREDICATE = `capability = 'reveal_to_model'
+     AND conditions IS NULL
+     AND ${ACTIVE_PREDICATE}`;
 var SqliteExceptionsRepository = class {
-  constructor(db) {
+  constructor(db, now = () => Date.now()) {
     this.db = db;
+    this.now = now;
     this.consumeStmt = db.prepare(
       `UPDATE exceptions
           SET use_count = use_count + 1, last_used_at = :now, updated_at = :now
@@ -19804,6 +20491,7 @@ var SqliteExceptionsRepository = class {
     );
   }
   db;
+  now;
   consumeStmt;
   insertBlockedStmt;
   sweepBlockedStmt;
@@ -19830,8 +20518,8 @@ var SqliteExceptionsRepository = class {
         "provider conditions are not supported yet \u2014 a grant with one would never apply"
       );
     }
-    const id = randomUUID();
-    const now = Date.now();
+    const id = randomUUID2();
+    const now = this.now();
     try {
       this.insertExceptionRow(id, input, now);
     } catch (err) {
@@ -19875,11 +20563,11 @@ var SqliteExceptionsRepository = class {
     this.db.prepare(
       `INSERT INTO exceptions (
              id, rule_id, category, value_fingerprint, key_version, masked_value,
-             scope, expires_at, max_uses, use_count, last_used_at, justification,
-             conditions, created_by, created_via, created_at, updated_at
+             capability, scope, expires_at, max_uses, use_count, last_used_at,
+             justification, conditions, created_by, created_via, created_at, updated_at
            ) VALUES (
              :id, :ruleId, :category, :valueFingerprint, :keyVersion, :maskedValue,
-             :scope, :expiresAt, :maxUses, 0, NULL, :justification,
+             :capability, :scope, :expiresAt, :maxUses, 0, NULL, :justification,
              :conditions, :createdBy, :createdVia, :now, :now
            )`
     ).run({
@@ -19889,6 +20577,7 @@ var SqliteExceptionsRepository = class {
       valueFingerprint: input.valueFingerprint,
       keyVersion: input.keyVersion,
       maskedValue: input.maskedValue,
+      capability: input.capability ?? "suppress",
       scope: input.scope,
       expiresAt: input.expiresAt === null ? null : isoToEpochMillis(input.expiresAt),
       maxUses: input.maxUses,
@@ -19908,7 +20597,7 @@ var SqliteExceptionsRepository = class {
     const where = opts?.includeTerminal ? "" : `WHERE ${ACTIVE_PREDICATE}`;
     const rows = allRows(
       this.db.prepare(`SELECT * FROM exceptions ${where} ORDER BY created_at DESC, rowid DESC`),
-      opts?.includeTerminal ? {} : { now: Date.now() }
+      opts?.includeTerminal ? {} : { now: this.now() }
     );
     const exceptions = mapRowsTolerant(rows, parseExceptionRow);
     return Promise.resolve(exceptions);
@@ -19943,7 +20632,7 @@ var SqliteExceptionsRepository = class {
    * already revoked.
    */
   revoke(id, revokedBy, reason) {
-    const now = Date.now();
+    const now = this.now();
     const result = this.db.prepare(
       `UPDATE exceptions
             SET revoked_at = :now, revoked_by = :revokedBy, revoke_reason = :reason, updated_at = :now
@@ -19957,7 +20646,7 @@ var SqliteExceptionsRepository = class {
    * callers must treat identically — means it does not and the detection is
    * enforced as usual. Deliberately NOT wrapped in try/catch.
    */
-  consume(id, now = Date.now()) {
+  consume(id, now = this.now()) {
     const result = this.consumeStmt.run({ id, now });
     return Promise.resolve(Number(result.changes) === 1);
   }
@@ -19966,7 +20655,7 @@ var SqliteExceptionsRepository = class {
    * version — what rides the policy bundle to the hook. Grants written under
    * a different (rotated-away) key never match, so they are excluded at read.
    */
-  activeBundleEntries(keyVersion, now = Date.now()) {
+  activeBundleEntries(keyVersion, now = this.now()) {
     const rows = allRows(
       this.db.prepare(
         `SELECT * FROM exceptions
@@ -19982,6 +20671,7 @@ var SqliteExceptionsRepository = class {
         ruleId: row.rule_id,
         valueFingerprint: row.value_fingerprint,
         keyVersion: row.key_version,
+        capability: row.capability,
         expiresAt: row.expires_at === null ? null : epochMillisToIso(row.expires_at),
         maxUses: row.max_uses,
         useCount: row.use_count,
@@ -19997,7 +20687,7 @@ var SqliteExceptionsRepository = class {
    * than the retention window on every write, so the ledger self-limits.
    */
   recordBlocked(entry) {
-    const now = Date.now();
+    const now = this.now();
     this.sweepBlockedStmt.run({ cutoff: now - BLOCKED_DETECTIONS_RETENTION_MS });
     this.insertBlockedStmt.run({
       reference: entry.reference,
@@ -20020,7 +20710,7 @@ var SqliteExceptionsRepository = class {
           WHERE blocked_at > :cutoff
           ORDER BY blocked_at DESC, rowid DESC`
       ),
-      { cutoff: Date.now() - windowMs }
+      { cutoff: this.now() - windowMs }
     );
     return Promise.resolve(
       rows.map((row) => ({
@@ -20036,6 +20726,36 @@ var SqliteExceptionsRepository = class {
       }))
     );
   }
+  /**
+   * The active reveal-to-model grant for a vaulted value's identity, or null.
+   * Matching is exact on (ruleId, valueFingerprint, keyVersion) — the same key
+   * suppression uses — plus the capability: a suppression grant must never
+   * authorize a reveal. Read-only: the caller does NOT consume here, because a
+   * revealed value re-enters the detection scan immediately afterward and the
+   * suppression match there claims the use — one crossing, one use.
+   *
+   * A grant with `conditions` NEVER matches here: the reveal path does not yet
+   * evaluate conditions, and a narrowing clause that is ignored would WIDEN the
+   * grant instead. Fail closed until reveal-side condition evaluation exists.
+   */
+  activeRevealGrant(ruleId, valueFingerprint, keyVersion, now) {
+    try {
+      const at = now ?? this.now();
+      const row = getRow(
+        this.db.prepare(
+          `SELECT id FROM exceptions
+            WHERE rule_id = :ruleId AND value_fingerprint = :valueFingerprint
+              AND key_version = :keyVersion
+              AND ${ACTIVE_REVEAL_GRANT_PREDICATE}
+            LIMIT 1`
+        ),
+        { ruleId, valueFingerprint, keyVersion, now: at }
+      );
+      return Promise.resolve(row ?? null);
+    } catch (err) {
+      return Promise.reject(err instanceof Error ? err : new Error(String(err)));
+    }
+  }
   /**
    * Retention sweep: delete TERMINAL rows (revoked, expired, or use-budget
    * exhausted) whose last transition is older than the retention window.
@@ -20043,7 +20763,7 @@ var SqliteExceptionsRepository = class {
    * predicate, so correctness never depends on this sweep; it only bounds how
    * long the audit evidence is kept locally. Returns the deleted count.
    */
-  sweepTerminal(retentionMs, now = Date.now()) {
+  sweepTerminal(retentionMs, now = this.now()) {
     const result = this.db.prepare(
       `DELETE FROM exceptions
           WHERE updated_at < :cutoff
@@ -20063,6 +20783,7 @@ function parseExceptionRow(row) {
     valueFingerprint: row.value_fingerprint,
     keyVersion: row.key_version,
     maskedValue: row.masked_value,
+    capability: row.capability,
     scope: row.scope,
     expiresAt: row.expires_at === null ? null : epochMillisToIso(row.expires_at),
     maxUses: row.max_uses,
@@ -20105,6 +20826,23 @@ var LATEST_RESOLUTION_BY_KEY_SQL = `(
 
 // ../../packages/persistence/src/repositories/findings.ts
 var PREVIEW_INSTANCES_PER_GROUP = 200;
+var SCAN_BATCH_ROWS = 1e3;
+var DEFAULT_LOCATIONS_LIMIT = 100;
+var LOCATION_RULE_IDS_CAP = 20;
+function compareLocationOrder(a, b) {
+  return compareFindingGroupOrder(
+    {
+      severity: a.maxSeverity,
+      latestDetectedAt: a.latestDetectedAt,
+      id: ""
+    },
+    {
+      severity: b.maxSeverity,
+      latestDetectedAt: b.latestDetectedAt,
+      id: ""
+    }
+  );
+}
 var CONCAT_SEP = ",";
 var TUPLE_SEP = "|";
 function splitConcat(value) {
@@ -20117,6 +20855,33 @@ function deriveInstanceStatus(row) {
     latestResolutionStatus: row.latest_status
   });
 }
+function encodeGroupCursor(group) {
+  const payload = {
+    sev: group.severity,
+    t: group.latestDetectedAt,
+    id: group.id
+  };
+  return Buffer.from(JSON.stringify(payload)).toString("base64url");
+}
+function decodeGroupCursor(cursor) {
+  const parsed = parseJsonObject(Buffer.from(cursor, "base64url").toString("utf8"));
+  if (parsed !== void 0 && typeof parsed.sev === "string" && typeof parsed.t === "string" && typeof parsed.id === "string") {
+    return {
+      severity: parsed.sev,
+      latestDetectedAt: parsed.t,
+      id: parsed.id
+    };
+  }
+  return null;
+}
+function firstAfter(sorted, cursor) {
+  const index = sorted.findIndex((g) => compareFindingGroupOrder(g, cursor) > 0);
+  return index === -1 ? sorted.length : index;
+}
+function findDeepLinked(sorted, page, id) {
+  if (page.some((g) => g.id === id || g.instances.some((i) => i.id === id))) return void 0;
+  return sorted.find((g) => g.id === id || g.instances.some((i) => i.id === id));
+}
 var DAY_MS3 = 864e5;
 var SqliteFindingsRepository = class {
   constructor(db) {
@@ -20226,8 +20991,13 @@ var SqliteFindingsRepository = class {
    */
   listGroupedFindings(query) {
     const sessionPredicate = query.sessionId ? ` AND e.root_session_id = :sessionId` : "";
-    const predicate = `WHERE e.event_type IN (${CAPTURE_EVENT_TYPES_SQL})${sessionPredicate}`;
-    const sessionParams = query.sessionId ? { sessionId: query.sessionId } : {};
+    const fromMs = query.from === void 0 ? void 0 : isoToEpochMillis(query.from);
+    const fromPredicate = fromMs === void 0 ? "" : ` AND e.started_at >= :fromMs`;
+    const predicate = `WHERE e.event_type IN (${CAPTURE_EVENT_TYPES_SQL})${sessionPredicate}${fromPredicate}`;
+    const sessionParams = {
+      ...query.sessionId ? { sessionId: query.sessionId } : {},
+      ...fromMs === void 0 ? {} : { fromMs }
+    };
     const aggregates = this.groupAggregates(query.q !== void 0 && query.q !== "", {
       predicate,
       params: sessionParams
@@ -20235,7 +21005,8 @@ var SqliteFindingsRepository = class {
     const rows = allRows(
       this.db.prepare(
         `SELECT id, rule_id, category, severity, masked_match, action_taken, confidence,
-                occurred_at, source_tool, repo, file, tool_name, kind, finding_key, latest_status
+                occurred_at, source_tool, repo, file, tool_name, event_id, session_id,
+                kind, finding_key, latest_status
          FROM (
            SELECT f.id AS id, d.rule_id AS rule_id, d.category AS category,
                   d.severity AS severity, f.masked_match AS masked_match,
@@ -20245,6 +21016,7 @@ var SqliteFindingsRepository = class {
                   json_extract(e.attributes, '$.repo') AS repo,
                   json_extract(e.attributes, '$.file_path') AS file,
                   json_extract(e.attributes, '$.tool_name') AS tool_name,
+                  f.audit_event_id AS event_id, e.root_session_id AS session_id,
                   e.event_type AS kind, f.finding_key AS finding_key,
                   latest.status AS latest_status,
                   ROW_NUMBER() OVER (
@@ -20276,6 +21048,8 @@ var SqliteFindingsRepository = class {
       repo: r.repo ?? "",
       file: r.file ?? "",
       ...r.tool_name === null ? {} : { toolName: r.tool_name },
+      eventId: r.event_id,
+      ...r.session_id === null ? {} : { sessionId: r.session_id },
       status: deriveInstanceStatus(r)
     }));
     const allGroups = buildFindingGroups(groupable, { aggregates });
@@ -20299,18 +21073,23 @@ var SqliteFindingsRepository = class {
       groups: sorted.length
     };
     const limit = query.limit ?? DEFAULT_GROUPED_FINDINGS_LIMIT;
+    const cursor = query.cursor === void 0 ? null : decodeGroupCursor(query.cursor);
+    const start = cursor === null ? 0 : firstAfter(sorted, cursor);
+    const page = sorted.slice(start, start + limit);
+    const lastOnPage = page.at(-1);
+    const nextCursor = start + limit < sorted.length && lastOnPage ? encodeGroupCursor(lastOnPage) : null;
+    const deepLinked = query.includeId === void 0 || query.includeId === "" ? void 0 : findDeepLinked(sorted, page, query.includeId);
     const statusSet = statusFilter.length > 0 ? new Set(statusFilter) : null;
-    const items = sorted.slice(0, limit).map(
-      (g) => statusSet ? {
-        ...g,
-        instances: g.instances.filter((i) => i.status !== void 0 && statusSet.has(i.status))
-      } : g
-    );
+    const narrow = (g) => statusSet ? {
+      ...g,
+      instances: g.instances.filter((i) => i.status !== void 0 && statusSet.has(i.status))
+    } : g;
+    const items = [...page, ...deepLinked ? [deepLinked] : []].map(narrow);
     return Promise.resolve({
       totals,
       facets,
       items,
-      nextCursor: null,
+      nextCursor,
       ...query.sessionId ? { sessionFirings: this.sessionFirings(query.sessionId) } : {}
     });
   }
@@ -20342,6 +21121,266 @@ var SqliteFindingsRepository = class {
    * request actually carries a `q`. (Substring matching is unaffected by a
    * path repeating across tuples.)
    */
+  /**
+   * The instance-level (flat) findings list: one row per finding, newest first,
+   * paged by keyset.
+   *
+   * SQL owns SCOPE, JS owns every FILTER DIMENSION. The session and the time
+   * bound are SQL predicates: nothing counts them, so narrowing the scan by
+   * them changes no reported number. Severity, subtype, provider, action,
+   * status, tool, repo, file and `q` all stay in JS — each has a facet, and a
+   * facet excludes its own filter, so a row the filter rejects still has to be
+   * counted. Pushing any of them into SQL would silently empty its own facet.
+   * Several could not be expressed there anyway: status comes from the one
+   * shared classifier (deriveFindingStatus), and provider 'api' means "a tool
+   * none of the mappers names", which no IN-list can say.
+   *
+   * The scan runs from the top of the scope on every request, not from the
+   * cursor: `totals` and `facets` describe the whole filtered scope and must not
+   * move as the caller pages. Rows are pulled in batches so memory stays flat
+   * while the counting runs, and only the page itself is retained.
+   */
+  listFindingInstances(query) {
+    const opts = {
+      severity: query.severity,
+      subtype: query.subtype,
+      providers: query.provider,
+      actions: query.action,
+      statuses: query.status,
+      tools: query.tool,
+      repo: query.repo,
+      file: query.file,
+      q: query.q
+    };
+    const limit = query.limit ?? DEFAULT_FLAT_FINDINGS_LIMIT;
+    const cursor = query.cursor === void 0 ? null : decodeKeysetCursor(query.cursor);
+    const accumulator = createInstanceFacetAccumulator(opts);
+    const items = [];
+    let total = 0;
+    let last;
+    let hasMore = false;
+    for (const row of this.scanFindingRows({
+      sessionId: query.sessionId,
+      from: query.from
+    })) {
+      accumulator.add(row);
+      if (!matchesInstanceFilters(row, opts)) continue;
+      total += 1;
+      if (items.length < limit) {
+        items.push(toInstanceDetail(row));
+        last = row;
+      } else {
+        hasMore = true;
+      }
+    }
+    const nextCursor = hasMore && last ? encodeKeysetCursor({ startedAtMs: isoToEpochMillis(last.occurredAt), id: last.id }) : null;
+    if (cursor !== null) {
+      const resumed = this.pageAfter(cursor, opts, limit, query);
+      return Promise.resolve({
+        totals: { findings: total },
+        facets: accumulator.facets(),
+        items: resumed.items,
+        nextCursor: resumed.nextCursor
+      });
+    }
+    return Promise.resolve({
+      totals: { findings: total },
+      facets: accumulator.facets(),
+      items,
+      nextCursor
+    });
+  }
+  /**
+   * The page of matching rows strictly after `cursor`. Separate from the
+   * counting pass because that one starts at the top of the scope by design;
+   * this one narrows the scan with the same keyset predicate the activity list
+   * uses, so a later page costs less than the first rather than more.
+   */
+  pageAfter(cursor, opts, limit, query) {
+    const items = [];
+    let last;
+    let hasMore = false;
+    for (const row of this.scanFindingRows({
+      sessionId: query.sessionId,
+      from: query.from,
+      after: cursor
+    })) {
+      if (!matchesInstanceFilters(row, opts)) continue;
+      if (items.length < limit) {
+        items.push(toInstanceDetail(row));
+        last = row;
+      } else {
+        hasMore = true;
+        break;
+      }
+    }
+    return {
+      items,
+      nextCursor: hasMore && last ? encodeKeysetCursor({ startedAtMs: isoToEpochMillis(last.occurredAt), id: last.id }) : null
+    };
+  }
+  /**
+   * The same findings folded by location: repository, then file within it.
+   *
+   * The grouping keys come from the capturing event's attributes, which is what
+   * the local store relates a finding to — there is no finding↔asset row to
+   * group by instead. A repo or file the event did not record folds into the
+   * empty-string bucket, which the view renders but does not link, since no
+   * filter can name it.
+   */
+  listFindingLocations(query) {
+    const opts = {
+      severity: query.severity,
+      subtype: query.subtype,
+      providers: query.provider,
+      actions: query.action,
+      statuses: query.status,
+      tools: query.tool,
+      q: query.q
+    };
+    const limit = query.limit ?? DEFAULT_LOCATIONS_LIMIT;
+    const byRepo = /* @__PURE__ */ new Map();
+    let total = 0;
+    for (const row of this.scanFindingRows({
+      sessionId: query.sessionId,
+      from: query.from
+    })) {
+      if (!matchesInstanceFilters(row, opts)) continue;
+      total += 1;
+      let files = byRepo.get(row.repo);
+      if (files === void 0) {
+        files = /* @__PURE__ */ new Map();
+        byRepo.set(row.repo, files);
+      }
+      let acc = files.get(row.file);
+      if (acc === void 0) {
+        acc = newLocationAccumulator();
+        files.set(row.file, acc);
+      }
+      addToLocation(acc, row);
+    }
+    let fileCount = 0;
+    const repos = [...byRepo.entries()].map(([repo, files]) => {
+      fileCount += files.size;
+      const fileRows = [...files.entries()].map(([file2, acc]) => ({
+        file: file2,
+        instanceCount: acc.instanceCount,
+        maxSeverity: acc.maxSeverity,
+        latestDetectedAt: acc.latestDetectedAt,
+        ...foldGroupStatus(acc.statuses) === void 0 ? {} : { status: foldGroupStatus(acc.statuses) },
+        ruleIds: [...acc.ruleIds].slice(0, LOCATION_RULE_IDS_CAP)
+      })).sort(compareLocationOrder);
+      const rollup = fileRows.reduce(
+        (a, f) => ({
+          instanceCount: a.instanceCount + f.instanceCount,
+          maxSeverity: compareLocationOrder(f, a) < 0 ? f.maxSeverity : a.maxSeverity,
+          latestDetectedAt: f.latestDetectedAt > a.latestDetectedAt ? f.latestDetectedAt : a.latestDetectedAt
+        }),
+        {
+          instanceCount: 0,
+          maxSeverity: fileRows[0]?.maxSeverity ?? "low",
+          latestDetectedAt: ""
+        }
+      );
+      const statuses = fileRows.map((f) => f.status);
+      const folded = foldGroupStatus(statuses);
+      return {
+        repo,
+        instanceCount: rollup.instanceCount,
+        maxSeverity: rollup.maxSeverity,
+        latestDetectedAt: rollup.latestDetectedAt,
+        ...folded === void 0 ? {} : { status: folded },
+        files: fileRows
+      };
+    });
+    repos.sort(compareLocationOrder);
+    return Promise.resolve({
+      totals: { findings: total, repos: repos.length, files: fileCount },
+      items: repos.slice(0, limit),
+      hasMore: repos.length > limit
+    });
+  }
+  /**
+   * Every finding in scope as a FlatFindingRow, newest first, pulled in batches.
+   *
+   * A generator so a caller streams the scope without it ever being an array:
+   * the flat list counts and facets the whole filtered scope, which on a large
+   * store is far more rows than any page. Each batch advances the same keyset
+   * predicate the page read uses, so the scan is a sequence of bounded reads
+   * rather than one unbounded result set.
+   *
+   * The latest-resolution lookup is the CORRELATED form, not the derived table
+   * the grouped path joins: only `status` is needed, idx_finding_resolution_key
+   * makes it a point lookup per row, and the derived table would re-materialize
+   * a window over the whole resolution table once per batch.
+   *
+   * `scope` carries ONLY what no facet counts. A filter dimension narrowed here
+   * would be missing from its own facet, which is computed by excluding that
+   * dimension — see listFindingInstances.
+   */
+  *scanFindingRows(scope) {
+    const conditions = [`e.event_type IN (${CAPTURE_EVENT_TYPES_SQL})`];
+    const params = [];
+    if (scope.sessionId !== void 0 && scope.sessionId !== "") {
+      conditions.push("e.root_session_id = ?");
+      params.push(scope.sessionId);
+    }
+    if (scope.from !== void 0) {
+      conditions.push("e.started_at >= ?");
+      params.push(isoToEpochMillis(scope.from));
+    }
+    const sql = `SELECT f.id AS id, d.rule_id AS rule_id, d.category AS category,
+              d.severity AS severity, f.masked_match AS masked_match,
+              f.action_taken AS action_taken, f.confidence AS confidence,
+              e.started_at AS occurred_at,
+              json_extract(e.attributes, '$.source_tool') AS source_tool,
+              json_extract(e.attributes, '$.repo') AS repo,
+              json_extract(e.attributes, '$.file_path') AS file,
+              json_extract(e.attributes, '$.tool_name') AS tool_name,
+              f.audit_event_id AS event_id, e.root_session_id AS session_id,
+              e.event_type AS kind, f.finding_key AS finding_key,
+              ${latestResolutionStatusSql("f")} AS latest_status
+         FROM inspection_findings f
+         JOIN audit_events e ON e.id = f.audit_event_id
+         JOIN inspection_definitions d ON d.id = f.inspection_definition_id
+        WHERE ${conditions.join(" AND ")}
+          AND (e.started_at < ? OR (e.started_at = ? AND f.id < ?))
+        ORDER BY e.started_at DESC, f.id DESC
+        LIMIT ?`;
+    let after = scope.after ?? { startedAtMs: Number.MAX_SAFE_INTEGER, id: "\uFFFF" };
+    for (; ; ) {
+      const rows = allRows(this.db.prepare(sql), [
+        ...params,
+        after.startedAtMs,
+        after.startedAtMs,
+        after.id,
+        SCAN_BATCH_ROWS
+      ]);
+      for (const r of rows) {
+        yield {
+          id: r.id,
+          ruleId: r.rule_id,
+          category: r.category,
+          severity: r.severity,
+          maskedMatch: r.masked_match,
+          actionTaken: r.action_taken,
+          confidence: r.confidence,
+          occurredAt: epochMillisToIso(r.occurred_at),
+          sourceTool: r.source_tool,
+          repo: r.repo ?? "",
+          file: r.file ?? "",
+          ...r.tool_name === null ? {} : { toolName: r.tool_name },
+          eventId: r.event_id,
+          ...r.session_id === null ? {} : { sessionId: r.session_id },
+          status: deriveInstanceStatus(r)
+        };
+      }
+      if (rows.length < SCAN_BATCH_ROWS) return;
+      const lastRow = rows[rows.length - 1];
+      if (lastRow === void 0) return;
+      after = { startedAtMs: lastRow.occurred_at, id: lastRow.id };
+    }
+  }
   groupAggregates(withSearchText, scope) {
     const innerSearchColumns = withSearchText ? `, group_concat(DISTINCT json_extract(e.attributes, '$.repo')) AS repos,
            group_concat(DISTINCT json_extract(e.attributes, '$.file_path')) AS files,
@@ -20602,7 +21641,7 @@ var SqliteInspectionFindingsRepository = class {
 };
 
