@akasecurity/cli 0.9.3 → 0.9.4

package/dist/cli.js

@@ -751,7 +751,7 @@ function installAgentPlugin(agentId, mode = "capture") {
 }
 
 // ../packages/local-ops/src/egress-record.ts
-import { statSync as statSync4 } from "fs";
+import { statSync as statSync5 } from "fs";
 import { dirname as dirname4, relative as relative2, resolve } from "path";
 
 // ../packages/detections/src/egress/registry.ts
@@ -1855,9 +1855,9 @@ function extractGoMod(text) {
   let blockKeyword = null;
   eachLine(text, (rawLine, lineNumber) => {
     if (blockKeyword === null) {
-      const open = GO_BLOCK_OPEN.exec(rawLine)?.[1];
-      if (open !== void 0) {
-        blockKeyword = open;
+      const open2 = GO_BLOCK_OPEN.exec(rawLine)?.[1];
+      if (open2 !== void 0) {
+        blockKeyword = open2;
         return;
       }
       const path = GO_REQUIRE_SINGLE_LINE.exec(rawLine)?.[1];
@@ -2375,12 +2375,12 @@ function redact(text, findings) {
   const regions = [];
   for (const f of sorted) {
     const rank = SEVERITY_RANK[f.severity];
-    const open = regions[regions.length - 1];
-    if (open && f.span.start < open.end) {
-      open.end = Math.max(open.end, f.span.end);
-      if (rank > open.rank) {
-        open.rank = rank;
-        open.category = f.category;
+    const open2 = regions[regions.length - 1];
+    if (open2 && f.span.start < open2.end) {
+      open2.end = Math.max(open2.end, f.span.end);
+      if (rank > open2.rank) {
+        open2.rank = rank;
+        open2.category = f.category;
       }
     } else {
       regions.push({ start: f.span.start, end: f.span.end, category: f.category, rank });
@@ -2409,94 +2409,6 @@ function maskMatch(raw) {
   return `${raw.charAt(0)}${"*".repeat(6)}${raw.charAt(raw.length - 1)}`;
 }
 
-// ../packages/detections/src/posture/config-posture.ts
-var RULE_VERSION = "1";
-var KNOWN_TOOLS = /* @__PURE__ */ new Set([
-  "prettier",
-  "eslint",
-  "biome",
-  "black",
-  "ruff",
-  "gofmt",
-  "rustfmt",
-  "node",
-  "npx",
-  "npm",
-  "pnpm",
-  "yarn",
-  "make",
-  "git",
-  "jq",
-  "echo"
-]);
-var EGRESS_RE = /\b(curl|wget|nc|ncat|netcat|ssh|scp|rsync)\b|https?:\/\//;
-var MUTATION_RE = /(--write|--fix|\s-w\b|\s-i\b|(?<![\d&>])>\s?\S)/;
-var CONFIG_POSTURE_RULES = [
-  {
-    ruleId: "hook-conflict",
-    version: RULE_VERSION,
-    name: "Overlapping hooks \u2014 run order is undefined",
-    category: "config",
-    severity: "medium",
-    definition: JSON.stringify({
-      kind: "hook-conflict",
-      mutation: MUTATION_RE.source,
-      note: "two hooks on the same event with overlapping matchers, both mutating the tool target"
-    })
-  },
-  {
-    ruleId: "hook-unknown",
-    version: RULE_VERSION,
-    name: "Unknown hook \u2014 not attributable to a plugin or known tool",
-    category: "config",
-    // medium, not high: with a deliberately tiny allowlist this v1 heuristic
-    // fires on ordinary interpreter hooks (python3 x.py) and compound commands
-    // (cd … && tool); 'high' is reserved for egress, which is genuinely
-    // dangerous. Revisit when the known-hooks registry replaces the allowlist.
-    severity: "medium",
-    definition: JSON.stringify({ kind: "hook-unknown", knownTools: [...KNOWN_TOOLS] })
-  },
-  {
-    ruleId: "hook-external-egress",
-    version: RULE_VERSION,
-    name: "Hook command can send data externally",
-    category: "config",
-    severity: "high",
-    definition: JSON.stringify({ kind: "hook-external-egress", pattern: EGRESS_RE.source })
-  }
-];
-
-// ../packages/detections/src/security/redos-probe.ts
-var EXPONENTIAL_UNITS = [
-  "a",
-  "0",
-  " ",
-  "x",
-  "ab",
-  "a.",
-  "a-",
-  "a_",
-  "a@",
-  "a/",
-  "a:",
-  "a=",
-  "a;",
-  "aA0",
-  "	"
-];
-var EXPONENTIAL_PROBES = EXPONENTIAL_UNITS.flatMap(
-  (unit) => [23, 25].map((len) => unit.repeat(Math.ceil(len / unit.length)).slice(0, len) + "!")
-);
-var POLYNOMIAL_PROBES = ["abc-", "a.", "a ", "a=", "x", "0", "a@", "a/", "ab"].map(
-  (unit) => unit.repeat(1e4).slice(0, 4e4) + "!"
-);
-
-// ../packages/persistence/src/database.ts
-import { randomUUID as randomUUID8 } from "crypto";
-import { existsSync as existsSync2, renameSync as renameSync2, rmSync as rmSync2 } from "fs";
-import { join as join2, sep } from "path";
-import { DatabaseSync } from "node:sqlite";
-
 // ../packages/schema/src/drizzle/sqlite-ddl.ts
 var SQLITE_MIGRATIONS = [
   {
@@ -2558,6 +2470,22 @@ var SQLITE_MIGRATIONS = [
   {
     tag: "0014_drop_legacy_events_findings",
     sql: "-- Custom migration: drops the frozen legacy `events`/`findings` tables\n-- (superseded by audit_events/inspection_definitions/inspection_findings) and\n-- replaces them with read-only views of the same name.\n--\n-- persistence's migrations.ts applies this migration ONLY once the batched\n-- history backfill (see runLegacyHistoryBackfill) has fully drained both\n-- tables, and only after copying the live file aside \u2014 see\n-- backupBeforeLegacyDrop in packages/persistence/src/migrations.ts. A store\n-- still mid-copy keeps its real tables and this migration stays pending.\n--\n-- The views exist for skew: the `aka` CLI and the Claude Code plugin update\n-- independently against one shared store, so an older, already-installed\n-- binary can open a store a newer binary already dropped these tables on.\n-- Every already-shipped repository constructor prepares its SQL eagerly at\n-- open time, so a bare \"table not found\" would fail the WHOLE open, not just\n-- a findings-specific read \u2014 these views keep `prepare()` succeeding so an\n-- old binary's unrelated features keep working; its own reads stay truthful,\n-- and its rare (already fail-open) writes fail at run time instead.\n--\n-- The 0009/0010 expression indexes existed only over the legacy `events`\n-- table; DROP TABLE below would remove them implicitly, but they are\n-- dropped explicitly first so the intent reads clearly. IF EXISTS so a store\n-- that reached here with an index missing out of band (an adopted-tag store\n-- whose physical index was never built) does not throw a deterministic \"no\n-- such index\" out of the fail-open drop path.\nDROP INDEX IF EXISTS `idx_events_code_change_path`;\n--> statement-breakpoint\nDROP INDEX IF EXISTS `idx_events_session_id`;\n--> statement-breakpoint\n-- `findings.event_id` references `events.id` \u2014 drop the child first.\nDROP TABLE `findings`;\n--> statement-breakpoint\nDROP TABLE `events`;\n--> statement-breakpoint\n-- Legacy `events` shape, projected from audit_events: `kind`/`occurred_at`/\n-- `source_tool` become real columns again (source_tool round-trips through\n-- the attributes bag, the only place a capture-typed audit row keeps it);\n-- `metadata` is reconstructed as the old camelCase JSON object from the new\n-- snake_case attributes bag, with `root_session_id` folded back in as\n-- `sessionId` (the one legacy metadata key that became a column, never an\n-- attribute, on the new table). Constrained to the four capture kinds so\n-- structural rows (session/run/tool_call/llm_call/source_lookup/config_scan)\n-- never leak into a legacy reader's result set \u2014 the old `events` table\n-- never held them either.\nCREATE VIEW `events` AS\nSELECT\n  id,\n  json_extract(attributes, '$.source_tool') AS source_tool,\n  event_type AS kind,\n  started_at AS occurred_at,\n  content_hash,\n  content,\n  -- Plugin-local bookkeeping column that `ensureSyncedAtColumn` adds to the\n  -- real `events` table at open time. A pre-cutover binary runs that probe on\n  -- EVERY open; without this projection its `columnNames('events')` check\n  -- misses `synced_at` and issues `ALTER TABLE events ADD COLUMN` against this\n  -- view, which SQLite rejects (\"Cannot add a column to a view\") \u2014 a hard,\n  -- non-fail-open crash of the whole open, the exact skew failure these views\n  -- exist to prevent. Projecting it (always NULL; no reader consumes it)\n  -- short-circuits that ALTER.\n  NULL AS synced_at,\n  json_object(\n    'sessionId', root_session_id,\n    'repo', json_extract(attributes, '$.repo'),\n    'filePath', json_extract(attributes, '$.file_path'),\n    'toolName', json_extract(attributes, '$.tool_name'),\n    'gitignored', json_extract(attributes, '$.gitignored'),\n    'wholeFile', json_extract(attributes, '$.whole_file'),\n    'model', json_extract(attributes, '$.model'),\n    'turnIndex', json_extract(attributes, '$.turn_index'),\n    'correlationId', json_extract(attributes, '$.correlation_id'),\n    'traceId', json_extract(attributes, '$.trace_id'),\n    'exceptionIds', json_extract(attributes, '$.exception_ids')\n  ) AS metadata\nFROM audit_events\nWHERE event_type IN ('prompt', 'response', 'code_change', 'tool_use');\n--> statement-breakpoint\n-- A plain single-row INSERT (the old writer's shape \u2014 no ON CONFLICT) is\n-- accepted by prepare() against a view once an INSTEAD OF INSERT trigger\n-- exists, so it fails at run time instead of at open \u2014 landing in the same\n-- fail-open path the caller already wraps its write in.\nCREATE TRIGGER `trg_events_ro`\nINSTEAD OF INSERT ON `events`\nBEGIN SELECT RAISE(ABORT, 'events is read-only; write to audit_events instead'); END;\n--> statement-breakpoint\n-- Legacy `findings` shape: rule_id/category/severity come from the joined\n-- inspection_definitions row (the legacy table inlined them per-row; the\n-- generalized schema normalizes them out into the shared definition). A view\n-- has no rowid of its own, so the underlying table's rowid is re-exposed\n-- explicitly under that name \u2014 a legacy reader ordering by `f.rowid` would\n-- otherwise fail to resolve the column at all. Joined to audit_events for the\n-- same four-capture-kind constraint as the events view above (a finding\n-- attached to a tool_call/config_scan row never existed in the legacy table\n-- either \u2014 see the persistence findings repository's identical predicate).\nCREATE VIEW `findings` AS\nSELECT\n  f.id AS id,\n  f.rowid AS rowid,\n  f.audit_event_id AS event_id,\n  d.rule_id AS rule_id,\n  d.category AS category,\n  d.severity AS severity,\n  f.span_start AS span_start,\n  f.span_end AS span_end,\n  f.masked_match AS masked_match,\n  f.action_taken AS action_taken,\n  f.confidence AS confidence,\n  f.finding_key AS finding_key,\n  f.first_detected_at AS first_detected_at\nFROM inspection_findings f\nJOIN audit_events e ON e.id = f.audit_event_id\nJOIN inspection_definitions d ON d.id = f.inspection_definition_id\nWHERE e.event_type IN ('prompt', 'response', 'code_change', 'tool_use');\n--> statement-breakpoint\n-- Defense in depth only: SQLite refuses to plan ANY upsert against a view\n-- (\"cannot UPSERT a view\") no matter what trigger exists, so this can never\n-- rescue the real legacy writer, which always used\n-- `ON CONFLICT (finding_key) DO UPDATE` \u2014 that statement still fails at\n-- prepare() on an old binary, same as it would with no trigger at all. This\n-- only covers a plain-INSERT shape, should one ever exist.\nCREATE TRIGGER `trg_findings_ro`\nINSTEAD OF INSERT ON `findings`\nBEGIN SELECT RAISE(ABORT, 'findings is read-only; write to inspection_findings instead'); END;\n"
+  },
+  {
+    tag: "0015_busy_vengeance",
+    sql: "CREATE TABLE `secret_vault` (\n	`pointer_id` text PRIMARY KEY NOT NULL,\n	`value_fingerprint` text NOT NULL,\n	`fingerprint_key_version` integer NOT NULL,\n	`key_version` integer NOT NULL,\n	`category` text NOT NULL,\n	`rule_id` text NOT NULL,\n	`masked_match` text NOT NULL,\n	`provider` text,\n	`ciphertext` text NOT NULL,\n	`nonce` text NOT NULL,\n	`auth_tag` text NOT NULL,\n	`occurrence_count` integer DEFAULT 1 NOT NULL,\n	`first_seen` integer NOT NULL,\n	`last_seen` integer NOT NULL\n);\n--> statement-breakpoint\nCREATE UNIQUE INDEX `uq_secret_vault_value` ON `secret_vault` (`value_fingerprint`);--> statement-breakpoint\nCREATE TABLE `secret_vault_deref` (\n	`id` text PRIMARY KEY NOT NULL,\n	`pointer_id` text NOT NULL,\n	`at` integer NOT NULL,\n	`target` text NOT NULL,\n	`reason` text NOT NULL,\n	`outcome` text NOT NULL,\n	`grant_id` text,\n	`pointer_count` integer DEFAULT 1 NOT NULL\n);\n--> statement-breakpoint\nCREATE INDEX `idx_secret_vault_deref_pointer` ON `secret_vault_deref` (`pointer_id`);--> statement-breakpoint\nCREATE INDEX `idx_secret_vault_deref_reason_at` ON `secret_vault_deref` (`reason`,`at`);"
+  },
+  {
+    tag: "0016_breezy_zodiak",
+    sql: "ALTER TABLE `exceptions` ADD `capability` text DEFAULT 'suppress' NOT NULL;"
+  },
+  {
+    tag: "0017_rainy_kat_farrell",
+    sql: "CREATE TABLE `secret_vault_sighting` (\n	`id` text PRIMARY KEY NOT NULL,\n	`pointer_id` text NOT NULL,\n	`location` text NOT NULL,\n	`kind` text NOT NULL,\n	`first_seen` integer NOT NULL,\n	`last_seen` integer NOT NULL\n);\n--> statement-breakpoint\nCREATE UNIQUE INDEX `uq_secret_vault_sighting` ON `secret_vault_sighting` (`pointer_id`,`location`);"
+  },
+  {
+    tag: "0018_serious_tana_nile",
+    sql: "ALTER TABLE `secret_vault` ADD `format_version` integer DEFAULT 2 NOT NULL;"
   }
 ];
 
