@rulvar/core 1.57.0 → 1.58.0

package/dist/index.d.ts

@@ -1035,6 +1035,90 @@ declare function maskSecrets(text: string): string;
 declare function maskSecretsDeep<T>(value: T): T;
 /** Convenience for hosts: masks a Json value (alias of the deep walk). */
 declare function maskSecretsJson(value: Json): Json;
+/** A compiled masking policy: text and deep-JSON forms of one pattern set. */
+interface SecretMasker {
+  maskText(text: string): string;
+  maskDeep<T>(value: T): T;
+}
+/**
+* Compiles the redaction policy: the DEFAULT credential pattern set
+* plus host-defined patterns (RV-217), for the telemetry boundary
+* (events and traces; never the journal, where lossless encryption is
+* the right tool). String patterns compile as global regexes; RegExp
+* patterns are recompiled with the global flag when it is missing, so
+* replace-all semantics always hold. An invalid pattern is a typed
+* ConfigError at compile time, before anything runs under the policy.
+*/
+declare function compileSecretMasker(patterns?: ReadonlyArray<RegExp | string>, site?: string): SecretMasker;
+//#endregion
+//#region src/l0/encryption.d.ts
+/**
+* The KMS seam. `keyId` is a stable routing id stamped into every
+* envelope (a KMS key ARN or alias, or a local rotation label); the
+* two methods are the exact shape of KMS GenerateDataKey and Decrypt.
+* Both are called only inside `createEnvelopeEncryption`.
+*/
+interface DataKeyProvider {
+  readonly keyId: string;
+  generateDataKey(): Promise<{
+    plaintext: Bytes;
+    wrapped: Bytes;
+  }>;
+  unwrapDataKey(wrapped: Bytes): Promise<Bytes>;
+}
+/**
+* The local reference DataKeyProvider: the key-encryption key is
+* HKDF-SHA256(secret, info), data keys are random 32-byte AES keys,
+* and wrapping is AES-256-GCM under the KEK. `info` partitions one
+* master secret into unrelated KEKs (tenant-scoped keys: one provider
+* per tenant with `info: tenantId`); a provider with different
+* secret or info CANNOT unwrap this provider's keys. For production
+* KMS, implement the same interface over GenerateDataKey/Decrypt.
+*/
+declare function localKeyProvider(options: {
+  secret: string | Bytes; /** Stamped into envelopes; default 'local:v1'. */
+  keyId?: string; /** KEK partition label (e.g. a tenant id); default ''. */
+  info?: string;
+}): DataKeyProvider;
+/** The journal envelope marker; a stored entry's whole value is this. */
+declare const JOURNAL_ENVELOPE_MARKER = "__rulvarEnvelope";
+interface EnvelopeEncryption {
+  /** Pass as `createEngine({ serialization })`. */
+  hook: SerializationHook;
+  /** The provider's routing id, stamped into every envelope. */
+  keyId: string;
+  /**
+  * The CURRENT wrapped data key. Every write stamps it into the
+  * envelope, so nothing else must be persisted; it is exposed for
+  * hosts that keep a rotation ledger.
+  */
+  wrappedDataKey: Bytes;
+}
+interface EnvelopeEncryptionOptions {
+  provider: DataKeyProvider;
+  /**
+  * Wrapped data keys from earlier sessions or rotations that this
+  * process must still read. Unwrapped once at creation; an envelope
+  * carrying an UNREGISTERED wrapped key fails typed at read, naming
+  * this list.
+  */
+  historicalWrappedKeys?: readonly Bytes[];
+  /**
+  * What a NON-enveloped stored entry or blob means at read:
+  * 'reject' (default, fail closed) or 'passthrough' (explicit
+  * migration mode for stores with pre-encryption history).
+  */
+  plaintextReads?: "reject" | "passthrough";
+}
+/**
+* Builds the envelope-encryption SerializationHook. All DataKeyProvider
+* calls happen HERE (the hook itself is synchronous, on in-memory data
+* keys): a fresh data key is minted and wrapped for this instance, and
+* every historical wrapped key is unwrapped for the read path.
+*/
+declare function createEnvelopeEncryption(options: EnvelopeEncryptionOptions): Promise<EnvelopeEncryption>;
+/** Guards against non-constant-time comparisons in host key checks. */
+declare function constantTimeEqual(a: Bytes, b: Bytes): boolean;
 //#endregion
 //#region src/l0/usage.d.ts
 /**
@@ -5446,12 +5530,18 @@ interface CreateEngineOptions {
   */
   serialization?: SerializationHook;
   /**
-  * The default key-masking policy at the telemetry boundary. Default
-  * ON: key-shaped strings in every
-  * emitted WorkflowEvent are masked; never touches the journal.
+  * The masking policy at the telemetry boundary. Default ON:
+  * key-shaped strings in every emitted WorkflowEvent are masked;
+  * never touches the journal (lossless encryption via `serialization`
+  * is the persistence-side tool). `patterns` adds host-defined
+  * redaction on top of the default credential set (RV-217): RegExp or
+  * pattern strings, compiled once at construction, applied to every
+  * string in every emitted event body. Feed the same patterns to the
+  * OTel exporter for trace parity.
   */
   redaction?: {
     maskEvents?: boolean;
+    patterns?: ReadonlyArray<RegExp | string>;
   };
   /**
   * Bare-nondeterminism detection over in-process workflow bodies
@@ -5465,6 +5555,21 @@ interface CreateEngineOptions {
   * runtime frames are classified exempt and stay silent.
   */
   determinism?: DeterminismConfig;
+  /**
+  * Metadata protection knobs (RV-217). `argsHashSalt` switches the
+  * RunMeta.argsHash digest from plain sha256 to HMAC-SHA256 under the
+  * salt: equal args stop correlating across deployments and
+  * low-entropy args stop being recoverable from the digest. The salt
+  * is deployment config, not a per-run secret: every engine (and the
+  * CLI host config) resuming this store's runs must carry the SAME
+  * salt, or the resume args gate refuses matching args. Runs recorded
+  * before the salt keep their unsalted digests; the gate then simply
+  * mismatches until forced, so introduce the salt on a fresh store or
+  * accept --allow-args-change on legacy runs.
+  */
+  security?: {
+    argsHashSalt?: string;
+  };
 }
 interface RunOptions {
   /** Explicit id; otherwise the engine mints a ULID. */
@@ -5590,6 +5695,35 @@ interface Engine {
   pruneRun(runId: string, opts?: {
     lease?: Lease;
   }): Promise<number>;
+  /**
+  * Portable run export (RV-217): the meta record, every journal
+  * entry, and every transcript blob, read through Engine.stores (the
+  * one policy point), so an encrypted deployment exports PLAINTEXT
+  * for a subject-access request or a store migration, without raw
+  * store spelunking. Blobs are materialized in memory; export runs
+  * one at a time, not catalogs.
+  */
+  exportRun(runId: string): Promise<RunExport>;
+  /**
+  * Imports a bundle produced by exportRun, under its ORIGINAL runId
+  * (transcript refs and journal fields embed it; rewriting ids is
+  * deliberately out of scope). Writes through Engine.stores, so an
+  * encrypting target re-encrypts under its own policy. Refuses typed
+  * when the run already exists in the target store, so an import can
+  * never interleave with live history.
+  */
+  importRun(bundle: RunExport): Promise<void>;
+}
+/** The portable bundle exportRun produces and importRun consumes (RV-217). */
+interface RunExport {
+  runId: string;
+  /** Absent when the source store had no meta row for the run. */
+  meta?: RunMeta;
+  entries: JournalEntry[];
+  blobs: Array<{
+    ref: string;
+    data: Bytes;
+  }>;
 }
 /** Content hash of an in-process workflow body (run-to-definition binding). */
 declare function hashWorkflowBody(wf: Workflow<never, never> | Workflow<unknown, unknown>): string;
@@ -5613,7 +5747,9 @@ declare function workflowSourceRef(runId: string): string;
 * sensitive-derived metadata, not a value safe to publish (see the
 * `argsHash` field docs).
 */
-declare function hashRunArgs(args: unknown): string | undefined;
+declare function hashRunArgs(args: unknown, options?: {
+  salt?: string;
+}): string | undefined;
 /**
 * sha256 hex over the JCS canonical serialization of a run's result
 * value: the digest the engine records as `outputHash` on the journaled
@@ -7545,6 +7681,37 @@ declare function implementationAgentProfile(options?: AgentProfileTemplateOption
 */
 declare function reviewAgentProfile(options?: AgentProfileTemplateOptions): AgentProfile;
 //#endregion
+//#region src/engine/audit.d.ts
+type AuditCategory = "suspension" | "resolution" | "abandon" | "decision" | "termination-denied" | "run-settle";
+/** One reviewable authority event, in journal order. */
+interface AuditRecord {
+  /** The journal seq of the entry behind this record. */
+  seq: number;
+  /** The entry's startedAt timestamp. */
+  at: string;
+  scope: string;
+  category: AuditCategory;
+  /**
+  * The finer type: the suspension kind ('external' | 'approval') for
+  * suspensions, the journaled decisionType for decisions.
+  */
+  type?: string;
+  /** Who acted: a ResolutionBy for resolutions, 'engine' for decisions. */
+  by?: string;
+  /** The seq of the entry this record acts on (resolution/abandon target). */
+  target?: number;
+  /** One deterministic reviewable line. */
+  summary: string;
+  /** The journaled payload, verbatim (plaintext through Engine.stores). */
+  value?: Json;
+}
+/**
+* Folds a loaded journal into the audit trail, in seq order. Pass the
+* FULL entry list (`Engine.stores.journal.load(runId)` or
+* `exportRun(runId).entries`); filtering is the reducer's job.
+*/
+declare function reduceAuditTrail(entries: readonly JournalEntry[]): AuditRecord[];
+//#endregion
 //#region src/journal/scope.d.ts
 /**
 * Scope-path grammar (M1-T04): deterministic structural paths, independent
@@ -8114,7 +8281,7 @@ declare class EventBus {
   private readonly runId;
   private readonly spans;
   private readonly now;
-  private readonly maskEvents;
+  private readonly mask;
   private readonly subscribers;
   private readonly listeners;
   private seq;
@@ -8131,6 +8298,12 @@ declare class EventBus {
     */
     maskEvents?: boolean;
     /**
+    * The compiled masking policy applied when maskEvents is on
+    * (RV-217): the default credential set plus host patterns. Absent
+    * falls back to the default maskSecretsDeep.
+    */
+    mask?: (body: WorkflowEventBody) => WorkflowEventBody;
+    /**
     * First seq value (default 0): the resumed-segment base that keeps
     * seq strictly increasing per run across segments (v1.22.0 review
     * P1-2).
