@rulvar/core 1.57.0 → 1.59.0

package/dist/index.d.ts

@@ -1035,6 +1035,90 @@ declare function maskSecrets(text: string): string;
 declare function maskSecretsDeep<T>(value: T): T;
 /** Convenience for hosts: masks a Json value (alias of the deep walk). */
 declare function maskSecretsJson(value: Json): Json;
+/** A compiled masking policy: text and deep-JSON forms of one pattern set. */
+interface SecretMasker {
+  maskText(text: string): string;
+  maskDeep<T>(value: T): T;
+}
+/**
+* Compiles the redaction policy: the DEFAULT credential pattern set
+* plus host-defined patterns (RV-217), for the telemetry boundary
+* (events and traces; never the journal, where lossless encryption is
+* the right tool). String patterns compile as global regexes; RegExp
+* patterns are recompiled with the global flag when it is missing, so
+* replace-all semantics always hold. An invalid pattern is a typed
+* ConfigError at compile time, before anything runs under the policy.
+*/
+declare function compileSecretMasker(patterns?: ReadonlyArray<RegExp | string>, site?: string): SecretMasker;
+//#endregion
+//#region src/l0/encryption.d.ts
+/**
+* The KMS seam. `keyId` is a stable routing id stamped into every
+* envelope (a KMS key ARN or alias, or a local rotation label); the
+* two methods are the exact shape of KMS GenerateDataKey and Decrypt.
+* Both are called only inside `createEnvelopeEncryption`.
+*/
+interface DataKeyProvider {
+  readonly keyId: string;
+  generateDataKey(): Promise<{
+    plaintext: Bytes;
+    wrapped: Bytes;
+  }>;
+  unwrapDataKey(wrapped: Bytes): Promise<Bytes>;
+}
+/**
+* The local reference DataKeyProvider: the key-encryption key is
+* HKDF-SHA256(secret, info), data keys are random 32-byte AES keys,
+* and wrapping is AES-256-GCM under the KEK. `info` partitions one
+* master secret into unrelated KEKs (tenant-scoped keys: one provider
+* per tenant with `info: tenantId`); a provider with different
+* secret or info CANNOT unwrap this provider's keys. For production
+* KMS, implement the same interface over GenerateDataKey/Decrypt.
+*/
+declare function localKeyProvider(options: {
+  secret: string | Bytes; /** Stamped into envelopes; default 'local:v1'. */
+  keyId?: string; /** KEK partition label (e.g. a tenant id); default ''. */
+  info?: string;
+}): DataKeyProvider;
+/** The journal envelope marker; a stored entry's whole value is this. */
+declare const JOURNAL_ENVELOPE_MARKER = "__rulvarEnvelope";
+interface EnvelopeEncryption {
+  /** Pass as `createEngine({ serialization })`. */
+  hook: SerializationHook;
+  /** The provider's routing id, stamped into every envelope. */
+  keyId: string;
+  /**
+  * The CURRENT wrapped data key. Every write stamps it into the
+  * envelope, so nothing else must be persisted; it is exposed for
+  * hosts that keep a rotation ledger.
+  */
+  wrappedDataKey: Bytes;
+}
+interface EnvelopeEncryptionOptions {
+  provider: DataKeyProvider;
+  /**
+  * Wrapped data keys from earlier sessions or rotations that this
+  * process must still read. Unwrapped once at creation; an envelope
+  * carrying an UNREGISTERED wrapped key fails typed at read, naming
+  * this list.
+  */
+  historicalWrappedKeys?: readonly Bytes[];
+  /**
+  * What a NON-enveloped stored entry or blob means at read:
+  * 'reject' (default, fail closed) or 'passthrough' (explicit
+  * migration mode for stores with pre-encryption history).
+  */
+  plaintextReads?: "reject" | "passthrough";
+}
+/**
+* Builds the envelope-encryption SerializationHook. All DataKeyProvider
+* calls happen HERE (the hook itself is synchronous, on in-memory data
+* keys): a fresh data key is minted and wrapped for this instance, and
+* every historical wrapped key is unwrapped for the read path.