@@ -18337,6 +18265,7 @@ var ExceptionConditions = external_exports.object({
   sourceTool: external_exports.string().optional(),
   provider: external_exports.string().optional()
 }).strict();
+var ExceptionCapability = external_exports.enum(["suppress", "reveal_to_model"]);
 var DetectionException = external_exports.object({
   id: external_exports.guid(),
   ruleId: external_exports.string(),
@@ -18353,6 +18282,7 @@ var DetectionException = external_exports.object({
   keyVersion: external_exports.number().int().positive(),
   // maskMatch() preview of the approved value — never the raw value.
   maskedValue: external_exports.string(),
+  capability: ExceptionCapability.default("suppress"),
   scope: ExceptionScope,
   expiresAt: external_exports.iso.datetime().nullable(),
   maxUses: external_exports.number().int().positive().nullable(),
@@ -18376,6 +18306,7 @@ var ExceptionBundleEntry = DetectionException.pick({
   ruleId: true,
   valueFingerprint: true,
   keyVersion: true,
+  capability: true,
   expiresAt: true,
   maxUses: true,
   useCount: true,
@@ -19483,8 +19414,128 @@ var PatchInstalledPackRequest = external_exports.object({
   message: "At least one field must be provided"
 }).meta({ id: "PatchInstalledPackRequest" });
 
+// ../packages/schema/src/zod/vault.ts
+var POINTER_FORMAT_VERSION = 2;
+var CATEGORY_ALTERNATION = DetectionCategory.options.join("|");
+var POINTER_TOKEN_PATTERN = new RegExp(
+  `\\[\\[aka:(?:${CATEGORY_ALTERNATION}):[A-Z2-7]{2,7}\\.[A-Z2-7]{26}\\.[A-Z2-7]{16}\\]\\]`
+);
+var POINTER_TOKEN_ANCHORED = new RegExp(`^${POINTER_TOKEN_PATTERN.source}$`);
+function pointerTokenScanner() {
+  return new RegExp(POINTER_TOKEN_PATTERN.source, "g");
+}
+var PointerToken = external_exports.string().regex(POINTER_TOKEN_ANCHORED);
+var ParsedPointer = external_exports.object({
+  category: DetectionCategory,
+  keyVersion: external_exports.number().int().positive(),
+  pointerId: external_exports.string(),
+  tag: external_exports.string()
+});
+var VaultEntry = external_exports.object({
+  pointerId: external_exports.string(),
+  // The keyed HMAC of the raw value under `exception.key`, and the epoch it was
+  // derived under. This is what a reveal-to-model grant matches on, and it rotates
+  // independently of the vault encryption key below.
+  valueFingerprint: external_exports.string().regex(/^[0-9a-f]{64}$/),
+  fingerprintKeyVersion: external_exports.number().int().positive(),
+  // The vault-key epoch this row's ciphertext was sealed under.
+  keyVersion: external_exports.number().int().positive(),
+  // Fixed at first mint and never updated: the same value detected later under a
+  // different rule's category keeps the category it was minted with, so one
+  // value always produces exactly one wire token.
+  category: DetectionCategory,
+  ruleId: external_exports.string(),
+  // Partial-reveal preview for badges and listings. Never the raw value.
+  maskedMatch: external_exports.string(),
+  provider: external_exports.string().optional(),
+  ciphertext: external_exports.string(),
+  nonce: external_exports.string(),
+  authTag: external_exports.string(),
+  // How many times this value has been detected on this machine — the reuse
+  // signal the vault dashboard reads. Distinct from VaultDeref.pointerCount.
+  occurrenceCount: external_exports.number().int().nonnegative(),
+  firstSeen: external_exports.string(),
+  lastSeen: external_exports.string()
+});
+var PointerDescriptor = external_exports.object({
+  category: DetectionCategory,
+  provider: external_exports.string().optional(),
+  maskedMatch: external_exports.string(),
+  occurrences: external_exports.number().int().nonnegative(),
+  firstSeen: external_exports.string(),
+  lastSeen: external_exports.string()
+});
+var PointerIdentity = external_exports.object({
+  ruleId: external_exports.string(),
+  valueFingerprint: external_exports.string().regex(/^[0-9a-f]{64}$/),
+  fingerprintKeyVersion: external_exports.number().int().positive()
+});
+var DetokenizeTarget = external_exports.enum(["human", "model"]);
+var VaultDerefReason = external_exports.enum([
+  "display",
+  "explicit-reveal",
+  "view-render",
+  "model-input",
+  "remediation",
+  "purge"
+]);
+var VaultDerefOutcome = external_exports.enum(["revealed", "refused", "unavailable"]);
+var BATCHED_DEREF_REASONS = ["display", "view-render"];
+function isBatchedDerefReason(reason) {
+  return BATCHED_DEREF_REASONS.includes(reason);
+}
+var VaultDeref = external_exports.object({
+  id: external_exports.guid(),
+  pointerId: external_exports.string(),
+  at: external_exports.string(),
+  target: DetokenizeTarget,
+  reason: VaultDerefReason,
+  outcome: VaultDerefOutcome,
+  // Present only on a model-target crossing that a reveal grant authorized.
+  grantId: external_exports.string().optional(),
+  // How many pointers ONE batched render resolved. 1 for unbatched rows. Named
+  // apart from VaultEntry.occurrenceCount, which counts detections of a value.
+  pointerCount: external_exports.number().int().positive().default(1)
+});
+var VaultSightingKind = external_exports.enum([
+  "prompt",
+  "tool-input",
+  "tool-output",
+  "file",
+  "transcript"
+]);
+var VaultSighting = external_exports.object({
+  location: external_exports.string(),
+  kind: VaultSightingKind,
+  firstSeen: external_exports.string(),
+  lastSeen: external_exports.string()
+});
+var VaultInventoryEntry = external_exports.object({
+  pointerId: external_exports.string(),
+  category: DetectionCategory,
+  provider: external_exports.string().optional(),
+  maskedMatch: external_exports.string(),
+  occurrences: external_exports.number().int().nonnegative(),
+  firstSeen: external_exports.string(),
+  lastSeen: external_exports.string(),
+  // The active reveal-to-model grant covering this value, when one exists —
+  // the inventory badges it, the row links to revocation.
+  revealGrantId: external_exports.string().nullable(),
+  sightings: external_exports.array(VaultSighting)
+});
+var VaultKeyCustody = external_exports.string();
+var VaultInlineReveal = external_exports.enum(["masked", "full", "off"]);
+var VAULT_CONSENT_VERSION = 1;
+var VaultConsent = external_exports.object({
+  acknowledgedAt: external_exports.iso.datetime(),
+  version: external_exports.number().int().positive()
+});
+function isVaultConsentValid(consent) {
+  return consent?.version === VAULT_CONSENT_VERSION;
+}
+
 // ../packages/schema/src/zod/local.ts
-var WORKSPACE_SETTINGS_SPEC_VERSION = 4;
+var WORKSPACE_SETTINGS_SPEC_VERSION = 5;
 var RunMode = external_exports.enum(["standalone"]);
 var SimpleDetectionPolicy = external_exports.enum(["redact", "warn"]);
 var HistoricalAccess = external_exports.enum(["full", "session-only"]);
@@ -19506,6 +19557,16 @@ var WorkspaceSettings = external_exports.object({
   // In-place egress extraction on the scan paths; disable to stop all Data
   // Shares writes.
   dataSharesInPlace: external_exports.boolean().default(true),
+  // Consent to keep a RECOVERABLE encrypted copy of detected values in the local
+  // vault, instead of destroying them. Absent by default: this is a custody
+  // change from one-way redaction, so it is never an assumed grant on upgrade.
+  // Revoking stops future vaulting; it does not erase what is already stored —
+  // purging the vault is the eraser.
+  vaultConsent: VaultConsent.optional(),
+  // Where the vault master key lives.
+  vaultKeyCustody: VaultKeyCustody.default("file"),
+  // How a pointer renders in assistant prose on screen (see VaultInlineReveal).
+  vaultInlineReveal: VaultInlineReveal.default("masked"),
   // Absent until /aka:setup completes; its presence is what "onboarded" means.
   onboardedAt: external_exports.iso.datetime().optional(),
   // Records that the user consented to sending findings to the model API for
@@ -20052,6 +20113,112 @@ function reviewSeverityRank(reasons) {
   return Math.min(...reasons.map((r) => REVIEW_SEVERITY_RANK[r]));
 }
 
+// ../packages/detections/src/pointer-shield.ts
+function shieldPointers(text) {
+  const spans = [];
+  let out = null;
+  for (const match of text.matchAll(pointerTokenScanner())) {
+    spans.push({ start: match.index, end: match.index + match[0].length });
+    out ??= text;
+    out = out.slice(0, match.index) + " ".repeat(match[0].length) + out.slice(match.index + match[0].length);
+  }
+  return { text: out ?? text, spans };
+}
+function dropShieldedFindings(findings, spans) {
+  if (spans.length === 0) return findings;
+  return findings.filter(
+    (finding) => !spans.some((s) => finding.span.start < s.end && finding.span.end > s.start)
+  );
+}
+
+// ../packages/detections/src/posture/config-posture.ts
+var RULE_VERSION = "1";
+var KNOWN_TOOLS = /* @__PURE__ */ new Set([
+  "prettier",
+  "eslint",
+  "biome",
+  "black",
+  "ruff",
+  "gofmt",
+  "rustfmt",
+  "node",
+  "npx",
+  "npm",
+  "pnpm",
+  "yarn",
+  "make",
+  "git",
+  "jq",
+  "echo"
+]);
+var EGRESS_RE = /\b(curl|wget|nc|ncat|netcat|ssh|scp|rsync)\b|https?:\/\//;
+var MUTATION_RE = /(--write|--fix|\s-w\b|\s-i\b|(?<![\d&>])>\s?\S)/;
+var CONFIG_POSTURE_RULES = [
+  {
+    ruleId: "hook-conflict",
+    version: RULE_VERSION,
+    name: "Overlapping hooks \u2014 run order is undefined",
+    category: "config",
+    severity: "medium",
+    definition: JSON.stringify({
+      kind: "hook-conflict",
+      mutation: MUTATION_RE.source,
+      note: "two hooks on the same event with overlapping matchers, both mutating the tool target"
+    })
+  },
+  {
+    ruleId: "hook-unknown",
+    version: RULE_VERSION,
+    name: "Unknown hook \u2014 not attributable to a plugin or known tool",
+    category: "config",
+    // medium, not high: with a deliberately tiny allowlist this v1 heuristic
+    // fires on ordinary interpreter hooks (python3 x.py) and compound commands
+    // (cd … && tool); 'high' is reserved for egress, which is genuinely
+    // dangerous. Revisit when the known-hooks registry replaces the allowlist.
+    severity: "medium",
+    definition: JSON.stringify({ kind: "hook-unknown", knownTools: [...KNOWN_TOOLS] })
+  },
+  {
+    ruleId: "hook-external-egress",
+    version: RULE_VERSION,
+    name: "Hook command can send data externally",
+    category: "config",
+    severity: "high",
+    definition: JSON.stringify({ kind: "hook-external-egress", pattern: EGRESS_RE.source })
+  }
+];
+
+// ../packages/detections/src/security/redos-probe.ts
+var EXPONENTIAL_UNITS = [
+  "a",
+  "0",
+  " ",
+  "x",
+  "ab",
+  "a.",
+  "a-",
+  "a_",
+  "a@",
+  "a/",
+  "a:",
+  "a=",
+  "a;",
+  "aA0",
+  "	"
+];
+var EXPONENTIAL_PROBES = EXPONENTIAL_UNITS.flatMap(
+  (unit) => [23, 25].map((len) => unit.repeat(Math.ceil(len / unit.length)).slice(0, len) + "!")
+);
+var POLYNOMIAL_PROBES = ["abc-", "a.", "a ", "a=", "x", "0", "a@", "a/", "ab"].map(
+  (unit) => unit.repeat(1e4).slice(0, 4e4) + "!"
+);
+
+// ../packages/persistence/src/database.ts
+import { randomUUID as randomUUID9 } from "crypto";
+import { existsSync as existsSync2, renameSync as renameSync2, rmSync as rmSync2 } from "fs";
+import { join as join2, sep } from "path";
+import { DatabaseSync } from "node:sqlite";
+
 // ../packages/persistence/src/ids.ts
 import { createHash } from "crypto";
 function sha256Hex(input) {
@@ -21912,6 +22079,9 @@ var AmbiguousExceptionIdError = class extends Error {
 var ACTIVE_PREDICATE = `revoked_at IS NULL
      AND (expires_at IS NULL OR expires_at > :now)
      AND (max_uses IS NULL OR use_count < max_uses)`;
+var ACTIVE_REVEAL_GRANT_PREDICATE = `capability = 'reveal_to_model'
+     AND conditions IS NULL
+     AND ${ACTIVE_PREDICATE}`;
 var SqliteExceptionsRepository = class {
   constructor(db) {
     this.db = db;
@@ -22003,11 +22173,11 @@ var SqliteExceptionsRepository = class {
     this.db.prepare(
       `INSERT INTO exceptions (
              id, rule_id, category, value_fingerprint, key_version, masked_value,
-             scope, expires_at, max_uses, use_count, last_used_at, justification,
-             conditions, created_by, created_via, created_at, updated_at
+             capability, scope, expires_at, max_uses, use_count, last_used_at,
+             justification, conditions, created_by, created_via, created_at, updated_at
            ) VALUES (
              :id, :ruleId, :category, :valueFingerprint, :keyVersion, :maskedValue,
-             :scope, :expiresAt, :maxUses, 0, NULL, :justification,
+             :capability, :scope, :expiresAt, :maxUses, 0, NULL, :justification,
              :conditions, :createdBy, :createdVia, :now, :now
            )`
     ).run({
@@ -22017,6 +22187,7 @@ var SqliteExceptionsRepository = class {
       valueFingerprint: input.valueFingerprint,
       keyVersion: input.keyVersion,
       maskedValue: input.maskedValue,
+      capability: input.capability ?? "suppress",
       scope: input.scope,
       expiresAt: input.expiresAt === null ? null : isoToEpochMillis(input.expiresAt),
       maxUses: input.maxUses,
@@ -22110,6 +22281,7 @@ var SqliteExceptionsRepository = class {
         ruleId: row.rule_id,
         valueFingerprint: row.value_fingerprint,
         keyVersion: row.key_version,
+        capability: row.capability,
         expiresAt: row.expires_at === null ? null : epochMillisToIso(row.expires_at),
         maxUses: row.max_uses,
         useCount: row.use_count,
@@ -22164,6 +22336,35 @@ var SqliteExceptionsRepository = class {
       }))
     );
   }
+  /**
+   * The active reveal-to-model grant for a vaulted value's identity, or null.
+   * Matching is exact on (ruleId, valueFingerprint, keyVersion) — the same key
+   * suppression uses — plus the capability: a suppression grant must never
+   * authorize a reveal. Read-only: the caller does NOT consume here, because a
+   * revealed value re-enters the detection scan immediately afterward and the
+   * suppression match there claims the use — one crossing, one use.
+   *
+   * A grant with `conditions` NEVER matches here: the reveal path does not yet
+   * evaluate conditions, and a narrowing clause that is ignored would WIDEN the
+   * grant instead. Fail closed until reveal-side condition evaluation exists.
+   */
+  activeRevealGrant(ruleId, valueFingerprint, keyVersion, now = Date.now()) {
+    try {
+      const row = getRow(
+        this.db.prepare(
+          `SELECT id FROM exceptions
+            WHERE rule_id = :ruleId AND value_fingerprint = :valueFingerprint
+              AND key_version = :keyVersion
+              AND ${ACTIVE_REVEAL_GRANT_PREDICATE}
+            LIMIT 1`
+        ),
+        { ruleId, valueFingerprint, keyVersion, now }
+      );
+      return Promise.resolve(row ?? null);
+    } catch (err) {
+      return Promise.reject(err instanceof Error ? err : new Error(String(err)));
+    }
+  }
   /**
    * Retention sweep: delete TERMINAL rows (revoked, expired, or use-budget
    * exhausted) whose last transition is older than the retention window.
@@ -22191,6 +22392,7 @@ function parseExceptionRow(row) {
     valueFingerprint: row.value_fingerprint,
     keyVersion: row.key_version,
     maskedValue: row.masked_value,
+    capability: row.capability,
     scope: row.scope,
     expiresAt: row.expires_at === null ? null : epochMillisToIso(row.expires_at),
     maxUses: row.max_uses,
@@ -24356,29 +24558,310 @@ var SqliteScanLedgerRepository = class {
   }
 };
 