 // ../../packages/persistence/src/repositories/installed-packs.ts
-import { createHash as createHash2, randomUUID as randomUUID2 } from "crypto";
+import { createHash as createHash2, randomUUID as randomUUID3 } from "crypto";
 
 // ../../packages/persistence/src/semver.ts
 function parse3(version2) {
@@ -20753,7 +21792,7 @@ var SqliteInstalledPacksRepository = class {
           let behind = false;
           for (const row of rows) {
             const params = {
-              id: randomUUID2(),
+              id: randomUUID3(),
               namespace: row.namespace,
               packId: row.packId,
               version: row.version,
@@ -20765,7 +21804,7 @@ var SqliteInstalledPacksRepository = class {
             if (stored === void 0 || !isMirrorDowngrade(row, stored)) {
               this.upsertAvailableStmt.run({
                 ...params,
-                id: randomUUID2(),
+                id: randomUUID3(),
                 recordedBy: meta3?.recordedBy ?? null
               });
             } else {
@@ -21088,14 +22127,15 @@ var SqliteInventoryRepository = class {
 };
 
 // ../../packages/persistence/src/repositories/inventory-assets.ts
-import { randomUUID as randomUUID3 } from "crypto";
+import { randomUUID as randomUUID4 } from "crypto";
 var CATEGORY_ORDER = ["config", "skill", "mcp", "hook"];
 var VALID_HARNESS_IDS = new Set(HarnessId.options);
 var WORKTREE_CHECKOUT_FILTER = "(url IS NULL OR (url NOT LIKE '%/.claude/worktrees/%' AND url NOT LIKE '%\\.claude\\worktrees\\%'))";
 var HARNESS_LABELS = {
   claudecode: "Claude Code",
   cursor: "Cursor",
-  codex: "Codex"
+  codex: "Codex",
+  antigravity: "Antigravity"
 };
 var HARNESS_LIVENESS_WINDOW_MS = 30 * 24 * 60 * 60 * 1e3;
 var EMPTY_PROJECT_AGG = {
@@ -21110,6 +22150,7 @@ function resolveHarnessId(attrs, row) {
   if (t.includes("claudecode") || t === "claude") return "claudecode";
   if (t.includes("cursor")) return "cursor";
   if (t.includes("codex")) return "codex";
+  if (t.includes("antigravity")) return "antigravity";
   return null;
 }
 function isLiveRealClaudeCode(rows) {
@@ -21568,7 +22609,7 @@ var SqliteInventoryAssetsRepository = class {
         `INSERT INTO file_access_override (id, project_id, path, access, created_at, updated_at)
            VALUES (:id, :projectId, :path, :access, :now, :now)
            ON CONFLICT (project_id, path) DO UPDATE SET access = excluded.access, updated_at = excluded.updated_at`
-      ).run({ id: randomUUID3(), projectId, path, access, now: Date.now() });
+      ).run({ id: randomUUID4(), projectId, path, access, now: Date.now() });
     }
     return true;
   }
@@ -21589,7 +22630,7 @@ var SqliteInventoryAssetsRepository = class {
         `INSERT INTO mcp_trust_override (id, asset_id, trust, created_at, updated_at)
            VALUES (:id, :assetId, :trust, :now, :now)
            ON CONFLICT (asset_id) DO UPDATE SET trust = excluded.trust, updated_at = excluded.updated_at`
-      ).run({ id: randomUUID3(), assetId, trust, now: Date.now() });
+      ).run({ id: randomUUID4(), assetId, trust, now: Date.now() });
     }
     this.configRowsCache = void 0;
     return "ok";
@@ -21886,7 +22927,7 @@ var SqliteInventoryAssetsRepository = class {
 };
 
 // ../../packages/persistence/src/repositories/policies.ts
-import { randomUUID as randomUUID4 } from "crypto";
+import { randomUUID as randomUUID5 } from "crypto";
 var SqlitePoliciesRepository = class {
   constructor(db) {
     this.db = db;
@@ -21921,7 +22962,7 @@ var SqlitePoliciesRepository = class {
     failOpenTransaction(this.db, () => {
       for (const [category, action] of Object.entries(DEFAULT_ACTIONS)) {
         stmt.run({
-          id: randomUUID4(),
+          id: randomUUID5(),
           target: JSON.stringify({ category }),
           action,
           now: Date.now()
@@ -21941,7 +22982,7 @@ var SqlitePoliciesRepository = class {
       `INSERT INTO policies (id, scope, target, action, enabled, created_at, updated_at)
          VALUES (:id, 'global', :target, :action, 1, :now, :now)
          ON CONFLICT(scope, target) DO UPDATE SET action = excluded.action, enabled = 1, updated_at = excluded.updated_at`
-    ).run({ id: randomUUID4(), target: JSON.stringify({ category }), action, now });
+    ).run({ id: randomUUID5(), target: JSON.stringify({ category }), action, now });
   }
   // Caps every global per-category policy currently set to block/redact down
   // to warn (see warn-era-cap.ts). Rule-targeted policies are untouched.
@@ -22009,7 +23050,7 @@ var SqlitePolicyCatalogRepository = class {
 };
 
 // ../../packages/persistence/src/repositories/project-files.ts
-import { randomUUID as randomUUID5 } from "crypto";
+import { randomUUID as randomUUID6 } from "crypto";
 var SqliteProjectFilesRepository = class {
   constructor(db) {
     this.db = db;
@@ -22041,7 +23082,7 @@ var SqliteProjectFilesRepository = class {
     const stamp = Math.max(now, maxStamp + 1);
     for (const file2 of scan2.files) {
       this.upsertStmt.run({
-        id: randomUUID5(),
+        id: randomUUID6(),
         projectId,
         path: file2.path,
         name: file2.name,
@@ -22055,7 +23096,7 @@ var SqliteProjectFilesRepository = class {
 };
 
 // ../../packages/persistence/src/repositories/resolutions.ts
-import { randomUUID as randomUUID6 } from "crypto";
+import { randomUUID as randomUUID7 } from "crypto";
 var SqliteResolutionsRepository = class {
   constructor(db, now = () => Date.now()) {
     this.db = db;
@@ -22109,7 +23150,7 @@ var SqliteResolutionsRepository = class {
    */
   insertResolution(r) {
     this.insertStmt.run({
-      id: randomUUID6(),
+      id: randomUUID7(),
       findingKey: r.findingKey,
       status: FindingStatus.parse(r.status),
       method: ResolutionMethod.parse(r.method),
@@ -22168,13 +23209,51 @@ var SqliteRuleProbeCacheRepository = class {
     this.readStmt = db.prepare(
       `SELECT verdict, worst_probe_ms AS worstProbeMs FROM rule_probe_cache WHERE rule_key = :ruleKey`
     );
+    this.countQuarantinedStmt = db.prepare(
+      `SELECT COUNT(*) AS n FROM rule_probe_cache WHERE verdict = 'quarantined'`
+    );
+    this.clearQuarantinedStmt = db.prepare(
+      `DELETE FROM rule_probe_cache WHERE verdict = 'quarantined'`
+    );
   }
   db;
   upsertStmt;
   readStmt;
+  countQuarantinedStmt;
+  clearQuarantinedStmt;
   getVerdict(ruleKey) {
     return getRow(this.readStmt, { ruleKey });
   }
+  /** How many rules are currently excluded by a cached quarantine verdict. */
+  countQuarantined() {
+    return getRow(this.countQuarantinedStmt, {})?.n ?? 0;
+  }
+  /**
+   * Forgets every quarantine verdict, so the rules behind them are measured
+   * again on the next load. This is the undo for a verdict the machine reached
+   * on its own: a rule terminated mid-scan is cached forever and dropped from
+   * every later scan, and a timing verdict is a wall-clock judgement that a
+   * loaded or slow machine can reach about a rule that is in fact fine.
+   *
+   * Only 'quarantined' rows go — a 'safe' verdict is a measurement worth
+   * keeping, and dropping it would make every rule pay the battery again.
+   *
+   * Reports `refused` from the write's own result rather than inferring it from
+   * the row count. The two are NOT the same answer: `failOpenTransaction`
+   * swallows a contended DELETE (another writer holding the lock past
+   * `busy_timeout` — reads are unaffected in WAL), and a swallowed refusal
+   * leaves the count unchanged, which is indistinguishable from "there was
+   * nothing to clear". An undo that reports success while the quarantines are
+   * still in place is worse than one that fails, because the rules it claimed
+   * to restore are silently still disabled.
+   */
+  clearQuarantined() {
+    const before = this.countQuarantined();
+    const committed = failOpenTransaction(this.db, () => {
+      this.clearQuarantinedStmt.run();
+    });
+    return { refused: !committed, cleared: before - this.countQuarantined() };
+  }
   setVerdict(ruleKey, verdict, worstProbeMs) {
     failOpenTransaction(this.db, () => {
       this.upsertStmt.run({ ruleKey, verdict, worstProbeMs, checkedAt: Date.now() });
@@ -22228,92 +23307,507 @@ var SqliteScanLedgerRepository = class {
   }
 };
 