@@ -8311,4 +8484,4 @@ interface SandboxBridge {
 declare const SANDBOX_AGENT_OPT_KEYS: readonly string[];
 declare function createSandboxBridge(ctx: Ctx<never>, options: SandboxBridgeOptions): SandboxBridge;
 //#endregion
-export { AWAIT_SCHEMA, AbandonAttempt, AbandonFold, AbandonPayload, AbandonedSpendView, AbortClass, type AdaptiveEvents, AdmissionController, AdmissionDecision, AdmissionRejectedError, AdmissionStatsBefore, AdmitLineage, AdmitRejectReason, AdmitSpec, AdmitVerdict, AgentCallError, AgentError, type AgentEvents, AgentIdentityInput, type AgentInvocationRow, AgentOpts, AgentProfile, AgentProfilePermissions, AgentProfileTemplateOptions, AgentResult, AgentResultMeta, AgentStatus, ApproachSignatureInputs, ApprovalDecision, ApprovalIdentityInput, Artifact, AttemptOutcomeClass, AuditRunsOptions, BUDGET_ABORT_REASON, BaseAppend, BriefOpts, BudgetAccountView, BudgetDefaults, BudgetExhaustedError, BudgetExhaustionDiagnostics, BudgetHooks, BudgetReserve, type Bytes, CANCEL_AGENT_SCHEMA, CHECKPOINT_FORMAT_V1, CLAIM_STATEMENT_MAX_CHARS, CLAIM_TTL_DAYS, COMPACTION_SUMMARY_PREFIX, CURRENT_HASH_VERSION, CacheHint, CacheTtl, CanUseTool, CanonicalId, CanonicalIdentity, CanonicalLadderSpec, CanonicalModelSpec, ChatEvent, ChatRequest, CheckpointState, ChildArtifactPage, ChildIdentityInput, ChildResultPage, type ClaimClass, type ClaimOp, type ClaimStatus, ClaimValidationOptions, CollectOpts, CollectedTurn, CompactionConfig, CompiledPermissionChain, CompiledWorkflow, ConfigError, type CoreEvents, CostAttribution, CostAttributionFacts, CostReport, CreateEngineOptions, type CriticalPath, Ctx, DEFAULT_CHILD_BUDGET_FRACTION, DEFAULT_CHILD_RESULT_PAGE_CHARS, DEFAULT_CITATION_PATTERN, DEFAULT_COMPACTION_THRESHOLD, DEFAULT_ESCALATION_LIMITS, DEFAULT_EVIDENCE_MIN_SHARE, DEFAULT_FINISH_MAX_REPAIRS, DEFAULT_FLAT_RESERVE_USD, DEFAULT_MAX_CHILDREN_PER_NODE, DEFAULT_MAX_DEPTH, DEFAULT_MAX_OSCILLATIONS_PER_KEY, DEFAULT_MAX_PINNED_WORKTREES, DEFAULT_MAX_REVISIONS_PER_RUN, DEFAULT_MAX_TOTAL_SPAWNS, DEFAULT_MAX_TURNS, DEFAULT_MODEL_RETRY_ATTEMPTS, DEFAULT_NO_PROGRESS_TURNS, DEFAULT_PER_RUN_CONCURRENCY, DEFAULT_RETRY_POLICY, DEFAULT_STREAM_IDLE_TIMEOUT_MS, DEFAULT_SYNTHESIS_MAX_TURNS, DEFAULT_SYNTHESIS_NOTE_MAX_TURNS, DebitResult, DeclaredLadder, DedupIndex, DedupNote, DedupedClaims, DerivedKey, DeriverRegistry, type DeterminismConfig, DeterminismError, type DeterminismEvents, type DeterminismMode, DispositionRule, DispositionTable, DonorCandidate, DonorRef, DroppedItem, EMIT_RESULT_TOOL, EMPTY_SCHEMA_HASH, EMPTY_TOOLSET_HASH, ESCALATE_TOOL_NAME, ESCALATION_REPORT_SCHEMA, ESCALATION_REQUEST_SCHEMA, EVENT_SEGMENT_STRIDE, EffectiveUsageLimits, Effort, Engine, EngineDefaults, EngineQuotaConfig, EngineQuotaRuntime, EntryKind, EntryRef, EntryStatus, ErrorClass, ErrorCode, ErrorPolicy, EscalatedResult, EscalationDecision, EscalationDecisionAbortedError, EscalationDigest, EscalationKind, EscalationLimits, EscalationOptions, EscalationReport, EscalationRequest, EventBus, type EvidenceRef, type ExplorationSummary, ExtensionAppendInput, ExtensionDispatchSpec, ExternalIdentityInput, ExternalRegistry, ExtractNecessityInput, FINALIZE_SYNTHESIS_INSTRUCTION, FINISH_SCHEMA, FINISH_TOOL_NAME, FailRunError, FailoverTarget, FailoverTrigger, FallbackField, FallbackTrigger, FileModelKnowledgeStore, FileModelKnowledgeStoreOptions, FileTranscriptStore, FinishInfo, FinishValidationChild, FinishValidationInput, FinishValidationSpec, FinishValidationVerdict, FinishValidator, GET_CHILD_RESULT_SCHEMA, GET_CHILD_RESULT_TOOL_NAME, Gate, GateAudit, type GateRecord, GitWorktreeProvider, GitWorktreeProviderOptions, GraftBoot, HashVersion, HookVerdict, IMPLEMENTATION_PROFILE_LIMITS, INBOX_PROPOSAL_TTL_DAYS, IdentityInput, InMemoryStore, InMemoryTranscriptStore, InProcessRunner, IncrementalSynthesisResult, InvalidResolutionError, InvocationRole, type InvocationTable, type IsolationProvider, type IsolationSpec, Issue$1 as Issue, JournalCompatSubCode, JournalCompatibilityError, JournalEntry, JournalMatcher, JournalMissError, JournalOperation, JournalOrderViolation, JournalSerializationHook, type JournalStore, type Json, JsonSchema, JsonlFileStore, KB_ACTIVE_CLAIMS_CAP, KB_CARD_RENDER_BUDGET_CHARS, type KbProposal, type KbProposalTrigger, KeyDeriver, KeyRing, KeyedLimiter, KnowledgeCasError, type KnowledgeSnapshot, LARGE_VALUE_WARN_BYTES, LEGACY_LTID_PREFIX, LEGACY_SIGNATURE_INPUTS, LINEAGE_SIG_VERSION, LadderSpec, type LeasableStore, type Lease, LeaseHeldError, Ledger, LineageCounters, LineageIndex, LineageRef, LineageRelation, LineageStats, LogicalTaskId, MASKED_SECRET, MAX_CHILD_RESULT_PAGE_CHARS, MAX_DEPTH_CEILING, MatchResult, McpConfig, McpToolSource, MechanicalGateProfile, MechanicalGateVerdict, MemoryQuotaLimiter, type MetaLookupStore, type ModelCaps, ModelChoice, type ModelClaim, ModelEpochInputs, type ModelKnowledgeHandle, type ModelKnowledgeStore, ModelListConstraint, ModelRef, ModelRetry, ModelSpec, Msg, NoProgressDetector, NodeId, NodeLinkValue, NonSerializableValueError, ORCHESTRATE_WORKFLOW_NAME, OnEscalation, OperationDisposition, OrchestrateAcceptance, OrchestrateOptions, OrchestrateSynthesis, OrchestratorBudgetSpec, OrchestratorCapConfigError, OrchestratorExtension, OrchestratorExtensionIO, OrchestratorRuntime, Out, PARALLEL_AGENTS_SCHEMA, PROGRESS_REPORT_TOOL_NAME, ParallelSiteCounter, Part, PendingExternal, PendingToolTurn, PermissionConfig, PermissionGate, PermissionHook, PermissionPreset, PermissionRule, PermissionVerdict, type PhaseRow, PhaseTarget, PipelineCollected, PipelineOpts, PlanInvariantError, PriceTable, PricedUsage, type Pricing, type PricingTier, ProgressReport, type ProviderAdapter, QUOTA_WINDOW_MS, QualityFloors, QuotaCounters, type QuotaDecision, type QuotaEstimate, type QuotaLimiter, type QuotaReservationRequest, QuotaRule, QuotaWindowSnapshot, READ_CHILD_ARTIFACT_SCHEMA, READ_CHILD_ARTIFACT_TOOL_NAME, RESEARCH_PROFILE_LIMITS, REVIEW_PROFILE_LIMITS, ROLE_EFFORT_DEFAULTS, ROOT_ACCOUNT, ROOT_SCOPE, RUN_PROFILES, RUN_SETTLE_DECISION_TYPE, RandIdentityInput, RandPayload, ReconcileOptions, ReconcileResult, RefEntryAppender, RefEntryClassification, RefusalInfo, RepeatedClaim, ReplayDisposition, ReplayMode, ReplayPlanHashMismatch, Replayer, RepositoryResearchToolset, RepositoryResearchToolsetOptions, ResearchAgentProfileOptions, ResearchAgentProfileResult, ResearchEvidenceEntry, ResolutionArbiter, ResolutionAttempt, ResolutionBy, ResolutionFold, ResolutionLayer, ResolutionOutcome, ResolutionPayload, ResolvedInvocation, ResolvedToolset, ResumeHandle, ResumeOptions, ResumePreview, ResumeReport, RetryClass, RetryPolicy, ReuseConfig, RiskRuleValue, Role, RulvarError, RulvarErrorCode, RunAgentOptions, RunAuditVerdict, RunBudget, RunEventSink, type RunFilter, RunHandle, RunInternals, type RunMeta, RunOptions, RunOutcome, RunProfile, RunStateAudit, RunStatus, RuntimeEventSink, SANDBOX_AGENT_OPT_KEYS, SPAWN_AGENT_SCHEMA, SandboxBridge, SandboxBridgeOptions, SandboxError, SandboxHostToWorker, SandboxMethod, SandboxWorkerToHost, SchemaPair, SchemaSpec, SchemaValidationResult, ScopeSegment, ScriptRejected, ScriptRunner, ScrubNote, Semaphore, SerializationHook, Settled, ShellPatternRules, ShellSegment, ShellVerdict, SinglePhaseAppend, SpanMinter, SpanRegistry, SpawnAdmissionValue, SpawnAgentParams, SpawnKey, SpawnLineage, SpawnLineageOpt, SpawnOrigin, SpawnRecord, Spend, Stage, type StandardJSONSchemaV1, type StandardSchemaV1, StepIdentityInput, StructuredOutputTier, SuspendedAppend, SuspensionState, TOOL_NAME_PATTERN, type TaskClass, TaskDigest, TaskSpec, TerminalPatch, TerminationAccount, TerminationAccountSnapshot, TerminationDeniedValue, TerminationDeniedWriter, TerminationInitValue, TerminationLimits, TerminationResource, ToolCallRequest, ToolChoice, type ToolContext, ToolContextSeed, ToolContract, type ToolDef, type ToolEvents, type ToolExecutor, ToolInit, type ToolRisk, ToolRuntime, type ToolSource, type ToolSourceSession, ToolsOption, TranscriptSerializationHook, type TranscriptStore, TriggerClass, TtlState, Usage, UsageLimits, UsageSlice, VerifiedRecommendation, WAIT_FOR_EVENTS_SCHEMA, WAIT_FOR_EVENTS_TOOL_NAME, WAKE_SUMMARY_RENDER_BUDGET_CHARS, WakeBudgetBlock, WakeDigest, WakeTrigger, WireError, Workflow, WorkflowCallOpts, type WorkflowEvent, type