-// ../packages/persistence/src/repositories/security.ts
-var DAY_MS4 = 864e5;
-var SEVERITIES = ["critical", "high", "medium", "low"];
-var ACTION_TO_KIND = {
-  block: "blocked",
-  redact: "redacted",
-  warn: "warned"
-};
-var ENFORCEMENT_KINDS = ["blocked", "redacted", "warned"];
-var SCAN_COVERAGE = [
-  { provider: "claudecode", coverage: 100, supported: true },
-  { provider: "cursor", coverage: 0, supported: false },
-  { provider: "codex", coverage: 0, supported: false },
-  { provider: "chatgpt", coverage: 0, supported: false },
-  { provider: "copilot", coverage: 0, supported: false },
-  { provider: "api", coverage: 0, supported: false }
-];
-var GRANULARITY = {
-  "7d": "day",
-  "30d": "day",
-  "3m": "week",
-  "6m": "week"
-};
+// ../packages/persistence/src/repositories/secret-vault.ts
+import { randomUUID as randomUUID7 } from "crypto";
+var SELECT_COLUMNS = `
+  pointer_id AS pointerId,
+  value_fingerprint AS valueFingerprint,
+  fingerprint_key_version AS fingerprintKeyVersion,
+  key_version AS keyVersion,
+  format_version AS formatVersion,
+  category,
+  rule_id AS ruleId,
+  masked_match AS maskedMatch,
+  provider,
+  ciphertext,
+  nonce,
+  auth_tag AS authTag,
+  occurrence_count AS occurrenceCount,
+  first_seen AS firstSeen,
+  last_seen AS lastSeen`;
+function toRow(raw) {
+  const { provider, ...rest } = raw;
+  return provider === null ? rest : { ...rest, provider };
+}
+var SqliteSecretVaultRepository = class {
+  constructor(db) {
+    this.db = db;
+    this.insertStmt = db.prepare(
+      `INSERT INTO secret_vault (
+         pointer_id, value_fingerprint, fingerprint_key_version, key_version,
+         format_version, category, rule_id, masked_match, provider,
+         ciphertext, nonce, auth_tag,
+         occurrence_count, first_seen, last_seen
+       ) VALUES (
+         :pointerId, :valueFingerprint, :fingerprintKeyVersion, :keyVersion,
+         :formatVersion, :category, :ruleId, :maskedMatch, :provider,
+         :ciphertext, :nonce, :authTag,
+         1, :now, :now
+       )`
+    );
+    this.bumpStmt = db.prepare(
+      `UPDATE secret_vault
+       SET occurrence_count = occurrence_count + 1, last_seen = :now
+       WHERE value_fingerprint = :valueFingerprint`
+    );
+    this.byPointerStmt = db.prepare(
+      `SELECT ${SELECT_COLUMNS} FROM secret_vault WHERE pointer_id = :pointerId`
+    );
+    this.byFingerprintStmt = db.prepare(
+      `SELECT ${SELECT_COLUMNS} FROM secret_vault WHERE value_fingerprint = :valueFingerprint`
+    );
+    this.listStmt = db.prepare(`SELECT ${SELECT_COLUMNS} FROM secret_vault ORDER BY first_seen`);
+    this.replaceCiphertextStmt = db.prepare(
+      `UPDATE secret_vault
+       SET key_version = :keyVersion, ciphertext = :ciphertext, nonce = :nonce, auth_tag = :authTag
+       WHERE pointer_id = :pointerId`
+    );
+    this.refreshFingerprintStmt = db.prepare(
+      `UPDATE secret_vault
+       SET value_fingerprint = :valueFingerprint, fingerprint_key_version = :fingerprintKeyVersion
+       WHERE pointer_id = :pointerId`
+    );
+    this.derefStmt = db.prepare(
+      `INSERT INTO secret_vault_deref (id, pointer_id, at, target, reason, outcome, grant_id, pointer_count)
+       VALUES (:id, :pointerId, :at, :target, :reason, :outcome, :grantId, :pointerCount)`
+    );
+  }
+  db;
+  insertStmt;
+  bumpStmt;
+  byPointerStmt;
+  byFingerprintStmt;
+  listStmt;
+  replaceCiphertextStmt;
+  refreshFingerprintStmt;
+  derefStmt;
+  /**
+   * Vault a value, or record another sighting of one already vaulted. Keyed on
+   * `valueFingerprint`, never on the caller's pointer id: a value seen again
+   * bumps `occurrence_count` and `last_seen` and comes back with its ORIGINAL
+   * pointer, category and ciphertext, so the same secret always resolves to one
+   * wire token. `minted` is true only when this call created the row.
+   *
+   * The read-then-write runs in one IMMEDIATE transaction so two concurrent
+   * writers cannot both decide they are minting.
+   */
+  upsert(input, now) {
+    let minted = false;
+    withTransaction(
+      this.db,
+      () => {
+        const existing = getRow(this.byFingerprintStmt, {
+          valueFingerprint: input.valueFingerprint
+        });
+        if (existing === void 0) {
+          this.insertStmt.run(
+            bindParams({
+              pointerId: input.pointerId,
+              valueFingerprint: input.valueFingerprint,
+              fingerprintKeyVersion: input.fingerprintKeyVersion,
+              keyVersion: input.keyVersion,
+              formatVersion: input.formatVersion ?? POINTER_FORMAT_VERSION,
+              category: input.category,
+              ruleId: input.ruleId,
+              maskedMatch: input.maskedMatch,
+              provider: input.provider,
+              ciphertext: input.ciphertext,
+              nonce: input.nonce,
+              authTag: input.authTag,
+              now
+            })
+          );
+          minted = true;
+          return;
+        }
+        this.bumpStmt.run({ valueFingerprint: input.valueFingerprint, now });
+      },
+      "IMMEDIATE"
+    );
+    const row = getRow(this.byFingerprintStmt, {
+      valueFingerprint: input.valueFingerprint
+    });
+    if (row === void 0) throw new Error("vault: row vanished immediately after write");
+    return { row: toRow(row), minted };
+  }
+  byPointerId(pointerId) {
+    const raw = getRow(this.byPointerStmt, { pointerId });
+    return raw === void 0 ? null : toRow(raw);
+  }
+  byValueFingerprint(fingerprint) {
+    const raw = getRow(this.byFingerprintStmt, { valueFingerprint: fingerprint });
+    return raw === void 0 ? null : toRow(raw);
+  }
+  /** Append one audit row. Carries no raw value and no ciphertext, by shape. */
+  recordDeref(entry) {
+    this.derefStmt.run(
+      bindParams({
+        id: entry.id,
+        pointerId: entry.pointerId,
+        at: entry.at,
+        target: entry.target,
+        reason: entry.reason,
+        outcome: entry.outcome,
+        grantId: entry.grantId,
+        pointerCount: entry.pointerCount ?? 1
+      })
+    );
+  }
+  listAll() {
+    return allRows(this.listStmt).map(toRow);
+  }
+  /** Re-seal an entry under a new key epoch, leaving its identity untouched. */
+  replaceCiphertext(pointerId, next) {
+    this.replaceCiphertextStmt.run({ pointerId, ...next });
+  }
+  /** Re-derive an entry's fingerprint under a new fingerprint-key epoch. */
+  refreshFingerprint(pointerId, next) {
+    this.refreshFingerprintStmt.run({ pointerId, ...next });
+  }
+  /**
+   * Destroy every vaulted value and report how many were destroyed. The deref
+   * audit is left alone on purpose — see the table note above.
+   */
+  purgeAll() {
+    let destroyed = 0;
+    withTransaction(
+      this.db,
+      () => {
+        destroyed = this.countEntries();
+        this.db.exec("DELETE FROM secret_vault");
+      },
+      "IMMEDIATE"
+    );
+    return destroyed;
+  }
+  /**
+   * Record (or re-stamp) one place a pointer has been written. One row per
+   * (pointer, location); a re-sighting bumps last_seen. Best-effort bookkeeping
+   * on hook paths — a failure must never affect the rewrite that triggered it,
+   * so callers wrap this, not the other way around.
+   */
+  recordSighting(entry, now) {
+    this.db.prepare(
+      `INSERT INTO secret_vault_sighting (id, pointer_id, location, kind, first_seen, last_seen)
+         VALUES (:id, :pointerId, :location, :kind, :now, :now)
+         ON CONFLICT (pointer_id, location) DO UPDATE SET last_seen = :now`
+    ).run({
+      id: randomUUID7(),
+      pointerId: entry.pointerId,
+      location: entry.location,
+      kind: entry.kind,
+      now
+    });
+  }
+  listSightings(pointerId) {
+    const rows = allRows(
+      this.db.prepare(
+        `SELECT location, kind, first_seen, last_seen FROM secret_vault_sighting
+          WHERE pointer_id = :pointerId ORDER BY last_seen DESC`
+      ),
+      { pointerId }
+    );
+    return rows.map((r) => ({
+      location: r.location,
+      kind: r.kind,
+      firstSeen: new Date(r.first_seen).toISOString(),
+      lastSeen: new Date(r.last_seen).toISOString()
+    }));
+  }
+  /**
+   * The dashboard inventory: every vaulted value's descriptor data joined with
+   * its sightings and the active reveal-to-model grant when one exists.
+   * Raw-free by construction — neither the fingerprint nor the ciphertext
+   * columns are selected.
+   */
+  listInventory(now = Date.now()) {
+    const rows = allRows(
+      this.db.prepare(
+        `SELECT v.pointer_id, v.category, v.rule_id, v.masked_match, v.provider,
+                v.occurrence_count, v.first_seen, v.last_seen,
+                (SELECT e.id FROM exceptions e
+                  WHERE e.rule_id = v.rule_id
+                    AND e.value_fingerprint = v.value_fingerprint
+                    AND e.key_version = v.fingerprint_key_version
+                    AND ${ACTIVE_REVEAL_GRANT_PREDICATE}
+                  LIMIT 1) AS grant_id
+           FROM secret_vault v
+          ORDER BY v.last_seen DESC`
+      ),
+      { now }
+    );
+    return rows.map((r) => ({
+      pointerId: r.pointer_id,
+      category: r.category,
+      ...r.provider === null ? {} : { provider: r.provider },
+      maskedMatch: r.masked_match,
+      occurrences: r.occurrence_count,
+      firstSeen: new Date(r.first_seen).toISOString(),
+      lastSeen: new Date(r.last_seen).toISOString(),
+      revealGrantId: r.grant_id,
+      sightings: this.listSightings(r.pointer_id)
+    }));
+  }
+  /**
+   * The de-reference trail, newest first. By default the batched, high-volume
+   * reasons (display, view-render) are hidden and counted instead — the rows
+   * that matter as a signal are the model crossings, and burying them under
+   * render noise would defeat the audit's purpose.
+   */
+  listDerefs(opts) {
+    const limit = opts?.limit ?? 200;
+    const where = opts?.includeBatched === true ? "" : `WHERE reason NOT IN ('display', 'view-render')`;
+    const rows = allRows(
+      this.db.prepare(
+        `SELECT id, pointer_id, at, target, reason, outcome, grant_id, pointer_count
+           FROM secret_vault_deref ${where}
+          ORDER BY at DESC, rowid DESC LIMIT :limit`
+      ),
+      { limit }
+    );
+    const hiddenBatched = opts?.includeBatched === true ? 0 : countScalar(
+      this.db,
+      `SELECT count(*) AS n FROM secret_vault_deref WHERE reason IN ('display', 'view-render')`
+    );
+    return {
+      rows: rows.map((r) => ({
+        id: r.id,
+        pointerId: r.pointer_id,
+        at: new Date(r.at).toISOString(),
+        target: r.target,
+        reason: r.reason,
+        outcome: r.outcome,
+        ...r.grant_id === null ? {} : { grantId: r.grant_id },
+        pointerCount: r.pointer_count
+      })),
+      hiddenBatched
+    };
+  }
+  countEntries() {
+    return countScalar(this.db, "SELECT COUNT(*) AS n FROM secret_vault");
+  }
+};
+
+// ../packages/persistence/src/repositories/security.ts
+var DAY_MS4 = 864e5;
+var SEVERITIES = ["critical", "high", "medium", "low"];
+var ACTION_TO_KIND = {
+  block: "blocked",
+  redact: "redacted",
+  warn: "warned"
+};
+var ENFORCEMENT_KINDS = ["blocked", "redacted", "warned"];
+var SCAN_COVERAGE = [
+  { provider: "claudecode", coverage: 100, supported: true },
+  { provider: "cursor", coverage: 0, supported: false },
+  { provider: "codex", coverage: 0, supported: false },
+  { provider: "chatgpt", coverage: 0, supported: false },
+  { provider: "copilot", coverage: 0, supported: false },
+  { provider: "api", coverage: 0, supported: false }
+];
+var GRANULARITY = {
+  "7d": "day",
+  "30d": "day",
+  "3m": "week",
+  "6m": "week"
+};
 function granularityFor(range) {
   return GRANULARITY[range];
 }
@@ -24701,7 +25184,7 @@ var SqliteSecurityRepository = class {
 };
 