-// ../../packages/persistence/src/repositories/security.ts
-var DAY_MS4 = 864e5;
-var SEVERITIES = ["critical", "high", "medium", "low"];
-var ACTION_TO_KIND = {
-  block: "blocked",
-  redact: "redacted",
-  warn: "warned"
-};
-var ENFORCEMENT_KINDS = ["blocked", "redacted", "warned"];
-var SCAN_COVERAGE = [
-  { provider: "claudecode", coverage: 100, supported: true },
-  { provider: "cursor", coverage: 0, supported: false },
-  { provider: "codex", coverage: 0, supported: false },
-  { provider: "chatgpt", coverage: 0, supported: false },
-  { provider: "copilot", coverage: 0, supported: false },
-  { provider: "api", coverage: 0, supported: false }
-];
-var GRANULARITY = {
-  "7d": "day",
-  "30d": "day",
-  "3m": "week",
-  "6m": "week"
-};
-function granularityFor(range) {
-  return GRANULARITY[range];
-}
-function startOfUtcDay2(ms) {
-  return Math.floor(ms / DAY_MS4) * DAY_MS4;
+// ../../packages/persistence/src/repositories/secret-vault.ts
+import { randomUUID as randomUUID8 } from "crypto";
+function pageLimit(requested, fallback) {
+  if (requested === void 0) return fallback;
+  return Math.min(Math.max(1, Math.trunc(requested)), MAX_VAULT_PAGE_LIMIT);
 }
-function toUtcDateString(ms) {
-  return new Date(ms).toISOString().slice(0, 10);
+function encodeReuseCursor(payload) {
+  return Buffer.from(JSON.stringify(payload)).toString("base64url");
 }
-function isTimeseriesSeverity(s) {
-  return s === "critical" || s === "high" || s === "medium";
+function decodeReuseCursor(cursor) {
+  const parsed = parseJsonObject(Buffer.from(cursor, "base64url").toString("utf8"));
+  if (parsed !== void 0 && // `Number.isInteger`, not `typeof === 'number'`: a payload carrying
+  // ±Infinity or a fraction binds cleanly and returns an EMPTY page with a
+  // null cursor, which the caller reads as "end of list" — the one outcome a
+  // malformed cursor must never produce, since restarting from the top is the
+  // documented behaviour and the only recoverable one. (`1e999` is valid JSON
+  // and parses to Infinity; a bare `NaN` is not, so it cannot arrive here.)
+  Number.isInteger(parsed.occurrences) && typeof parsed.pointerId === "string") {
+    return { occurrences: parsed.occurrences, pointerId: parsed.pointerId };
+  }
+  return null;
 }
-var SqliteSecurityRepository = class {
-  constructor(db, now = () => Date.now()) {
+var REUSED_PREDICATE = `(v.occurrence_count > 1
+     OR (SELECT count(*) FROM secret_vault_sighting s WHERE s.pointer_id = v.pointer_id) > 1)`;
+var INVENTORY_COLUMNS = `v.pointer_id, v.category, v.rule_id, v.masked_match, v.provider,
+          v.occurrence_count, v.first_seen, v.last_seen`;
+function toSighting(row) {
+  return {
+    location: row.location,
+    kind: row.kind,
+    firstSeen: new Date(row.first_seen).toISOString(),
+    lastSeen: new Date(row.last_seen).toISOString()
+  };
+}
+var SELECT_COLUMNS = `
+  pointer_id AS pointerId,
+  value_fingerprint AS valueFingerprint,
+  fingerprint_key_version AS fingerprintKeyVersion,
+  key_version AS keyVersion,
+  format_version AS formatVersion,
+  category,
+  rule_id AS ruleId,
+  masked_match AS maskedMatch,
+  provider,
+  ciphertext,
+  nonce,
+  auth_tag AS authTag,
+  occurrence_count AS occurrenceCount,
+  first_seen AS firstSeen,
+  last_seen AS lastSeen`;
+function toRow(raw) {
+  const { provider, ...rest } = raw;
+  return provider === null ? rest : { ...rest, provider };
+}
+var SqliteSecretVaultRepository = class {
+  constructor(db) {
     this.db = db;
-    this.now = now;
+    this.insertStmt = db.prepare(
+      `INSERT INTO secret_vault (
+         pointer_id, value_fingerprint, fingerprint_key_version, key_version,
+         format_version, category, rule_id, masked_match, provider,
+         ciphertext, nonce, auth_tag,
+         occurrence_count, first_seen, last_seen
+       ) VALUES (
+         :pointerId, :valueFingerprint, :fingerprintKeyVersion, :keyVersion,
+         :formatVersion, :category, :ruleId, :maskedMatch, :provider,
+         :ciphertext, :nonce, :authTag,
+         1, :now, :now
+       )`
+    );
+    this.bumpStmt = db.prepare(
+      `UPDATE secret_vault
+       SET occurrence_count = occurrence_count + 1, last_seen = :now
+       WHERE value_fingerprint = :valueFingerprint`
+    );
+    this.byPointerStmt = db.prepare(
+      `SELECT ${SELECT_COLUMNS} FROM secret_vault WHERE pointer_id = :pointerId`
+    );
+    this.byFingerprintStmt = db.prepare(
+      `SELECT ${SELECT_COLUMNS} FROM secret_vault WHERE value_fingerprint = :valueFingerprint`
+    );
+    this.listStmt = db.prepare(`SELECT ${SELECT_COLUMNS} FROM secret_vault ORDER BY first_seen`);
+    this.replaceCiphertextStmt = db.prepare(
+      `UPDATE secret_vault
+       SET key_version = :keyVersion, ciphertext = :ciphertext, nonce = :nonce, auth_tag = :authTag
+       WHERE pointer_id = :pointerId`
+    );
+    this.refreshFingerprintStmt = db.prepare(
+      `UPDATE secret_vault
+       SET value_fingerprint = :valueFingerprint, fingerprint_key_version = :fingerprintKeyVersion
+       WHERE pointer_id = :pointerId`
+    );
+    this.derefStmt = db.prepare(
+      `INSERT INTO secret_vault_deref (id, pointer_id, at, target, reason, outcome, grant_id, pointer_count)
+       VALUES (:id, :pointerId, :at, :target, :reason, :outcome, :grantId, :pointerCount)`
+    );
   }
   db;
-  now;
-  // Status-aware: every finding is classified by origin (its parent event's
-  // kind — 'code_change' is at-rest, everything else is in-flight) and, for
-  // at-rest findings, whether its finding_key's LATEST finding_resolution row
-  // (max created_at, not "does ANY row exist") has status 'resolved' — mirrors
-  // SqliteResolutionsRepository's LATEST-RESOLUTION-WINS convention. "Any row
-  // exists" would let a fixed-at-source key that is later redetected (the same
-  // secret re-added) stay silently "caught" forever under its stale resolved
-  // row; latest-wins lets the scanner supersede it with a fresh status:'open'
-  // row (see scan.ts's reopenRedetectedFindings) so the invariant holds: a
-  // finding_key present in the current scan is OPEN, regardless of history.
-  // In-flight findings are born caught (enforcement already ran); at-rest
-  // findings are caught only once their latest disposition is resolved,
-  // otherwise they are open-at-rest.
-  //
-  // NOTE for future manual-resolution writers: only latest status
-  // 'resolved' counts as caught above. When acknowledged/dismissed/
-  // false-positive manual dispositions land, this must keep filtering by
-  // status/method — 'acknowledged' is accepted risk, not a fix, and must NOT
-  // be bucketed as caught alongside 'resolved'.
-  //
-  // Legacy at-rest findings from pre-branch scans carry finding_key = NULL —
-  // the resolution lifecycle is keyed by finding_key, so it can never attach a
-  // disposition to (or clear) one of these on re-scan. They are excluded from
-  // both caught and openAtRest (untracked, not "needs remediation forever"),
-  // but still counted in total/count below — this keeps this predicate
-  // consistent with SqliteResolutionsRepository.openAtRestKeysForPath, which
-  // already filters `finding_key IS NOT NULL`.
-  //
-  // One GROUP BY aggregate: the result set stays O(distinct severities) no
-  // matter how many findings the store has accumulated (this backs `aka stats`
-  // and the dashboard severity card, both hot paths on a table that only
-  // grows). The latest-resolution status comes from the shared derived-table
-  // fragment (see resolution-sql.ts) rather than a correlated subquery per
-  // finding — its rn = 1 filter is also what makes the LEFT JOIN safe against
-  // double-counting a key that accumulated several append-only rows.
-  severitySummary() {
-    const rows = allRows(
-      this.db.prepare(
-        `SELECT d.severity AS severity,
-                COUNT(*) AS count,
-                SUM(CASE
-                      WHEN e.event_type != 'code_change' THEN 1
-                      WHEN f.finding_key IS NULL THEN 0
-                      WHEN latest.status = 'resolved' THEN 1
+  insertStmt;
+  bumpStmt;
+  byPointerStmt;
+  byFingerprintStmt;
+  listStmt;
+  replaceCiphertextStmt;
+  refreshFingerprintStmt;
+  derefStmt;
+  /**
+   * Vault a value, or record another sighting of one already vaulted. Keyed on
+   * `valueFingerprint`, never on the caller's pointer id: a value seen again
+   * bumps `occurrence_count` and `last_seen` and comes back with its ORIGINAL
+   * pointer, category and ciphertext, so the same secret always resolves to one
+   * wire token. `minted` is true only when this call created the row.
+   *
+   * The read-then-write runs in one IMMEDIATE transaction so two concurrent
+   * writers cannot both decide they are minting.
+   */
+  upsert(input, now) {
+    let minted = false;
+    withTransaction(
+      this.db,
+      () => {
+        const existing = getRow(this.byFingerprintStmt, {
+          valueFingerprint: input.valueFingerprint
+        });
+        if (existing === void 0) {
+          this.insertStmt.run(
+            bindParams({
+              pointerId: input.pointerId,
+              valueFingerprint: input.valueFingerprint,
+              fingerprintKeyVersion: input.fingerprintKeyVersion,
+              keyVersion: input.keyVersion,
+              formatVersion: input.formatVersion ?? POINTER_FORMAT_VERSION,
+              category: input.category,
+              ruleId: input.ruleId,
+              maskedMatch: input.maskedMatch,
+              provider: input.provider,
+              ciphertext: input.ciphertext,
+              nonce: input.nonce,
+              authTag: input.authTag,
+              now
+            })
+          );
+          minted = true;
+          return;
+        }
+        this.bumpStmt.run({ valueFingerprint: input.valueFingerprint, now });
+      },
+      "IMMEDIATE"
+    );
+    const row = getRow(this.byFingerprintStmt, {
+      valueFingerprint: input.valueFingerprint
+    });
+    if (row === void 0) throw new Error("vault: row vanished immediately after write");
+    return { row: toRow(row), minted };
+  }
+  byPointerId(pointerId) {
+    const raw = getRow(this.byPointerStmt, { pointerId });
+    return raw === void 0 ? null : toRow(raw);
+  }
+  byValueFingerprint(fingerprint) {
+    const raw = getRow(this.byFingerprintStmt, { valueFingerprint: fingerprint });
+    return raw === void 0 ? null : toRow(raw);
+  }
+  /** Append one audit row. Carries no raw value and no ciphertext, by shape. */
+  recordDeref(entry) {
+    this.derefStmt.run(
+      bindParams({
+        id: entry.id,
+        pointerId: entry.pointerId,
+        at: entry.at,
+        target: entry.target,
+        reason: entry.reason,
+        outcome: entry.outcome,
+        grantId: entry.grantId,
+        pointerCount: entry.pointerCount ?? 1
+      })
+    );
+  }
+  listAll() {
+    return allRows(this.listStmt).map(toRow);
+  }
+  /** Re-seal an entry under a new key epoch, leaving its identity untouched. */
+  replaceCiphertext(pointerId, next) {
+    this.replaceCiphertextStmt.run({ pointerId, ...next });
+  }
+  /** Re-derive an entry's fingerprint under a new fingerprint-key epoch. */
+  refreshFingerprint(pointerId, next) {
+    this.refreshFingerprintStmt.run({ pointerId, ...next });
+  }
+  /**
+   * Destroy every vaulted value and report how many were destroyed. The deref
+   * audit is left alone on purpose — see the table note above.
+   */
+  purgeAll() {
+    let destroyed = 0;
+    withTransaction(
+      this.db,
+      () => {
+        destroyed = this.countEntries();
+        this.db.exec("DELETE FROM secret_vault");
+      },
+      "IMMEDIATE"
+    );
+    return destroyed;
+  }
+  /**
+   * Record (or re-stamp) one place a pointer has been written. One row per
+   * (pointer, location); a re-sighting bumps last_seen. Best-effort bookkeeping
+   * on hook paths — a failure must never affect the rewrite that triggered it,
+   * so callers wrap this, not the other way around.
+   */
+  recordSighting(entry, now) {
+    this.db.prepare(
+      `INSERT INTO secret_vault_sighting (id, pointer_id, location, kind, first_seen, last_seen)
+         VALUES (:id, :pointerId, :location, :kind, :now, :now)
+         ON CONFLICT (pointer_id, location) DO UPDATE SET last_seen = :now`
+    ).run({
+      id: randomUUID8(),
+      pointerId: entry.pointerId,
+      location: entry.location,
+      kind: entry.kind,
+      now
+    });
+  }
+  /**
+   * Sightings for a whole page of pointers, in ONE query grouped in JS rather
+   * than one query per row. A pointer with no sightings still gets an entry, so
+   * the caller never has to distinguish "none" from "missing".
+   *
+   * The `IN` list is sized to the page, so this statement cannot be cached on
+   * the instance the way the fixed-shape ones in the constructor are.
+   */
+  sightingsFor(pointerIds) {
+    const byPointer = new Map(pointerIds.map((id) => [id, []]));
+    if (pointerIds.length === 0) return byPointer;
+    const rows = allRows(
+      this.db.prepare(
+        `SELECT pointer_id, location, kind, first_seen, last_seen
+           FROM secret_vault_sighting
+          WHERE pointer_id IN (${placeholders(pointerIds.length)})
+          ORDER BY last_seen DESC`
+      ),
+      pointerIds
+    );
+    for (const row of rows) byPointer.get(row.pointer_id)?.push(toSighting(row));
+    return byPointer;
+  }
+  /** Hydrate a page of raw inventory rows with their sightings, batched. */
+  toInventoryEntries(rows) {
+    const sightings = this.sightingsFor(rows.map((r) => r.pointer_id));
+    return rows.map((r) => ({
+      pointerId: r.pointer_id,
+      category: r.category,
+      ...r.provider === null ? {} : { provider: r.provider },
+      maskedMatch: r.masked_match,
+      occurrences: r.occurrence_count,
+      firstSeen: new Date(r.first_seen).toISOString(),
+      lastSeen: new Date(r.last_seen).toISOString(),
+      revealGrantId: r.grant_id,
+      sightings: sightings.get(r.pointer_id) ?? []
+    }));
+  }
+  /**
+   * The dashboard inventory, newest-first, ONE PAGE at a time: every vaulted
+   * value's descriptor data joined with its sightings and the active
+   * reveal-to-model grant when one exists. Raw-free by construction — neither
+   * the fingerprint nor the ciphertext columns are selected.
+   *
+   * `totals.values` counts the whole store, not the page, so the count a reader
+   * sees never depends on how far they have paged.
+   */
+  listInventory(query = {}, now = Date.now()) {
+    const limit = pageLimit(query.limit, DEFAULT_VAULT_INVENTORY_LIMIT);
+    const cursor = query.cursor === void 0 ? null : decodeKeysetCursor(query.cursor);
+    const where = cursor === null ? "" : "WHERE (v.last_seen < :cursorLastSeen OR (v.last_seen = :cursorLastSeen AND v.pointer_id < :cursorPointerId))";
+    const rows = allRows(
+      this.db.prepare(
+        `SELECT ${INVENTORY_COLUMNS},
+                (SELECT e.id FROM exceptions e
+                  WHERE e.rule_id = v.rule_id
+                    AND e.value_fingerprint = v.value_fingerprint
+                    AND e.key_version = v.fingerprint_key_version
+                    AND ${ACTIVE_REVEAL_GRANT_PREDICATE}
+                  LIMIT 1) AS grant_id
+           FROM secret_vault v
+           ${where}
+          ORDER BY v.last_seen DESC, v.pointer_id DESC
+          LIMIT :limit`
+      ),
+      bindParams({
+        now,
+        limit: limit + 1,
+        ...cursor === null ? {} : { cursorLastSeen: cursor.startedAtMs, cursorPointerId: cursor.id }
+      })
+    );
+    const hasMore = rows.length > limit;
+    const page = hasMore ? rows.slice(0, limit) : rows;
+    const last = page[page.length - 1];
+    return {
+      totals: { values: this.countEntries() },
+      items: this.toInventoryEntries(page),
+      // Minted from the last row of the PAGE, never the extra probe row.
+      nextCursor: hasMore && last ? encodeKeysetCursor({ startedAtMs: last.last_seen, id: last.pointer_id }) : null
+    };
+  }
+  /**
+   * Values reused on this machine — detected more than once, or written to more
+   * than one location — most-reused first, one page at a time.
+   *
+   * Its own read rather than a filter over an inventory page: reuse is a
+   * property of the whole store, and deriving it from 50 newest rows would
+   * under-report exactly the values a reader most needs to see.
+   */
+  listReuse(query = {}, now = Date.now()) {
+    const limit = pageLimit(query.limit, DEFAULT_VAULT_INVENTORY_LIMIT);
+    const cursor = query.cursor === void 0 ? null : decodeReuseCursor(query.cursor);
+    const after = cursor === null ? "" : `AND (v.occurrence_count < :cursorOccurrences
+              OR (v.occurrence_count = :cursorOccurrences AND v.pointer_id < :cursorPointerId))`;
+    const rows = allRows(
+      this.db.prepare(
+        `SELECT ${INVENTORY_COLUMNS},
+                (SELECT e.id FROM exceptions e
+                  WHERE e.rule_id = v.rule_id
+                    AND e.value_fingerprint = v.value_fingerprint
+                    AND e.key_version = v.fingerprint_key_version
+                    AND ${ACTIVE_REVEAL_GRANT_PREDICATE}
+                  LIMIT 1) AS grant_id
+           FROM secret_vault v
+          WHERE ${REUSED_PREDICATE} ${after}
+          ORDER BY v.occurrence_count DESC, v.pointer_id DESC
+          LIMIT :limit`
+      ),
+      bindParams({
+        now,
+        limit: limit + 1,
+        ...cursor === null ? {} : { cursorOccurrences: cursor.occurrences, cursorPointerId: cursor.pointerId }
+      })
+    );
+    const hasMore = rows.length > limit;
+    const page = hasMore ? rows.slice(0, limit) : rows;
+    const last = page[page.length - 1];
+    return {
+      totals: { reused: this.countReused() },
+      items: this.toInventoryEntries(page),
+      nextCursor: hasMore && last ? encodeReuseCursor({ occurrences: last.occurrence_count, pointerId: last.pointer_id }) : null
+    };
+  }
+  /**
+   * The de-reference trail, newest first, one page at a time. By default the
+   * batched, high-volume reasons (display, view-render) are hidden and counted
+   * instead — the rows that matter as a signal are the model crossings, and
+   * burying them under render noise would defeat the audit's purpose.
+   *
+   * `hiddenBatched` counts the whole trail rather than the page: it is what the
+   * view's "N hidden" line and its toggle speak for, so it must not shrink as
+   * the reader pages.
+   */
+  listDerefs(query = {}) {
+    const limit = pageLimit(query.limit, DEFAULT_VAULT_DEREFS_LIMIT);
+    const cursor = query.cursor === void 0 ? null : decodeKeysetCursor(query.cursor);
+    const conditions = [];
+    if (query.includeBatched !== true) {
+      conditions.push(`reason NOT IN ('display', 'view-render')`);
+    }
+    if (cursor !== null) {
+      conditions.push("(at < :cursorAt OR (at = :cursorAt AND id < :cursorId))");
+    }
+    const where = conditions.length === 0 ? "" : `WHERE ${conditions.join(" AND ")}`;
+    const rows = allRows(
+      this.db.prepare(
+        `SELECT id, pointer_id, at, target, reason, outcome, grant_id, pointer_count
+           FROM secret_vault_deref ${where}
+          ORDER BY at DESC, id DESC LIMIT :limit`
+      ),
+      bindParams({
+        limit: limit + 1,
+        ...cursor === null ? {} : { cursorAt: cursor.startedAtMs, cursorId: cursor.id }
+      })
+    );
+    const hasMore = rows.length > limit;
+    const page = hasMore ? rows.slice(0, limit) : rows;
+    const last = page[page.length - 1];
+    const hiddenBatched = query.includeBatched === true ? 0 : countScalar(
+      this.db,
+      `SELECT count(*) AS n FROM secret_vault_deref WHERE reason IN ('display', 'view-render')`
+    );
+    return {
+      items: page.map((r) => ({
+        id: r.id,
+        pointerId: r.pointer_id,
+        at: new Date(r.at).toISOString(),
+        target: r.target,
+        reason: r.reason,
+        outcome: r.outcome,
+        ...r.grant_id === null ? {} : { grantId: r.grant_id },
+        pointerCount: r.pointer_count
+      })),
+      nextCursor: hasMore && last ? encodeKeysetCursor({ startedAtMs: last.at, id: last.id }) : null,
+      hiddenBatched
+    };
+  }
+  countEntries() {
+    return countScalar(this.db, "SELECT COUNT(*) AS n FROM secret_vault");
+  }
+  /** Values reused on this machine — the reuse list's page-independent total. */
+  countReused() {
+    return countScalar(
+      this.db,
+      `SELECT COUNT(*) AS n FROM secret_vault v WHERE ${REUSED_PREDICATE}`
+    );
+  }
+};
+
+// ../../packages/persistence/src/repositories/security.ts
+var DAY_MS4 = 864e5;
+var SEVERITIES = ["critical", "high", "medium", "low"];
+var ACTION_TO_KIND = {
+  block: "blocked",
+  redact: "redacted",
+  warn: "warned"
+};
+var ENFORCEMENT_KINDS = ["blocked", "redacted", "warned"];
+var SCAN_COVERAGE = [
+  { provider: "claudecode", coverage: 100, supported: true },
+  { provider: "cursor", coverage: 0, supported: false },
+  { provider: "codex", coverage: 80, supported: true },
+  { provider: "antigravity", coverage: 60, supported: true },
+  { provider: "claudeai", coverage: 0, supported: false },
+  { provider: "chatgpt", coverage: 0, supported: false },
+  { provider: "copilot", coverage: 0, supported: false },
+  { provider: "api", coverage: 0, supported: false }
+];
+var GRANULARITY = {
+  "7d": "day",
+  "30d": "day",
+  "3m": "week",
+  "6m": "week"
+};
+function granularityFor(range) {
+  return GRANULARITY[range];
+}
+function startOfUtcDay2(ms) {
+  return Math.floor(ms / DAY_MS4) * DAY_MS4;
+}
+function toUtcDateString(ms) {
+  return new Date(ms).toISOString().slice(0, 10);
+}
+function isTimeseriesSeverity(s) {
+  return s === "critical" || s === "high" || s === "medium";
+}
+var SqliteSecurityRepository = class {
+  constructor(db, now = () => Date.now()) {
+    this.db = db;
+    this.now = now;
+  }
+  db;
+  now;
+  // Status-aware: every finding is classified by origin (its parent event's
+  // kind — 'code_change' is at-rest, everything else is in-flight) and, for
+  // at-rest findings, whether its finding_key's LATEST finding_resolution row
+  // (max created_at, not "does ANY row exist") has status 'resolved' — mirrors
+  // SqliteResolutionsRepository's LATEST-RESOLUTION-WINS convention. "Any row
+  // exists" would let a fixed-at-source key that is later redetected (the same
+  // secret re-added) stay silently "caught" forever under its stale resolved
+  // row; latest-wins lets the scanner supersede it with a fresh status:'open'
+  // row (see scan.ts's reopenRedetectedFindings) so the invariant holds: a
+  // finding_key present in the current scan is OPEN, regardless of history.
+  // In-flight findings are born caught (enforcement already ran); at-rest
+  // findings are caught only once their latest disposition is resolved,
+  // otherwise they are open-at-rest.
+  //
+  // NOTE for future manual-resolution writers: only latest status
+  // 'resolved' counts as caught above. When acknowledged/dismissed/
+  // false-positive manual dispositions land, this must keep filtering by
+  // status/method — 'acknowledged' is accepted risk, not a fix, and must NOT
+  // be bucketed as caught alongside 'resolved'.
+  //
+  // Legacy at-rest findings from pre-branch scans carry finding_key = NULL —
+  // the resolution lifecycle is keyed by finding_key, so it can never attach a
+  // disposition to (or clear) one of these on re-scan. They are excluded from
+  // both caught and openAtRest (untracked, not "needs remediation forever"),
+  // but still counted in total/count below — this keeps this predicate
+  // consistent with SqliteResolutionsRepository.openAtRestKeysForPath, which
+  // already filters `finding_key IS NOT NULL`.
+  //
+  // One GROUP BY aggregate: the result set stays O(distinct severities) no
+  // matter how many findings the store has accumulated (this backs `aka stats`
+  // and the dashboard severity card, both hot paths on a table that only
+  // grows). The latest-resolution status comes from the shared derived-table
+  // fragment (see resolution-sql.ts) rather than a correlated subquery per
+  // finding — its rn = 1 filter is also what makes the LEFT JOIN safe against
+  // double-counting a key that accumulated several append-only rows.
+  severitySummary() {
+    const rows = allRows(
+      this.db.prepare(
+        `SELECT d.severity AS severity,
+                COUNT(*) AS count,
+                SUM(CASE
+                      WHEN e.event_type != 'code_change' THEN 1
+                      WHEN f.finding_key IS NULL THEN 0
+                      WHEN latest.status = 'resolved' THEN 1
                       ELSE 0
                     END) AS caught,
                 SUM(CASE
@@ -22573,7 +24067,7 @@ var SqliteSecurityRepository = class {
 };
 