WorkflowEventBody, WorkflowRegistry, admissionReserveUsd, affordableOutputTokens, agentErrorFromWire, agentErrorToWire, agentResultWire, agentScope, applyClaimOps, applyStructuredOutputTier, approachSigCoarse, approachSigOf, archiveDeprecatedModelOps, assertFencedWrites, atCompactionThreshold, auditRun, auditRuns, buildAbandonFold, buildAdapterRegistry, buildCostReport, buildDeriverRegistry, buildOrchestratorTools, buildTerminationInitValue, buildToolContext, canRideLoopTurn, canonicalIsolationTag, canonicalizeLadder, canonicalizeSchema, capIssues, capsHashOf, checkFloors, checkpointRefFor, childCoveragePrefix, claimExpired, claimExpiry, claimIssues, claimOpIssues, classifyAgentError, classifyAttemptOutcome, collectDeclaredLadders, compactMessages, compilePermissionChain, compilePermissionPreset, compileVerifiedLayer, costReportFromJournal, countsAgainstLimit, createCanonicalIdMinter, createCtx, createEngine, createSandboxBridge, currentOnlyKeyRing, decodeCheckpoint, dedupeRepeatedClaims, defineWorkflow, deriveContentKey, deriverV1, deriverV2, digestOf, dispositionHook, emptyDigestBlocks, emptyToolset, encodeCheckpoint, entryUsageSlices, escalateTool, evaluatePermission, evaluateReuse, evidencePreservedValidator, executeWorkflow, exhaustionCodeOf, extractCandidate, failoverTriggerOf, fallbackTriggerOf, filterClaimsForRun, finalizeFires, foldTermination, formatRePrompt, formatScopePath, hasFencedWrites, hasMetaLookup, hashRunArgs, hashRunOutput, hashWorkflowBody, hashWorkflowSource, identityJcs, implementationAgentProfile, isEscalated, isSchemaPairSpec, isStandardSchemaSpec, isStrictCompatibleSchema, kMaxOf, knowledgeHash, ladderLengthOf, ladderRungChoice, lastRunSettle, latestProgressReport, lexShellCommand, liftRetainedParts, lineageWeightOf, makeOrchestratorWorkflow, maskSecrets, maskSecretsDeep, maskSecretsJson, matchArgvPattern, matchShellCommand, mcp, memoryQuotaLimiter, mergeQuotaDenial, mergeUsageLimits, metaMatchesFilter, minMatchesValidator, modelEpochOf, modelKnowledgeCard, modelSpecIdentity, needsSeparateExtract, nextFailover, nodeLinkKey, normalizeApproachTag, normalizeEntry, normalizeFallbacks, orchestrate, parallelScope, parseModelRef, parseScopePath, phiInitialOf, pipelineScope, planNodeScope, priceEntryUsage, priceUsdOf, profileCard, profileRegistrySnapshotHash, progressReportTool, projectHistory, projectIdentity, projectToJsonSchema, proposalStatement, providerOf, quotaActualTokens, quotaEstimateTokens, quotaRuleAdmission, quotaRuleMatches, readRunMeta, readTerminationInit, reconcileRunMeta, reduceCriticalPath, reduceInvocationTable, registryKeyRing, remeasureQueue, replayDisposition, repositoryResearchToolset, requiredFieldsValidator, requiredSectionsValidator, researchAgentProfile, resolveModelInvocation, resolvePricing, resolveToolset, retryClassOf, retryDelayMs, reviewAgentProfile, roleConfiguredInRouting, roundOneDisposition, runAgent, runProfile, sanitizeTerminalText, sanitizeTokenCount, sanitizeUsage, sanitizeUsageDelta, scanJournalCompatibility, schemaHash, schemaHashOfSpec, selectStructuredOutputTier, shouldCompact, snapshotUsage, spawnDepthOf, summarizeInstruction, summarizeOutput, terminationConfigDrift, tierWithinCaps, toApprovalDecision, toJournalValue, tool, toolContract, toolsetHash, ttlState, usageViolations, validateEditorialCommit, validateEngineQuotaConfig, validateEntryShape, validateEscalationLimits, validateEscalationReport, validateQuotaRules, validateRetryPolicy, validateSchemaSpec, validateTerminationLimits, validateUsageLimits, workflowScope, workflowSourceRef, wrapJournalStore, wrapTranscriptStore };
+export { AWAIT_SCHEMA, AbandonAttempt, AbandonFold, AbandonPayload, AbandonedSpendView, AbortClass, type AdaptiveEvents, AdmissionController, AdmissionDecision, AdmissionRejectedError, AdmissionStatsBefore, AdmitLineage, AdmitRejectReason, AdmitSpec, AdmitVerdict, AgentCallError, AgentError, type AgentEvents, AgentIdentityInput, type AgentInvocationRow, AgentOpts, AgentProfile, AgentProfilePermissions, AgentProfileTemplateOptions, AgentResult, AgentResultMeta, AgentStatus, ApproachSignatureInputs, ApprovalDecision, ApprovalIdentityInput, Artifact, AttemptOutcomeClass, AuditCategory, AuditRecord, AuditRunsOptions, BUDGET_ABORT_REASON, BaseAppend, BriefOpts, BudgetAccountView, BudgetDefaults, BudgetExhaustedError, BudgetExhaustionDiagnostics, BudgetHooks, BudgetReserve, type Bytes, CANCEL_AGENT_SCHEMA, CHECKPOINT_FORMAT_V1, CLAIM_STATEMENT_MAX_CHARS, CLAIM_TTL_DAYS, COMPACTION_SUMMARY_PREFIX, CURRENT_HASH_VERSION, CacheHint, CacheTtl, CanUseTool, CanonicalId, CanonicalIdentity, CanonicalLadderSpec, CanonicalModelSpec, ChatEvent, ChatRequest, CheckpointState, ChildArtifactPage, ChildIdentityInput, ChildResultPage, type ClaimClass, type ClaimOp, type ClaimStatus, ClaimValidationOptions, CollectOpts, CollectedTurn, CompactionConfig, CompiledPermissionChain, CompiledWorkflow, ConfigError, type CoreEvents, CostAttribution, CostAttributionFacts, CostReport, CreateEngineOptions, type CriticalPath, Ctx, DEFAULT_CHILD_BUDGET_FRACTION, DEFAULT_CHILD_RESULT_PAGE_CHARS, DEFAULT_CITATION_PATTERN, DEFAULT_COMPACTION_THRESHOLD, DEFAULT_ESCALATION_LIMITS, DEFAULT_EVIDENCE_MIN_SHARE, DEFAULT_FINISH_MAX_REPAIRS, DEFAULT_FLAT_RESERVE_USD, DEFAULT_MAX_CHILDREN_PER_NODE, DEFAULT_MAX_DEPTH, DEFAULT_MAX_OSCILLATIONS_PER_KEY, DEFAULT_MAX_PINNED_WORKTREES, DEFAULT_MAX_REVISIONS_PER_RUN, DEFAULT_MAX_TOTAL_SPAWNS, DEFAULT_MAX_TURNS, DEFAULT_MODEL_RETRY_ATTEMPTS, DEFAULT_NO_PROGRESS_TURNS, DEFAULT_PER_RUN_CONCURRENCY, DEFAULT_RETRY_POLICY, DEFAULT_STREAM_IDLE_TIMEOUT_MS, DEFAULT_SYNTHESIS_MAX_TURNS, DEFAULT_SYNTHESIS_NOTE_MAX_TURNS, DataKeyProvider, DebitResult, DeclaredLadder, DedupIndex, DedupNote, DedupedClaims, DerivedKey, DeriverRegistry, type DeterminismConfig, DeterminismError, type DeterminismEvents, type DeterminismMode, DispositionRule, DispositionTable, DonorCandidate, DonorRef, DroppedItem, EMIT_RESULT_TOOL, EMPTY_SCHEMA_HASH, EMPTY_TOOLSET_HASH, ESCALATE_TOOL_NAME, ESCALATION_REPORT_SCHEMA, ESCALATION_REQUEST_SCHEMA, EVENT_SEGMENT_STRIDE, EffectiveUsageLimits, Effort, Engine, EngineDefaults, EngineQuotaConfig, EngineQuotaRuntime, EntryKind, EntryRef, EntryStatus, EnvelopeEncryption, EnvelopeEncryptionOptions, ErrorClass, ErrorCode, ErrorPolicy, EscalatedResult, EscalationDecision, EscalationDecisionAbortedError, EscalationDigest, EscalationKind, EscalationLimits, EscalationOptions, EscalationReport, EscalationRequest, EventBus, type EvidenceRef, type ExplorationSummary, ExtensionAppendInput, ExtensionDispatchSpec, ExternalIdentityInput, ExternalRegistry, ExtractNecessityInput, FINALIZE_SYNTHESIS_INSTRUCTION, FINISH_SCHEMA, FINISH_TOOL_NAME, FailRunError, FailoverTarget, FailoverTrigger, FallbackField, FallbackTrigger, FileModelKnowledgeStore, FileModelKnowledgeStoreOptions, FileTranscriptStore, FinishInfo, FinishValidationChild, FinishValidationInput, FinishValidationSpec, FinishValidationVerdict, FinishValidator, GET_CHILD_RESULT_SCHEMA, GET_CHILD_RESULT_TOOL_NAME, Gate, GateAudit, type GateRecord, GitWorktreeProvider, GitWorktreeProviderOptions, GraftBoot, HashVersion, HookVerdict, IMPLEMENTATION_PROFILE_LIMITS, INBOX_PROPOSAL_TTL_DAYS, IdentityInput, InMemoryStore, InMemoryTranscriptStore, InProcessRunner, IncrementalSynthesisResult, InvalidResolutionError, InvocationRole, type InvocationTable, type IsolationProvider, type IsolationSpec, Issue$1 as Issue, JOURNAL_ENVELOPE_MARKER, JournalCompatSubCode, JournalCompatibilityError, JournalEntry, JournalMatcher, JournalMissError, JournalOperation, JournalOrderViolation, JournalSerializationHook, type JournalStore, type Json, JsonSchema, JsonlFileStore, KB_ACTIVE_CLAIMS_CAP, KB_CARD_RENDER_BUDGET_CHARS, type KbProposal, type KbProposalTrigger, KeyDeriver, KeyRing, KeyedLimiter, KnowledgeCasError, type KnowledgeSnapshot, LARGE_VALUE_WARN_BYTES, LEGACY_LTID_PREFIX, LEGACY_SIGNATURE_INPUTS, LINEAGE_SIG_VERSION, LadderSpec, type LeasableStore, type Lease, LeaseHeldError, Ledger, LineageCounters, LineageIndex, LineageRef, LineageRelation, LineageStats, LogicalTaskId, MASKED_SECRET, MAX_CHILD_RESULT_PAGE_CHARS, MAX_DEPTH_CEILING, MatchResult, McpConfig, McpToolSource, MechanicalGateProfile, MechanicalGateVerdict, MemoryQuotaLimiter, type MetaLookupStore, type ModelCaps, ModelChoice, type