 // ../packages/persistence/src/repositories/shares.ts
-import { randomUUID as randomUUID7 } from "crypto";
+import { randomUUID as randomUUID8 } from "crypto";
 var MAX_EGRESS_CALL_SITES_PER_PROJECT = 5e3;
 var IN_CHUNK = 500;
 var KIND_ORDER = ["provider", "internal", "external", "ip"];
@@ -24957,7 +25440,7 @@ var SqliteSharesRepository = class {
                (id, destination_id, host, decision, created_at, updated_at)
              VALUES (:id, :destinationId, :host, :decision, :now, :now)`
         ).run({
-          id: randomUUID7(),
+          id: randomUUID8(),
           destinationId,
           host: dest.host,
           decision,
@@ -25106,7 +25589,7 @@ var SqliteSharesRepository = class {
       let destinationId = destIds.get(hit.host);
       if (destinationId === void 0) {
         destStmt.run({
-          id: randomUUID7(),
+          id: randomUUID8(),
           kind: hit.kind,
           name: hit.name,
           host: hit.host,
@@ -25122,7 +25605,7 @@ var SqliteSharesRepository = class {
       let endpointId = endpointIds.get(endpointKey);
       if (endpointId === void 0) {
         endpointStmt.run({
-          id: randomUUID7(),
+          id: randomUUID8(),
           destinationId,
           method: hit.method,
           transport: hit.transport,
@@ -25135,7 +25618,7 @@ var SqliteSharesRepository = class {
         endpointIds.set(endpointKey, endpointId);
       }
       siteStmt.run({
-        id: randomUUID7(),
+        id: randomUUID8(),
         endpointId,
         project: input.project,
         projectKey: input.projectKey,
@@ -25551,6 +26034,7 @@ function openAndInitialize(file2) {
       policies,
       installedPacks,
       scanLedger: new SqliteScanLedgerRepository(db),
+      secretVault: new SqliteSecretVaultRepository(db),
       exceptions: new SqliteExceptionsRepository(db),
       resolutions: new SqliteResolutionsRepository(db),
       ruleProbeCache: new SqliteRuleProbeCacheRepository(db),
@@ -25586,6 +26070,7 @@ function openLocalDatabase(dir) {
     policies,
     installedPacks,
     scanLedger,
+    secretVault,
     exceptions,
     resolutions,
     ruleProbeCache,
@@ -25694,7 +26179,7 @@ function openLocalDatabase(dir) {
         const definitionId = definitionIds.get(`${finding.ruleId}@${finding.version}`);
         if (!definitionId) continue;
         inspectionFindings.insertFinding({
-          id: randomUUID8(),
+          id: randomUUID9(),
           auditEventId: record2.scanEvent.id,
           inspectionDefinitionId: definitionId,
           span: finding.span,
@@ -25771,6 +26256,7 @@ function openLocalDatabase(dir) {
     policies,
     installedPacks,
     scanLedger,
+    secretVault,
     exceptions,
     resolutions,
     ruleProbeCache,
@@ -25841,7 +26327,11 @@ function parseKeyFile(raw) {
   }
   return { version: version2, material: bytes };
 }
-var KEY_VERSION_TABLES = ["exceptions", "blocked_detections"];
+var KEY_VERSION_COLUMNS = {
+  exceptions: "key_version",
+  blocked_detections: "key_version",
+  secret_vault: "fingerprint_key_version"
+};
 var SQLITE_ERROR = 1;
 var FLOOR_BUSY_TIMEOUT_MS = 250;
 var FloorUnreadableError = class extends Error {
@@ -25862,10 +26352,10 @@ function storedKeyVersionFloor(dataDir2) {
     db = new DatabaseSync2(file2, { readOnly: true });
     db.exec(`PRAGMA busy_timeout = ${String(FLOOR_BUSY_TIMEOUT_MS)}`);
     let floor = 0;
-    for (const table of KEY_VERSION_TABLES) {
+    for (const [table, column] of Object.entries(KEY_VERSION_COLUMNS)) {
       try {
         const row = getRow(
-          db.prepare(`SELECT MAX(key_version) AS v FROM ${table}`)
+          db.prepare(`SELECT MAX(${column}) AS v FROM ${table}`)
         );
         floor = Math.max(floor, row?.v ?? 0);
       } catch (err) {
@@ -25944,6 +26434,9 @@ function dataDir(base = defaultDataDir()) {
 function dbPath(base = defaultDataDir()) {
   return join4(dataDir(base), "aka.db");
 }
+function keysDir(base = defaultDataDir()) {
+  return join4(base, "keys");
+}
 function ensureLayoutDirSync(dir = defaultDataDir()) {
   ensureDataDirSync(dir);
 }
@@ -25970,13 +26463,874 @@ function readJson(file2) {
   return parseJsonObject(text) ?? null;
 }
 