 // ../../packages/persistence/src/repositories/shares.ts
-import { randomUUID as randomUUID7 } from "crypto";
+import { randomUUID as randomUUID9 } from "crypto";
 var MAX_EGRESS_CALL_SITES_PER_PROJECT = 5e3;
 var IN_CHUNK = 500;
 var KIND_ORDER = ["provider", "internal", "external", "ip"];
@@ -22829,7 +24323,7 @@ var SqliteSharesRepository = class {
                (id, destination_id, host, decision, created_at, updated_at)
              VALUES (:id, :destinationId, :host, :decision, :now, :now)`
         ).run({
-          id: randomUUID7(),
+          id: randomUUID9(),
           destinationId,
           host: dest.host,
           decision,
@@ -22978,7 +24472,7 @@ var SqliteSharesRepository = class {
       let destinationId = destIds.get(hit.host);
       if (destinationId === void 0) {
         destStmt.run({
-          id: randomUUID7(),
+          id: randomUUID9(),
           kind: hit.kind,
           name: hit.name,
           host: hit.host,
@@ -22994,7 +24488,7 @@ var SqliteSharesRepository = class {
       let endpointId = endpointIds.get(endpointKey);
       if (endpointId === void 0) {
         endpointStmt.run({
-          id: randomUUID7(),
+          id: randomUUID9(),
           destinationId,
           method: hit.method,
           transport: hit.transport,
@@ -23007,7 +24501,7 @@ var SqliteSharesRepository = class {
         endpointIds.set(endpointKey, endpointId);
       }
       siteStmt.run({
-        id: randomUUID7(),
+        id: randomUUID9(),
         endpointId,
         project: input.project,
         projectKey: input.projectKey,
@@ -23372,6 +24866,9 @@ function purgeSampleData(db) {
 }
 
 // ../../packages/persistence/src/database.ts
+var UNSAFE_TEST_ONLY_RAW_HANDLE = /* @__PURE__ */ Symbol(
+  "aka.persistence.unsafeTestOnlyRawHandle"
+);
 function linkHost(input, hostId) {
   return hostId ? { ...input, hostId } : input;
 }
@@ -23393,21 +24890,34 @@ function openWithPragmas(file2) {
   }
   return db;
 }
-function backupLegacyStore(file2) {
-  const backup = `${file2}.legacy.${String(Date.now())}.bak`;
-  renameSync2(file2, backup);
-  tightenFile(backup);
-  for (const sidecar of dbSidecars(file2)) {
-    if (existsSync(sidecar)) rmSync2(sidecar);
+function backupLegacyStore(db, file2) {
+  reapStalePartials(file2);
+  const backup = backupPath(file2, "legacy");
+  let snapshotted = false;
+  let snapshotError;
+  try {
+    snapshotStore(db, backup);
+    snapshotted = true;
+  } catch (error51) {
+    snapshotError = error51;
+  } finally {
+    db.close();
   }
+  if (!snapshotted) {
+    akaWarn(
+      `Could not snapshot the incompatible ${DB_FILENAME} (${String(snapshotError)}); moving the store aside with its sidecars instead.`
+    );
+    moveStoreAside(file2, backup);
+    return backup;
+  }
+  discardStore(file2, backup);
   return backup;
 }
 function openAndInitialize(file2) {
   let db = openWithPragmas(file2);
   try {
     if (isForeignSqliteLineage(db)) {
-      db.close();
-      const backup = backupLegacyStore(file2);
+      const backup = backupLegacyStore(db, file2);
       db = openWithPragmas(file2);
       akaWarn(
         `Detected an older, incompatible (tenant-bearing) ${DB_FILENAME}; backed it up to ${backup} and created a fresh store.`
@@ -23423,6 +24933,7 @@ function openAndInitialize(file2) {
       policies,
       installedPacks,
       scanLedger: new SqliteScanLedgerRepository(db),
+      secretVault: new SqliteSecretVaultRepository(db),
       exceptions: new SqliteExceptionsRepository(db),
       resolutions: new SqliteResolutionsRepository(db),
       ruleProbeCache: new SqliteRuleProbeCacheRepository(db),
@@ -23450,7 +24961,7 @@ function openAndInitialize(file2) {
 }
 function openLocalDatabase(dir) {
   ensureDataDirSync(dir);
-  const file2 = join(dir, DB_FILENAME);
+  const file2 = join2(dir, DB_FILENAME);
   const {
     db,
     events,
@@ -23458,6 +24969,7 @@ function openLocalDatabase(dir) {
     policies,
     installedPacks,
     scanLedger,
+    secretVault,
     exceptions,
     resolutions,
     ruleProbeCache,
@@ -23566,7 +25078,7 @@ function openLocalDatabase(dir) {
         const definitionId = definitionIds.get(`${finding.ruleId}@${finding.version}`);
         if (!definitionId) continue;
         inspectionFindings.insertFinding({
-          id: randomUUID8(),
+          id: randomUUID10(),
           auditEventId: record2.scanEvent.id,
           inspectionDefinitionId: definitionId,
           span: finding.span,
@@ -23643,6 +25155,7 @@ function openLocalDatabase(dir) {
     policies,
     installedPacks,
     scanLedger,
+    secretVault,
     exceptions,
     resolutions,
     ruleProbeCache,
@@ -23671,22 +25184,58 @@ function openLocalDatabase(dir) {
     transaction,
     close: () => {
       db.close();
-    }
+    },
+    // Last, and a plain value rather than a getter, so `{ ...db }` carries it.
+    [UNSAFE_TEST_ONLY_RAW_HANDLE]: db
   };
 }
 
+// ../../packages/persistence/src/exception-policy.ts
+var UserGrantPolicyProvider = class {
+  #exceptions;
+  constructor(exceptions) {
+    this.#exceptions = exceptions;
+  }
+  async decideReveal(identity) {
+    try {
+      const grant = await this.#exceptions.activeRevealGrant(
+        identity.ruleId,
+        identity.valueFingerprint,
+        identity.fingerprintKeyVersion
+      );
+      return grant === null ? { allow: false } : { allow: true, grantId: grant.id };
+    } catch {
+      return { allow: false };
+    }
+  }
+};
+
+// ../../packages/persistence/src/file-lock.ts
+import { randomUUID as randomUUID11 } from "crypto";
+import {
+  closeSync,
+  existsSync as existsSync2,
+  openSync,
+  readFileSync,
+  rmSync as rmSync3,
+  statSync as statSync2,
+  writeFileSync as writeFileSync2
+} from "fs";
+import { hostname as hostname3 } from "os";
+var PARK = new Int32Array(new SharedArrayBuffer(4));
+
 // ../../packages/persistence/src/finding-key.ts
 import { createHash as createHash3 } from "crypto";
 
 // ../../packages/persistence/src/fingerprint.ts
 import { createHmac, randomBytes } from "crypto";
-import { existsSync as existsSync2, readFileSync } from "fs";
-import { join as join2 } from "path";
+import { existsSync as existsSync3, readFileSync as readFileSync2 } from "fs";
+import { join as join3 } from "path";
 import { DatabaseSync as DatabaseSync2 } from "node:sqlite";
-var KEY_FILENAME = "exception.key";
+var EXCEPTION_KEY_FILENAME = "exception.key";
 var KEY_MATERIAL_BYTES = 32;
 function keyFilePath(dataDir2) {
-  return join2(dataDir2, KEY_FILENAME);
+  return join3(dataDir2, EXCEPTION_KEY_FILENAME);
 }
 function parseKeyFile(raw) {
   const parsed = JSON.parse(raw);
@@ -23706,33 +25255,120 @@ function parseKeyFile(raw) {
   }
   return { version: version2, material: bytes };
 }
+var KEY_VERSION_COLUMNS = {
+  exceptions: "key_version",
+  blocked_detections: "key_version",
+  secret_vault: "fingerprint_key_version"
+};
+var SQLITE_ERROR = 1;
+var FLOOR_BUSY_TIMEOUT_MS = 250;
+var FloorUnreadableError = class extends Error {
+  code = "floor-unreadable";
+  constructor(cause) {
+    super(
+      `cannot read the stored fingerprint key versions: ${cause instanceof Error ? cause.message : String(cause)}`,
+      { cause }
+    );
+    this.name = "FloorUnreadableError";
+  }
+};
+function storedKeyVersionFloor(dataDir2) {
+  const file2 = join3(dataDir2, DB_FILENAME);
+  if (!existsSync3(file2)) return 0;
+  let db;
+  try {
+    db = new DatabaseSync2(file2, { readOnly: true });
+    db.exec(`PRAGMA busy_timeout = ${String(FLOOR_BUSY_TIMEOUT_MS)}`);
+    let floor = 0;
+    for (const [table, column] of Object.entries(KEY_VERSION_COLUMNS)) {
+      try {
+        const row = getRow(
+          db.prepare(`SELECT MAX(${column}) AS v FROM ${table}`)
+        );
+        floor = Math.max(floor, row?.v ?? 0);
+      } catch (err) {
+        if (err.errcode !== SQLITE_ERROR) {
+          throw new FloorUnreadableError(err);
+        }
+      }
+    }
+    return floor;
+  } catch (err) {
+    throw err instanceof FloorUnreadableError ? err : new FloorUnreadableError(err);
+  } finally {
+    db?.close();
+  }
+}
+function serializeKey(key) {
+  return JSON.stringify({ version: key.version, material: key.material.toString("base64") });
+}
+function createKeyFile(dataDir2, key) {
+  ensureDataDirSync(dataDir2);
+  const file2 = keyFilePath(dataDir2);
+  if (createOwnerOnlyFileSync(file2, `${serializeKey(key)}
+`)) return key;
+  const winner = readFingerprintKey(dataDir2);
+  if (winner) {
+    tightenFile(file2);
+    return winner;
+  }
+  const occupant = classifyOccupant(file2);
+  throw new KeyUnclaimableError(occupantMessage(file2, occupant.kind), occupant.cause);
+}
+function occupantMessage(file2, kind) {
+  switch (kind) {
+    case "symlink":
+      return `exception key file is a symlink (${file2}); remove it so a key can be created`;
+    case "gone":
+      return "exception key file was removed while it was being created";
+    case "unknown":
+      return `exception key file (${file2}) is occupied but cannot be inspected; check the permissions on its directory`;
+  }
+}
 function readFingerprintKey(dataDir2) {
   let raw;
   try {
-    raw = readFileSync(keyFilePath(dataDir2), "utf8");
+    raw = readFileSync2(keyFilePath(dataDir2), "utf8");
   } catch (err) {
     if (err.code === "ENOENT") return null;
     throw err instanceof Error ? err : new Error(String(err));
   }
   return parseKeyFile(raw);
 }
+function loadOrCreateFingerprintKey(dataDir2) {
+  const existing = readFingerprintKey(dataDir2);
+  if (existing) {
+    tightenFile(keyFilePath(dataDir2));
+    return existing;
+  }
+  return createKeyFile(dataDir2, {
+    version: storedKeyVersionFloor(dataDir2) + 1,
+    material: randomBytes(KEY_MATERIAL_BYTES)
+  });
+}
+function fingerprintValue(key, raw) {
+  return createHmac("sha256", key.material).update(raw, "utf8").digest("hex");
+}
 
 // ../../packages/persistence/src/local-layout.ts
 import { renameSync as renameSync3 } from "fs";
 import { mkdir } from "fs/promises";
 import { homedir } from "os";
-import { join as join3 } from "path";
+import { join as join4 } from "path";
 function defaultDataDir() {
-  return join3(homedir(), ".aka");
+  return join4(homedir(), ".aka");
 }
 function settingsDir(base = defaultDataDir()) {
-  return join3(base, "settings");
+  return join4(base, "settings");
 }
 function dataDir(base = defaultDataDir()) {
-  return join3(base, "data");
+  return join4(base, "data");
 }
 function dbPath(base = defaultDataDir()) {
-  return join3(dataDir(base), "aka.db");
+  return join4(dataDir(base), "aka.db");
+}
+function keysDir(base = defaultDataDir()) {
+  return join4(base, "keys");
 }
 function ensureLayoutDirSync(dir = defaultDataDir()) {
   ensureDataDirSync(dir);
@@ -23745,8 +25381,8 @@ function migrateLegacyLayout(base = defaultDataDir()) {
   for (const { name, dest } of moves) {
     try {
       ensureDataDirSync(dest);
-      const moved = join3(dest, name);
-      renameSync3(join3(base, name), moved);
+      const moved = join4(dest, name);
+      renameSync3(join4(base, name), moved);
       tightenFile(moved);
     } catch {
     }
@@ -23754,10 +25390,11 @@ function migrateLegacyLayout(base = defaultDataDir()) {
 }
 
 // ../../packages/persistence/src/settings.ts
-import { readFileSync as readFileSync2 } from "fs";
-import { join as join4 } from "path";
+import { readFileSync as readFileSync3 } from "fs";
+import { join as join5 } from "path";
+var SETTINGS_FILENAME = "settings.json";
 function readWorkspaceSettings(base = defaultDataDir()) {
-  const record2 = readJson(join4(settingsDir(base), "settings.json"));
+  const record2 = readJson(join5(settingsDir(base), SETTINGS_FILENAME));
   if (!record2) return defaultWorkspaceSettings();
   try {
     return WorkspaceSettings.parse(record2);
@@ -23768,23 +25405,898 @@ function readWorkspaceSettings(base = defaultDataDir()) {
 function readJson(file2) {
   let text;
   try {
-    text = readFileSync2(file2, "utf8");
+    text = readFileSync3(file2, "utf8");
   } catch {
     return null;
   }
   return parseJsonObject(text) ?? null;
 }
 