ModelClaim, ModelEpochInputs, type ModelKnowledgeHandle, type ModelKnowledgeStore, ModelListConstraint, ModelRef, ModelRetry, ModelSpec, Msg, NoProgressDetector, NodeId, NodeLinkValue, NonSerializableValueError, ORCHESTRATE_WORKFLOW_NAME, OnEscalation, OperationDisposition, OrchestrateAcceptance, OrchestrateOptions, OrchestrateSynthesis, OrchestratorBudgetSpec, OrchestratorCapConfigError, OrchestratorExtension, OrchestratorExtensionIO, OrchestratorRuntime, Out, PARALLEL_AGENTS_SCHEMA, PROGRESS_REPORT_TOOL_NAME, ParallelSiteCounter, Part, PendingExternal, PendingToolTurn, PermissionConfig, PermissionGate, PermissionHook, PermissionPreset, PermissionRule, PermissionVerdict, type PhaseRow, PhaseTarget, PipelineCollected, PipelineOpts, PlanInvariantError, PriceTable, PricedUsage, type Pricing, type PricingTier, ProgressReport, type ProviderAdapter, QUOTA_WINDOW_MS, QualityFloors, QuotaCounters, type QuotaDecision, type QuotaEstimate, type QuotaLimiter, type QuotaReservationRequest, QuotaRule, QuotaWindowSnapshot, READ_CHILD_ARTIFACT_SCHEMA, READ_CHILD_ARTIFACT_TOOL_NAME, RESEARCH_PROFILE_LIMITS, REVIEW_PROFILE_LIMITS, ROLE_EFFORT_DEFAULTS, ROOT_ACCOUNT, ROOT_SCOPE, RUN_PROFILES, RUN_SETTLE_DECISION_TYPE, RandIdentityInput, RandPayload, ReconcileOptions, ReconcileResult, RefEntryAppender, RefEntryClassification, RefusalInfo, RepeatedClaim, ReplayDisposition, ReplayMode, ReplayPlanHashMismatch, Replayer, RepositoryResearchToolset, RepositoryResearchToolsetOptions, ResearchAgentProfileOptions, ResearchAgentProfileResult, ResearchEvidenceEntry, ResolutionArbiter, ResolutionAttempt, ResolutionBy, ResolutionFold, ResolutionLayer, ResolutionOutcome, ResolutionPayload, ResolvedInvocation, ResolvedToolset, ResumeHandle, ResumeOptions, ResumePreview, ResumeReport, RetryClass, RetryPolicy, ReuseConfig, RiskRuleValue, Role, RulvarError, RulvarErrorCode, RunAgentOptions, RunAuditVerdict, RunBudget, RunEventSink, RunExport, type RunFilter, RunHandle, RunInternals, type RunMeta, RunOptions, RunOutcome, RunProfile, RunStateAudit, RunStatus, RuntimeEventSink, SANDBOX_AGENT_OPT_KEYS, SPAWN_AGENT_SCHEMA, SandboxBridge, SandboxBridgeOptions, SandboxError, SandboxHostToWorker, SandboxMethod, SandboxWorkerToHost, SchemaPair, SchemaSpec, SchemaValidationResult, ScopeSegment, ScriptRejected, ScriptRunner, ScrubNote, SecretMasker, Semaphore, SerializationHook, Settled, ShellPatternRules, ShellSegment, ShellVerdict, SinglePhaseAppend, SpanMinter, SpanRegistry, SpawnAdmissionValue, SpawnAgentParams, SpawnKey, SpawnLineage, SpawnLineageOpt, SpawnOrigin, SpawnRecord, Spend, Stage, type StandardJSONSchemaV1, type StandardSchemaV1, StepIdentityInput, StructuredOutputTier, SuspendedAppend, SuspensionState, TOOL_NAME_PATTERN, type TaskClass, TaskDigest, TaskSpec, TerminalPatch, TerminationAccount, TerminationAccountSnapshot, TerminationDeniedValue, TerminationDeniedWriter, TerminationInitValue, TerminationLimits, TerminationResource, ToolCallRequest, ToolChoice, type ToolContext, ToolContextSeed, ToolContract, type ToolDef, type ToolEvents, type ToolExecutor, ToolInit, type ToolRisk, ToolRuntime, type ToolSource, type ToolSourceSession, ToolsOption, TranscriptSerializationHook, type TranscriptStore, TriggerClass, TtlState, Usage, UsageLimits, UsageSlice, VerifiedRecommendation, WAIT_FOR_EVENTS_SCHEMA, WAIT_FOR_EVENTS_TOOL_NAME, WAKE_SUMMARY_RENDER_BUDGET_CHARS, WakeBudgetBlock, WakeDigest, WakeTrigger, WireError, Workflow, WorkflowCallOpts, type WorkflowEvent, type WorkflowEventBody, WorkflowRegistry, admissionReserveUsd, affordableOutputTokens, agentErrorFromWire, agentErrorToWire, agentResultWire, agentScope, applyClaimOps, applyStructuredOutputTier, approachSigCoarse, approachSigOf, archiveDeprecatedModelOps, assertFencedWrites, atCompactionThreshold, auditRun, auditRuns, buildAbandonFold, buildAdapterRegistry, buildCostReport, buildDeriverRegistry, buildOrchestratorTools, buildTerminationInitValue, buildToolContext, canRideLoopTurn, canonicalIsolationTag, canonicalizeLadder, canonicalizeSchema, capIssues, capsHashOf, checkFloors, checkpointRefFor, childCoveragePrefix, claimExpired, claimExpiry, claimIssues, claimOpIssues, classifyAgentError, classifyAttemptOutcome, collectDeclaredLadders, compactMessages, compilePermissionChain, compilePermissionPreset, compileSecretMasker, compileVerifiedLayer, constantTimeEqual, costReportFromJournal, countsAgainstLimit, createCanonicalIdMinter, createCtx, createEngine, createEnvelopeEncryption, createSandboxBridge, currentOnlyKeyRing, decodeCheckpoint, dedupeRepeatedClaims, defineWorkflow, deriveContentKey, deriverV1, deriverV2, digestOf, dispositionHook, emptyDigestBlocks, emptyToolset, encodeCheckpoint, entryUsageSlices, escalateTool, evaluatePermission, evaluateReuse, evidencePreservedValidator, executeWorkflow, exhaustionCodeOf, extractCandidate, failoverTriggerOf, fallbackTriggerOf, filterClaimsForRun, finalizeFires, foldTermination, formatRePrompt, formatScopePath, hasFencedWrites, hasMetaLookup, hashRunArgs, hashRunOutput, hashWorkflowBody, hashWorkflowSource, identityJcs, implementationAgentProfile, isEscalated, isSchemaPairSpec, isStandardSchemaSpec, isStrictCompatibleSchema, kMaxOf, knowledgeHash, ladderLengthOf, ladderRungChoice, lastRunSettle, latestProgressReport, lexShellCommand, liftRetainedParts, lineageWeightOf, localKeyProvider, makeOrchestratorWorkflow, maskSecrets, maskSecretsDeep, maskSecretsJson, matchArgvPattern, matchShellCommand, mcp, memoryQuotaLimiter, mergeQuotaDenial, mergeUsageLimits, metaMatchesFilter, minMatchesValidator, modelEpochOf, modelKnowledgeCard, modelSpecIdentity, needsSeparateExtract, nextFailover, nodeLinkKey, normalizeApproachTag, normalizeEntry, normalizeFallbacks, orchestrate, parallelScope, parseModelRef, parseScopePath, phiInitialOf, pipelineScope, planNodeScope, priceEntryUsage, priceUsdOf, profileCard, profileRegistrySnapshotHash, progressReportTool, projectHistory, projectIdentity, projectToJsonSchema, proposalStatement, providerOf, quotaActualTokens, quotaEstimateTokens, quotaRuleAdmission, quotaRuleMatches, readRunMeta, readTerminationInit, reconcileRunMeta, reduceAuditTrail, reduceCriticalPath, reduceInvocationTable, registryKeyRing, remeasureQueue, replayDisposition, repositoryResearchToolset, requiredFieldsValidator, requiredSectionsValidator, researchAgentProfile, resolveModelInvocation, resolvePricing, resolveToolset, retryClassOf, retryDelayMs, reviewAgentProfile, roleConfiguredInRouting, roundOneDisposition, runAgent, runProfile, sanitizeTerminalText, sanitizeTokenCount, sanitizeUsage, sanitizeUsageDelta, scanJournalCompatibility, schemaHash, schemaHashOfSpec, selectStructuredOutputTier, shouldCompact, snapshotUsage, spawnDepthOf, summarizeInstruction, summarizeOutput, terminationConfigDrift, tierWithinCaps, toApprovalDecision, toJournalValue, tool, toolContract, toolsetHash, ttlState, usageViolations, validateEditorialCommit, validateEngineQuotaConfig, validateEntryShape, validateEscalationLimits, validateEscalationReport, validateQuotaRules, validateRetryPolicy, validateSchemaSpec, validateTerminationLimits, validateUsageLimits, workflowScope, workflowSourceRef, wrapJournalStore, wrapTranscriptStore };

package/dist/index.js

@@ -1,4 +1,4 @@
-import { createHash, getRandomValues, randomUUID } from "node:crypto";
+import { createCipheriv, createDecipheriv, createHash, createHmac, getRandomValues, hkdfSync, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
 import { appendFileSync, mkdirSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
 import path, { dirname, join, resolve, sep } from "node:path";
 import { Client } from "@modelcontextprotocol/sdk/client";
@@ -491,6 +491,338 @@ function maskSecretsDeep(value) {
 function maskSecretsJson(value) {
 	return maskSecretsDeep(value);
 }
+/**
+* Compiles the redaction policy: the DEFAULT credential pattern set
+* plus host-defined patterns (RV-217), for the telemetry boundary
+* (events and traces; never the journal, where lossless encryption is
+* the right tool). String patterns compile as global regexes; RegExp
+* patterns are recompiled with the global flag when it is missing, so
+* replace-all semantics always hold. An invalid pattern is a typed
+* ConfigError at compile time, before anything runs under the policy.