+*/
+declare function createEnvelopeEncryption(options: EnvelopeEncryptionOptions): Promise<EnvelopeEncryption>;
+/** Guards against non-constant-time comparisons in host key checks. */
+declare function constantTimeEqual(a: Bytes, b: Bytes): boolean;
 //#endregion
 //#region src/l0/usage.d.ts
 /**
@@ -1430,8 +1514,12 @@ interface ToolContext {
 }
 /**
 * Where execute runs. A declared capability consumed by dispatch and
-* policy; only 'inprocess' is enforced in v1, subprocess/container remain
-* declared capability while the executor design stays an open question.
+* policy. 'inprocess' runs the tool's `execute` closure in the engine
+* process (full host capabilities, an execution convenience). A
+* non-inprocess tag routes dispatch through the engine's registered
+* ToolExecutorProvider (RV-216) instead, so the tool's work runs out of
+* process under host-owned isolation; the shipped reference adapters live
+* in `@rulvar/executor`. The tag never enters toolsetHash.
 */
 type ToolExecutor = "inprocess" | "subprocess" | "container";
 /**
@@ -1449,6 +1537,14 @@ interface ToolDef<S extends SchemaSpec = SchemaSpec> {
   readonly version?: string;
   /** Default 'inprocess'. */
   readonly executor: ToolExecutor;
+  /**
+  * Opaque policy data for a non-inprocess executor: what THIS tool's
+  * declared executor should run (for a subprocess adapter, the command
+  * and its argv). Never identity: excluded from toolsetHash exactly like
+  * `executor` and `risk`, and ignored for 'inprocess'. The engine passes
+  * it verbatim to the ToolExecutorProvider (RV-216).
+  */
+  readonly executorSpec?: Json;
   /** Default false; the terminal permission default asks when true. */
   readonly needsApproval: boolean;
   readonly risk?: ToolRisk;
@@ -1691,6 +1787,67 @@ interface QuotaLimiter {
   reconcile(reservationId: string, usage: Usage): Promise<void>;
 }
 //#endregion
+//#region src/l0/spi/executor.d.ts
+/** The non-inprocess executor tags a provider can be registered under. */
+type IsolatedExecutorTag = Exclude<ToolExecutor, "inprocess">;
+/**
+* The per-call context handed to a ToolExecutorProvider. It carries the
+* tool span (so provider telemetry nests under the run tree), the
+* cancellation signal, and a stable idempotency key.
+*/
+interface IsolatedExecContext {
+  runId: string;
+  /** The tool span, minted under the agent span exactly like inprocess. */
+  spanId: string;
+  agentType: string;
+  /**
+  * Stable identity of THIS logical tool call: identical
+  * (runId, tool, args) always derive the same key, so a provider whose
+  * work has external side effects can fold an at-least-once retry into
+  * effectively-once. A rerun of the same call after a mid-flight crash
+  * reuses the key; a different call never collides.
+  */
+  idempotencyKey: string;
+  /** Fires on cancellation, a budget ceiling, or UsageLimits expiry. */
+  signal: AbortSignal;
+  /** Emits telemetry log events under the tool span; never journals. */
+  log(level: "debug" | "info" | "warn" | "error", msg: string, data?: Json): void;
+}
+/** One out-of-process tool dispatch. */
+interface IsolatedExecRequest {
+  /** The declared executor tag ('subprocess' | 'container'). */
+  executor: IsolatedExecutorTag;
+  /** The tool contract name. */
+  tool: string;
+  /** The validated arguments, after the permission chain rewrote them. */
+  args: Json;
+  /**
+  * The tool's `executorSpec`: opaque host data telling THIS provider
+  * what to run (for a subprocess adapter, the command and its argv).
+  * Never identity; the engine passes it through verbatim.