+// ../../packages/persistence/src/vault/crypto.ts
+import {
+  createCipheriv,
+  createDecipheriv,
+  createHmac as createHmac2,
+  hkdfSync,
+  timingSafeEqual
+} from "crypto";
+var POINTER_ID_BYTES = 16;
+var NONCE_BYTES = 12;
+var TAG_BYTES = 10;
+var SUBKEY_BYTES = 32;
+var HKDF_INFO_ENC = "aka:vault:enc:v1";
+var HKDF_INFO_SIGN = "aka:vault:sign:v1";
+var HKDF_SALT = "aka:vault:v1";
+var B32_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
+function base32Encode(bytes) {
+  let out = "";
+  let buffer = 0;
+  let bits = 0;
+  for (const byte of bytes) {
+    buffer = buffer << 8 | byte;
+    bits += 8;
+    while (bits >= 5) {
+      out += B32_ALPHABET.charAt(buffer >>> bits - 5 & 31);
+      bits -= 5;
+    }
+  }
+  if (bits > 0) out += B32_ALPHABET.charAt(buffer << 5 - bits & 31);
+  return out;
+}
+function base32Decode(text) {
+  const out = [];
+  let buffer = 0;
+  let bits = 0;
+  for (const char of text) {
+    const value = B32_ALPHABET.indexOf(char);
+    if (value < 0) throw new Error("base32: character outside the alphabet");
+    buffer = buffer << 5 | value;
+    bits += 5;
+    if (bits >= 8) {
+      out.push(buffer >>> bits - 8 & 255);
+      bits -= 8;
+    }
+  }
+  return Buffer.from(out);
+}
+function encodeKeyVersion(version2) {
+  if (!Number.isInteger(version2) || version2 < 1 || version2 > 4294967295) {
+    throw new Error("vault: key version out of range");
+  }
+  const bytes = [];
+  let remaining = version2;
+  while (remaining > 0) {
+    bytes.unshift(remaining & 255);
+    remaining = Math.floor(remaining / 256);
+  }
+  return base32Encode(Uint8Array.from(bytes));
+}
+function decodeKeyVersion(encoded) {
+  const bytes = base32Decode(encoded);
+  if (bytes.length === 0 || bytes.length > 4) throw new Error("vault: bad key version encoding");
+  let version2 = 0;
+  for (const byte of bytes) version2 = version2 * 256 + byte;
+  if (version2 < 1) throw new Error("vault: bad key version");
+  return version2;
+}
+function deriveSubkeys(master) {
+  const derive = (info) => Buffer.from(hkdfSync("sha256", master, HKDF_SALT, info, SUBKEY_BYTES));
+  return { enc: derive(HKDF_INFO_ENC), sign: derive(HKDF_INFO_SIGN) };
+}
+function bindingInput(keyVersion, pointerId, category, formatVersion = POINTER_FORMAT_VERSION) {
+  if (pointerId.length !== POINTER_ID_BYTES) {
+    throw new Error("vault: pointer id must be 16 bytes");
+  }
+  const head = Buffer.alloc(6);
+  head.writeUInt16BE(formatVersion, 0);
+  head.writeUInt32BE(keyVersion, 2);
+  return Buffer.concat([head, Buffer.from(pointerId), Buffer.from(category, "utf8")]);
+}
+function seal(encKey, plaintext, aad, nonce) {
+  const cipher = createCipheriv("aes-256-gcm", encKey, nonce);
+  cipher.setAAD(aad);
+  const ciphertext = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
+  return { ciphertext, nonce, authTag: cipher.getAuthTag() };
+}
+function open(encKey, sealed, aad) {
+  try {
+    const decipher = createDecipheriv("aes-256-gcm", encKey, sealed.nonce);
+    decipher.setAAD(aad);
+    decipher.setAuthTag(sealed.authTag);
+    return Buffer.concat([decipher.update(sealed.ciphertext), decipher.final()]).toString("utf8");
+  } catch {
+    return null;
+  }
+}
+function signPointer(signKey, keyVersion, pointerId, category) {
+  return createHmac2("sha256", signKey).update(bindingInput(keyVersion, pointerId, category, POINTER_FORMAT_VERSION)).digest().subarray(0, TAG_BYTES);
+}
+function verifyPointerTag(signKey, keyVersion, pointerId, category, tag) {
+  if (tag.length !== TAG_BYTES) return false;
+  const expected = signPointer(signKey, keyVersion, pointerId, category);
+  return timingSafeEqual(expected, Buffer.from(tag));
+}
+function formatPointer(category, keyVersion, pointerId, tag) {
+  return `[[aka:${category}:${encodeKeyVersion(keyVersion)}.${base32Encode(pointerId)}.${base32Encode(tag)}]]`;
+}
+
+// ../../packages/persistence/src/vault/key-provider.ts
+import { execFileSync } from "child_process";
+import { randomBytes as randomBytes2 } from "crypto";
+import {
+  chmodSync as chmodSync2,
+  mkdirSync as mkdirSync2,
+  readFileSync as readFileSync4,
+  renameSync as renameSync4,
+  rmSync as rmSync4,
+  statSync as statSync3,
+  writeFileSync as writeFileSync3
+} from "fs";
+import { join as join6 } from "path";
+var VAULT_OCCUPANT_REASON = {
+  symlink: "the path is a symlink; remove it so a keyring can be created",
+  gone: "the path was occupied but holds no keyring (removed while it was being created)",
+  unknown: "the path is occupied but cannot be inspected; check the permissions on its directory"
+};
+var VaultKeyEpochMissingError = class extends Error {
+  version;
+  constructor(version2) {
+    super(`vault: key epoch ${String(version2)} is not present in the keyring`);
+    this.name = "VaultKeyEpochMissingError";
+    this.version = version2;
+  }
+};
+var VAULT_KEY_FILENAME = "vault.key";
+var KEY_MATERIAL_BYTES2 = 32;
+var KEYCHAIN_SERVICE = "aka-vault";
+var KEYCHAIN_ACCOUNT = "keyring";
+function parseKeyring(raw) {
+  const parsed = JSON.parse(raw);
+  if (typeof parsed !== "object" || parsed === null) {
+    throw new Error("vault key file is corrupt: not a JSON object");
+  }
+  const { current, keys } = parsed;
+  if (typeof current !== "number" || !Number.isInteger(current) || current < 1) {
+    throw new Error("vault key file is corrupt: bad current version");
+  }
+  if (typeof keys !== "object" || keys === null || Array.isArray(keys)) {
+    throw new Error("vault key file is corrupt: bad keys map");
+  }
+  const map2 = /* @__PURE__ */ new Map();
+  for (const [rawVersion, rawMaterial] of Object.entries(keys)) {
+    const version2 = Number(rawVersion);
+    if (!Number.isInteger(version2) || version2 < 1) {
+      throw new Error("vault key file is corrupt: bad key version");
+    }
+    if (typeof rawMaterial !== "string") {
+      throw new Error("vault key file is corrupt: bad key material");
+    }
+    const bytes = Buffer.from(rawMaterial, "base64");
+    if (bytes.length !== KEY_MATERIAL_BYTES2) {
+      throw new Error("vault key file is corrupt: bad key material length");
+    }
+    map2.set(version2, bytes);
+  }
+  if (!map2.has(current)) {
+    throw new Error("vault key file is corrupt: current version has no material");
+  }
+  return { current, keys: map2 };
+}
+function serializeKeyring(keyring) {
+  const keys = {};
+  for (const version2 of [...keyring.keys.keys()].sort((a, b) => a - b)) {
+    const material = keyring.keys.get(version2);
+    if (material) keys[String(version2)] = material.toString("base64");
+  }
+  return JSON.stringify({ current: keyring.current, keys });
+}
+function mintKeyring() {
+  return { current: 1, keys: /* @__PURE__ */ new Map([[1, randomBytes2(KEY_MATERIAL_BYTES2)]]) };
+}
+function withNextEpoch(keyring) {
+  const next = Math.max(...keyring.keys.keys()) + 1;
+  const keys = new Map(keyring.keys);
+  keys.set(next, randomBytes2(KEY_MATERIAL_BYTES2));
+  return { current: next, keys };
+}
+function currentOf(keyring) {
+  const material = keyring.keys.get(keyring.current);
+  if (!material) throw new VaultKeyEpochMissingError(keyring.current);
+  return { material, version: keyring.current };
+}
+function epochOf(keyring, version2) {
+  const material = keyring.keys.get(version2);
+  if (!material) throw new VaultKeyEpochMissingError(version2);
+  return { material, version: version2 };
+}
+function asAsync(work) {
+  try {
+    return Promise.resolve(work());
+  } catch (err) {
+    return Promise.reject(err instanceof Error ? err : new Error(String(err)));
+  }
+}
+function asError(err) {
+  return err instanceof Error ? err : new Error(String(err));
+}
+var ROTATION_LOCK_STALE_MS = 6e4;
+var LOCK_OWNER_FILE = "owner";
+var ROTATION_IN_PROGRESS = "vault: a key rotation is already in progress";
+function claimRotationLock(lock, owner) {
+  try {
+    mkdirSync2(lock);
+  } catch (err) {
+    if (err.code === "EEXIST") return false;
+    throw asError(err);
+  }
+  try {
+    writeFileSync3(join6(lock, LOCK_OWNER_FILE), `${owner}
+`, { mode: DATA_FILE_MODE });
+    return true;
+  } catch (err) {
+    rmSync4(lock, { recursive: true, force: true });
+    throw asError(err);
+  }
+}
+function acquireRotationLock(keysDir2) {
+  const lock = join6(keysDir2, `${VAULT_KEY_FILENAME}.lock`);
+  const owner = randomBytes2(16).toString("hex");
+  if (claimRotationLock(lock, owner)) return { lock, owner };
+  let held;
+  try {
+    held = statSync3(lock);
+  } catch {
+    throw new Error(ROTATION_IN_PROGRESS);
+  }
+  if (Date.now() - held.mtimeMs < ROTATION_LOCK_STALE_MS) throw new Error(ROTATION_IN_PROGRESS);
+  const aside = `${lock}.stale.${owner}`;
+  try {
+    const now = statSync3(lock);
+    if (now.ino !== held.ino || now.mtimeMs !== held.mtimeMs) {
+      throw new Error(ROTATION_IN_PROGRESS);
+    }
+    renameSync4(lock, aside);
+  } catch (err) {
+    if (err instanceof Error && err.message === ROTATION_IN_PROGRESS) throw err;
+    throw new Error(ROTATION_IN_PROGRESS, { cause: err });
+  }
+  rmSync4(aside, { recursive: true, force: true });
+  if (!claimRotationLock(lock, owner)) throw new Error(ROTATION_IN_PROGRESS);
+  return { lock, owner };
+}
+function releaseRotationLock(lease) {
+  try {
+    if (readFileSync4(join6(lease.lock, LOCK_OWNER_FILE), "utf8").trim() !== lease.owner) return;
+  } catch {
+    return;
+  }
+  rmSync4(lease.lock, { recursive: true, force: true });
+}
+function withRotationLock(keysDir2, work) {
+  ensureDataDirSync(keysDir2);
+  const lease = acquireRotationLock(keysDir2);
+  try {
+    return work();
+  } finally {
+    releaseRotationLock(lease);
+  }
+}
+var FileKeyProvider = class {
+  #keysDir;
+  constructor(keysDir2) {
+    this.#keysDir = keysDir2;
+  }
+  get filePath() {
+    return join6(this.#keysDir, VAULT_KEY_FILENAME);
+  }
+  loadOrCreate() {
+    return asAsync(() => {
+      const existing = this.#read();
+      if (!existing) return currentOf(this.#createExclusive());
+      tightenFileMode(this.filePath);
+      return currentOf(existing);
+    });
+  }
+  rotate() {
+    return asAsync(
+      () => withRotationLock(this.#keysDir, () => {
+        const existing = this.#read();
+        if (!existing) return currentOf(this.#createExclusive());
+        return currentOf(this.#write(withNextEpoch(existing)));
+      })
+    );
+  }
+  materialFor(version2) {
+    return asAsync(() => {
+      const existing = this.#read();
+      if (!existing) throw new VaultKeyEpochMissingError(version2);
+      return epochOf(existing, version2);
+    });
+  }
+  /** The keyring, or null when the file is ABSENT. A corrupt file throws. */
+  #read() {
+    let raw;
+    try {
+      raw = readFileSync4(this.filePath, "utf8");
+    } catch (err) {
+      if (err.code === "ENOENT") return null;
+      throw err instanceof Error ? err : new Error(String(err));
+    }
+    return parseKeyring(raw);
+  }
+  /**
+   * First mint: the keyring is CREATED, never replaced, so two processes racing
+   * a fresh machine cannot each mint a different epoch 1 — with tmp + rename
+   * the loser's replace would orphan everything the winner had already sealed.
+   * The loser re-reads and adopts the winner's keyring; it minted nothing.
+   *
+   * `createOwnerOnlyFileSync` publishes by link rather than by an exclusive open
+   * at the final path, so the keyring never exists at zero length: a reader —
+   * including the loser, re-reading in order to adopt — sees the file absent or
+   * whole, and never mistakes a live keyring for a corrupt one. A corrupt file
+   * still throws from the parse and is never re-minted over.
+   */
+  #createExclusive() {
+    ensureDataDirSync(this.#keysDir);
+    const keyring = mintKeyring();
+    if (createOwnerOnlyFileSync(this.filePath, `${serializeKeyring(keyring)}
+`)) return keyring;
+    const winner = this.#read();
+    if (!winner) {
+      const occupant = classifyOccupant(this.filePath);
+      throw new KeyUnclaimableError(
+        `vault: cannot create a key file at ${this.filePath} \u2014 ${VAULT_OCCUPANT_REASON[occupant.kind]}`,
+        occupant.cause
+      );
+    }
+    tightenFileMode(this.filePath);
+    return winner;
+  }
+  /**
+   * Atomic tmp + rename so a crash mid-write cannot truncate the keyring.
+   * Used only for rotation, under the rotation lock — first creation goes
+   * through the creation-exclusive path instead.
+   */
+  #write(keyring) {
+    ensureDataDirSync(this.#keysDir);
+    const file2 = this.filePath;
+    const tmp = `${file2}.tmp`;
+    writeFileSync3(tmp, `${serializeKeyring(keyring)}
+`, { mode: DATA_FILE_MODE });
+    renameSync4(tmp, file2);
+    tightenFileMode(file2);
+    return keyring;
+  }
+};
+function tightenFileMode(file2) {
+  try {
+    chmodSync2(file2, DATA_FILE_MODE);
+  } catch {
+  }
+}
+var runSecurity = (args) => execFileSync("/usr/bin/security", args, {
+  encoding: "utf8",
+  stdio: ["ignore", "pipe", "ignore"]
+});
+var SECURITY_ITEM_NOT_FOUND = 44;
+var KeychainKeyProvider = class {
+  #keysDir;
+  #exec;
+  constructor(keysDir2, exec = runSecurity) {
+    if (exec === runSecurity && process.platform !== "darwin") {
+      throw new Error(
+        `keychain custody is not available on this platform (${process.platform}); use file custody`
+      );
+    }
+    this.#keysDir = keysDir2;
+    this.#exec = exec;
+  }
+  /** Where a fallback file provider for the same vault would keep its keyring. */
+  get keysDir() {
+    return this.#keysDir;
+  }
+  loadOrCreate() {
+    return asAsync(() => {
+      const existing = this.#read();
+      if (existing) return currentOf(existing);
+      return currentOf(this.#create(mintKeyring()));
+    });
+  }
+  rotate() {
+    return asAsync(
+      () => withRotationLock(this.#keysDir, () => {
+        const existing = this.#read();
+        if (!existing) return currentOf(this.#create(mintKeyring()));
+        return currentOf(this.#replace(withNextEpoch(existing)));
+      })
+    );
+  }
+  materialFor(version2) {
+    return asAsync(() => {
+      const existing = this.#read();
+      if (!existing) throw new VaultKeyEpochMissingError(version2);
+      return epochOf(existing, version2);
+    });
+  }
+  /** The keyring, or null when no item exists yet. A corrupt item throws. */
+  #read() {
+    let raw;
+    try {
+      raw = this.#exec([
+        "find-generic-password",
+        "-s",
+        KEYCHAIN_SERVICE,
+        "-a",
+        KEYCHAIN_ACCOUNT,
+        "-w"
+      ]);
+    } catch (err) {
+      if (err.status === SECURITY_ITEM_NOT_FOUND) return null;
+      throw new Error(
+        `vault: keychain read failed (${err instanceof Error ? err.message : String(err)}); refusing to treat the failure as an absent keyring`,
+        { cause: err }
+      );
+    }
+    const body = raw.trim();
+    if (body.length === 0) return null;
+    return parseKeyring(body);
+  }
+  /**
+   * First mint: a plain `add-generic-password` (no `-U`) fails when an item
+   * already exists, so a concurrent first mint cannot overwrite the winner's
+   * keyring — the loser re-reads and adopts it instead.
+   */
+  #create(keyring) {
+    const args = [
+      "add-generic-password",
+      "-s",
+      KEYCHAIN_SERVICE,
+      "-a",
+      KEYCHAIN_ACCOUNT,
+      "-w",
+      serializeKeyring(keyring)
+    ];
+    try {
+      this.#exec(args);
+    } catch (err) {
+      const winner = this.#read();
+      if (winner) return winner;
+      throw asError(err);
+    }
+    return keyring;
+  }
+  // `-U` updates the item in place, deliberately replacing the stored map with
+  // one that contains it — used only for rotation, under the rotation lock.
+  #replace(keyring) {
+    this.#exec([
+      "add-generic-password",
+      "-U",
+      "-s",
+      KEYCHAIN_SERVICE,
+      "-a",
+      KEYCHAIN_ACCOUNT,
+      "-w",
+      serializeKeyring(keyring)
+    ]);
+    return keyring;
+  }
+};
+function createKeyProvider(custody, keysDir2) {
+  if (custody === "keychain") return new KeychainKeyProvider(keysDir2);
+  return new FileKeyProvider(keysDir2);
+}
+
+// ../../packages/persistence/src/vault/vault.ts
+import { randomBytes as randomBytes3, randomUUID as randomUUID12 } from "crypto";
+var CONSENT_ABSENT = /* @__PURE__ */ Symbol("aka.vault.consentAbsent");
+var UNAVAILABLE = /* @__PURE__ */ Symbol("aka.vault.unavailable");
+var VAULT_PURGE_POINTER_ID = "*";
+function parsePointer(token) {
+  if (!POINTER_TOKEN_ANCHORED.test(token)) return null;
+  const body = token.slice("[[aka:".length, -"]]".length);
+  const colon = body.indexOf(":");
+  if (colon < 0) return null;
+  const category = body.slice(0, colon);
+  const [kv, id, tag] = body.slice(colon + 1).split(".");