+*/
+function compileSecretMasker(patterns = [], site = "redaction.patterns") {
+	const raw = patterns;
+	if (!Array.isArray(raw)) throw new ConfigError(`${site} must be an array of RegExp or string patterns`);
+	const compiled = raw.map((pattern, index) => {
+		const at = `${site}[${String(index)}]`;
+		if (pattern instanceof RegExp) return pattern.flags.includes("g") ? pattern : new RegExp(pattern.source, `${pattern.flags}g`);
+		if (typeof pattern !== "string" || pattern === "") throw new ConfigError(`${at} must be a RegExp or a nonempty pattern string`);
+		try {
+			return new RegExp(pattern, "g");
+		} catch (thrown) {
+			throw new ConfigError(`${at} is not a valid regular expression: ${thrown instanceof Error ? thrown.message : String(thrown)}`);
+		}
+	});
+	const maskText = (text) => {
+		let masked = maskSecrets(text);
+		for (const pattern of compiled) masked = masked.replace(pattern, MASKED_SECRET);
+		return masked;
+	};
+	const maskDeep = (value) => deepMap(value, maskText);
+	return {
+		maskText,
+		maskDeep
+	};
+}
+/** Shared deep string walk preserving identity when nothing changed. */
+function deepMap(value, mapText) {
+	if (typeof value === "string") {
+		const masked = mapText(value);
+		return masked === value ? value : masked;
+	}
+	if (Array.isArray(value)) {
+		let changed = false;
+		const next = value.map((item) => {
+			const masked = deepMap(item, mapText);
+			if (masked !== item) changed = true;
+			return masked;
+		});
+		return changed ? next : value;
+	}
+	if (value !== null && typeof value === "object") {
+		let changed = false;
+		const next = {};
+		for (const [key, item] of Object.entries(value)) {
+			const masked = deepMap(item, mapText);
+			if (masked !== item) changed = true;
+			next[key] = masked;
+		}
+		return changed ? next : value;
+	}
+	return value;
+}
+//#endregion
+//#region src/l0/encryption.ts
+/**
+* Envelope encryption over the serialization hook (RV-217): the
+* reference implementation of "PII never persists in plaintext". The
+* hook seam (l0/serialization.ts) is the single policy point between
+* the engine and persistence; this module puts real cryptography on
+* it, KMS-shaped.
+*
+* The envelope pattern, exactly as cloud KMS services frame it:
+*
+* - A DataKeyProvider is the KMS seam. It mints a fresh DATA key and
+*   returns it in two forms (plaintext for this process's memory,
+*   wrapped for storage), and it unwraps previously wrapped keys. The
+*   shipped `localKeyProvider` derives its key-encryption key from a
+*   host secret via HKDF-SHA256; an AWS KMS provider maps 1:1 onto
+*   GenerateDataKey and Decrypt (the guide shows the sketch), and
+*   tenant-scoped keys are providers constructed per tenant (the
+*   `info` input partitions one master secret into unrelated KEKs).
+* - All provider calls are ASYNC and happen ONCE, in
+*   `createEnvelopeEncryption`, never per entry: the hook contract is
+*   synchronous, so the factory unwraps everything up front and the
+*   hooks run on in-memory data keys. Entries carry the WRAPPED key in
+*   every envelope, so decrypt needs only the provider registration,
+*   not a live KMS on the read path.
+* - Payload encryption is AES-256-GCM with a random IV per write and
+*   the entry identity as ASSOCIATED DATA (`seq` and `key` for journal
+*   entries, the ref for transcript blobs), so a ciphertext moved to a
+*   different entry fails authentication instead of decrypting into
+*   the wrong place.
+* - Journal entries keep the kernel ordering/identity fields plus the
+*   operational timestamps and spanId in plaintext (stores index and
+*   humans operate on them; none carry payload content); EVERYTHING
+*   else (value, error, usage, servedBy, cost attribution, refs) is
+*   inside the ciphertext. `fromStored(toStored(e))` reproduces the
+*   entry, so replay, content keys, and the folds are untouched.
+* - Reads of NON-enveloped stored data fail closed by default
+*   (`plaintextReads: 'reject'`); `'passthrough'` is the explicit
+*   migration mode for stores with pre-encryption history.
+*
+* Docs: https://docs.rulvar.com/guide/data-protection
+*/
+const HKDF_SALT = "rulvar-envelope-kek-v1";
+const GCM_IV_BYTES = 12;
+const GCM_TAG_BYTES = 16;
+const DATA_KEY_BYTES = 32;
+/**
+* The local reference DataKeyProvider: the key-encryption key is
+* HKDF-SHA256(secret, info), data keys are random 32-byte AES keys,
+* and wrapping is AES-256-GCM under the KEK. `info` partitions one
+* master secret into unrelated KEKs (tenant-scoped keys: one provider
+* per tenant with `info: tenantId`); a provider with different
+* secret or info CANNOT unwrap this provider's keys. For production
+* KMS, implement the same interface over GenerateDataKey/Decrypt.
+*/
+function localKeyProvider(options) {
+	const raw = options.secret;
+	if ((typeof raw !== "string" || raw === "") && !(raw instanceof Uint8Array)) throw new ConfigError("localKeyProvider secret must be a nonempty string or bytes");
+	if (raw instanceof Uint8Array && raw.length < 16) throw new ConfigError("localKeyProvider secret bytes must be at least 16 bytes");
+	const keyId = options.keyId ?? "local:v1";
+	if (typeof keyId !== "string" || keyId === "") throw new ConfigError("localKeyProvider keyId must be a nonempty string when given");
+	const kek = Buffer.from(hkdfSync("sha256", typeof raw === "string" ? Buffer.from(raw, "utf8") : Buffer.from(raw), Buffer.from(HKDF_SALT, "utf8"), Buffer.from(options.info ?? "", "utf8"), DATA_KEY_BYTES));
+	return {
+		keyId,
+		async generateDataKey() {
+			const plaintext = randomBytes(DATA_KEY_BYTES);
+			const iv = randomBytes(GCM_IV_BYTES);
+			const cipher = createCipheriv("aes-256-gcm", kek, iv);
+			const ct = Buffer.concat([cipher.update(plaintext), cipher.final()]);
+			const wrapped = Buffer.concat([
+				iv,
+				cipher.getAuthTag(),
+				ct
+			]);
+			return {
+				plaintext: new Uint8Array(plaintext),
+				wrapped: new Uint8Array(wrapped)
+			};
+		},
+		async unwrapDataKey(wrapped) {
+			const buffer = Buffer.from(wrapped);
+			if (buffer.length <= 28) throw new ConfigError("localKeyProvider: the wrapped data key is truncated");
+			const iv = buffer.subarray(0, GCM_IV_BYTES);
+			const tag = buffer.subarray(GCM_IV_BYTES, 28);
+			const ct = buffer.subarray(28);
+			const decipher = createDecipheriv("aes-256-gcm", kek, iv);
+			decipher.setAuthTag(tag);
+			try {
+				const plaintext = Buffer.concat([decipher.update(ct), decipher.final()]);
+				return new Uint8Array(plaintext);
+			} catch {
+				throw new ConfigError(`localKeyProvider '${keyId}': cannot unwrap the data key (wrong secret, wrong info partition, or a corrupted wrapped key)`);
+			}
+		}
+	};
+}
+/** The journal envelope marker; a stored entry's whole value is this. */
+const JOURNAL_ENVELOPE_MARKER = "__rulvarEnvelope";
+/** The transcript blob envelope magic (version 1). */
+const BLOB_MAGIC = Buffer.from("RVE1", "utf8");
+/**
+* Plaintext fields of a stored journal entry: the kernel
+* ordering/identity fields the hook contract pins, plus the
+* operational metadata stores index and operators read (timestamps,
+* spanId). None carry payload content.
+*/
+const CLEAR_FIELDS = [
+	"hashVersion",
+	"seq",
+	"ref",
+	"scope",
+	"key",
+	"ordinal",
+	"kind",
+	"status",
+	"spanId",
+	"startedAt",
+	"endedAt"
+];
+function b64(bytes) {
+	return Buffer.from(bytes).toString("base64");
+}
+function isEnvelope(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
+	const keys = Object.keys(value);
+	if (keys.length !== 1 || keys[0] !== "__rulvarEnvelope") return false;
+	const env = value[JOURNAL_ENVELOPE_MARKER];
+	return typeof env === "object" && env !== null && env.v === 1 && typeof env.keyId === "string" && typeof env.wrapped === "string" && typeof env.iv === "string" && typeof env.tag === "string" && typeof env.data === "string";
+}
+/**
+* Builds the envelope-encryption SerializationHook. All DataKeyProvider
+* calls happen HERE (the hook itself is synchronous, on in-memory data
+* keys): a fresh data key is minted and wrapped for this instance, and
+* every historical wrapped key is unwrapped for the read path.