-// ../packages/persistence/src/warn-era-cap.ts
-import { existsSync as existsSync4, writeFileSync as writeFileSync2 } from "fs";
+// ../packages/persistence/src/vault/crypto.ts
+import {
+  createCipheriv,
+  createDecipheriv,
+  createHmac as createHmac2,
+  hkdfSync,
+  timingSafeEqual
+} from "crypto";
+var POINTER_ID_BYTES = 16;
+var NONCE_BYTES = 12;
+var TAG_BYTES = 10;
+var SUBKEY_BYTES = 32;
+var HKDF_INFO_ENC = "aka:vault:enc:v1";
+var HKDF_INFO_SIGN = "aka:vault:sign:v1";
+var HKDF_SALT = "aka:vault:v1";
+var B32_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZ234567";
+function base32Encode(bytes) {
+  let out = "";
+  let buffer = 0;
+  let bits = 0;
+  for (const byte of bytes) {
+    buffer = buffer << 8 | byte;
+    bits += 8;
+    while (bits >= 5) {
+      out += B32_ALPHABET.charAt(buffer >>> bits - 5 & 31);
+      bits -= 5;
+    }
+  }
+  if (bits > 0) out += B32_ALPHABET.charAt(buffer << 5 - bits & 31);
+  return out;
+}
+function base32Decode(text) {
+  const out = [];
+  let buffer = 0;
+  let bits = 0;
+  for (const char of text) {
+    const value = B32_ALPHABET.indexOf(char);
+    if (value < 0) throw new Error("base32: character outside the alphabet");
+    buffer = buffer << 5 | value;
+    bits += 5;
+    if (bits >= 8) {
+      out.push(buffer >>> bits - 8 & 255);
+      bits -= 8;
+    }
+  }
+  return Buffer.from(out);
+}
+function encodeKeyVersion(version2) {
+  if (!Number.isInteger(version2) || version2 < 1 || version2 > 4294967295) {
+    throw new Error("vault: key version out of range");
+  }
+  const bytes = [];
+  let remaining = version2;
+  while (remaining > 0) {
+    bytes.unshift(remaining & 255);
+    remaining = Math.floor(remaining / 256);
+  }
+  return base32Encode(Uint8Array.from(bytes));
+}
+function decodeKeyVersion(encoded) {
+  const bytes = base32Decode(encoded);
+  if (bytes.length === 0 || bytes.length > 4) throw new Error("vault: bad key version encoding");
+  let version2 = 0;
+  for (const byte of bytes) version2 = version2 * 256 + byte;
+  if (version2 < 1) throw new Error("vault: bad key version");
+  return version2;
+}
+function deriveSubkeys(master) {
+  const derive = (info) => Buffer.from(hkdfSync("sha256", master, HKDF_SALT, info, SUBKEY_BYTES));
+  return { enc: derive(HKDF_INFO_ENC), sign: derive(HKDF_INFO_SIGN) };
+}
+function bindingInput(keyVersion, pointerId, category, formatVersion = POINTER_FORMAT_VERSION) {
+  if (pointerId.length !== POINTER_ID_BYTES) {
+    throw new Error("vault: pointer id must be 16 bytes");
+  }
+  const head = Buffer.alloc(6);
+  head.writeUInt16BE(formatVersion, 0);
+  head.writeUInt32BE(keyVersion, 2);
+  return Buffer.concat([head, Buffer.from(pointerId), Buffer.from(category, "utf8")]);
+}
+function seal(encKey, plaintext, aad, nonce) {
+  const cipher = createCipheriv("aes-256-gcm", encKey, nonce);
+  cipher.setAAD(aad);
+  const ciphertext = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
+  return { ciphertext, nonce, authTag: cipher.getAuthTag() };
+}
+function open(encKey, sealed, aad) {
+  try {
+    const decipher = createDecipheriv("aes-256-gcm", encKey, sealed.nonce);
+    decipher.setAAD(aad);
+    decipher.setAuthTag(sealed.authTag);
+    return Buffer.concat([decipher.update(sealed.ciphertext), decipher.final()]).toString("utf8");
+  } catch {
+    return null;
+  }
+}
+function signPointer(signKey, keyVersion, pointerId, category) {
+  return createHmac2("sha256", signKey).update(bindingInput(keyVersion, pointerId, category, POINTER_FORMAT_VERSION)).digest().subarray(0, TAG_BYTES);
+}
+function verifyPointerTag(signKey, keyVersion, pointerId, category, tag) {
+  if (tag.length !== TAG_BYTES) return false;
+  const expected = signPointer(signKey, keyVersion, pointerId, category);
+  return timingSafeEqual(expected, Buffer.from(tag));
+}
+function formatPointer(category, keyVersion, pointerId, tag) {
+  return `[[aka:${category}:${encodeKeyVersion(keyVersion)}.${base32Encode(pointerId)}.${base32Encode(tag)}]]`;
+}
+
+// ../packages/persistence/src/vault/key-provider.ts
+import { execFileSync as execFileSync2 } from "child_process";
+import { randomBytes as randomBytes2 } from "crypto";
+import {
+  chmodSync as chmodSync2,
+  mkdirSync as mkdirSync2,
+  readFileSync as readFileSync4,
+  renameSync as renameSync4,
+  rmSync as rmSync3,
+  statSync,
+  writeFileSync as writeFileSync2
+} from "fs";
 import { join as join6 } from "path";
+var VaultKeyEpochMissingError = class extends Error {
+  version;
+  constructor(version2) {
+    super(`vault: key epoch ${String(version2)} is not present in the keyring`);
+    this.name = "VaultKeyEpochMissingError";
+    this.version = version2;
+  }
+};
+var VAULT_KEY_FILENAME = "vault.key";
+var KEY_MATERIAL_BYTES2 = 32;
+var KEYCHAIN_SERVICE = "aka-vault";
+var KEYCHAIN_ACCOUNT = "keyring";
+function parseKeyring(raw) {
+  const parsed = JSON.parse(raw);
+  if (typeof parsed !== "object" || parsed === null) {
+    throw new Error("vault key file is corrupt: not a JSON object");
+  }
+  const { current, keys } = parsed;
+  if (typeof current !== "number" || !Number.isInteger(current) || current < 1) {
+    throw new Error("vault key file is corrupt: bad current version");
+  }
+  if (typeof keys !== "object" || keys === null || Array.isArray(keys)) {
+    throw new Error("vault key file is corrupt: bad keys map");
+  }
+  const map2 = /* @__PURE__ */ new Map();
+  for (const [rawVersion, rawMaterial] of Object.entries(keys)) {
+    const version2 = Number(rawVersion);
+    if (!Number.isInteger(version2) || version2 < 1) {
+      throw new Error("vault key file is corrupt: bad key version");
+    }
+    if (typeof rawMaterial !== "string") {
+      throw new Error("vault key file is corrupt: bad key material");
+    }
+    const bytes = Buffer.from(rawMaterial, "base64");
+    if (bytes.length !== KEY_MATERIAL_BYTES2) {
+      throw new Error("vault key file is corrupt: bad key material length");
+    }
+    map2.set(version2, bytes);
+  }
+  if (!map2.has(current)) {
+    throw new Error("vault key file is corrupt: current version has no material");
+  }
+  return { current, keys: map2 };
+}
+function serializeKeyring(keyring) {
+  const keys = {};
+  for (const version2 of [...keyring.keys.keys()].sort((a, b) => a - b)) {
+    const material = keyring.keys.get(version2);
+    if (material) keys[String(version2)] = material.toString("base64");
+  }
+  return JSON.stringify({ current: keyring.current, keys });
+}
+function mintKeyring() {
+  return { current: 1, keys: /* @__PURE__ */ new Map([[1, randomBytes2(KEY_MATERIAL_BYTES2)]]) };
+}
+function withNextEpoch(keyring) {
+  const next = Math.max(...keyring.keys.keys()) + 1;
+  const keys = new Map(keyring.keys);
+  keys.set(next, randomBytes2(KEY_MATERIAL_BYTES2));
+  return { current: next, keys };
+}
+function currentOf(keyring) {
+  const material = keyring.keys.get(keyring.current);
+  if (!material) throw new VaultKeyEpochMissingError(keyring.current);
+  return { material, version: keyring.current };
+}
+function epochOf(keyring, version2) {
+  const material = keyring.keys.get(version2);
+  if (!material) throw new VaultKeyEpochMissingError(version2);
+  return { material, version: version2 };
+}
+function asAsync(work) {
+  try {
+    return Promise.resolve(work());
+  } catch (err) {
+    return Promise.reject(err instanceof Error ? err : new Error(String(err)));
+  }
+}
+function asError(err) {
+  return err instanceof Error ? err : new Error(String(err));
+}
+var ROTATION_LOCK_STALE_MS = 6e4;
+var LOCK_OWNER_FILE = "owner";
+var ROTATION_IN_PROGRESS = "vault: a key rotation is already in progress";
+function claimRotationLock(lock, owner) {
+  try {
+    mkdirSync2(lock);
+  } catch (err) {
+    if (err.code === "EEXIST") return false;
+    throw asError(err);
+  }
+  try {
+    writeFileSync2(join6(lock, LOCK_OWNER_FILE), `${owner}
+`, { mode: DATA_FILE_MODE });
+    return true;
+  } catch (err) {
+    rmSync3(lock, { recursive: true, force: true });
+    throw asError(err);
+  }
+}
+function acquireRotationLock(keysDir2) {
+  const lock = join6(keysDir2, `${VAULT_KEY_FILENAME}.lock`);
+  const owner = randomBytes2(16).toString("hex");
+  if (claimRotationLock(lock, owner)) return { lock, owner };
+  let held;
+  try {
+    held = statSync(lock);
+  } catch {
+    throw new Error(ROTATION_IN_PROGRESS);
+  }
+  if (Date.now() - held.mtimeMs < ROTATION_LOCK_STALE_MS) throw new Error(ROTATION_IN_PROGRESS);
+  const aside = `${lock}.stale.${owner}`;
+  try {
+    const now = statSync(lock);
+    if (now.ino !== held.ino || now.mtimeMs !== held.mtimeMs) {
+      throw new Error(ROTATION_IN_PROGRESS);
+    }
+    renameSync4(lock, aside);
+  } catch (err) {
+    if (err instanceof Error && err.message === ROTATION_IN_PROGRESS) throw err;
+    throw new Error(ROTATION_IN_PROGRESS, { cause: err });
+  }
+  rmSync3(aside, { recursive: true, force: true });
+  if (!claimRotationLock(lock, owner)) throw new Error(ROTATION_IN_PROGRESS);
+  return { lock, owner };
+}
+function releaseRotationLock(lease) {
+  try {
+    if (readFileSync4(join6(lease.lock, LOCK_OWNER_FILE), "utf8").trim() !== lease.owner) return;
+  } catch {
+    return;
+  }
+  rmSync3(lease.lock, { recursive: true, force: true });
+}
+function withRotationLock(keysDir2, work) {
+  ensureDataDirSync(keysDir2);
+  const lease = acquireRotationLock(keysDir2);
+  try {
+    return work();
+  } finally {
+    releaseRotationLock(lease);
+  }
+}
+var FileKeyProvider = class {
+  #keysDir;
+  constructor(keysDir2) {
+    this.#keysDir = keysDir2;
+  }
+  get filePath() {
+    return join6(this.#keysDir, VAULT_KEY_FILENAME);
+  }
+  loadOrCreate() {
+    return asAsync(() => {
+      const existing = this.#read();
+      if (!existing) return currentOf(this.#createExclusive());
+      tightenFileMode(this.filePath);
+      return currentOf(existing);
+    });
+  }
+  rotate() {
+    return asAsync(
+      () => withRotationLock(this.#keysDir, () => {
+        const existing = this.#read();
+        if (!existing) return currentOf(this.#createExclusive());
+        return currentOf(this.#write(withNextEpoch(existing)));
+      })
+    );
+  }
+  materialFor(version2) {
+    return asAsync(() => {
+      const existing = this.#read();
+      if (!existing) throw new VaultKeyEpochMissingError(version2);
+      return epochOf(existing, version2);
+    });
+  }
+  /** The keyring, or null when the file is ABSENT. A corrupt file throws. */
+  #read() {
+    let raw;
+    try {
+      raw = readFileSync4(this.filePath, "utf8");
+    } catch (err) {
+      if (err.code === "ENOENT") return null;
+      throw err instanceof Error ? err : new Error(String(err));
+    }
+    return parseKeyring(raw);
+  }
+  /**
+   * First mint: the keyring is created at its FINAL path with a
+   * creation-exclusive write, so two processes racing a fresh machine cannot
+   * each mint a different epoch 1 — with tmp + rename the loser's replace
+   * would orphan everything the winner had already sealed. On EEXIST the
+   * loser re-reads and adopts the winner's keyring; it minted nothing.
+   * Atomic replace is unnecessary here: nothing can be mid-read of a file
+   * that did not exist, and a torn exclusive write parses as corrupt on the
+   * next read and fails secure rather than being re-minted over.
+   */
+  #createExclusive() {
+    ensureDataDirSync(this.#keysDir);
+    const keyring = mintKeyring();
+    try {
+      writeFileSync2(this.filePath, `${serializeKeyring(keyring)}
+`, {
+        flag: "wx",
+        mode: DATA_FILE_MODE
+      });
+    } catch (err) {
+      if (err.code !== "EEXIST") throw asError(err);
+      const winner = this.#read();
+      if (!winner) {
+        throw new Error("vault: key file vanished during first mint", { cause: err });
+      }
+      return winner;
+    }
+    tightenFileMode(this.filePath);
+    return keyring;
+  }
+  /**
+   * Atomic tmp + rename so a crash mid-write cannot truncate the keyring.
+   * Used only for rotation, under the rotation lock — first creation goes
+   * through the creation-exclusive path instead.
+   */
+  #write(keyring) {
+    ensureDataDirSync(this.#keysDir);
+    const file2 = this.filePath;
+    const tmp = `${file2}.tmp`;
+    writeFileSync2(tmp, `${serializeKeyring(keyring)}
+`, { mode: DATA_FILE_MODE });
+    renameSync4(tmp, file2);
+    tightenFileMode(file2);
+    return keyring;
+  }
+};
+function tightenFileMode(file2) {
+  try {
+    chmodSync2(file2, DATA_FILE_MODE);
+  } catch {
+  }
+}
+var runSecurity = (args) => execFileSync2("/usr/bin/security", args, {
+  encoding: "utf8",
+  stdio: ["ignore", "pipe", "ignore"]
+});
+var SECURITY_ITEM_NOT_FOUND = 44;
+var KeychainKeyProvider = class {
+  #keysDir;
+  #exec;
+  constructor(keysDir2, exec = runSecurity) {
+    if (exec === runSecurity && process.platform !== "darwin") {
+      throw new Error(
+        `keychain custody is not available on this platform (${process.platform}); use file custody`
+      );
+    }
+    this.#keysDir = keysDir2;
+    this.#exec = exec;
+  }
+  /** Where a fallback file provider for the same vault would keep its keyring. */
+  get keysDir() {
+    return this.#keysDir;
+  }
+  loadOrCreate() {
+    return asAsync(() => {
+      const existing = this.#read();
+      if (existing) return currentOf(existing);
+      return currentOf(this.#create(mintKeyring()));
+    });
+  }
+  rotate() {
+    return asAsync(
+      () => withRotationLock(this.#keysDir, () => {
+        const existing = this.#read();
+        if (!existing) return currentOf(this.#create(mintKeyring()));
+        return currentOf(this.#replace(withNextEpoch(existing)));
+      })
+    );
+  }
+  materialFor(version2) {
+    return asAsync(() => {
+      const existing = this.#read();
+      if (!existing) throw new VaultKeyEpochMissingError(version2);
+      return epochOf(existing, version2);
+    });
+  }
+  /** The keyring, or null when no item exists yet. A corrupt item throws. */
+  #read() {
+    let raw;
+    try {
+      raw = this.#exec([
+        "find-generic-password",
+        "-s",
+        KEYCHAIN_SERVICE,
+        "-a",
+        KEYCHAIN_ACCOUNT,
+        "-w"
+      ]);
+    } catch (err) {
+      if (err.status === SECURITY_ITEM_NOT_FOUND) return null;
+      throw new Error(
+        `vault: keychain read failed (${err instanceof Error ? err.message : String(err)}); refusing to treat the failure as an absent keyring`,
+        { cause: err }
+      );
+    }
+    const body = raw.trim();
+    if (body.length === 0) return null;
+    return parseKeyring(body);
+  }
+  /**
+   * First mint: a plain `add-generic-password` (no `-U`) fails when an item
+   * already exists, so a concurrent first mint cannot overwrite the winner's
+   * keyring — the loser re-reads and adopts it instead.
+   */
+  #create(keyring) {
+    const args = [
+      "add-generic-password",
+      "-s",
+      KEYCHAIN_SERVICE,
+      "-a",
+      KEYCHAIN_ACCOUNT,
+      "-w",
+      serializeKeyring(keyring)
+    ];
+    try {
+      this.#exec(args);
+    } catch (err) {
+      const winner = this.#read();
+      if (winner) return winner;
+      throw asError(err);
+    }
+    return keyring;
+  }
+  // `-U` updates the item in place, deliberately replacing the stored map with
+  // one that contains it — used only for rotation, under the rotation lock.
+  #replace(keyring) {
+    this.#exec([
+      "add-generic-password",
+      "-U",
+      "-s",
+      KEYCHAIN_SERVICE,
+      "-a",
+      KEYCHAIN_ACCOUNT,
+      "-w",
+      serializeKeyring(keyring)
+    ]);
+    return keyring;
+  }
+};
+function createKeyProvider(custody, keysDir2) {
+  if (custody === "keychain") return new KeychainKeyProvider(keysDir2);
+  return new FileKeyProvider(keysDir2);
+}
+
+// ../packages/persistence/src/vault/vault.ts
+import { randomBytes as randomBytes3, randomUUID as randomUUID10 } from "crypto";
+var CONSENT_ABSENT = /* @__PURE__ */ Symbol("aka.vault.consentAbsent");
+var UNAVAILABLE = /* @__PURE__ */ Symbol("aka.vault.unavailable");
+var VAULT_PURGE_POINTER_ID = "*";
+function parsePointer(token) {
+  if (!POINTER_TOKEN_ANCHORED.test(token)) return null;
+  const body = token.slice("[[aka:".length, -"]]".length);
+  const colon = body.indexOf(":");
+  if (colon < 0) return null;
+  const category = body.slice(0, colon);
+  const [kv, id, tag] = body.slice(colon + 1).split(".");
+  if (kv === void 0 || id === void 0 || tag === void 0) return null;
+  try {
+    const keyVersion = decodeKeyVersion(kv);
+    const pointerId = base32Decode(id);
+    const tagBytes = base32Decode(tag);
+    if (encodeKeyVersion(keyVersion) !== kv || base32Encode(pointerId) !== id || base32Encode(tagBytes) !== tag) {
+      return null;
+    }
+    return { category, keyVersion, pointerId, tag: tagBytes };
+  } catch {
+    return null;
+  }
+}
+var SecretVault = class {
+  #repo;
+  #keys;
+  #fingerprintKey;
+  #isConsented;
+  #verifyGrant;
+  #now;
+  constructor(deps) {
+    this.#repo = deps.repo;
+    this.#keys = deps.keys;
+    this.#fingerprintKey = deps.fingerprintKey;
+    this.#isConsented = deps.isConsented;
+    this.#verifyGrant = deps.verifyGrant;
+    this.#now = deps.now ?? (() => Date.now());
+  }
+  /**
+   * Store a value and return the pointer that stands for it. The same value
+   * always yields the same pointer on this machine — one row, one pointer id,
+   * one category — which is what makes dedup and reuse counting work.
+   */
+  async tokenize(raw, meta3) {
+    if (!this.#isConsented()) return CONSENT_ABSENT;
+    const valueFingerprint = fingerprintValue(this.#fingerprintKey, raw);
+    const existing = this.#repo.byValueFingerprint(valueFingerprint);
+    const now = this.#now();
+    if (existing) {
+      this.#repo.upsert({ ...existing, provider: existing.provider ?? void 0 }, now);
+      return await this.#emitToken(existing.keyVersion, existing.pointerId, existing.category);
+    }
+    const { material, version: version2 } = await this.#keys.loadOrCreate();
+    const subkeys = deriveSubkeys(material);
+    const pointerId = randomBytes3(POINTER_ID_BYTES);
+    const aad = bindingInput(version2, pointerId, meta3.category, POINTER_FORMAT_VERSION);
+    const sealed = seal(subkeys.enc, raw, aad, randomBytes3(NONCE_BYTES));
+    const { row } = this.#repo.upsert(
+      {
+        pointerId: base32Encode(pointerId),
+        valueFingerprint,
+        fingerprintKeyVersion: this.#fingerprintKey.version,
+        keyVersion: version2,
+        // Recorded so the row stays OPENABLE if the wire-format constant ever
+        // moves: it is part of this row's AEAD AAD. It is not a tag input —
+        // tags are pinned to the constant on both sides.
+        formatVersion: POINTER_FORMAT_VERSION,
+        category: meta3.category,
+        ruleId: meta3.ruleId,
+        maskedMatch: meta3.maskedMatch,
+        provider: meta3.provider,
+        ciphertext: sealed.ciphertext.toString("base64"),
+        nonce: sealed.nonce.toString("base64"),
+        authTag: sealed.authTag.toString("base64")
+      },
+      now
+    );
+    return await this.#emitToken(row.keyVersion, row.pointerId, row.category);
+  }
+  /**
+   * Resolve a pointer back to its value, for a human or (with a grant) for the
+   * model. Every call that gets as far as an identified row writes an audit row.
+   */
+  async detokenize(token, opts) {
+    const parsed = parsePointer(token);
+    if (!parsed) return UNAVAILABLE;
+    let signKey;
+    try {
+      const epoch = await this.#keys.materialFor(parsed.keyVersion);
+      signKey = deriveSubkeys(epoch.material).sign;
+    } catch {
+      return UNAVAILABLE;
+    }
+    if (!verifyPointerTag(signKey, parsed.keyVersion, parsed.pointerId, parsed.category, parsed.tag)) {
+      return UNAVAILABLE;
+    }
+    const pointerId = base32Encode(parsed.pointerId);
+    const row = this.#repo.byPointerId(pointerId);
+    if (!row) {
+      this.#audit(pointerId, opts, "unavailable");
+      return UNAVAILABLE;
+    }
+    if (row.category !== parsed.category) return UNAVAILABLE;
+    if (opts.target === "model") {
+      const grantId = opts.grantId;
+      const verify = this.#verifyGrant;
+      if (verify === void 0 || grantId === void 0 || grantId === "") {
+        this.#audit(pointerId, opts, "refused");
+        return UNAVAILABLE;
+      }
+      let covered;
+      try {
+        covered = await verify(grantId, {
+          ruleId: row.ruleId,
+          valueFingerprint: row.valueFingerprint,
+          fingerprintKeyVersion: row.fingerprintKeyVersion
+        });
+      } catch {
+        covered = false;
+      }
+      if (!covered) {
+        this.#audit(pointerId, opts, "refused");
+        return UNAVAILABLE;
+      }
+    }
+    let raw;
+    try {
+      const epoch = await this.#keys.materialFor(row.keyVersion);
+      raw = open(
+        deriveSubkeys(epoch.material).enc,
+        {
+          ciphertext: Buffer.from(row.ciphertext, "base64"),
+          nonce: Buffer.from(row.nonce, "base64"),
+          authTag: Buffer.from(row.authTag, "base64")
+        },
+        // Sealed under the ROW's epoch and format version. Rotation may have
+        // moved the epoch past the one this token names, and a format bump may
+        // have moved the constant past the generation this row was sealed
+        // under — the AAD follows the row in both cases, never the token.
+        bindingInput(row.keyVersion, parsed.pointerId, row.category, row.formatVersion)
+      );
+    } catch {
+      raw = null;
+    }
+    if (raw === null) {
+      this.#audit(pointerId, opts, "unavailable");
+      return UNAVAILABLE;
+    }
+    this.#audit(pointerId, opts, "revealed");
+    return raw;
+  }
+  /**
+   * Owner-surface reveal by row id: the dashboard shows a row the owner can
+   * already see and asks for its value. There is no wire token here to verify —
+   * the tag exists to stop FORGED tokens arriving in untrusted text, and a row
+   * id selected server-side from the owner's own store is not that — so this
+   * loads the row directly, opens its ciphertext under the row's epoch, and
+   * audits exactly like a human-target de-reference. Never callable with
+   * target 'model': the wire-token path with its grant gate is the only road
+   * raw travels toward the model.
+   */
+  async revealEntry(pointerId, opts) {
+    const row = this.#repo.byPointerId(pointerId);
+    if (!row) {
+      this.#audit(pointerId, { target: "human", reason: opts.reason }, "unavailable");
+      return UNAVAILABLE;
+    }
+    const raw = await this.#openRow(row);
+    if (raw === null) {
+      this.#audit(pointerId, { target: "human", reason: opts.reason }, "unavailable");
+      return UNAVAILABLE;
+    }
+    this.#audit(pointerId, { target: "human", reason: opts.reason }, "revealed");
+    return raw;
+  }
+  /** Badge and listing data. No raw value, no fingerprint, and no audit row. */
+  async describePointer(token) {
+    const row = await this.#rowFor(token);
+    if (!row) return null;
+    return {
+      category: row.category,
+      ...row.provider === void 0 ? {} : { provider: row.provider },
+      maskedMatch: row.maskedMatch,
+      occurrences: row.occurrenceCount,
+      firstSeen: new Date(row.firstSeen).toISOString(),
+      lastSeen: new Date(row.lastSeen).toISOString()
+    };
+  }
+  /**
+   * The raw-free row identity a reveal grant matches on. Deliberately not fed to
+   * view surfaces: the keyed fingerprint is a correlation key and must not reach
+   * a presentation layer.
+   */
+  async resolvePointerIdentity(token) {
+    const row = await this.#rowFor(token);
+    if (!row) return null;
+    return {
+      ruleId: row.ruleId,
+      valueFingerprint: row.valueFingerprint,
+      fingerprintKeyVersion: row.fingerprintKeyVersion
+    };
+  }
+  /**
+   * Mint the next vault key epoch and re-encrypt every entry under it. Pointers
+   * already emitted keep verifying: their tag is checked against the historical
+   * epoch they name, which the key provider retains.
+   *
+   * Safe to interrupt — each row carries the epoch its ciphertext is sealed
+   * under, so a half-finished pass leaves every row openable.
+   *
+   * The rotation lock covers only the keyring mint inside `rotate()`; the
+   * re-seal pass below runs unlocked. Two concurrent rotations therefore
+   * serialize on the keyring but interleave over the rows, so a slower pass can
+   * re-seal a row back to an epoch a faster one already moved past, and
+   * `reEncrypted` can double-count. No value is lost either way — every epoch is
+   * retained and every row stays openable — but "after rotation every row sits
+   * at the newest epoch" does not hold under concurrency. Holding the lock
+   * across the whole pass requires an async-aware lock, since a callback that
+   * awaits would release the lock at its first suspension.
+   */
+  async rotateVaultKey() {
+    const next = await this.#keys.rotate();
+    const nextEnc = deriveSubkeys(next.material).enc;
+    let reEncrypted = 0;
+    for (const row of this.#repo.listAll()) {
+      if (row.keyVersion === next.version) continue;
+      const pointerId = base32Decode(row.pointerId);
+      let raw;
+      try {
+        const epoch = await this.#keys.materialFor(row.keyVersion);
+        raw = open(
+          deriveSubkeys(epoch.material).enc,
+          {
+            ciphertext: Buffer.from(row.ciphertext, "base64"),
+            nonce: Buffer.from(row.nonce, "base64"),
+            authTag: Buffer.from(row.authTag, "base64")
+          },
+          bindingInput(row.keyVersion, pointerId, row.category, row.formatVersion)
+        );
+      } catch {
+        raw = null;
+      }
+      if (raw === null) continue;
+      const sealed = seal(
+        nextEnc,
+        raw,
+        bindingInput(next.version, pointerId, row.category, row.formatVersion),
+        randomBytes3(NONCE_BYTES)
+      );
+      this.#repo.replaceCiphertext(row.pointerId, {
+        keyVersion: next.version,
+        ciphertext: sealed.ciphertext.toString("base64"),
+        nonce: sealed.nonce.toString("base64"),
+        authTag: sealed.authTag.toString("base64")
+      });
+      reEncrypted += 1;
+    }
+    return { version: next.version, reEncrypted };
+  }
+  /**
+   * Re-key every entry's value fingerprint after the exception key rotates,
+   * PRESERVING each pointer id. Unlike grants — where rotation is invalidation,
+   * because the raw values are gone — the vault still holds the values, so
+   * determinism, dedup, and every outstanding pointer survive the rotation.
+   *
+   * Every fingerprint-key rotation must run this: a row left at the old epoch
+   * still resolves, but the same value detected again fingerprints under the
+   * NEW key, misses the dedup lookup, and mints a second row and a second
+   * pointer — one value, two tokens in circulation.
+   *
+   * Per-row best-effort: a row that cannot open, or whose refreshed
+   * fingerprint collides with a row already refreshed, is skipped rather than
+   * aborting the pass — one damaged entry must not strand the re-key of every
+   * other. A skipped row keeps resolving under its old fingerprint epoch.
+   */
+  async refreshFingerprints(next) {
+    let refreshed = 0;
+    for (const row of this.#repo.listAll()) {
+      try {
+        const raw = await this.#openRow(row);
+        if (raw === null) continue;
+        this.#repo.refreshFingerprint(row.pointerId, {
+          valueFingerprint: fingerprintValue(next, raw),
+          fingerprintKeyVersion: next.version
+        });
+        refreshed += 1;
+      } catch {
+        continue;
+      }
+    }
+    return refreshed;
+  }
+  /**
+   * Destroy every entry, making all outstanding pointers permanently
+   * unresolvable.
+   *
+   * The count comes from `purgeAll` rather than a separate `countEntries` —
+   * `purgeAll` counts inside the same transaction that deletes, so the audit row
+   * reports what was actually destroyed. Counting beforehand would let a
+   * concurrent write land between the two statements and put a number in the
+   * durable record that never matched reality.
+   */
+  purgeVault() {
+    const destroyed = this.#repo.purgeAll();
+    this.#repo.recordDeref({
+      id: randomUUID10(),
+      pointerId: VAULT_PURGE_POINTER_ID,
+      at: this.#now(),
+      target: "human",
+      reason: "purge",
+      outcome: "unavailable",
+      pointerCount: Math.max(destroyed, 1)
+    });
+    return destroyed;
+  }
+  // Sign under the epoch the token names — which for a re-detected value is the
+  // epoch its row currently sits at rather than whatever is current.
+  //
+  // The row's format version is NOT a tag input. It binds the row's ciphertext
+  // (it is part of the AEAD AAD, so an old row stays openable) but never the
+  // wire tag, which verification checks against POINTER_FORMAT_VERSION without
+  // knowing any row. Signing a token here under a row's own generation is what
+  // would make the vault emit tokens it then refuses.
+  async #emitToken(keyVersion, pointerIdB32, category) {
+    const pointerId = base32Decode(pointerIdB32);
+    const epoch = await this.#keys.materialFor(keyVersion);
+    const signKey = deriveSubkeys(epoch.material).sign;
+    return formatPointer(
+      category,
+      keyVersion,
+      pointerId,
+      signPointer(signKey, keyVersion, pointerId, category)
+    );
+  }
+  async #openRow(row) {
+    try {
+      const epoch = await this.#keys.materialFor(row.keyVersion);
+      return open(
+        deriveSubkeys(epoch.material).enc,
+        {
+          ciphertext: Buffer.from(row.ciphertext, "base64"),
+          nonce: Buffer.from(row.nonce, "base64"),
+          authTag: Buffer.from(row.authTag, "base64")
+        },
+        bindingInput(row.keyVersion, base32Decode(row.pointerId), row.category, row.formatVersion)
+      );
+    } catch {
+      return null;
+    }
+  }
+  // Shared lookup for the read-only surfaces. It verifies the tag exactly as
+  // detokenize does: a descriptor is not raw, but a token nobody can vouch for
+  // should not resolve to anything at all — otherwise a fabricated pointer, or a
+  // lookalike planted in a file, would still yield a category and a masked
+  // preview. Verifying needs the historical epoch's key, which is why these
+  // surfaces are async.
+  async #rowFor(token) {
+    const parsed = parsePointer(token);
+    if (!parsed) return null;
+    try {
+      const epoch = await this.#keys.materialFor(parsed.keyVersion);
+      const signKey = deriveSubkeys(epoch.material).sign;
+      if (!verifyPointerTag(signKey, parsed.keyVersion, parsed.pointerId, parsed.category, parsed.tag)) {
+        return null;
+      }
+    } catch {
+      return null;
+    }
+    const row = this.#repo.byPointerId(base32Encode(parsed.pointerId));
+    if (row?.category !== parsed.category) return null;
+    return row;
+  }
+  #audit(pointerId, opts, outcome) {
+    this.#repo.recordDeref({
+      id: randomUUID10(),
+      pointerId,
+      at: this.#now(),
+      target: opts.target,
+      reason: opts.reason,
+      outcome,
+      ...opts.grantId === void 0 ? {} : { grantId: opts.grantId },
+      // Only the batched reasons carry a count above one; a model crossing is
+      // always its own row.
+      pointerCount: isBatchedDerefReason(opts.reason) ? opts.pointerCount ?? 1 : 1
+    });
+  }
+};
+
+// ../packages/persistence/src/warn-era-cap.ts
+import { existsSync as existsSync4, writeFileSync as writeFileSync3 } from "fs";
+import { join as join7 } from "path";
 