+  if (kv === void 0 || id === void 0 || tag === void 0) return null;
+  try {
+    const keyVersion = decodeKeyVersion(kv);
+    const pointerId = base32Decode(id);
+    const tagBytes = base32Decode(tag);
+    if (encodeKeyVersion(keyVersion) !== kv || base32Encode(pointerId) !== id || base32Encode(tagBytes) !== tag) {
+      return null;
+    }
+    return { category, keyVersion, pointerId, tag: tagBytes };
+  } catch {
+    return null;
+  }
+}
+var SecretVault = class {
+  #repo;
+  #keys;
+  #isConsented;
+  #verifyGrant;
+  #now;
+  constructor(deps) {
+    this.#repo = deps.repo;
+    this.#keys = deps.keys;
+    this.#isConsented = deps.isConsented;
+    this.#verifyGrant = deps.verifyGrant;
+    this.#now = deps.now ?? (() => Date.now());
+  }
+  /**
+   * Store a value and return the pointer that stands for it. The same value
+   * always yields the same pointer on this machine — one row, one pointer id,
+   * one category — which is what makes dedup and reuse counting work.
+   *
+   * `fingerprintKey` is the exception-key epoch this value's fingerprint is
+   * derived under — a different key from the vault's, with different rotation
+   * semantics. It is a parameter of the WRITE rather than a constructor dep,
+   * and a thunk rather than a value, so that the only way to reach a key is to
+   * store something: a read-only caller never names it, and a caller whose
+   * source mints on absence mints only once consent has actually opened the
+   * write. `refreshFingerprints` takes its key the same way, for the same
+   * reason.
+   *
+   * Resolved once per call, so the fingerprint and the version it is recorded
+   * under can never come from two different epochs.
+   */
+  async tokenize(raw, meta3, fingerprintKey) {
+    if (!this.#isConsented()) return CONSENT_ABSENT;
+    const fpKey = fingerprintKey();
+    const valueFingerprint = fingerprintValue(fpKey, raw);
+    const existing = this.#repo.byValueFingerprint(valueFingerprint);
+    const now = this.#now();
+    if (existing) {
+      this.#repo.upsert({ ...existing, provider: existing.provider ?? void 0 }, now);
+      return await this.#emitToken(existing.keyVersion, existing.pointerId, existing.category);
+    }
+    const { material, version: version2 } = await this.#keys.loadOrCreate();
+    const subkeys = deriveSubkeys(material);
+    const pointerId = randomBytes3(POINTER_ID_BYTES);
+    const aad = bindingInput(version2, pointerId, meta3.category, POINTER_FORMAT_VERSION);
+    const sealed = seal(subkeys.enc, raw, aad, randomBytes3(NONCE_BYTES));
+    const { row } = this.#repo.upsert(
+      {
+        pointerId: base32Encode(pointerId),
+        valueFingerprint,
+        fingerprintKeyVersion: fpKey.version,
+        keyVersion: version2,
+        // Recorded so the row stays OPENABLE if the wire-format constant ever
+        // moves: it is part of this row's AEAD AAD. It is not a tag input —
+        // tags are pinned to the constant on both sides.
+        formatVersion: POINTER_FORMAT_VERSION,
+        category: meta3.category,
+        ruleId: meta3.ruleId,
+        maskedMatch: meta3.maskedMatch,
+        provider: meta3.provider,
+        ciphertext: sealed.ciphertext.toString("base64"),
+        nonce: sealed.nonce.toString("base64"),
+        authTag: sealed.authTag.toString("base64")
+      },
+      now
+    );
+    return await this.#emitToken(row.keyVersion, row.pointerId, row.category);
+  }
+  /**
+   * Resolve a pointer back to its value, for a human or (with a grant) for the
+   * model. Every call that gets as far as an identified row writes an audit row.
+   */
+  async detokenize(token, opts) {
+    const parsed = parsePointer(token);
+    if (!parsed) return UNAVAILABLE;
+    let signKey;
+    try {
+      const epoch = await this.#keys.materialFor(parsed.keyVersion);
+      signKey = deriveSubkeys(epoch.material).sign;
+    } catch {
+      return UNAVAILABLE;
+    }
+    if (!verifyPointerTag(signKey, parsed.keyVersion, parsed.pointerId, parsed.category, parsed.tag)) {
+      return UNAVAILABLE;
+    }
+    const pointerId = base32Encode(parsed.pointerId);
+    const row = this.#repo.byPointerId(pointerId);
+    if (!row) {
+      this.#audit(pointerId, opts, "unavailable");
+      return UNAVAILABLE;
+    }
+    if (row.category !== parsed.category) return UNAVAILABLE;
+    if (opts.target === "model") {
+      const grantId = opts.grantId;
+      const verify = this.#verifyGrant;
+      if (verify === void 0 || grantId === void 0 || grantId === "") {
+        this.#audit(pointerId, opts, "refused");
+        return UNAVAILABLE;
+      }
+      let covered;
+      try {
+        covered = await verify(grantId, {
+          ruleId: row.ruleId,
+          valueFingerprint: row.valueFingerprint,
+          fingerprintKeyVersion: row.fingerprintKeyVersion
+        });
+      } catch {
+        covered = false;
+      }
+      if (!covered) {
+        this.#audit(pointerId, opts, "refused");
+        return UNAVAILABLE;
+      }
+    }
+    let raw;
+    try {
+      const epoch = await this.#keys.materialFor(row.keyVersion);
+      raw = open(
+        deriveSubkeys(epoch.material).enc,
+        {
+          ciphertext: Buffer.from(row.ciphertext, "base64"),
+          nonce: Buffer.from(row.nonce, "base64"),
+          authTag: Buffer.from(row.authTag, "base64")
+        },
+        // Sealed under the ROW's epoch and format version. Rotation may have
+        // moved the epoch past the one this token names, and a format bump may
+        // have moved the constant past the generation this row was sealed
+        // under — the AAD follows the row in both cases, never the token.
+        bindingInput(row.keyVersion, parsed.pointerId, row.category, row.formatVersion)
+      );
+    } catch {
+      raw = null;
+    }
+    if (raw === null) {
+      this.#audit(pointerId, opts, "unavailable");
+      return UNAVAILABLE;
+    }
+    this.#audit(pointerId, opts, "revealed");
+    return raw;
+  }
+  /**
+   * Owner-surface reveal by row id: the dashboard shows a row the owner can
+   * already see and asks for its value. There is no wire token here to verify —
+   * the tag exists to stop FORGED tokens arriving in untrusted text, and a row
+   * id selected server-side from the owner's own store is not that — so this
+   * loads the row directly, opens its ciphertext under the row's epoch, and
+   * audits exactly like a human-target de-reference. Never callable with
+   * target 'model': the wire-token path with its grant gate is the only road
+   * raw travels toward the model.
+   */
+  async revealEntry(pointerId, opts) {
+    const row = this.#repo.byPointerId(pointerId);
+    if (!row) {
+      this.#audit(pointerId, { target: "human", reason: opts.reason }, "unavailable");
+      return UNAVAILABLE;
+    }
+    const raw = await this.#openRow(row);
+    if (raw === null) {
+      this.#audit(pointerId, { target: "human", reason: opts.reason }, "unavailable");
+      return UNAVAILABLE;
+    }
+    this.#audit(pointerId, { target: "human", reason: opts.reason }, "revealed");
+    return raw;
+  }
+  /** Badge and listing data. No raw value, no fingerprint, and no audit row. */
+  async describePointer(token) {
+    const row = await this.#rowFor(token);
+    if (!row) return null;
+    return {
+      category: row.category,
+      ...row.provider === void 0 ? {} : { provider: row.provider },
+      maskedMatch: row.maskedMatch,
+      occurrences: row.occurrenceCount,
+      firstSeen: new Date(row.firstSeen).toISOString(),
+      lastSeen: new Date(row.lastSeen).toISOString()
+    };
+  }
+  /**
+   * The raw-free row identity a reveal grant matches on. Deliberately not fed to
+   * view surfaces: the keyed fingerprint is a correlation key and must not reach
+   * a presentation layer.
+   */
+  async resolvePointerIdentity(token) {
+    const row = await this.#rowFor(token);
+    if (!row) return null;
+    return {
+      ruleId: row.ruleId,
+      valueFingerprint: row.valueFingerprint,
+      fingerprintKeyVersion: row.fingerprintKeyVersion
+    };
+  }
+  /**
+   * Mint the next vault key epoch and re-encrypt every entry under it. Pointers
+   * already emitted keep verifying: their tag is checked against the historical
+   * epoch they name, which the key provider retains.
+   *
+   * Safe to interrupt — each row carries the epoch its ciphertext is sealed
+   * under, so a half-finished pass leaves every row openable.
+   *
+   * The rotation lock covers only the keyring mint inside `rotate()`; the
+   * re-seal pass below runs unlocked. Two concurrent rotations therefore
+   * serialize on the keyring but interleave over the rows, so a slower pass can
+   * re-seal a row back to an epoch a faster one already moved past, and
+   * `reEncrypted` can double-count. No value is lost either way — every epoch is
+   * retained and every row stays openable — but "after rotation every row sits
+   * at the newest epoch" does not hold under concurrency. Holding the lock
+   * across the whole pass requires an async-aware lock, since a callback that
+   * awaits would release the lock at its first suspension.
+   */
+  async rotateVaultKey() {
+    const next = await this.#keys.rotate();
+    const nextEnc = deriveSubkeys(next.material).enc;
+    let reEncrypted = 0;
+    for (const row of this.#repo.listAll()) {
+      if (row.keyVersion === next.version) continue;
+      const pointerId = base32Decode(row.pointerId);
+      let raw;
+      try {
+        const epoch = await this.#keys.materialFor(row.keyVersion);
+        raw = open(
+          deriveSubkeys(epoch.material).enc,
+          {
+            ciphertext: Buffer.from(row.ciphertext, "base64"),
+            nonce: Buffer.from(row.nonce, "base64"),
+            authTag: Buffer.from(row.authTag, "base64")
+          },
+          bindingInput(row.keyVersion, pointerId, row.category, row.formatVersion)
+        );
+      } catch {
+        raw = null;
+      }
+      if (raw === null) continue;
+      const sealed = seal(
+        nextEnc,
+        raw,
+        bindingInput(next.version, pointerId, row.category, row.formatVersion),
+        randomBytes3(NONCE_BYTES)
+      );
+      this.#repo.replaceCiphertext(row.pointerId, {
+        keyVersion: next.version,
+        ciphertext: sealed.ciphertext.toString("base64"),
+        nonce: sealed.nonce.toString("base64"),
+        authTag: sealed.authTag.toString("base64")
+      });
+      reEncrypted += 1;
+    }
+    return { version: next.version, reEncrypted };
+  }
+  /**
+   * Re-key every entry's value fingerprint after the exception key rotates,
+   * PRESERVING each pointer id. Unlike grants — where rotation is invalidation,
+   * because the raw values are gone — the vault still holds the values, so
+   * determinism, dedup, and every outstanding pointer survive the rotation.
+   *
+   * Every fingerprint-key rotation must run this: a row left at the old epoch
+   * still resolves, but the same value detected again fingerprints under the
+   * NEW key, misses the dedup lookup, and mints a second row and a second
+   * pointer — one value, two tokens in circulation.
+   *
+   * Per-row best-effort: a row that cannot open, or whose refreshed
+   * fingerprint collides with a row already refreshed, is skipped rather than
+   * aborting the pass — one damaged entry must not strand the re-key of every
+   * other. A skipped row keeps resolving under its old fingerprint epoch.
+   */
+  async refreshFingerprints(next) {
+    let refreshed = 0;
+    for (const row of this.#repo.listAll()) {
+      try {
+        const raw = await this.#openRow(row);
+        if (raw === null) continue;
+        this.#repo.refreshFingerprint(row.pointerId, {
+          valueFingerprint: fingerprintValue(next, raw),
+          fingerprintKeyVersion: next.version
+        });
+        refreshed += 1;
+      } catch {
+        continue;
+      }
+    }
+    return refreshed;
+  }
+  /**
+   * Destroy every entry, making all outstanding pointers permanently
+   * unresolvable.
+   *
+   * The count comes from `purgeAll` rather than a separate `countEntries` —
+   * `purgeAll` counts inside the same transaction that deletes, so the audit row
+   * reports what was actually destroyed. Counting beforehand would let a
+   * concurrent write land between the two statements and put a number in the
+   * durable record that never matched reality.
+   */
+  purgeVault() {
+    const destroyed = this.#repo.purgeAll();
+    this.#repo.recordDeref({
+      id: randomUUID12(),
+      pointerId: VAULT_PURGE_POINTER_ID,
+      at: this.#now(),
+      target: "human",
+      reason: "purge",
+      outcome: "unavailable",
+      pointerCount: Math.max(destroyed, 1)
+    });
+    return destroyed;
+  }
+  // Sign under the epoch the token names — which for a re-detected value is the
+  // epoch its row currently sits at rather than whatever is current.
+  //
+  // The row's format version is NOT a tag input. It binds the row's ciphertext
+  // (it is part of the AEAD AAD, so an old row stays openable) but never the
+  // wire tag, which verification checks against POINTER_FORMAT_VERSION without
+  // knowing any row. Signing a token here under a row's own generation is what
+  // would make the vault emit tokens it then refuses.
+  async #emitToken(keyVersion, pointerIdB32, category) {
+    const pointerId = base32Decode(pointerIdB32);
+    const epoch = await this.#keys.materialFor(keyVersion);
+    const signKey = deriveSubkeys(epoch.material).sign;
+    return formatPointer(
+      category,
+      keyVersion,
+      pointerId,
+      signPointer(signKey, keyVersion, pointerId, category)
+    );
+  }
+  async #openRow(row) {
+    try {
+      const epoch = await this.#keys.materialFor(row.keyVersion);
+      return open(
+        deriveSubkeys(epoch.material).enc,
+        {
+          ciphertext: Buffer.from(row.ciphertext, "base64"),
+          nonce: Buffer.from(row.nonce, "base64"),
+          authTag: Buffer.from(row.authTag, "base64")
+        },
+        bindingInput(row.keyVersion, base32Decode(row.pointerId), row.category, row.formatVersion)
+      );
+    } catch {
+      return null;
+    }
+  }
+  // Shared lookup for the read-only surfaces. It verifies the tag exactly as
+  // detokenize does: a descriptor is not raw, but a token nobody can vouch for
+  // should not resolve to anything at all — otherwise a fabricated pointer, or a
+  // lookalike planted in a file, would still yield a category and a masked
+  // preview. Verifying needs the historical epoch's key, which is why these
+  // surfaces are async.
+  async #rowFor(token) {
+    const parsed = parsePointer(token);
+    if (!parsed) return null;
+    try {
+      const epoch = await this.#keys.materialFor(parsed.keyVersion);
+      const signKey = deriveSubkeys(epoch.material).sign;
+      if (!verifyPointerTag(signKey, parsed.keyVersion, parsed.pointerId, parsed.category, parsed.tag)) {
+        return null;
+      }
+    } catch {
+      return null;
+    }
+    const row = this.#repo.byPointerId(base32Encode(parsed.pointerId));
+    if (row?.category !== parsed.category) return null;
+    return row;
+  }
+  #audit(pointerId, opts, outcome) {
+    this.#repo.recordDeref({
+      id: randomUUID12(),
+      pointerId,
+      at: this.#now(),
+      target: opts.target,
+      reason: opts.reason,
+      outcome,
+      ...opts.grantId === void 0 ? {} : { grantId: opts.grantId },
+      // Only the batched reasons carry a count above one; a model crossing is
+      // always its own row.
+      pointerCount: isBatchedDerefReason(opts.reason) ? opts.pointerCount ?? 1 : 1
+    });
+  }
+};
+
 // ../../packages/persistence/src/warn-era-cap.ts
-import { existsSync as existsSync3, writeFileSync as writeFileSync2 } from "fs";
-import { join as join5 } from "path";
+import { existsSync as existsSync4, writeFileSync as writeFileSync4 } from "fs";
+import { join as join7 } from "path";
 var MARKER = "warn-era-capped";
 function capWarnEraEnforcementOnce(db, policyMode, dataDir2) {
   if (policyMode !== "warn") return { capped: 0, skipped: "not-warn" };
-  const marker = join5(dataDir2, MARKER);
-  if (existsSync3(marker)) return { capped: 0, skipped: "already-run" };
+  const marker = join7(dataDir2, MARKER);
+  if (existsSync4(marker)) return { capped: 0, skipped: "already-run" };
   const capped = db.policies.capCategoryActions();
-  writeFileSync2(marker, `${new Date(Date.now()).toISOString()}
+  writeFileSync4(marker, `${new Date(Date.now()).toISOString()}
 `, { mode: DATA_FILE_MODE });
   return { capped };
 }
@@ -23848,11 +26360,11 @@ function providerFromModelId(modelId) {
 }
 