+*/
+async function createEnvelopeEncryption(options) {
+	const provider = options.provider;
+	if (typeof provider !== "object" || provider === null || typeof provider.keyId !== "string" || provider.keyId === "" || typeof provider.generateDataKey !== "function" || typeof provider.unwrapDataKey !== "function") throw new ConfigError("createEnvelopeEncryption: provider must implement DataKeyProvider (keyId, generateDataKey, unwrapDataKey)");
+	const plaintextReads = options.plaintextReads ?? "reject";
+	if (plaintextReads !== "reject" && plaintextReads !== "passthrough") throw new ConfigError("createEnvelopeEncryption: plaintextReads must be 'reject' or 'passthrough'");
+	const realProvider = options.provider;
+	const current = await realProvider.generateDataKey();
+	if (current.plaintext.length !== DATA_KEY_BYTES) throw new ConfigError(`createEnvelopeEncryption: the provider returned a ${String(current.plaintext.length)}-byte data key; AES-256-GCM needs exactly ${String(DATA_KEY_BYTES)}`);
+	const ring = /* @__PURE__ */ new Map();
+	ring.set(b64(current.wrapped), Buffer.from(current.plaintext));
+	for (const wrapped of options.historicalWrappedKeys ?? []) {
+		const plaintext = await realProvider.unwrapDataKey(wrapped);
+		if (plaintext.length !== DATA_KEY_BYTES) throw new ConfigError(`createEnvelopeEncryption: a historical wrapped key unwrapped to ${String(plaintext.length)} bytes; AES-256-GCM needs exactly ${String(DATA_KEY_BYTES)}`);
+		ring.set(b64(wrapped), Buffer.from(plaintext));
+	}
+	const keyId = realProvider.keyId;
+	const currentWrappedB64 = b64(current.wrapped);
+	const currentKey = ring.get(currentWrappedB64);
+	const keyFor = (envelopeKeyId, wrappedB64, site) => {
+		const key = ring.get(wrappedB64);
+		if (key === void 0) throw new ConfigError(`${site}: the stored envelope carries a data key (keyId '${envelopeKeyId}') that this process has not registered; pass it in historicalWrappedKeys so the factory can unwrap it, and check the provider secret and info match the writing deployment`);
+		return key;
+	};
+	const encrypt = (key, aad, plaintext) => {
+		const iv = randomBytes(GCM_IV_BYTES);
+		const cipher = createCipheriv("aes-256-gcm", key, iv);
+		cipher.setAAD(aad);
+		const ct = Buffer.concat([cipher.update(plaintext), cipher.final()]);
+		return {
+			v: 1,
+			keyId,
+			wrapped: currentWrappedB64,
+			iv: iv.toString("base64"),
+			tag: cipher.getAuthTag().toString("base64"),
+			data: ct.toString("base64")
+		};
+	};
+	const decrypt = (key, aad, env, site) => {
+		const decipher = createDecipheriv("aes-256-gcm", key, Buffer.from(env.iv, "base64"));
+		decipher.setAAD(aad);
+		decipher.setAuthTag(Buffer.from(env.tag, "base64"));
+		try {
+			return Buffer.concat([decipher.update(Buffer.from(env.data, "base64")), decipher.final()]);
+		} catch {
+			throw new ConfigError(`${site}: envelope authentication failed (a tampered ciphertext, or a ciphertext moved to a different entry; the entry identity is associated data)`);
+		}
+	};
+	return {
+		hook: {
+			journal: {
+				toStored(e) {
+					const clear = {};
+					const rest = {};
+					for (const [field, fieldValue] of Object.entries(e)) if (CLEAR_FIELDS.includes(field)) clear[field] = fieldValue;
+					else rest[field] = fieldValue;
+					const aad = Buffer.from(`journal:${String(e.seq)}:${e.key}`, "utf8");
+					const envelope = encrypt(currentKey, aad, Buffer.from(JSON.stringify(rest), "utf8"));
+					return {
+						...clear,
+						value: { [JOURNAL_ENVELOPE_MARKER]: envelope }
+					};
+				},
+				fromStored(e) {
+					if (!isEnvelope(e.value)) {
+						if (plaintextReads === "passthrough") return e;
+						throw new ConfigError(`envelope encryption: stored entry seq ${String(e.seq)} is not enveloped and plaintextReads is 'reject'; enable 'passthrough' only for a deliberate migration of pre-encryption history`);
+					}
+					const env = e.value[JOURNAL_ENVELOPE_MARKER];
+					const key = keyFor(env.keyId, env.wrapped, "envelope encryption (journal read)");
+					const aad = Buffer.from(`journal:${String(e.seq)}:${e.key}`, "utf8");
+					const rest = JSON.parse(decrypt(key, aad, env, "envelope encryption (journal read)").toString("utf8"));
+					const clear = {};
+					for (const field of CLEAR_FIELDS) if (e[field] !== void 0) clear[field] = e[field];
+					return {
+						...clear,
+						...rest
+					};
+				}
+			},
+			transcripts: {
+				toStored(ref, blob) {
+					const iv = randomBytes(GCM_IV_BYTES);
+					const cipher = createCipheriv("aes-256-gcm", currentKey, iv);
+					cipher.setAAD(Buffer.from(`blob:${ref}`, "utf8"));
+					const ct = Buffer.concat([cipher.update(Buffer.from(blob)), cipher.final()]);
+					const keyIdBytes = Buffer.from(keyId, "utf8");
+					const wrappedBytes = Buffer.from(currentWrappedB64, "base64");
+					const header = Buffer.alloc(4);
+					header.writeUInt16BE(keyIdBytes.length, 0);
+					header.writeUInt16BE(wrappedBytes.length, 2);
+					return new Uint8Array(Buffer.concat([
+						BLOB_MAGIC,
+						header,
+						keyIdBytes,
+						wrappedBytes,
+						iv,
+						cipher.getAuthTag(),
+						ct
+					]));
+				},
+				fromStored(ref, blob) {
+					const buffer = Buffer.from(blob);
+					if (buffer.length < BLOB_MAGIC.length || !buffer.subarray(0, 4).equals(BLOB_MAGIC)) {
+						if (plaintextReads === "passthrough") return blob;
+						throw new ConfigError(`envelope encryption: stored blob '${ref}' is not enveloped and plaintextReads is 'reject'; enable 'passthrough' only for a deliberate migration`);
+					}
+					let offset = BLOB_MAGIC.length;
+					const keyIdLen = buffer.readUInt16BE(offset);
+					const wrappedLen = buffer.readUInt16BE(offset + 2);
+					offset += 4;
+					const envelopeKeyId = buffer.subarray(offset, offset + keyIdLen).toString("utf8");
+					offset += keyIdLen;
+					const wrappedB64 = buffer.subarray(offset, offset + wrappedLen).toString("base64");
+					offset += wrappedLen;
+					const iv = buffer.subarray(offset, offset + GCM_IV_BYTES);
+					const tag = buffer.subarray(offset + GCM_IV_BYTES, offset + GCM_IV_BYTES + GCM_TAG_BYTES);
+					const ct = buffer.subarray(offset + GCM_IV_BYTES + GCM_TAG_BYTES);
+					const decipher = createDecipheriv("aes-256-gcm", keyFor(envelopeKeyId, wrappedB64, `envelope encryption (blob '${ref}')`), iv);
+					decipher.setAAD(Buffer.from(`blob:${ref}`, "utf8"));
+					decipher.setAuthTag(tag);
+					try {
+						return new Uint8Array(Buffer.concat([decipher.update(ct), decipher.final()]));
+					} catch {
+						throw new ConfigError(`envelope encryption: blob '${ref}' authentication failed (tampered ciphertext or a ciphertext moved between refs; the ref is associated data)`);
+					}
+				}
+			}
+		},
+		keyId,
+		wrappedDataKey: new Uint8Array(current.wrapped)
+	};
+}
+/** Guards against non-constant-time comparisons in host key checks. */
+function constantTimeEqual(a, b) {
+	if (a.length !== b.length) return false;
+	return timingSafeEqual(Buffer.from(a), Buffer.from(b));
+}
 //#endregion
 //#region src/vendor/ulid.ts
 /**
@@ -3941,6 +4273,90 @@ function reviewAgentProfile(options = {}) {
 	};
 }
 //#endregion
+//#region src/engine/audit.ts
+function record(entry, fields) {
+	return {
+		seq: entry.seq,
+		at: entry.startedAt,
+		scope: entry.scope,
+		...fields
+	};
+}
+/**
+* Folds a loaded journal into the audit trail, in seq order. Pass the
+* FULL entry list (`Engine.stores.journal.load(runId)` or
+* `exportRun(runId).entries`); filtering is the reducer's job.
+*/
+function reduceAuditTrail(entries) {
+	const trail = [];
+	for (const entry of entries) {
+		if ((entry.kind === "external" || entry.kind === "approval") && entry.status === "suspended") {
+			trail.push(record(entry, {
+				category: "suspension",
+				type: entry.kind,
+				summary: `${entry.kind} suspension opened` + (entry.deadlineAt === void 0 ? "" : ` (deadline ${entry.deadlineAt})`),
+				...entry.value === void 0 ? {} : { value: entry.value }
+			}));
+			continue;
+		}
+		if (entry.kind === "resolution") {
+			const payload = entry.resolution;
+			if (payload === void 0) continue;
+			trail.push(record(entry, {
+				category: "resolution",
+				by: payload.by,
+				target: payload.target,
+				summary: `suspension #${String(payload.target)} resolved by ${payload.by}` + (payload.decisionRef === void 0 ? "" : ` (class decision #${String(payload.decisionRef)})`),
+				value: payload.value
+			}));
+			continue;
+		}
+		if (entry.kind === "abandon") {
+			const payload = entry.abandon;
+			if (payload === void 0) continue;
+			trail.push(record(entry, {
+				category: "abandon",
+				target: payload.target,
+				by: `decision #${String(payload.authorizedBy)}`,
+				summary: `#${String(payload.target)} abandoned: ${payload.reason}`
+			}));
+			continue;
+		}
+		if (entry.kind === "termination.denied") {
+			trail.push(record(entry, {
+				category: "termination-denied",
+				by: "engine",
+				summary: "a termination-limit action was denied",
+				...entry.value === void 0 ? {} : { value: entry.value }
+			}));
+			continue;
+		}
+		if (entry.kind === "decision") {
+			const value = entry.value;
+			const decisionType = typeof value?.decisionType === "string" ? value.decisionType : void 0;
+			if (decisionType === void 0) continue;
+			if (decisionType === "run_settle") {
+				trail.push(record(entry, {
+					category: "run-settle",
+					by: "engine",
+					type: decisionType,
+					summary: `run settled ${typeof value?.runStatus === "string" ? value.runStatus : "unknown"}`,
+					...entry.value === void 0 ? {} : { value: entry.value }
+				}));
+				continue;
+			}
+			trail.push(record(entry, {
+				category: "decision",
+				by: "engine",
+				type: decisionType,
+				summary: `engine decision ${decisionType}`,
+				...entry.value === void 0 ? {} : { value: entry.value }
+			}));
+		}
+	}
+	return trail;
+}
+//#endregion
 //#region src/journal/identity.ts
 /**
 * Content-addressed entry identity (M1-T04): IdentityInput records per
@@ -15949,7 +16365,7 @@ var EventBus = class {
 	runId;
 	spans;
 	now;
-	maskEvents;
+	mask;
 	subscribers = /* @__PURE__ */ new Set();
 	listeners = /* @__PURE__ */ new Set();
 	seq;
@@ -15959,12 +16375,12 @@ var EventBus = class {
 		this.runId = options.runId;
 		this.spans = options.spans;
 		this.now = options.now ?? realNow;
-		this.maskEvents = options.maskEvents ?? true;
+		this.mask = options.maskEvents ?? true ? options.mask ?? maskSecretsDeep : void 0;
 		this.seq = options.firstSeq ?? 0;
 	}
 	emit(body, spanId, replayed) {
 		const parentSpanId = this.spans.parentOf(spanId);
-		const safeBody = this.maskEvents ? maskSecretsDeep(body) : body;
+		const safeBody = this.mask === void 0 ? body : this.mask(body);
 		const event = {
 			runId: this.runId,
 			seq: this.seq++,
@@ -16564,9 +16980,12 @@ function liftRunCompletion(candidate) {
 * sensitive-derived metadata, not a value safe to publish (see the
 * `argsHash` field docs).