+  */
+  spec: Json;
+  ctx: IsolatedExecContext;
+}
+/**
+* The isolated tool executor seam. A provider runs one dispatch to its
+* JSON result. A thrown error becomes the call's error tool result, never
+* a run abort: an executor failure (non-zero exit, timeout kill,
+* unparseable output, infrastructure error) is surfaced to the model
+* exactly like any other tool error, so the loop can react and the run
+* stays durable.
+*/
+interface ToolExecutorProvider {
+  /** Runs one dispatch to its JSON result; throws to signal tool failure. */
+  run(request: IsolatedExecRequest): Promise<Json>;
+}
+/**
+* The engine's executor registry: at most one provider per non-inprocess
+* tag. A tool whose `executor` tag is absent here fails typed at spawn
+* time, before any provider or model call.
+*/
+type ExecutorRegistry = Partial<Record<IsolatedExecutorTag, ToolExecutorProvider>>;
+//#endregion
 //#region src/knowledge/decay.d.ts
 /**
 * The asymmetric TTL table:
@@ -3919,6 +4076,14 @@ interface ToolRuntime {
   contextFor(toolName: string): ToolContext;
   /** Permission chain evaluation (M3-T03); absent = every call allowed. */
   permission?: (call: ToolCallRequest) => Promise<PermissionGate>;
+  /**
+  * Runs a non-inprocess tool out of process through the engine's
+  * registered ToolExecutorProvider (RV-216). Present whenever the frozen
+  * toolset holds any non-inprocess tool; the ctx layer mints the tool
+  * span and idempotency key and wires the provider. A throw becomes the
+  * call's error tool result exactly like an inprocess execute throw.
+  */
+  executeExternal?: (def: ToolDef, args: Json) => Promise<unknown>;
 }
 /** One serving target of a phase: the primary or a failover fallback. */
 interface PhaseTarget {
@@ -4225,7 +4390,7 @@ declare function emptyToolset(): ResolvedToolset;
 * without one, string entries fail with the same unknown-name error as
 * a miss, so nothing outside the declared registry is ever reachable.
 */
-declare function resolveToolset(specs: ToolsOption | undefined, session: ToolSourceSession, toolsets?: Record<string, ToolsOption>): Promise<ResolvedToolset>;
+declare function resolveToolset(specs: ToolsOption | undefined, session: ToolSourceSession, toolsets?: Record<string, ToolsOption>, executors?: ReadonlySet<string>): Promise<ResolvedToolset>;
 //#endregion
 //#region src/journal/termination.d.ts
 /** The frozen limits vector written into termination.init. */
@@ -5426,6 +5591,19 @@ interface CreateEngineOptions {
     sandbox?: ScriptRunner;
   };
   /**
+  * Isolated tool executors (RV-216): one ToolExecutorProvider per
+  * non-inprocess `executor` tag. A tool declaring `executor: 'subprocess'`
+  * or `'container'` dispatches through the matching provider, so its work
+  * runs OUT of the engine process under host-owned isolation instead of
+  * as an inprocess closure with full host capabilities. The shipped
+  * reference adapters (subprocessExecutor, containerExecutor) live in
+  * `@rulvar/executor`. Absent = only inprocess tools are accepted, and a
+  * non-inprocess tag is a typed ConfigError at spawn time. In-process
+  * tools stay ordinary function calls: never a sandbox for hostile or
+  * model-generated code.
+  */
+  executors?: ExecutorRegistry;
+  /**
   * The InProcessRunner escalation hook:
   * receives escalated results when the call form cannot carry them; the
   * returned decision is journaled as the authoritative
@@ -5446,12 +5624,18 @@ interface CreateEngineOptions {
   */
   serialization?: SerializationHook;
   /**
-  * The default key-masking policy at the telemetry boundary. Default
-  * ON: key-shaped strings in every
-  * emitted WorkflowEvent are masked; never touches the journal.