 // ../../packages/plugin-sdk/src/config.ts
-function loadConfig(base = defaultDataDir()) {
+function loadConfig(base = defaultDataDir(), resolveProviderFn = resolveProvider) {
   try {
     ensureLayoutDirSync(base);
-    const settingsFile = join6(settingsDir(base), "settings.json");
-    if (existsSync4(settingsFile)) tightenFile(settingsFile);
+    const settingsFile = join8(settingsDir(base), "settings.json");
+    if (existsSync5(settingsFile)) tightenFile(settingsFile);
   } catch {
   }
   migrateLegacyLayout(base);
@@ -23863,21 +26375,21 @@ function loadConfig(base = defaultDataDir()) {
     dbPath: dbPath(base),
     settingsDir: settingsDir(base),
     onboarded: settings.onboardedAt != null,
-    provider: resolveProviderSafe()
+    provider: resolveProviderSafe(resolveProviderFn)
   };
 }
-function resolveProviderSafe() {
+function resolveProviderSafe(resolveProviderFn) {
   try {
-    return resolveProvider();
+    return resolveProviderFn();
   } catch {
     return { provider: "anthropic" };
   }
 }
 
 // ../../packages/plugin-sdk/src/config-inventory.ts
-import { readdirSync, readFileSync as readFileSync4, realpathSync, statSync as statSync2 } from "fs";
+import { readdirSync as readdirSync2, readFileSync as readFileSync6, realpathSync, statSync as statSync5 } from "fs";
 import { homedir as homedir2 } from "os";
-import { basename as basename2, join as join8 } from "path";
+import { basename as basename3, join as join10 } from "path";
 
 // ../../packages/detections/src/egress/registry.ts
 var EXTRACTOR_VERSION = "1";
@@ -24665,12 +27177,12 @@ function redact(text, findings) {
   const regions = [];
   for (const f of sorted) {
     const rank = SEVERITY_RANK2[f.severity];
-    const open = regions[regions.length - 1];
-    if (open && f.span.start < open.end) {
-      open.end = Math.max(open.end, f.span.end);
-      if (rank > open.rank) {
-        open.rank = rank;
-        open.category = f.category;
+    const open2 = regions[regions.length - 1];
+    if (open2 && f.span.start < open2.end) {
+      open2.end = Math.max(open2.end, f.span.end);
+      if (rank > open2.rank) {
+        open2.rank = rank;
+        open2.category = f.category;
       }
     } else {
       regions.push({ start: f.span.start, end: f.span.end, category: f.category, rank });
@@ -24699,6 +27211,24 @@ function maskMatch(raw) {
   return `${raw.charAt(0)}${"*".repeat(6)}${raw.charAt(raw.length - 1)}`;
 }
 
+// ../../packages/detections/src/pointer-shield.ts
+function shieldPointers(text) {
+  const spans = [];
+  let out = null;
+  for (const match of text.matchAll(pointerTokenScanner())) {
+    spans.push({ start: match.index, end: match.index + match[0].length });
+    out ??= text;
+    out = out.slice(0, match.index) + " ".repeat(match[0].length) + out.slice(match.index + match[0].length);
+  }
+  return { text: out ?? text, spans };
+}
+function dropShieldedFindings(findings, spans) {
+  if (spans.length === 0) return findings;
+  return findings.filter(
+    (finding) => !spans.some((s) => finding.span.start < s.end && finding.span.end > s.start)
+  );
+}
+
 // ../../packages/detections/src/posture/config-posture.ts
 var RULE_VERSION = "1";
 var KNOWN_TOOLS = /* @__PURE__ */ new Set([
@@ -26435,7 +28965,7 @@ var gcp_service_account_default = {
   severity: "critical",
   matcher: {
     type: "regex",
-    pattern: "\\b[a-z0-9][a-z0-9-]{2,60}@[a-z0-9][a-z0-9-]{2,60}\\.iam\\.gserviceaccount\\.com\\b",
+    pattern: "(?<![a-z0-9-])[a-z0-9-]{3,}@[a-z0-9][a-z0-9-]{2,60}\\.iam\\.gserviceaccount\\.com\\b",
     flags: "g"
   },
   examples: [
@@ -26832,7 +29362,8 @@ function scanText(text, ruleVersions) {
   if (!ensureBundledPacks()) return { masked: "[REDACTED]", findings: [] };
   try {
     const rules = getLoadedRules();
-    const matches = scan(text, rules);
+    const shielded = shieldPointers(text);
+    const matches = dropShieldedFindings(scan(shielded.text, rules), shielded.spans);
     if (matches.length === 0) return { masked: text, findings: [] };
     const byId = new Map(rules.map((r) => [r.id, r]));
     const findings = matches.map((m) => {
@@ -26855,8 +29386,8 @@ function scanText(text, ruleVersions) {
 }
 
 // ../../packages/plugin-sdk/src/repo.ts
-import { existsSync as existsSync5, readFileSync as readFileSync3, statSync } from "fs";
-import { basename, dirname, isAbsolute, join as join7, sep as sep2 } from "path";
+import { existsSync as existsSync6, readFileSync as readFileSync5, statSync as statSync4 } from "fs";
+import { basename as basename2, dirname as dirname2, isAbsolute, join as join9, sep as sep2 } from "path";
 function resolveRepoIdentity(cwd) {
   try {
     const root = findGitRoot(cwd);
@@ -26869,7 +29400,7 @@ function resolveRepoIdentity(cwd) {
       // win32) so the persistence layer's `/`-separated checkout-path patterns
       // (the ghost sweep + the read-side worktree filter) match it as written.
       url: url2 ?? headRoot.split(sep2).join("/"),
-      name: (url2 ? slugFromUrl(url2) : void 0) ?? basename(headRoot)
+      name: (url2 ? slugFromUrl(url2) : void 0) ?? basename2(headRoot)
     };
   } catch {
     return void 0;
@@ -26889,36 +29420,36 @@ function resolveRepoNwo(cwd) {
 function findGitRoot(start) {
   let dir = start;
   for (; ; ) {
-    if (existsSync5(join7(dir, ".git"))) return dir;
-    const parent = dirname(dir);
+    if (existsSync6(join9(dir, ".git"))) return dir;
+    const parent = dirname2(dir);
     if (parent === dir) return void 0;
     dir = parent;
   }
 }
 function resolveGitContext(root) {
-  const dotGit = join7(root, ".git");
+  const dotGit = join9(root, ".git");
   try {
-    if (statSync(dotGit).isDirectory()) {
-      return { configPath: join7(dotGit, "config"), headRoot: root };
+    if (statSync4(dotGit).isDirectory()) {
+      return { configPath: join9(dotGit, "config"), headRoot: root };
     }
   } catch {
     return void 0;
   }
   const target = /^gitdir:\s*(.+?)\s*$/m.exec(safeRead(dotGit) ?? "")?.[1];
   if (!target) return void 0;
-  const gitdir = isAbsolute(target) ? target : join7(root, target);
-  if (existsSync5(join7(gitdir, "config"))) {
-    return { configPath: join7(gitdir, "config"), headRoot: root };
+  const gitdir = isAbsolute(target) ? target : join9(root, target);
+  if (existsSync6(join9(gitdir, "config"))) {
+    return { configPath: join9(gitdir, "config"), headRoot: root };
   }
-  const commonRaw = safeRead(join7(gitdir, "commondir"))?.trim();
+  const commonRaw = safeRead(join9(gitdir, "commondir"))?.trim();
   if (!commonRaw) return void 0;
-  const commonGitDir = isAbsolute(commonRaw) ? commonRaw : join7(gitdir, commonRaw);
-  const headRoot = basename(commonGitDir) === ".git" ? dirname(commonGitDir) : root;
-  return { configPath: join7(commonGitDir, "config"), headRoot };
+  const commonGitDir = isAbsolute(commonRaw) ? commonRaw : join9(gitdir, commonRaw);
+  const headRoot = basename2(commonGitDir) === ".git" ? dirname2(commonGitDir) : root;
+  return { configPath: join9(commonGitDir, "config"), headRoot };
 }
 function safeRead(path) {
   try {
-    return readFileSync3(path, "utf8");
+    return readFileSync5(path, "utf8");
   } catch {
     return void 0;
   }
@@ -26969,18 +29500,23 @@ function nwoFromUrl(url2) {
 }
 
 // ../../packages/plugin-sdk/src/events.ts
-import { createHash as createHash4, randomUUID as randomUUID9 } from "crypto";
+import { createHash as createHash4, randomUUID as randomUUID13 } from "crypto";
+
+// ../../packages/plugin-sdk/src/isolated-scan.ts
+import { existsSync as existsSync7 } from "fs";
+import { fileURLToPath } from "url";
+import { Worker } from "worker_threads";
 
 // ../../packages/plugin-sdk/src/inventory-resolver.ts
-import { arch, hostname as hostname3, platform, release } from "os";
+import { arch, hostname as hostname4, platform, release } from "os";
 function resolveInventoryContext(input) {
   const host = {
     objectType: "host",
     // Stable-ish machine id; os/arch live in the descriptive bag (a
     // harder machine id can replace this without a schema change).
-    identityKey: hostname3(),
-    title: hostname3(),
-    attributes: { host_name: hostname3(), os: platform(), os_version: release(), arch: arch() }
+    identityKey: hostname4(),
+    title: hostname4(),
+    attributes: { host_name: hostname4(), os: platform(), os_version: release(), arch: arch() }
   };
   const harnessAttributes = {};
   if (input.harnessVersion != null) harnessAttributes.harness_version = input.harnessVersion;
@@ -27001,30 +29537,352 @@ function resolveInventoryContext(input) {
 }
 
 // ../../packages/plugin-sdk/src/nudge.ts
-import { mkdirSync as mkdirSync2, readFileSync as readFileSync5, writeFileSync as writeFileSync3 } from "fs";
-import { join as join9 } from "path";
+import { mkdirSync as mkdirSync3, readFileSync as readFileSync7, writeFileSync as writeFileSync5 } from "fs";
+import { join as join11 } from "path";
 
 // ../../packages/plugin-sdk/src/paths.ts
-import { readdirSync as readdirSync2, realpathSync as realpathSync2 } from "fs";
-import { basename as basename3, dirname as dirname2, sep as sep3 } from "path";
+import { readdirSync as readdirSync3, realpathSync as realpathSync2 } from "fs";
+import { basename as basename4, dirname as dirname3, sep as sep3 } from "path";
 
 // ../../packages/plugin-sdk/src/project-files.ts
 var import_ignore = __toESM(require_ignore(), 1);
-import { existsSync as existsSync6, readdirSync as readdirSync3, readFileSync as readFileSync6 } from "fs";
-import { basename as basename4, join as join10, relative, sep as sep4 } from "path";
+import { existsSync as existsSync8, readdirSync as readdirSync4, readFileSync as readFileSync8 } from "fs";
+import { basename as basename5, join as join12, relative, sep as sep4 } from "path";
+
+// ../../packages/plugin-sdk/src/provider-env-antigravity.ts
+var optionalBaseUrl2 = external_exports.preprocess((v) => {
+  if (typeof v === "string" && v.trim() === "") return void 0;
+  return v;
+}, external_exports.string().optional()).catch(void 0);
+var optionalFlag = external_exports.preprocess((v) => {
+  if (typeof v !== "string") return false;
+  const normalized = v.trim().toLowerCase();
+  return normalized !== "" && normalized !== "0" && normalized !== "false";
+}, external_exports.boolean()).catch(false);
+var antigravityProviderEnvShape = {
+  GOOGLE_GENAI_USE_VERTEXAI: optionalFlag,
+  GOOGLE_GEMINI_BASE_URL: optionalBaseUrl2
+};
+var AntigravityProviderEnvSchema = external_exports.object(antigravityProviderEnvShape);
+
+// ../../packages/plugin-sdk/src/provider-env-codex.ts
+var optionalBaseUrl3 = external_exports.preprocess((v) => {
+  if (typeof v === "string" && v.trim() === "") return void 0;
+  return v;
+}, external_exports.string().optional()).catch(void 0);
+var codexProviderEnvShape = {
+  OPENAI_BASE_URL: optionalBaseUrl3
+};
+var CodexProviderEnvSchema = external_exports.object(codexProviderEnvShape);
 
 // ../../packages/plugin-sdk/src/runtime.ts
-import { randomUUID as randomUUID10 } from "crypto";
+import { randomUUID as randomUUID14 } from "crypto";
 
 // ../../packages/plugin-sdk/src/suppressions.ts
 var THIRTY_DAYS_MS = 30 * 24 * 60 * 60 * 1e3;
 
 // ../../packages/plugin-sdk/src/throttle.ts
-import { mkdirSync as mkdirSync3, statSync as statSync3, writeFileSync as writeFileSync4 } from "fs";
-import { join as join11 } from "path";
+import { mkdirSync as mkdirSync4, statSync as statSync6, writeFileSync as writeFileSync6 } from "fs";
+import { join as join13 } from "path";
+
+// ../../packages/plugin-sdk/src/tokenize.ts
+function redactedPlaceholder(category) {
+  return `[REDACTED:${category.toUpperCase()}]`;
+}
+var POINTER_UNAVAILABLE_TEXT = "[unavailable]";
+var SEVERITY_RANK3 = { critical: 3, high: 2, medium: 1, low: 0 };
+function groupSpans(text, findings) {
+  const sorted = [...findings].filter((f) => f.span.start >= 0 && f.span.end <= text.length && f.span.start < f.span.end).sort((a, b) => a.span.start - b.span.start || b.span.end - a.span.end);
+  const groups = [];
+  for (const finding of sorted) {
+    const last = groups[groups.length - 1];
+    if (last && finding.span.start < last.end) {
+      last.end = Math.max(last.end, finding.span.end);
+      if ((SEVERITY_RANK3[finding.severity] ?? 0) > (SEVERITY_RANK3[last.severity] ?? 0)) {
+        last.category = finding.category;
+        last.severity = finding.severity;
+      }
+      delete last.finding;
+      continue;
+    }
+    groups.push({
+      start: finding.span.start,
+      end: finding.span.end,
+      finding,
+      category: finding.category,
+      severity: finding.severity
+    });
+  }
+  return groups;
+}
+var NULL_RESOLVER = () => Promise.resolve(null);
+var SecretVaultGlue = class {
+  #vault;
+  revealGrantResolver;
+  // Set only when THIS glue opened the store, so a glue over an injected vault
+  // never closes a handle it does not own.
+  #release;
+  constructor(vault, revealGrantResolver = NULL_RESOLVER, release2) {
+    this.#vault = vault;
+    this.revealGrantResolver = revealGrantResolver;
+    this.#release = release2;
+  }
+  close() {
+    const release2 = this.#release;
+    this.#release = void 0;
+    try {
+      release2?.();
+    } catch {
+    }
+  }
+  async tokenizeValue(raw, meta3) {
+    try {
+      const result = await this.#vault.tokenize(raw, meta3);
+      return typeof result === "string" ? result : redactedPlaceholder(meta3.category);
+    } catch {
+      return redactedPlaceholder(meta3.category);
+    }
+  }
+  async tokenizeText(text, opts) {
+    try {
+      const findings = opts?.findings ?? this.#selfScan(text);
+      if (findings === null) return { text: "[REDACTED]", pointers: [], degraded: [] };
+      if (findings.length === 0) return { text, pointers: [], degraded: [] };
+      const groups = groupSpans(text, findings);
+      const pointers = [];
+      const degraded = [];
+      let out = text;
+      for (const group of [...groups].reverse()) {
+        const original = text.slice(group.start, group.end);
+        const finding = group.finding;
+        let replacement;
+        if (finding === void 0) {
+          replacement = redactedPlaceholder(group.category);
+          degraded.unshift({ category: group.category });
+        } else if (original !== finding.rawMatch) {
+          replacement = redactedPlaceholder(group.category);
+          degraded.unshift({ category: group.category });
+        } else {
+          replacement = await this.tokenizeValue(finding.rawMatch, {
+            ruleId: finding.ruleId,
+            category: finding.category,
+            maskedMatch: maskMatch(finding.rawMatch)
+          });
+          if (replacement.startsWith("[[aka:")) pointers.unshift(replacement);
+          else degraded.unshift({ category: finding.category });
+        }
+        out = out.slice(0, group.start) + replacement + out.slice(group.end);
+      }
+      if (opts?.sighting && pointers.length > 0) {
+        for (const pointer of pointers) {
+          try {
+            const id = pointer.split(".")[1];
+            if (id !== void 0) this.#vault.recordSighting?.(id, opts.sighting);
+          } catch {
+          }
+        }
+      }
+      return { text: out, pointers, degraded };
+    } catch {
+      return { text: "[REDACTED]", pointers: [], degraded: [] };
+    }
+  }
+  async detokenizeText(text, opts) {
+    try {
+      const matches = [...text.matchAll(pointerTokenScanner())];
+      if (matches.length === 0) return { text, revealed: 0 };
+      const occurrences = /* @__PURE__ */ new Map();
+      for (const match of matches) {
+        occurrences.set(match[0], (occurrences.get(match[0]) ?? 0) + 1);
+      }
+      const resolved = /* @__PURE__ */ new Map();
+      for (const [pointer, count] of occurrences) {
+        try {
+          const value = await this.#vault.detokenize(pointer, {
+            target: "human",
+            reason: opts.reason,
+            pointerCount: count
+          });
+          resolved.set(pointer, typeof value === "string" ? value : null);
+        } catch {
+          resolved.set(pointer, null);
+        }
+      }
+      let out = text;
+      let revealed = 0;
+      for (const match of [...matches].reverse()) {
+        const value = resolved.get(match[0]);
+        const replacement = value ?? POINTER_UNAVAILABLE_TEXT;
+        if (value !== null && value !== void 0) revealed += 1;
+        out = out.slice(0, match.index) + replacement + out.slice(match.index + match[0].length);
+      }
+      return { text: out, revealed };
+    } catch {
+      return { text, revealed: 0 };
+    }
+  }
+  // Scan with the bundled packs, as the mask path does. Pointers already in the
+  // text are blanked first so a pointer is never re-tokenized. Returns null
+  // when the registry or the scan itself failed — the caller must then treat
+  // the whole text as unclassifiable.
+  #selfScan(text) {
+    try {
+      registerBundledPacks();
+      const shielded = shieldPointers(text);
+      return dropShieldedFindings(scan(shielded.text, getLoadedRules()), shielded.spans);
+    } catch {
+      return null;
+    }
+  }
+  async describePointerSafe(token) {
+    try {
+      return await this.#vault.describePointer(token);
+    } catch {
+      return null;
+    }
+  }
+  async probeModelPointers(text, opts) {
+    const granted = /* @__PURE__ */ new Map();
+    const ungranted = [];
+    try {
+      for (const pointer of new Set([...text.matchAll(pointerTokenScanner())].map((m) => m[0]))) {
+        try {
+          const grantId = await opts.resolveGrant(pointer);
+          if (grantId === null) ungranted.push(pointer);
+          else granted.set(pointer, grantId);
+        } catch {
+          ungranted.push(pointer);
+        }
+      }
+      return { granted, ungranted };
+    } catch {
+      return { granted: /* @__PURE__ */ new Map(), ungranted };
+    }
+  }
+  async substituteModelPointers(text, opts) {
+    try {
+      const matches = [...text.matchAll(pointerTokenScanner())];
+      if (matches.length === 0) return { text, revealed: [], unresolved: [], grantIds: [] };
+      const resolved = /* @__PURE__ */ new Map();
+      for (const pointer of new Set(matches.map((m) => m[0]))) {
+        try {
+          const grantId = await opts.resolveGrant(pointer);
+          if (grantId === null) {
+            await this.#vault.detokenize(pointer, { target: "model", reason: "model-input" });
+            resolved.set(pointer, null);
+            continue;
+          }
+          const value = await this.#vault.detokenize(pointer, {
+            target: "model",
+            reason: "model-input",
+            grantId
+          });
+          resolved.set(pointer, typeof value === "string" ? { value, grantId } : null);
+        } catch {
+          resolved.set(pointer, null);
+        }
+      }
+      const spentGrants = /* @__PURE__ */ new Set();
+      for (const entry of resolved.values()) {
+        if (entry === null || spentGrants.has(entry.grantId)) continue;
+        spentGrants.add(entry.grantId);
+        try {
+          await this.#vault.consumeGrant?.(entry.grantId);
+        } catch {
+        }
+      }
+      let out = text;
+      const revealed = /* @__PURE__ */ new Set();
+      const unresolved = /* @__PURE__ */ new Set();
+      for (const match of [...matches].reverse()) {
+        const entry = resolved.get(match[0]);
+        if (entry === null || entry === void 0) {
+          unresolved.add(match[0]);
+          continue;
+        }
+        revealed.add(match[0]);
+        out = out.slice(0, match.index) + entry.value + out.slice(match.index + match[0].length);
+      }
+      return {
+        text: out,
+        revealed: [...revealed],
+        unresolved: [...unresolved],
+        grantIds: [...spentGrants]
+      };
+    } catch {
+      return { text, revealed: [], unresolved: [], grantIds: [] };
+    }
+  }
+};
+function createVaultGlue(options) {
+  if (options?.vault) return new SecretVaultGlue(options.vault, options.revealResolver);
+  const base = options?.base ?? defaultDataDir();
+  try {
+    const dir = dataDir(base);
+    const db = openLocalDatabase(dir);
+    const settings = readWorkspaceSettings(base);
+    const provider = options?.policyProvider ?? new UserGrantPolicyProvider(db.exceptions);
+    const vault = new SecretVault({
+      repo: db.secretVault,
+      keys: createKeyProvider(settings.vaultKeyCustody, keysDir(base)),
+      // Read live so a revocation applies to the very next call, not the next
+      // process.
+      isConsented: () => isVaultConsentValid(readWorkspaceSettings(base).vaultConsent),
+      // This is the one construction site that reveals to the model, so it is
+      // the one that supplies the last gate. The decision is re-taken from the
+      // ROW's identity at the moment of crossing, which closes the window
+      // between resolving a grant and spending it: a grant revoked in between
+      // refuses here.
+      //
+      // The re-decision is on the identity alone, never on the grant id
+      // matching the one the resolver returned. ExceptionPolicyProvider
+      // promises no id stability across calls — a provider deciding from
+      // external policy may well mint a fresh id each time — so comparing ids
+      // would silently refuse every crossing for such a provider while looking
+      // like a security check. `allow` for this row is the whole question.
+      verifyGrant: async (_grantId, identity) => {
+        const decision = await provider.decideReveal(identity);
+        return decision.allow;
+      }
+    });
+    let fingerprintKey;
+    const fingerprintKeyForWrite = () => fingerprintKey ??= loadOrCreateFingerprintKey(dir);
+    const vaultWithSightings = {
+      tokenize: (raw, meta3) => vault.tokenize(raw, meta3, fingerprintKeyForWrite),
+      detokenize: (token, opts) => vault.detokenize(token, opts),
+      describePointer: (token) => vault.describePointer(token),
+      resolvePointerIdentity: (token) => vault.resolvePointerIdentity(token),
+      recordSighting: (pointerId, sighting) => {
+        db.secretVault.recordSighting({ pointerId, ...sighting }, Date.now());
+      },
+      consumeGrant: (grantId) => db.exceptions.consume(grantId)
+    };
+    const revealGrantResolver = async (pointer) => {
+      try {
+        const identity = await vault.resolvePointerIdentity(pointer);
+        if (identity === null) return null;
+        const decision = await provider.decideReveal(identity);
+        return decision.allow ? decision.grantId : null;
+      } catch {
+        return null;
+      }
+    };
+    return new SecretVaultGlue(vaultWithSightings, revealGrantResolver, () => {
+      db.close();
+    });
+  } catch {
+    return new SecretVaultGlue(UNOPENABLE_VAULT);
+  }
+}
+var UNOPENABLE_VAULT = {
+  tokenize: () => Promise.resolve(/* @__PURE__ */ Symbol("aka.vault.unopenable")),
+  detokenize: () => Promise.resolve(/* @__PURE__ */ Symbol("aka.vault.unopenable")),
+  describePointer: () => Promise.resolve(null),
+  resolvePointerIdentity: () => Promise.resolve(null)
+};
 