 // ../packages/plugin-sdk/src/config.ts
 import { existsSync as existsSync5 } from "fs";
-import { join as join7 } from "path";
+import { join as join8 } from "path";
 
 // ../packages/plugin-sdk/src/provider-env.ts
 var booleanish = external_exports.string().optional().transform((v) => {
@@ -25997,9 +27351,9 @@ var providerEnvShape = {
 var ProviderEnvSchema = external_exports.object(providerEnvShape);
 
 // ../packages/plugin-sdk/src/config-inventory.ts
-import { readdirSync, readFileSync as readFileSync5, realpathSync, statSync as statSync2 } from "fs";
+import { readdirSync, readFileSync as readFileSync6, realpathSync, statSync as statSync3 } from "fs";
 import { homedir as homedir4 } from "os";
-import { basename as basename2, join as join9 } from "path";
+import { basename as basename2, join as join10 } from "path";
 
 // ../rules/code-flaws/auth-jwt-no-verify.json
 var auth_jwt_no_verify_default = {
@@ -28034,8 +29388,8 @@ function bundledDetections() {
 }
 
 // ../packages/plugin-sdk/src/repo.ts
-import { existsSync as existsSync6, readFileSync as readFileSync4, statSync } from "fs";
-import { basename, dirname as dirname2, isAbsolute, join as join8, sep as sep2 } from "path";
+import { existsSync as existsSync6, readFileSync as readFileSync5, statSync as statSync2 } from "fs";
+import { basename, dirname as dirname2, isAbsolute, join as join9, sep as sep2 } from "path";
 function resolveRepoIdentity(cwd) {
   try {
     const root = findGitRoot(cwd);
@@ -28073,36 +29427,36 @@ function resolveHeadRoot(cwd) {
 function findGitRoot(start) {
   let dir = start;
   for (; ; ) {
-    if (existsSync6(join8(dir, ".git"))) return dir;
+    if (existsSync6(join9(dir, ".git"))) return dir;
     const parent = dirname2(dir);
     if (parent === dir) return void 0;
     dir = parent;
   }
 }
 function resolveGitContext(root) {
-  const dotGit = join8(root, ".git");
+  const dotGit = join9(root, ".git");
   try {
-    if (statSync(dotGit).isDirectory()) {
-      return { configPath: join8(dotGit, "config"), headRoot: root };
+    if (statSync2(dotGit).isDirectory()) {
+      return { configPath: join9(dotGit, "config"), headRoot: root };
     }
   } catch {
     return void 0;
   }
   const target = /^gitdir:\s*(.+?)\s*$/m.exec(safeRead(dotGit) ?? "")?.[1];
   if (!target) return void 0;
-  const gitdir = isAbsolute(target) ? target : join8(root, target);
-  if (existsSync6(join8(gitdir, "config"))) {
-    return { configPath: join8(gitdir, "config"), headRoot: root };
+  const gitdir = isAbsolute(target) ? target : join9(root, target);
+  if (existsSync6(join9(gitdir, "config"))) {
+    return { configPath: join9(gitdir, "config"), headRoot: root };
   }
-  const commonRaw = safeRead(join8(gitdir, "commondir"))?.trim();
+  const commonRaw = safeRead(join9(gitdir, "commondir"))?.trim();
   if (!commonRaw) return void 0;
-  const commonGitDir = isAbsolute(commonRaw) ? commonRaw : join8(gitdir, commonRaw);
+  const commonGitDir = isAbsolute(commonRaw) ? commonRaw : join9(gitdir, commonRaw);
   const headRoot = basename(commonGitDir) === ".git" ? dirname2(commonGitDir) : root;
-  return { configPath: join8(commonGitDir, "config"), headRoot };
+  return { configPath: join9(commonGitDir, "config"), headRoot };
 }
 function safeRead(path) {
   try {
-    return readFileSync4(path, "utf8");
+    return readFileSync5(path, "utf8");
   } catch {
     return void 0;
   }
@@ -28140,14 +29494,14 @@ function slugFromUrl(url2) {
 }
 
 // ../packages/plugin-sdk/src/events.ts
-import { createHash as createHash4, randomUUID as randomUUID9 } from "crypto";
+import { createHash as createHash4, randomUUID as randomUUID11 } from "crypto";
 
 // ../packages/plugin-sdk/src/inventory-resolver.ts
 import { arch, hostname as hostname3, platform, release } from "os";
 