+  * The masking policy at the telemetry boundary. Default ON:
+  * key-shaped strings in every emitted WorkflowEvent are masked;
+  * never touches the journal (lossless encryption via `serialization`
+  * is the persistence-side tool). `patterns` adds host-defined
+  * redaction on top of the default credential set (RV-217): RegExp or
+  * pattern strings, compiled once at construction, applied to every
+  * string in every emitted event body. Feed the same patterns to the
+  * OTel exporter for trace parity.
   */
   redaction?: {
     maskEvents?: boolean;
+    patterns?: ReadonlyArray<RegExp | string>;
   };
   /**
   * Bare-nondeterminism detection over in-process workflow bodies
@@ -5465,6 +5649,21 @@ interface CreateEngineOptions {
   * runtime frames are classified exempt and stay silent.
   */
   determinism?: DeterminismConfig;
+  /**
+  * Metadata protection knobs (RV-217). `argsHashSalt` switches the
+  * RunMeta.argsHash digest from plain sha256 to HMAC-SHA256 under the
+  * salt: equal args stop correlating across deployments and
+  * low-entropy args stop being recoverable from the digest. The salt
+  * is deployment config, not a per-run secret: every engine (and the
+  * CLI host config) resuming this store's runs must carry the SAME
+  * salt, or the resume args gate refuses matching args. Runs recorded
+  * before the salt keep their unsalted digests; the gate then simply
+  * mismatches until forced, so introduce the salt on a fresh store or
+  * accept --allow-args-change on legacy runs.
+  */
+  security?: {
+    argsHashSalt?: string;
+  };
 }
 interface RunOptions {
   /** Explicit id; otherwise the engine mints a ULID. */
@@ -5590,6 +5789,35 @@ interface Engine {
   pruneRun(runId: string, opts?: {
     lease?: Lease;
   }): Promise<number>;
+  /**
+  * Portable run export (RV-217): the meta record, every journal
+  * entry, and every transcript blob, read through Engine.stores (the
+  * one policy point), so an encrypted deployment exports PLAINTEXT
+  * for a subject-access request or a store migration, without raw
+  * store spelunking. Blobs are materialized in memory; export runs
+  * one at a time, not catalogs.
+  */
+  exportRun(runId: string): Promise<RunExport>;
+  /**
+  * Imports a bundle produced by exportRun, under its ORIGINAL runId
+  * (transcript refs and journal fields embed it; rewriting ids is
+  * deliberately out of scope). Writes through Engine.stores, so an
+  * encrypting target re-encrypts under its own policy. Refuses typed
+  * when the run already exists in the target store, so an import can
+  * never interleave with live history.
+  */
+  importRun(bundle: RunExport): Promise<void>;
+}
+/** The portable bundle exportRun produces and importRun consumes (RV-217). */
+interface RunExport {
+  runId: string;
+  /** Absent when the source store had no meta row for the run. */
+  meta?: RunMeta;
+  entries: JournalEntry[];
+  blobs: Array<{
+    ref: string;
+    data: Bytes;
+  }>;
 }
 /** Content hash of an in-process workflow body (run-to-definition binding). */
 declare function hashWorkflowBody(wf: Workflow<never, never> | Workflow<unknown, unknown>): string;
@@ -5613,7 +5841,9 @@ declare function workflowSourceRef(runId: string): string;
 * sensitive-derived metadata, not a value safe to publish (see the
 * `argsHash` field docs).
 */
-declare function hashRunArgs(args: unknown): string | undefined;
+declare function hashRunArgs(args: unknown, options?: {
+  salt?: string;
+}): string | undefined;
 /**
 * sha256 hex over the JCS canonical serialization of a run's result
 * value: the digest the engine records as `outputHash` on the journaled
@@ -7125,6 +7355,14 @@ interface RunInternals {
   /** The worktree lifecycle provider. */
   isolation?: IsolationProvider;
   /**
+  * Isolated tool executors (RV-216): the ToolExecutorProvider registry
+  * from createEngine, keyed by non-inprocess executor tag. A tool
+  * declaring such a tag dispatches through the matching provider instead
+  * of running its inprocess closure; absent means only inprocess tools
+  * are accepted.