 // ../../packages/plugin-runtime/src/standalone-gateway.ts
-import { randomUUID as randomUUID11 } from "crypto";
+import { randomUUID as randomUUID15 } from "crypto";
 
 // ../../packages/plugin-runtime/src/recorder.ts
 var PLUGIN_RECORDER_BINARY = "plugin";
@@ -27063,12 +29921,12 @@ var StandaloneDataGateway = class {
   // reconciler drops the whole pass and recovers it idempotently on the next read.
   recordLlmCalls(inputs) {
     if (inputs.length === 0) return Promise.resolve();
-    return new Promise((resolve, reject) => {
+    return new Promise((resolve2, reject) => {
       try {
         this.db.auditEvents.runInTransaction(() => {
           for (const input of inputs) this.db.auditEvents.insertLlmCall(input);
         });
-        resolve();
+        resolve2();
       } catch (err) {
         reject(err instanceof Error ? err : new Error(String(err)));
       }
@@ -27080,12 +29938,12 @@ var StandaloneDataGateway = class {
   // drops the whole pass and recovers it idempotently next time.
   recordToolCalls(inputs) {
     if (inputs.length === 0) return Promise.resolve();
-    return new Promise((resolve, reject) => {
+    return new Promise((resolve2, reject) => {
       try {
         this.db.auditEvents.runInTransaction(() => {
           for (const input of inputs) this.writeToolCall(input);
         });
-        resolve();
+        resolve2();
       } catch (err) {
         reject(err instanceof Error ? err : new Error(String(err)));
       }
@@ -27186,7 +30044,7 @@ var StandaloneDataGateway = class {
     const customKeywords = [...new Set(policies.flatMap((p) => p.customKeywords ?? []))];
     const installed = this.installedScanRules();
     const rulePolicies = installed ? [...installed.ruleActions].map(([ruleId, action]) => ({
-      id: randomUUID11(),
+      id: randomUUID15(),
       scope: "global",
       target: { ruleId },
       action,
@@ -27339,97 +30197,20 @@ function resolveDataGateway(config2, meta3, gatewayFactory = standaloneGatewayFa
 }
 
 // ../../packages/plugin-runtime/src/handle-session-start.ts
-import { randomUUID as randomUUID12 } from "crypto";
+import { randomUUID as randomUUID16 } from "crypto";
 var EXCEPTION_RETENTION_MS = 90 * 24 * 60 * 60 * 1e3;
 
-// src/history/tail.ts
-import { createHash as createHash5 } from "crypto";
-import {
-  closeSync,
-  fstatSync,
-  mkdirSync as mkdirSync4,
-  openSync,
-  readFileSync as readFileSync7,
-  readSync,
-  writeFileSync as writeFileSync5
-} from "fs";
-import { join as join12 } from "path";
-function offsetsDir(dataDir2) {
-  return join12(dataDir2, "usage-offsets");
-}
-var SAFE_SESSION_ID = /^[A-Za-z0-9._-]+$/;
-function safeSessionId(sessionId) {
-  if (SAFE_SESSION_ID.test(sessionId) && sessionId !== "." && sessionId !== "..") {
-    return sessionId;
-  }
-  return createHash5("sha256").update(sessionId).digest("hex");
-}
-function offsetPath(dataDir2, sessionId) {
-  return join12(offsetsDir(dataDir2), safeSessionId(sessionId));
-}
-function readOffset(dataDir2, sessionId) {
-  try {
-    const raw = readFileSync7(offsetPath(dataDir2, sessionId), "utf8");
-    const parsed = JSON.parse(raw);
-    if (typeof parsed === "object" && parsed !== null) {
-      const rec = parsed;
-      const offset = typeof rec.offset === "number" && Number.isFinite(rec.offset) && rec.offset >= 0 ? rec.offset : 0;
-      const lastPromptId = typeof rec.lastPromptId === "string" ? rec.lastPromptId : void 0;
-      return lastPromptId !== void 0 ? { offset, lastPromptId } : { offset };
-    }
-  } catch {
-  }
-  return { offset: 0 };
-}
-function writeOffset(dataDir2, sessionId, value) {
-  try {
-    mkdirSync4(offsetsDir(dataDir2), { recursive: true, mode: DATA_DIR_MODE });
-    const payload = value.lastPromptId !== void 0 ? { offset: value.offset, lastPromptId: value.lastPromptId } : { offset: value.offset };
-    writeFileSync5(offsetPath(dataDir2, sessionId), JSON.stringify(payload), {
-      mode: DATA_FILE_MODE
-    });
-  } catch {
-  }
-}
-function readTail(transcriptPath, startOffset) {
-  let fd;
-  try {
-    fd = openSync(transcriptPath, "r");
-  } catch {
-    return { chunk: "", nextOffset: startOffset };
-  }
-  try {
-    const size = fstatSync(fd).size;
-    const from = size < startOffset ? 0 : startOffset;
-    if (from >= size) return { chunk: "", nextOffset: from };
-    const length = size - from;
-    const buf = Buffer.allocUnsafe(length);
-    let filled = 0;
-    while (filled < length) {
-      const bytesRead = readSync(fd, buf, filled, length - filled, from + filled);
-      if (bytesRead === 0) break;
-      filled += bytesRead;
-    }
-    const slice = buf.subarray(0, filled);
-    const lastNl = slice.lastIndexOf(10);
-    if (lastNl === -1) return { chunk: "", nextOffset: from };
-    const consumedBytes = lastNl + 1;
-    const chunk = slice.subarray(0, consumedBytes).toString("utf8");
-    return { chunk, nextOffset: from + consumedBytes };
-  } catch {
-    return { chunk: "", nextOffset: startOffset };
-  } finally {
-    try {
-      closeSync(fd);
-    } catch {
-    }
-  }
-}
+// src/remediation/redact.ts
+import { readFileSync as readFileSync10, realpathSync as realpathSync3, renameSync as renameSync5, rmSync as rmSync5, writeFileSync as writeFileSync7 } from "fs";
+import { isAbsolute as isAbsolute2, relative as relative2, resolve } from "path";
 
 // src/history/transcripts.ts
-import { readdirSync as readdirSync4, readFileSync as readFileSync8 } from "fs";
+import { readdirSync as readdirSync5, readFileSync as readFileSync9 } from "fs";
 import { homedir as homedir3 } from "os";
-import { join as join13 } from "path";
+import { join as join14 } from "path";
+function transcriptsDir(home) {
+  return join14(home ?? homedir3(), ".claude", "projects");
+}
 function isRecord(value) {
   return typeof value === "object" && value !== null;
 }
@@ -27631,6 +30412,156 @@ function parseTranscriptToolCalls(jsonl, sinceMs = 0) {
 }
 var DAY_MS5 = 24 * 60 * 60 * 1e3;
 
+// src/remediation/redact.ts
+function platformRedactionScope(home) {
+  return { artifactRoots: [transcriptsDir(home)] };
+}
+function realPathOrNull(path) {
+  try {
+    return realpathSync3(path);
+  } catch {
+    return null;
+  }
+}
+function isWithinRoot(realTarget, root) {
+  const realRoot = realPathOrNull(root);
+  if (realRoot === null) return false;
+  const rel = relative2(realRoot, realTarget);
+  return rel !== "" && !rel.startsWith("..") && !isAbsolute2(rel);
+}
+function resolveRedactableArtifact(filePath, scope) {
+  const realTarget = realPathOrNull(resolve(filePath));
+  if (realTarget === null) return null;
+  return scope.artifactRoots.some((root) => isWithinRoot(realTarget, root)) ? realTarget : null;
+}
+
+// src/history/tail.ts
+import { createHash as createHash5 } from "crypto";
+import {
+  closeSync as closeSync2,
+  fstatSync,
+  mkdirSync as mkdirSync5,
+  openSync as openSync2,
+  readFileSync as readFileSync11,
+  readSync,
+  writeFileSync as writeFileSync8
+} from "fs";
+import { join as join15 } from "path";
+function offsetsDir(dataDir2) {
+  return join15(dataDir2, "usage-offsets");
+}
+var SAFE_SESSION_ID = /^[A-Za-z0-9._-]+$/;
+function safeSessionId(sessionId) {
+  if (SAFE_SESSION_ID.test(sessionId) && sessionId !== "." && sessionId !== "..") {
+    return sessionId;
+  }
+  return createHash5("sha256").update(sessionId).digest("hex");
+}
+function offsetPath(dataDir2, sessionId) {
+  return join15(offsetsDir(dataDir2), safeSessionId(sessionId));
+}
+function readOffset(dataDir2, sessionId) {
+  try {
+    const raw = readFileSync11(offsetPath(dataDir2, sessionId), "utf8");
+    const parsed = JSON.parse(raw);
+    if (typeof parsed === "object" && parsed !== null) {
+      const rec = parsed;
+      const offset = typeof rec.offset === "number" && Number.isFinite(rec.offset) && rec.offset >= 0 ? rec.offset : 0;
+      const lastPromptId = typeof rec.lastPromptId === "string" ? rec.lastPromptId : void 0;
+      return lastPromptId !== void 0 ? { offset, lastPromptId } : { offset };
+    }
+  } catch {
+  }
+  return { offset: 0 };
+}
+function writeOffset(dataDir2, sessionId, value) {
+  try {
+    mkdirSync5(offsetsDir(dataDir2), { recursive: true, mode: DATA_DIR_MODE });
+    const payload = value.lastPromptId !== void 0 ? { offset: value.offset, lastPromptId: value.lastPromptId } : { offset: value.offset };
+    writeFileSync8(offsetPath(dataDir2, sessionId), JSON.stringify(payload), {
+      mode: DATA_FILE_MODE
+    });
+  } catch {
+  }
+}
+function readTail(transcriptPath, startOffset) {
+  let fd;
+  try {
+    fd = openSync2(transcriptPath, "r");
+  } catch {
+    return { chunk: "", nextOffset: startOffset };
+  }
+  try {
+    const size = fstatSync(fd).size;
+    const from = size < startOffset ? 0 : startOffset;
+    if (from >= size) return { chunk: "", nextOffset: from };
+    const length = size - from;
+    const buf = Buffer.allocUnsafe(length);
+    let filled = 0;
+    while (filled < length) {
+      const bytesRead = readSync(fd, buf, filled, length - filled, from + filled);
+      if (bytesRead === 0) break;
+      filled += bytesRead;
+    }
+    const slice = buf.subarray(0, filled);
+    const lastNl = slice.lastIndexOf(10);
+    if (lastNl === -1) return { chunk: "", nextOffset: from };
+    const consumedBytes = lastNl + 1;
+    const chunk = slice.subarray(0, consumedBytes).toString("utf8");
+    return { chunk, nextOffset: from + consumedBytes };
+  } catch {
+    return { chunk: "", nextOffset: startOffset };
+  } finally {
+    try {
+      closeSync2(fd);
+    } catch {
+    }
+  }
+}
+
+// src/history/tail-scrub.ts
+import { readFileSync as readFileSync12, renameSync as renameSync6, rmSync as rmSync6, statSync as statSync7, writeFileSync as writeFileSync9 } from "fs";
+var DEFAULT_MAX_SCRUB_BYTES = 32 * 1024 * 1024;
+async function scrubTranscriptTail(filePath, deps) {
+  try {
+    const realPath = resolveRedactableArtifact(filePath, deps.scope);
+    if (realPath === null) return null;
+    const statBefore = statSync7(realPath);
+    if (statBefore.size > (deps.maxBytes ?? DEFAULT_MAX_SCRUB_BYTES)) return null;
+    const content = readFileSync12(realPath, "utf8");
+    const lines = content.split("\n");
+    let rewritten = 0;
+    for (const [i, line] of lines.entries()) {
+      if (line === "") continue;
+      const result = await deps.tokenizeText(line);
+      if (result.text === line) continue;
+      if (result.pointers.length === 0 && result.degraded.length === 0) return null;
+      lines[i] = result.text;
+      rewritten += 1;
+    }
+    if (rewritten === 0) return { rewritten: 0 };
+    const tmpPath = `${realPath}.aka-scrub.tmp`;
+    try {
+      writeFileSync9(tmpPath, lines.join("\n"), { mode: statBefore.mode & 511 });
+      const statNow = statSync7(realPath);
+      if (statNow.size !== statBefore.size || statNow.mtimeMs !== statBefore.mtimeMs) {
+        rmSync6(tmpPath, { force: true, recursive: true });
+        return null;
+      }
+      renameSync6(tmpPath, realPath);
+    } catch {
+      try {
+        rmSync6(tmpPath, { force: true, recursive: true });
+      } catch {
+      }
+      return null;
+    }
+    return { rewritten };
+  } catch {
+    return null;
+  }
+}
+
 // src/history/usage.ts
 var NO_PROJECT_CWD = "/nonexistent/aka-reconciler/no-project";
 var MAX_TARGET_LEN = 500;
@@ -27760,6 +30691,24 @@ async function reconcileSessionTail(config2, sessionId, transcriptPath) {
       offset: nextOffset,
       lastPromptId: result.lastPromptId
     });
+    if (isVaultConsentValid(config2.settings.vaultConsent)) {
+      try {
+        const glue = createVaultGlue();
+        const scrubbed = await scrubTranscriptTail(transcriptPath, {
+          tokenizeText: (text) => glue.tokenizeText(text, {
+            sighting: { location: transcriptPath, kind: "transcript" }
+          }),
+          scope: platformRedactionScope()
+        });
+        if (scrubbed !== null && scrubbed.rewritten > 0) {
+          writeOffset(config2.dataDir, sessionId, {
+            offset: 0,
+            lastPromptId: result.lastPromptId
+          });
+        }
+      } catch {
+      }
+    }
     return { llmCalls: result.llmCalls, skipped: result.skipped, toolCalls };
   } finally {
     await gateway.close();