 // ../packages/plugin-sdk/src/nudge.ts
-import { mkdirSync as mkdirSync2, readFileSync as readFileSync6, writeFileSync as writeFileSync3 } from "fs";
-import { join as join10 } from "path";
+import { mkdirSync as mkdirSync3, readFileSync as readFileSync7, writeFileSync as writeFileSync4 } from "fs";
+import { join as join11 } from "path";
 
 // ../packages/plugin-sdk/src/paths.ts
 import { readdirSync as readdirSync2, realpathSync as realpathSync2 } from "fs";
@@ -28185,8 +29539,8 @@ function resolveNonGitProject(startDir, recognizeMarker) {
 
 // ../packages/plugin-sdk/src/project-files.ts
 var import_ignore = __toESM(require_ignore(), 1);
-import { existsSync as existsSync7, readdirSync as readdirSync3, readFileSync as readFileSync7 } from "fs";
-import { basename as basename4, join as join11, relative, sep as sep4 } from "path";
+import { existsSync as existsSync7, readdirSync as readdirSync3, readFileSync as readFileSync8 } from "fs";
+import { basename as basename4, join as join12, relative, sep as sep4 } from "path";
 var SKIP_DIRS = /* @__PURE__ */ new Set([
   ".git",
   "node_modules",
@@ -28206,7 +29560,7 @@ var SKIP_DIRS = /* @__PURE__ */ new Set([
 var MAX_FILES = 2e4;
 function readIgnoreLayer(dir) {
   try {
-    const content = readFileSync7(join11(dir, ".gitignore"), "utf8");
+    const content = readFileSync8(join12(dir, ".gitignore"), "utf8");
     return { base: dir, matcher: (0, import_ignore.default)().add(content) };
   } catch {
     return void 0;
@@ -28284,10 +29638,10 @@ function resolveProjectFiles(cwd) {
       const layer = readIgnoreLayer(dir);
       const dirLayers = layer ? [...layers, layer] : layers;
       for (const entry of dirents) {
-        const fullPath = join11(dir, entry.name);
+        const fullPath = join12(dir, entry.name);
         if (entry.isDirectory()) {
           if (SKIP_DIRS.has(entry.name) || isIgnored(dirLayers, fullPath, true)) continue;
-          if (existsSync7(join11(fullPath, ".git"))) continue;
+          if (existsSync7(join12(fullPath, ".git"))) continue;
           if (visit3(fullPath, dirLayers)) return true;
           continue;
         }
@@ -28322,21 +29676,21 @@ function resolveProjectFiles(cwd) {
 }
 
 // ../packages/plugin-sdk/src/runtime.ts
-import { randomUUID as randomUUID10 } from "crypto";
+import { randomUUID as randomUUID12 } from "crypto";
 
 // ../packages/plugin-sdk/src/suppressions.ts
 var THIRTY_DAYS_MS = 30 * 24 * 60 * 60 * 1e3;
 
 // ../packages/plugin-sdk/src/throttle.ts
-import { mkdirSync as mkdirSync3, statSync as statSync3, writeFileSync as writeFileSync4 } from "fs";
-import { join as join12 } from "path";
+import { mkdirSync as mkdirSync4, statSync as statSync4, writeFileSync as writeFileSync5 } from "fs";
+import { join as join13 } from "path";
 
 // ../packages/local-ops/src/egress-record.ts
 function recordProjectEgress(db, target, egress, base = defaultDataDir()) {
   try {
     if (!readWorkspaceSettings(base).dataSharesInPlace) return null;
     const abs = resolve(target);
-    const targetDir = statSync4(abs).isDirectory() ? abs : dirname4(abs);
+    const targetDir = statSync5(abs).isDirectory() ? abs : dirname4(abs);
     const identity = resolveRepoIdentity(abs);
     const worktreeRoot = resolveWorktreeRoot(abs);
     let root;
@@ -28377,9 +29731,9 @@ function recordProjectEgress(db, target, egress, base = defaultDataDir()) {
 }
 
 // ../packages/local-ops/src/fs-scan.ts
-import { createHash as createHash5, randomUUID as randomUUID11 } from "crypto";
-import { readdirSync as readdirSync4, readFileSync as readFileSync8, statSync as statSync5 } from "fs";
-import { basename as basename5, extname, join as join13, relative as relative3, resolve as resolve2 } from "path";
+import { createHash as createHash5, randomUUID as randomUUID13 } from "crypto";
+import { readdirSync as readdirSync4, readFileSync as readFileSync9, statSync as statSync6 } from "fs";
+import { basename as basename5, extname, join as join14, relative as relative3, resolve as resolve2 } from "path";
 var import_ignore2 = __toESM(require_ignore(), 1);
 var AKAIGNORE_FILENAME = ".akaignore";
 var SKIP_DIRS2 = /* @__PURE__ */ new Set([
@@ -28395,7 +29749,7 @@ var SKIP_DIRS2 = /* @__PURE__ */ new Set([
 var MAX_BYTES = 1e6;
 function readIgnoreLayer2(dir, filename) {
   try {
-    const content = readFileSync8(join13(dir, filename), "utf8");
+    const content = readFileSync9(join14(dir, filename), "utf8");
     return { base: dir, matcher: (0, import_ignore2.default)().add(content) };
   } catch {
     return void 0;
@@ -28414,7 +29768,7 @@ function evaluate(layers, absPath, isDir) {
 function* collectFiles(target) {
   let st;
   try {
-    st = statSync5(target);
+    st = statSync6(target);
   } catch {
     return;
   }
@@ -28431,7 +29785,7 @@ function* visit(dir, markLayers, skipLayers, inIgnoredDir) {
   const skipLayer = readIgnoreLayer2(dir, AKAIGNORE_FILENAME);
   const dirSkipLayers = skipLayer ? [...skipLayers, skipLayer] : skipLayers;
   for (const entry of readdirSync4(dir, { withFileTypes: true })) {
-    const path = join13(dir, entry.name);
+    const path = join14(dir, entry.name);
     if (entry.isDirectory()) {
       const skipState = evaluate(dirSkipLayers, path, true);
       if (skipState !== "unignored" && (SKIP_DIRS2.has(entry.name) || entry.name.startsWith(".") || skipState === "ignored")) {
@@ -28443,7 +29797,7 @@ function* visit(dir, markLayers, skipLayers, inIgnoredDir) {
       if (evaluate(dirSkipLayers, path, false) === "ignored") continue;
       let size;
       try {
-        size = statSync5(path).size;
+        size = statSync6(path).size;
       } catch {
         continue;
       }
@@ -28484,16 +29838,17 @@ function scanPathIntoStore(db, target, opts = {}) {
   for (const { path: file2, gitignored } of collectFiles(resolve2(target))) {
     let text;
     try {
-      text = readFileSync8(file2, "utf8");
+      text = readFileSync9(file2, "utf8");
     } catch {
       continue;
     }
     scanned++;
     const fileEgress = extractFileEgress(file2, text);
     if (fileEgress) egressFiles.push(fileEgress);
-    const matches = scan(text, opts.rules);
+    const shielded = shieldPointers(text);
+    const matches = dropShieldedFindings(scan(shielded.text, opts.rules), shielded.spans);
     if (matches.length === 0) continue;
-    const eventId = randomUUID11();
+    const eventId = randomUUID13();
     const metadata = { filePath: file2 };
     if (gitignored) metadata.gitignored = true;
     const event = {
@@ -28511,7 +29866,7 @@ function scanPathIntoStore(db, target, opts = {}) {
       const key = resolveFingerprintKey();
       const valueFingerprint = key ? fingerprintValue(key, m.rawMatch) : maskedMatch;
       return {
-        id: randomUUID11(),
+        id: randomUUID13(),
         eventId,
         ruleId: m.ruleId,
         category: m.category,
@@ -28536,12 +29891,12 @@ function scanPathIntoStore(db, target, opts = {}) {
 }
 
 // ../packages/local-ops/src/project-inventory.ts
-import { statSync as statSync6 } from "fs";
+import { statSync as statSync7 } from "fs";
 import { resolve as resolve3 } from "path";
 function recordProjectInventory(db, target) {
   try {
     const abs = resolve3(target);
-    statSync6(abs);
+    statSync7(abs);
     const identity = resolveRepoIdentity(abs);
     if (!identity) return null;
     const sourceProjectId2 = db.sourceProject.upsert({
@@ -28590,17 +29945,17 @@ function reinvokeArgv(subcommand, extraArgs = []) {
 
 // ../packages/local-ops/src/update-cache.ts
 import { spawn } from "child_process";
-import { existsSync as existsSync8, readFileSync as readFileSync9, rmSync as rmSync3, writeFileSync as writeFileSync5 } from "fs";
-import { join as join14 } from "path";
+import { existsSync as existsSync8, readFileSync as readFileSync10, rmSync as rmSync4, writeFileSync as writeFileSync6 } from "fs";
+import { join as join15 } from "path";
 var CHECK_TTL_MS = 24 * 60 * 60 * 1e3;
 function cachePath(home) {
-  return join14(dataDir(home), "update-check.json");
+  return join15(dataDir(home), "update-check.json");
 }
 function readCache(home) {
   const path = cachePath(home);
   if (!existsSync8(path)) return null;
   try {
-    const raw = JSON.parse(readFileSync9(path, "utf8"));
+    const raw = JSON.parse(readFileSync10(path, "utf8"));
     if (!isRecord(raw) || typeof raw.checkedAt !== "number" || !isRecord(raw.report)) return null;
     return raw;
   } catch {
@@ -28610,7 +29965,7 @@ function readCache(home) {
 function writeCache(home, cache) {
   if (!existsSync8(dataDir(home))) return;
   try {
-    writeFileSync5(cachePath(home), `${JSON.stringify(cache, null, 2)}
+    writeFileSync6(cachePath(home), `${JSON.stringify(cache, null, 2)}
 `);
   } catch {
   }
@@ -28620,7 +29975,7 @@ function isStale(cache, ttlMs = CHECK_TTL_MS) {
 }
 function clearCache(home) {
   try {
-    rmSync3(cachePath(home), { force: true });
+    rmSync4(cachePath(home), { force: true });
   } catch {
   }
 }
@@ -28742,6 +30097,12 @@ var COMMAND_SPECS = [
     summary: "Manage detection exceptions (approve, add, list, show, revoke, rotate-key)",
     args: ["approve", "add", "list", "show", "revoke", "rotate-key"]
   },
+  {
+    name: "vault",
+    argHint: "[show]",
+    summary: "Reveal a vaulted secret by its pointer (every reveal is audited)",
+    args: ["show"]
+  },
   {
     name: "tui",
     argHint: "[view]",
@@ -28961,7 +30322,7 @@ import { spawn as spawn3 } from "child_process";
 import { existsSync as existsSync10 } from "fs";
 import { createRequire as createRequire2 } from "module";
 import { createServer } from "net";
-import { dirname as dirname5, join as join15 } from "path";
+import { dirname as dirname5, join as join16 } from "path";
 import { fileURLToPath as fileURLToPath2, pathToFileURL } from "url";
 import { parseArgs as parseArgs2 } from "util";
 
@@ -28982,7 +30343,7 @@ var require3 = createRequire2(import.meta.url);
 var here = dirname5(fileURLToPath2(import.meta.url));
 var BIND_HOST = "127.0.0.1";
 function pkgBase() {
-  return isSea() ? dirname5(process.execPath) : join15(here, "..");
+  return isSea() ? dirname5(process.execPath) : join16(here, "..");
 }
 function isPortFree(port) {
   return new Promise((resolve4) => {
@@ -29036,8 +30397,8 @@ async function runDashboard(argv) {
   refreshUpdateMirror(dataDir());
   const base = pkgBase();
   const bundledServer = [
-    join15(base, "web-ui", "server.js"),
-    join15(base, "web-ui", "web-ui", "server.js")
+    join16(base, "web-ui", "server.js"),
+    join16(base, "web-ui", "web-ui", "server.js")
   ].find((p) => existsSync10(p));
   if (bundledServer) {
     launchStandalone(bundledServer, port, shouldOpen, url2);
@@ -29057,7 +30418,7 @@ async function runDashboard(argv) {
     onReadyOpen(child, shouldOpen, url2, `Starting the AKA dashboard at ${url2}
 `);
   };
-  if (existsSync10(join15(webUiDir, ".next", "BUILD_ID"))) {
+  if (existsSync10(join16(webUiDir, ".next", "BUILD_ID"))) {
     startNext();
     return;
   }
@@ -29395,7 +30756,7 @@ var SCOPE_REQUIRED = `a scope is required \u2014 pick exactly one (there is no d
   --for <duration>  time-limited: 30m, 1h, 24h (max 24h)
   --permanent       until revoked (typed confirmation required)`;
 var VERB_HELP = {
-  approve: `Usage: aka exception approve [reference|value] [flags]
+  approve: `Usage: aka exception approve [reference|value|pointer] [flags]
 
 Grant an exception from a detection blocked in the last 30 minutes. Select the
 block by the reference from the block message, the masked value shown there,
@@ -29403,13 +30764,21 @@ or by pasting the blocked value itself. A pasted value is matched by its keyed
 fingerprint and never stored or echoed \u2014 but it does land in your shell
 history, so prefer the reference where that matters.
 