 */
-function hashRunArgs(args) {
+function hashRunArgs(args, options) {
 	if (args === void 0) return;
-	return createHash("sha256").update(jcsSerialize(args), "utf8").digest("hex");
+	const canonical = jcsSerialize(args);
+	const salt = options?.salt;
+	if (salt === void 0) return createHash("sha256").update(canonical, "utf8").digest("hex");
+	return createHmac("sha256", Buffer.from(salt, "utf8")).update(canonical, "utf8").digest("hex");
 }
 /**
 * sha256 hex over the JCS canonical serialization of a run's result
@@ -16595,6 +17014,7 @@ function createEngine(options) {
 	const journal = options.serialization?.journal === void 0 ? rawJournal : wrapJournalStore(rawJournal, options.serialization.journal);
 	const transcripts = options.serialization?.transcripts === void 0 ? rawTranscripts : wrapTranscriptStore(rawTranscripts, options.serialization.transcripts);
 	const maskEvents = options.redaction?.maskEvents ?? true;
+	const eventMasker = options.redaction?.patterns === void 0 ? void 0 : compileSecretMasker(options.redaction.patterns, "createEngine redaction.patterns");
 	const defaults = options.defaults ?? {};
 	if (defaults.retry !== void 0) validateRetryPolicy(defaults.retry, "createEngine defaults.retry");
 	if (options.concurrency?.perRun !== void 0) requirePositiveInteger(options.concurrency.perRun, "createEngine concurrency.perRun");
@@ -16618,6 +17038,8 @@ function createEngine(options) {
 	}
 	validateDeterminismConfig(options.determinism);
 	validateEngineQuotaConfig(options.quota);
+	if (options.security?.argsHashSalt !== void 0 && (typeof options.security.argsHashSalt !== "string" || options.security.argsHashSalt === "")) throw new ConfigError("createEngine security.argsHashSalt must be a nonempty string when given");
+	const argsHashSalt = options.security?.argsHashSalt;
 	const quotaRuntime = options.quota === void 0 ? void 0 : {
 		limiter: options.quota.limiter,
 		...options.quota.tenant === void 0 ? {} : { tenant: options.quota.tenant },
@@ -16657,6 +17079,7 @@ function createEngine(options) {
 			spans,
 			now: realNow,
 			maskEvents,
+			...eventMasker === void 0 ? {} : { mask: (body) => eventMasker.maskDeep(body) },
 			firstSeq: telemetryBase
 		});
 		const rootSpanId = spans.mint();
@@ -16783,7 +17206,7 @@ function createEngine(options) {
 		if (resumeCtx === void 0) {
 			argsBinding.argsProvided = args !== void 0;
 			try {
-				const argsHash = hashRunArgs(args);
+				const argsHash = hashRunArgs(args, argsHashSalt === void 0 ? void 0 : { salt: argsHashSalt });
 				if (argsHash !== void 0) argsBinding.argsHash = argsHash;
 			} catch {}
 		} else {
@@ -17044,6 +17467,42 @@ function createEngine(options) {
 			preview
 		};
 	}
+	/** Portable export through the policy point (RV-217). */
+	async function exportRun(runId) {
+		const entries = await journal.load(runId);
+		const meta = await readRunMeta(journal, runId);
+		const blobs = [];
+		for (const ref of await transcripts.list(runId)) {
+			const data = await transcripts.get(ref);
+			if (data !== null) blobs.push({
+				ref,
+				data
+			});
+		}
+		if (entries.length === 0 && meta === void 0 && blobs.length === 0) throw new ConfigError(`exportRun: run '${runId}' does not exist in this engine's stores`);
+		return {
+			runId,
+			...meta === void 0 ? {} : { meta },
+			entries,
+			blobs
+		};
+	}
+	/** Import under the original runId; refuses an existing run (RV-217). */
+	async function importRun(bundle) {
+		const raw = bundle;
+		if (typeof raw !== "object" || raw === null || typeof raw.runId !== "string" || raw.runId === "" || !Array.isArray(raw.entries) || !Array.isArray(raw.blobs)) throw new ConfigError("importRun: the bundle must be a RunExport (runId, entries, blobs)");
+		const runId = bundle.runId;
+		const existingMeta = await readRunMeta(journal, runId);
+		const existingEntries = await journal.load(runId);
+		const existingBlobs = await transcripts.list(runId);
+		if (existingMeta !== void 0 || existingEntries.length > 0 || existingBlobs.length > 0) throw new ConfigError(`importRun: run '${runId}' already exists in the target stores; an import never interleaves with live history (delete the run first if replacement is intended)`);
+		for (const entry of bundle.entries) await journal.append(runId, entry);
+		for (const blob of bundle.blobs) await transcripts.put(blob.ref, blob.data);
+		if (bundle.meta !== void 0) await journal.putMeta({
+			...bundle.meta,
+			runId
+		});
+	}
 	/** Retention cascade (OQ-20 executed at M8-T04): blobs, then journal. */
 	async function deleteRun(runId, opts) {
 		const refs = await transcripts.list(runId);
@@ -17108,6 +17567,8 @@ function createEngine(options) {
 		},
 		deleteRun,
 		pruneRun,
+		exportRun,
+		importRun,
 		profileCard: (names) => {
 			const registered = defaults.profiles ?? {};
 			if (names === void 0) return profileCard(registered, defaults.toolsets);
@@ -17405,4 +17866,4 @@ function createSandboxBridge(ctx, options) {
 	};
 }
 //#endregion
-export { AWAIT_SCHEMA, AdmissionController, AdmissionRejectedError, AgentCallError, BUDGET_ABORT_REASON, BudgetExhaustedError, CANCEL_AGENT_SCHEMA, CHECKPOINT_FORMAT_V1, CLAIM_STATEMENT_MAX_CHARS, CLAIM_TTL_DAYS, COMPACTION_SUMMARY_PREFIX, CURRENT_HASH_VERSION, ConfigError, DEFAULT_CHILD_BUDGET_FRACTION, DEFAULT_CHILD_RESULT_PAGE_CHARS, DEFAULT_CITATION_PATTERN, DEFAULT_COMPACTION_THRESHOLD, DEFAULT_ESCALATION_LIMITS, DEFAULT_EVIDENCE_MIN_SHARE, DEFAULT_FINISH_MAX_REPAIRS, DEFAULT_FLAT_RESERVE_USD, DEFAULT_MAX_CHILDREN_PER_NODE, DEFAULT_MAX_DEPTH, DEFAULT_MAX_OSCILLATIONS_PER_KEY, DEFAULT_MAX_PINNED_WORKTREES, DEFAULT_MAX_REVISIONS_PER_RUN, DEFAULT_MAX_TOTAL_SPAWNS, DEFAULT_MAX_TURNS, DEFAULT_MODEL_RETRY_ATTEMPTS, DEFAULT_NO_PROGRESS_TURNS, DEFAULT_PER_RUN_CONCURRENCY, DEFAULT_RETRY_POLICY, DEFAULT_STREAM_IDLE_TIMEOUT_MS, DEFAULT_SYNTHESIS_MAX_TURNS, DEFAULT_SYNTHESIS_NOTE_MAX_TURNS, DedupIndex, DeterminismError, EMIT_RESULT_TOOL, EMPTY_SCHEMA_HASH, EMPTY_TOOLSET_HASH, ESCALATE_TOOL_NAME, ESCALATION_REPORT_SCHEMA, ESCALATION_REQUEST_SCHEMA, EVENT_SEGMENT_STRIDE, EscalationDecisionAbortedError, EventBus, ExternalRegistry, FINALIZE_SYNTHESIS_INSTRUCTION, FINISH_SCHEMA, FINISH_TOOL_NAME, FailRunError, FileModelKnowledgeStore, FileTranscriptStore, GET_CHILD_RESULT_SCHEMA, GET_CHILD_RESULT_TOOL_NAME, GitWorktreeProvider, IMPLEMENTATION_PROFILE_LIMITS, INBOX_PROPOSAL_TTL_DAYS, InMemoryStore, InMemoryTranscriptStore, InProcessRunner, InvalidResolutionError, JournalCompatibilityError, JournalMatcher, JournalMissError, JournalOrderViolation, JsonlFileStore, KB_ACTIVE_CLAIMS_CAP, KB_CARD_RENDER_BUDGET_CHARS, KeyedLimiter, KnowledgeCasError, LARGE_VALUE_WARN_BYTES, LEGACY_LTID_PREFIX, LEGACY_SIGNATURE_INPUTS, LINEAGE_SIG_VERSION, LeaseHeldError, LineageIndex, MASKED_SECRET, MAX_CHILD_RESULT_PAGE_CHARS, MAX_DEPTH_CEILING, ModelRetry, NoProgressDetector, NonSerializableValueError, ORCHESTRATE_WORKFLOW_NAME, OrchestratorCapConfigError, PARALLEL_AGENTS_SCHEMA, PROGRESS_REPORT_TOOL_NAME, ParallelSiteCounter, PlanInvariantError, QUOTA_WINDOW_MS, READ_CHILD_ARTIFACT_SCHEMA, READ_CHILD_ARTIFACT_TOOL_NAME, RESEARCH_PROFILE_LIMITS, REVIEW_PROFILE_LIMITS, ROLE_EFFORT_DEFAULTS, ROOT_ACCOUNT, ROOT_SCOPE, RUN_PROFILES, RUN_SETTLE_DECISION_TYPE, ReplayPlanHashMismatch, Replayer, ResolutionArbiter, ResolutionFold, RulvarError, RunBudget, SANDBOX_AGENT_OPT_KEYS, SPAWN_AGENT_SCHEMA, SandboxError, ScriptRejected, Semaphore, SpanRegistry, TOOL_NAME_PATTERN, TerminationAccount, WAIT_FOR_EVENTS_SCHEMA, WAIT_FOR_EVENTS_TOOL_NAME, WAKE_SUMMARY_RENDER_BUDGET_CHARS, admissionReserveUsd, affordableOutputTokens, agentErrorFromWire, agentErrorToWire, agentResultWire, agentScope, applyClaimOps, applyStructuredOutputTier, approachSigCoarse, approachSigOf, archiveDeprecatedModelOps, assertFencedWrites, atCompactionThreshold, auditRun, auditRuns, buildAbandonFold, buildAdapterRegistry, buildCostReport, buildDeriverRegistry, buildOrchestratorTools, buildTerminationInitValue, buildToolContext, canRideLoopTurn, canonicalIsolationTag, canonicalizeLadder, canonicalizeSchema, capIssues, capsHashOf, checkFloors, checkpointRefFor, childCoveragePrefix, claimExpired, claimExpiry, claimIssues, claimOpIssues, classifyAgentError, classifyAttemptOutcome, collectDeclaredLadders, compactMessages, compilePermissionChain, compilePermissionPreset, compileVerifiedLayer, costReportFromJournal, countsAgainstLimit, createCanonicalIdMinter, createCtx, createEngine, createSandboxBridge, currentOnlyKeyRing, decodeCheckpoint, dedupeRepeatedClaims, defineWorkflow, deriveContentKey, deriverV1, deriverV2, digestOf, dispositionHook, emptyDigestBlocks, emptyToolset, encodeCheckpoint, entryUsageSlices, escalateTool, evaluatePermission, evaluateReuse, evidencePreservedValidator, executeWorkflow, exhaustionCodeOf, extractCandidate, failoverTriggerOf, fallbackTriggerOf, filterClaimsForRun, finalizeFires, foldTermination, formatRePrompt, formatScopePath, hasFencedWrites, hasMetaLookup, hashRunArgs, hashRunOutput, hashWorkflowBody, hashWorkflowSource, identityJcs, implementationAgentProfile, isEscalated, isSchemaPairSpec, isStandardSchemaSpec, isStrictCompatibleSchema, kMaxOf, knowledgeHash, ladderLengthOf, ladderRungChoice, lastRunSettle, latestProgressReport, lexShellCommand, liftRetainedParts, lineageWeightOf, makeOrchestratorWorkflow, maskSecrets, maskSecretsDeep, maskSecretsJson, matchArgvPattern, matchShellCommand, mcp, memoryQuotaLimiter, mergeQuotaDenial, mergeUsageLimits, metaMatchesFilter, minMatchesValidator, modelEpochOf, modelKnowledgeCard, modelSpecIdentity, needsSeparateExtract, nextFailover, nodeLinkKey, normalizeApproachTag, normalizeEntry, normalizeFallbacks, orchestrate, parallelScope, parseModelRef, parseScopePath, phiInitialOf, pipelineScope, planNodeScope, priceEntryUsage, priceUsdOf, profileCard, profileRegistrySnapshotHash, progressReportTool, projectHistory, projectIdentity, projectToJsonSchema, proposalStatement, providerOf, quotaActualTokens, quotaEstimateTokens, quotaRuleAdmission, quotaRuleMatches, readRunMeta, readTerminationInit, reconcileRunMeta, reduceCriticalPath, reduceInvocationTable, registryKeyRing, remeasureQueue, replayDisposition, repositoryResearchToolset, requiredFieldsValidator, requiredSectionsValidator, researchAgentProfile, resolveModelInvocation, resolvePricing, resolveToolset, retryClassOf, retryDelayMs, reviewAgentProfile, roleConfiguredInRouting, roundOneDisposition, runAgent, runProfile, sanitizeTerminalText, sanitizeTokenCount, sanitizeUsage, sanitizeUsageDelta, scanJournalCompatibility, schemaHash, schemaHashOfSpec, selectStructuredOutputTier, shouldCompact, snapshotUsage, spawnDepthOf, summarizeInstruction, summarizeOutput, terminationConfigDrift, tierWithinCaps, toApprovalDecision, toJournalValue, tool, toolContract, toolsetHash, ttlState, usageViolations, validateEditorialCommit, validateEngineQuotaConfig, validateEntryShape, validateEscalationLimits, validateEscalationReport, validateQuotaRules, validateRetryPolicy, validateSchemaSpec, validateTerminationLimits, validateUsageLimits, workflowScope, workflowSourceRef, wrapJournalStore, wrapTranscriptStore };
+export { AWAIT_SCHEMA, AdmissionController, AdmissionRejectedError, AgentCallError, BUDGET_ABORT_REASON, BudgetExhaustedError, CANCEL_AGENT_SCHEMA, CHECKPOINT_FORMAT_V1, CLAIM_STATEMENT_MAX_CHARS, CLAIM_TTL_DAYS, COMPACTION_SUMMARY_PREFIX, CURRENT_HASH_VERSION, ConfigError, DEFAULT_CHILD_BUDGET_FRACTION, DEFAULT_CHILD_RESULT_PAGE_CHARS, DEFAULT_CITATION_PATTERN, DEFAULT_COMPACTION_THRESHOLD, DEFAULT_ESCALATION_LIMITS, DEFAULT_EVIDENCE_MIN_SHARE, DEFAULT_FINISH_MAX_REPAIRS, DEFAULT_FLAT_RESERVE_USD, DEFAULT_MAX_CHILDREN_PER_NODE, DEFAULT_MAX_DEPTH, DEFAULT_MAX_OSCILLATIONS_PER_KEY, DEFAULT_MAX_PINNED_WORKTREES, DEFAULT_MAX_REVISIONS_PER_RUN, DEFAULT_MAX_TOTAL_SPAWNS, DEFAULT_MAX_TURNS, DEFAULT_MODEL_RETRY_ATTEMPTS, DEFAULT_NO_PROGRESS_TURNS, DEFAULT_PER_RUN_CONCURRENCY, DEFAULT_RETRY_POLICY, DEFAULT_STREAM_IDLE_TIMEOUT_MS, DEFAULT_SYNTHESIS_MAX_TURNS, DEFAULT_SYNTHESIS_NOTE_MAX_TURNS, DedupIndex, DeterminismError, EMIT_RESULT_TOOL, EMPTY_SCHEMA_HASH, EMPTY_TOOLSET_HASH, ESCALATE_TOOL_NAME, ESCALATION_REPORT_SCHEMA, ESCALATION_REQUEST_SCHEMA, EVENT_SEGMENT_STRIDE, EscalationDecisionAbortedError, EventBus, ExternalRegistry, FINALIZE_SYNTHESIS_INSTRUCTION, FINISH_SCHEMA, FINISH_TOOL_NAME, FailRunError, FileModelKnowledgeStore, FileTranscriptStore, GET_CHILD_RESULT_SCHEMA, GET_CHILD_RESULT_TOOL_NAME, GitWorktreeProvider, IMPLEMENTATION_PROFILE_LIMITS, INBOX_PROPOSAL_TTL_DAYS, InMemoryStore, InMemoryTranscriptStore, InProcessRunner, InvalidResolutionError, JOURNAL_ENVELOPE_MARKER, JournalCompatibilityError, JournalMatcher, JournalMissError, JournalOrderViolation, JsonlFileStore, KB_ACTIVE_CLAIMS_CAP, KB_CARD_RENDER_BUDGET_CHARS, KeyedLimiter, KnowledgeCasError, LARGE_VALUE_WARN_BYTES, LEGACY_LTID_PREFIX, LEGACY_SIGNATURE_INPUTS, LINEAGE_SIG_VERSION, LeaseHeldError, LineageIndex, MASKED_SECRET, MAX_CHILD_RESULT_PAGE_CHARS, MAX_DEPTH_CEILING, ModelRetry, NoProgressDetector, NonSerializableValueError, ORCHESTRATE_WORKFLOW_NAME, OrchestratorCapConfigError, PARALLEL_AGENTS_SCHEMA, PROGRESS_REPORT_TOOL_NAME, ParallelSiteCounter, PlanInvariantError, QUOTA_WINDOW_MS, READ_CHILD_ARTIFACT_SCHEMA, READ_CHILD_ARTIFACT_TOOL_NAME, RESEARCH_PROFILE_LIMITS, REVIEW_PROFILE_LIMITS, ROLE_EFFORT_DEFAULTS, ROOT_ACCOUNT, ROOT_SCOPE, RUN_PROFILES, RUN_SETTLE_DECISION_TYPE, ReplayPlanHashMismatch, Replayer, ResolutionArbiter, ResolutionFold, RulvarError, RunBudget, SANDBOX_AGENT_OPT_KEYS, SPAWN_AGENT_SCHEMA, SandboxError, ScriptRejected, Semaphore, SpanRegistry, TOOL_NAME_PATTERN, TerminationAccount, WAIT_FOR_EVENTS_SCHEMA, WAIT_FOR_EVENTS_TOOL_NAME, WAKE_SUMMARY_RENDER_BUDGET_CHARS, admissionReserveUsd, affordableOutputTokens, agentErrorFromWire, agentErrorToWire, agentResultWire, agentScope, applyClaimOps, applyStructuredOutputTier, approachSigCoarse, approachSigOf, archiveDeprecatedModelOps, assertFencedWrites, atCompactionThreshold, auditRun, auditRuns, buildAbandonFold, buildAdapterRegistry, buildCostReport, buildDeriverRegistry, buildOrchestratorTools, buildTerminationInitValue, buildToolContext, canRideLoopTurn, canonicalIsolationTag, canonicalizeLadder, canonicalizeSchema, capIssues, capsHashOf, checkFloors, checkpointRefFor, childCoveragePrefix, claimExpired, claimExpiry, claimIssues, claimOpIssues, classifyAgentError, classifyAttemptOutcome, collectDeclaredLadders, compactMessages, compilePermissionChain, compilePermissionPreset, compileSecretMasker, compileVerifiedLayer, constantTimeEqual, costReportFromJournal, countsAgainstLimit, createCanonicalIdMinter, createCtx, createEngine, createEnvelopeEncryption, createSandboxBridge, currentOnlyKeyRing, decodeCheckpoint, dedupeRepeatedClaims, defineWorkflow, deriveContentKey, deriverV1, deriverV2, digestOf, dispositionHook, emptyDigestBlocks, emptyToolset, encodeCheckpoint, entryUsageSlices, escalateTool, evaluatePermission, evaluateReuse, evidencePreservedValidator, executeWorkflow, exhaustionCodeOf, extractCandidate, failoverTriggerOf, fallbackTriggerOf, filterClaimsForRun, finalizeFires, foldTermination, formatRePrompt, formatScopePath, hasFencedWrites, hasMetaLookup, hashRunArgs, hashRunOutput, hashWorkflowBody, hashWorkflowSource, identityJcs, implementationAgentProfile, isEscalated, isSchemaPairSpec, isStandardSchemaSpec, isStrictCompatibleSchema, kMaxOf, knowledgeHash, ladderLengthOf, ladderRungChoice, lastRunSettle, latestProgressReport, lexShellCommand, liftRetainedParts, lineageWeightOf, localKeyProvider, makeOrchestratorWorkflow, maskSecrets, maskSecretsDeep, maskSecretsJson, matchArgvPattern, matchShellCommand, mcp, memoryQuotaLimiter, mergeQuotaDenial, mergeUsageLimits, metaMatchesFilter, minMatchesValidator, modelEpochOf, modelKnowledgeCard, modelSpecIdentity, needsSeparateExtract, nextFailover, nodeLinkKey, normalizeApproachTag, normalizeEntry, normalizeFallbacks, orchestrate, parallelScope, parseModelRef, parseScopePath, phiInitialOf, pipelineScope, planNodeScope, priceEntryUsage, priceUsdOf, profileCard, profileRegistrySnapshotHash, progressReportTool, projectHistory, projectIdentity, projectToJsonSchema, proposalStatement, providerOf, quotaActualTokens, quotaEstimateTokens, quotaRuleAdmission, quotaRuleMatches, readRunMeta, readTerminationInit, reconcileRunMeta, reduceAuditTrail, reduceCriticalPath, reduceInvocationTable, registryKeyRing, remeasureQueue, replayDisposition, repositoryResearchToolset, requiredFieldsValidator, requiredSectionsValidator, researchAgentProfile, resolveModelInvocation, resolvePricing, resolveToolset, retryClassOf, retryDelayMs, reviewAgentProfile, roleConfiguredInRouting, roundOneDisposition, runAgent, runProfile, sanitizeTerminalText, sanitizeTokenCount, sanitizeUsage, sanitizeUsageDelta, scanJournalCompatibility, schemaHash, schemaHashOfSpec, selectStructuredOutputTier, shouldCompact, snapshotUsage, spawnDepthOf, summarizeInstruction, summarizeOutput, terminationConfigDrift, tierWithinCaps, toApprovalDecision, toJournalValue, tool, toolContract, toolsetHash, ttlState, usageViolations, validateEditorialCommit, validateEngineQuotaConfig, validateEntryShape, validateEscalationLimits, validateEscalationReport, validateQuotaRules, validateRetryPolicy, validateSchemaSpec, validateTerminationLimits, validateUsageLimits, workflowScope, workflowSourceRef, wrapJournalStore, wrapTranscriptStore };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rulvar/core",
-  "version": "1.57.0",
+  "version": "1.58.0",
   "description": "Rulvar core: L0 contracts, journal kernel, ctx primitives, agent runtime, model router, tool system, dynamic orchestrator, InMemory and JSONL stores, event stream.",
   "type": "module",
   "license": "Apache-2.0",