+  */
+  executors?: ExecutorRegistry;
+  /**
   * The ModelKnowledge runtime handle (M10-T03): current()
   * only, commit physically absent. Present only when the engine was
   * given stores.modelKnowledge; absent means the feature is off and
@@ -7302,6 +7540,8 @@ interface ToolInit<S extends SchemaSpec> {
   version?: string;
   /** Default 'inprocess'. */
   executor?: ToolExecutor;
+  /** Opaque data for a non-inprocess executor (RV-216); never identity. */
+  executorSpec?: Json;
   /** Default false. */
   needsApproval?: boolean;
   /** Policy metadata; never identity. */
@@ -7545,6 +7785,37 @@ declare function implementationAgentProfile(options?: AgentProfileTemplateOption
 */
 declare function reviewAgentProfile(options?: AgentProfileTemplateOptions): AgentProfile;
 //#endregion
+//#region src/engine/audit.d.ts
+type AuditCategory = "suspension" | "resolution" | "abandon" | "decision" | "termination-denied" | "run-settle";
+/** One reviewable authority event, in journal order. */
+interface AuditRecord {
+  /** The journal seq of the entry behind this record. */
+  seq: number;
+  /** The entry's startedAt timestamp. */
+  at: string;
+  scope: string;
+  category: AuditCategory;
+  /**
+  * The finer type: the suspension kind ('external' | 'approval') for
+  * suspensions, the journaled decisionType for decisions.
+  */
+  type?: string;
+  /** Who acted: a ResolutionBy for resolutions, 'engine' for decisions. */
+  by?: string;
+  /** The seq of the entry this record acts on (resolution/abandon target). */
+  target?: number;
+  /** One deterministic reviewable line. */
+  summary: string;
+  /** The journaled payload, verbatim (plaintext through Engine.stores). */
+  value?: Json;
+}
+/**
+* Folds a loaded journal into the audit trail, in seq order. Pass the
+* FULL entry list (`Engine.stores.journal.load(runId)` or
+* `exportRun(runId).entries`); filtering is the reducer's job.
+*/
+declare function reduceAuditTrail(entries: readonly JournalEntry[]): AuditRecord[];
+//#endregion
 //#region src/journal/scope.d.ts
 /**
 * Scope-path grammar (M1-T04): deterministic structural paths, independent
@@ -8114,7 +8385,7 @@ declare class EventBus {
   private readonly runId;
   private readonly spans;
   private readonly now;
-  private readonly maskEvents;
+  private readonly mask;
   private readonly subscribers;
   private readonly listeners;
   private seq;
@@ -8131,6 +8402,12 @@ declare class EventBus {
     */
     maskEvents?: boolean;
     /**
+    * The compiled masking policy applied when maskEvents is on
+    * (RV-217): the default credential set plus host patterns. Absent
+    * falls back to the default maskSecretsDeep.
+    */
+    mask?: (body: WorkflowEventBody) => WorkflowEventBody;
+    /**
     * First seq value (default 0): the resumed-segment base that keeps
     * seq strictly increasing per run across segments (v1.22.0 review
     * P1-2).