+A vault pointer ([[aka:...]] \u2014 quote it in the shell) selects the vaulted
+value behind it and requires --reveal: the grant lets the model receive that
+value's RAW form at tool boundaries while it is active, with every crossing
+audited. Revoke any time with 'aka exception revoke <id>'.
+
 Flags:
+  --reveal-to-model   grant reveal-to-model instead of suppression (required with a
+                      pointer selector; --reveal is accepted as shorthand)
   --once | --for <30m|1h|24h> | --permanent   scope (required, pick one)
   --reason "<why>"    required; prompted on a terminal if omitted
   --yes               skip confirmations (non-interactive use)
   --home <dir>        alternate AKA home (default: ~/.aka)
 
 Example: aka exception approve 3f2a --for 1h --reason "temp deploy creds"
+Example: aka exception approve '[[aka:secret:...]]' --reveal-to-model --for 1h --reason "agent needs the live key"
 `,
   add: `Usage: aka exception add --rule <ruleId> [--stdin] [flags]
 
@@ -29596,6 +30965,20 @@ ${keyAccessHint(err, dir)}`, {
     });
   }
 }
+function grantFieldsFrom(entry, key) {
+  if (!isCurrentKeyVersion(key, entry.keyVersion)) {
+    throw new Error(
+      key === null ? `cannot approve ${entry.reference}: the fingerprint key file is missing, so the fingerprint recorded for it can no longer be matched \u2014 trigger the detection again` : `cannot approve ${entry.reference}: it was blocked under fingerprint key v${String(entry.keyVersion)} and the key is now v${String(key.version)}, so a grant from it could never match \u2014 trigger the detection again`
+    );
+  }
+  return {
+    ruleId: entry.ruleId,
+    category: entry.category,
+    valueFingerprint: entry.valueFingerprint,
+    keyVersion: entry.keyVersion,
+    maskedValue: entry.maskedValue
+  };
+}
 async function pickBlocked(entries, selector, io, key) {
   if (selector !== void 0) {
     const matches = entries.filter(
@@ -29654,20 +31037,90 @@ async function pickBlocked(entries, selector, io, key) {
   const answer = await io.ask(`Which one? [1-${String(entries.length)}]: `);
   const index = Number.parseInt(answer.trim(), 10);
   const picked = Number.isInteger(index) ? entries[index - 1] : void 0;
-  if (!picked) throw new Error(`invalid choice '${answer.trim()}'`);
+  if (!picked)
+    throw new Error(`invalid choice \u2014 enter a number between 1 and ${String(entries.length)}`);
   return picked;
 }
+function pointerCategory(pointer) {
+  const body = pointer.slice("[[aka:".length);
+  return DetectionCategory.parse(body.slice(0, body.indexOf(":")));
+}
+async function runApproveReveal(pointer, values, io, base) {
+  const dir = dataDir(base);
+  const db = openLocalDatabase(dir);
+  try {
+    const vault = new SecretVault({
+      repo: db.secretVault,
+      keys: createKeyProvider(readWorkspaceSettings(base).vaultKeyCustody, keysDir(base)),
+      fingerprintKey: loadOrCreateFingerprintKey(dir),
+      // Read live so a consent revocation applies to the very next call.
+      isConsented: () => isVaultConsentValid(readWorkspaceSettings(base).vaultConsent)
+    });
+    const identity = await vault.resolvePointerIdentity(pointer);
+    if (identity === null) {
+      throw new Error(
+        "the pointer is unknown here \u2014 not one this machine issued (forged or tampered), its vault entry was purged, or the key material is unavailable; nothing was granted"
+      );
+    }
+    const descriptor = await vault.describePointer(pointer);
+    const maskedValue = descriptor?.maskedMatch ?? "\xB7\xB7\xB7";
+    const { scope, reason } = await resolveScopeAndReason(values, io);
+    if (scope.scope === "permanent") {
+      await confirmPermanent(io, maskedValue, values.yes === true);
+    }
+    const granted = await createGrant(db, {
+      ruleId: identity.ruleId,
+      category: descriptor?.category ?? pointerCategory(pointer),
+      valueFingerprint: identity.valueFingerprint,
+      keyVersion: identity.fingerprintKeyVersion,
+      maskedValue,
+      capability: "reveal_to_model",
+      ...scope,
+      justification: reason,
+      conditions: null,
+      createdBy: resolveCreatedBy(),
+      createdVia: "cli-approve"
+    });
+    io.out(
+      `Reveal grant ${shortId(granted.id)}: ${granted.ruleId}  ${granted.maskedValue}  ${scopeSummary(granted)}
+While this grant is active the model can receive this value's RAW form at
+tool boundaries. Every crossing is audited. Revoke with: aka exception revoke ${shortId(granted.id)}
+`
+    );
+  } finally {
+    db.close();
+  }
+}
 async function runApprove(argv, io) {
   const { values, positionals } = parseArgs4({
     args: argv,
-    options: { ...HOME_OPTION, ...SCOPE_OPTIONS },
+    options: {
+      ...HOME_OPTION,
+      ...SCOPE_OPTIONS,
+      "reveal-to-model": { type: "boolean" },
+      // Shorthand for --reveal-to-model.
+      reveal: { type: "boolean" }
+    },
     allowPositionals: true
   });
   if (values.help) {
     io.out(VERB_HELP.approve ?? "");
     return;
   }
-  const dir = dataDir(homeBase(values.home));
+  const base = homeBase(values.home);
+  const wantsReveal = values["reveal-to-model"] === true || values.reveal === true;
+  const candidate = positionals[0]?.trim();
+  const pointer = candidate === void 0 ? void 0 : PointerToken.safeParse(candidate);
+  if (pointer?.success === true) {
+    if (!wantsReveal) {
+      throw new Error(
+        "that selector is a vault pointer \u2014 approving one mints a reveal-to-model grant, which must be asked for explicitly: add --reveal-to-model"
+      );
+    }
+    await runApproveReveal(pointer.data, values, io, base);
+    return;
+  }
+  const dir = dataDir(base);
   const db = openLocalDatabase(dir);
   try {
     const entries = await db.exceptions.recentBlocked();
@@ -29679,24 +31132,16 @@ To pre-authorize a value instead: aka exception add --rule <ruleId>
       );
       return;
     }
-    const selector = positionals[0]?.trim();
     const key = readKeyForApprove(dir);
-    const entry = await pickBlocked(entries, selector === "" ? void 0 : selector, io, key);
-    if (!isCurrentKeyVersion(key, entry.keyVersion)) {
-      throw new Error(
-        key === null ? `cannot approve ${entry.reference}: the fingerprint key file is missing, so the fingerprint recorded for it can no longer be matched \u2014 trigger the detection again` : `cannot approve ${entry.reference}: it was blocked under fingerprint key v${String(entry.keyVersion)} and the key is now v${String(key.version)}, so a grant from it could never match \u2014 trigger the detection again`
-      );
-    }
+    const entry = await pickBlocked(entries, candidate === "" ? void 0 : candidate, io, key);
+    const grant = grantFieldsFrom(entry, key);
     const { scope, reason } = await resolveScopeAndReason(values, io);
     if (scope.scope === "permanent") {
       await confirmPermanent(io, entry.maskedValue, values.yes === true);
     }
     const granted = await createGrant(db, {
-      ruleId: entry.ruleId,
-      category: entry.category,
-      valueFingerprint: entry.valueFingerprint,
-      keyVersion: entry.keyVersion,
-      maskedValue: entry.maskedValue,
+      ...grant,
+      ...wantsReveal ? { capability: "reveal_to_model" } : {},
       ...scope,
       justification: reason,
       conditions: null,
@@ -29704,6 +31149,11 @@ To pre-authorize a value instead: aka exception add --rule <ruleId>
       createdVia: "cli-approve"
     });
     printGranted(io, granted);
+    if (wantsReveal) {
+      io.out(
+        "While this grant is active the model can receive this value in RAW form at tool boundaries; every crossing is audited.\n"
+      );
+    }
     io.out("Resubmit the blocked prompt \u2014 it will now pass.\n");
   } finally {
     db.close();
@@ -29840,7 +31290,11 @@ Just got blocked? Run 'aka exception approve'.
       const row = [
         shortId(ex.id),
         ex.ruleId,
-        ex.maskedValue,
+        // A reveal grant is strictly stronger than a plain suppression: while
+        // it is active the model can receive this value's RAW form at tool
+        // boundaries. Tag the row so it reads differently from a suppress-only
+        // grant. The value stays masked — the list never shows raw values.
+        ex.capability === "reveal_to_model" ? `${ex.maskedValue} \xB7 REVEALS-TO-MODEL` : ex.maskedValue,
         ex.scope,
         // An expiry countdown is meaningless once the budget/revocation ended
         // the grant ("consumed · expires in 24m" reads as a contradiction);
@@ -29994,19 +31448,39 @@ written under the old key simply stop matching. They remain listed for audit.
         return;
       }
     }
-    let version2;
+    let next;
     try {
-      version2 = rotateFingerprintKey(dir).version;
+      next = rotateFingerprintKey(dir);
     } catch (err) {
       const message = err instanceof Error ? err.message : String(err);
       throw new Error(`cannot rotate: ${message}
 ${keyAccessHint(err, dir)}`, { cause: err });
     }
     io.out(
-      `Fingerprint key rotated \u2014 new key version v${String(version2)}.
+      `Fingerprint key rotated \u2014 new key version v${String(next.version)}.
 Existing grants no longer match; re-approve deliberately where still needed.
 `
     );
+    try {
+      const base = homeBase(values.home);
+      const vault = new SecretVault({
+        repo: db.secretVault,
+        keys: createKeyProvider(readWorkspaceSettings(base).vaultKeyCustody, keysDir(base)),
+        fingerprintKey: next,
+        isConsented: () => isVaultConsentValid(readWorkspaceSettings(base).vaultConsent)
+      });
+      const refreshed = await vault.refreshFingerprints(next);
+      if (refreshed > 0) {
+        io.out(
+          `Vault re-keyed \u2014 ${String(refreshed)} stored ${refreshed === 1 ? "value" : "values"} follow the new key; pointers are unchanged.
+`
+        );
+      }
+    } catch {
+      io.out(
+        "Warning: the vault could not be re-keyed under the new fingerprint key.\nStored values still resolve, but re-detections may mint new pointers until it succeeds.\n"
+      );
+    }
   } finally {
     db.close();
   }
@@ -30034,8 +31508,8 @@ async function runException(argv, io = terminalPrompter()) {
 }
 
 // src/commands/init.ts
-import { existsSync as existsSync12, statSync as statSync7 } from "fs";
-import { join as join16 } from "path";
+import { existsSync as existsSync12, statSync as statSync8 } from "fs";
+import { join as join17 } from "path";
 import * as readline from "readline/promises";
 import { parseArgs as parseArgs6 } from "util";
 
@@ -30147,12 +31621,12 @@ function looseStorePaths(home) {
     home,
     settingsDir(home),
     dataDir(home),
-    join16(settingsDir(home), "settings.json"),
+    join17(settingsDir(home), "settings.json"),
     dbPath(home)
   ];
   return targets.filter((p) => {
     try {
-      return (statSync7(p).mode & 63) !== 0;
+      return (statSync8(p).mode & 63) !== 0;
     } catch {
       return false;
     }
@@ -30167,7 +31641,7 @@ async function runInit(argv) {
   ensureLayoutDirSync(home);
   const settings = settingsDir(home);
   ensureLayoutDirSync(settings);
-  const settingsFile = join16(settings, "settings.json");
+  const settingsFile = join17(settings, "settings.json");
   const settingsCreated = !existsSync12(settingsFile);
   if (settingsCreated) {
     writeOwnerOnlyFileSync(
@@ -30242,7 +31716,7 @@ async function confirm(question) {
 }
 
 // src/commands/scan.ts
-import { statSync as statSync8 } from "fs";
+import { statSync as statSync9 } from "fs";
 import { parseArgs as parseArgs7 } from "util";
 function severityRank(s) {
   return Severity.options.indexOf(s);
@@ -30289,7 +31763,7 @@ function runScan(argv) {
     failOn = parsed.data;
   }
   try {
-    statSync8(target);
+    statSync9(target);
   } catch {
     process.stderr.write(`aka scan: no such file or directory: ${target}
 `);
@@ -31196,6 +32670,92 @@ function applyPluginUpdate2(status) {
   return ok;
 }
 
+// src/commands/vault.ts
+import { parseArgs as parseArgs11 } from "util";
+var VAULT_HELP = `Reveal a vaulted secret by its pointer (every reveal is audited).
+
+Resolve a pointer:   aka vault show '[[aka:...]]'    prints the raw value
+
+The pointer is the [[aka:...]] token that replaced a detected value. Quote it \u2014
+the double brackets are shell syntax otherwise. Each successful reveal writes an
+audit row (reason: explicit-reveal) to the local store.
+
+Flags:
+  --home <dir>        alternate AKA home (default: ~/.aka)
+`;
+var UNAVAILABLE_MESSAGE = `the pointer could not be resolved.
+This means one of: the pointer is not one this machine issued (forged or
+tampered), its entry was purged from the vault, or the vault key material is
+unavailable. The vault does not distinguish these cases \u2014 a token nobody can
+vouch for resolves to nothing.`;
+function descriptorLine(d) {
+  const kind = d.provider === void 0 ? d.category : `${d.category}/${d.provider}`;
+  return `${kind} \xB7 seen ${String(d.occurrences)}\xD7 \xB7 first ${d.firstSeen.slice(0, 10)}`;
+}
+async function runShow2(argv, io) {
+  const { values, positionals } = parseArgs11({
+    args: argv,
+    options: { ...HOME_OPTION, help: { type: "boolean", short: "h" } },
+    allowPositionals: true
+  });
+  if (values.help) {
+    io.out(VAULT_HELP);
+    return;
+  }
+  const candidate = positionals[0]?.trim();
+  if (candidate === void 0 || candidate === "") {
+    throw new Error(`usage: aka vault show '[[aka:...]]'`);
+  }
+  const parsed = PointerToken.safeParse(candidate);
+  if (!parsed.success) {
+    throw new Error(
+      "that is not a vault pointer \u2014 expected the full [[aka:...]] token (quote it in the shell)"
+    );
+  }
+  const base = homeBase(values.home);
+  const dir = dataDir(base);
+  const db = openLocalDatabase(dir);
+  try {
+    const vault = new SecretVault({
+      repo: db.secretVault,
+      keys: createKeyProvider(readWorkspaceSettings(base).vaultKeyCustody, keysDir(base)),
+      fingerprintKey: loadOrCreateFingerprintKey(dir),
+      // Read live so a consent revocation applies to the very next call.
+      isConsented: () => isVaultConsentValid(readWorkspaceSettings(base).vaultConsent)
+    });
+    const value = await vault.detokenize(parsed.data, {
+      target: "human",
+      reason: "explicit-reveal"
+    });
+    if (typeof value !== "string") {
+      throw new Error(UNAVAILABLE_MESSAGE);
+    }
+    io.out(`${value}
+`);
+    const descriptor = await vault.describePointer(parsed.data);
+    if (descriptor) io.out(`${descriptorLine(descriptor)}
+`);
+  } finally {
+    db.close();
+  }
+}
+var VERBS2 = {
+  show: runShow2
+};
+async function runVault(argv, io = terminalPrompter()) {
+  const [verb, ...rest] = argv;
+  if (verb === void 0 || verb === "-h" || verb === "--help") {
+    io.out(VAULT_HELP);
+    return;
+  }
+  const handler = VERBS2[verb];
+  if (!handler) {
+    io.out(VAULT_HELP);
+    return;
+  }
+  await handler(rest, io);
+}
+
 // src/lib/external-dispatch.ts
 import { spawnSync as spawnSync2 } from "child_process";
 import { constants } from "os";
@@ -31248,6 +32808,7 @@ var COMMANDS = {
   plugins: runPlugins,
   dashboard: runDashboard,
   exception: (argv) => runException(argv),
+  vault: (argv) => runVault(argv),
   tui: runTui,
   update: runUpdate,
   "check-updates": runCheckUpdates,