@@ -8311,4 +8588,4 @@ interface SandboxBridge {
 declare const SANDBOX_AGENT_OPT_KEYS: readonly string[];
 declare function createSandboxBridge(ctx: Ctx<never>, options: SandboxBridgeOptions): SandboxBridge;
 //#endregion
-export { AWAIT_SCHEMA, AbandonAttempt, AbandonFold, AbandonPayload, AbandonedSpendView, AbortClass, type AdaptiveEvents, AdmissionController, AdmissionDecision, AdmissionRejectedError, AdmissionStatsBefore, AdmitLineage, AdmitRejectReason, AdmitSpec, AdmitVerdict, AgentCallError, AgentError, type AgentEvents, AgentIdentityInput, type AgentInvocationRow, AgentOpts, AgentProfile, AgentProfilePermissions, AgentProfileTemplateOptions, AgentResult, AgentResultMeta, AgentStatus, ApproachSignatureInputs, ApprovalDecision, ApprovalIdentityInput, Artifact, AttemptOutcomeClass, AuditRunsOptions, BUDGET_ABORT_REASON, BaseAppend, BriefOpts, BudgetAccountView, BudgetDefaults, BudgetExhaustedError, BudgetExhaustionDiagnostics, BudgetHooks, BudgetReserve, type Bytes, CANCEL_AGENT_SCHEMA, CHECKPOINT_FORMAT_V1, CLAIM_STATEMENT_MAX_CHARS, CLAIM_TTL_DAYS, COMPACTION_SUMMARY_PREFIX, CURRENT_HASH_VERSION, CacheHint, CacheTtl, CanUseTool, CanonicalId, CanonicalIdentity, CanonicalLadderSpec, CanonicalModelSpec, ChatEvent, ChatRequest, CheckpointState, ChildArtifactPage, ChildIdentityInput, ChildResultPage, type ClaimClass, type ClaimOp, type ClaimStatus, ClaimValidationOptions, CollectOpts, CollectedTurn, CompactionConfig, CompiledPermissionChain, CompiledWorkflow, ConfigError, type CoreEvents, CostAttribution, CostAttributionFacts, CostReport, CreateEngineOptions, type CriticalPath, Ctx, DEFAULT_CHILD_BUDGET_FRACTION, DEFAULT_CHILD_RESULT_PAGE_CHARS, DEFAULT_CITATION_PATTERN, DEFAULT_COMPACTION_THRESHOLD, DEFAULT_ESCALATION_LIMITS, DEFAULT_EVIDENCE_MIN_SHARE, DEFAULT_FINISH_MAX_REPAIRS, DEFAULT_FLAT_RESERVE_USD, DEFAULT_MAX_CHILDREN_PER_NODE, DEFAULT_MAX_DEPTH, DEFAULT_MAX_OSCILLATIONS_PER_KEY, DEFAULT_MAX_PINNED_WORKTREES, DEFAULT_MAX_REVISIONS_PER_RUN, DEFAULT_MAX_TOTAL_SPAWNS, DEFAULT_MAX_TURNS, DEFAULT_MODEL_RETRY_ATTEMPTS, DEFAULT_NO_PROGRESS_TURNS, DEFAULT_PER_RUN_CONCURRENCY, DEFAULT_RETRY_POLICY, DEFAULT_STREAM_IDLE_TIMEOUT_MS, DEFAULT_SYNTHESIS_MAX_TURNS, DEFAULT_SYNTHESIS_NOTE_MAX_TURNS, DebitResult, DeclaredLadder, DedupIndex, DedupNote, DedupedClaims, DerivedKey, DeriverRegistry, type DeterminismConfig, DeterminismError, type DeterminismEvents, type DeterminismMode, DispositionRule, DispositionTable, DonorCandidate, DonorRef, DroppedItem, EMIT_RESULT_TOOL, EMPTY_SCHEMA_HASH, EMPTY_TOOLSET_HASH, ESCALATE_TOOL_NAME, ESCALATION_REPORT_SCHEMA, ESCALATION_REQUEST_SCHEMA, EVENT_SEGMENT_STRIDE, EffectiveUsageLimits, Effort, Engine, EngineDefaults, EngineQuotaConfig, EngineQuotaRuntime, EntryKind, EntryRef, EntryStatus, ErrorClass, ErrorCode, ErrorPolicy, EscalatedResult, EscalationDecision, EscalationDecisionAbortedError, EscalationDigest, EscalationKind, EscalationLimits, EscalationOptions, EscalationReport, EscalationRequest, EventBus, type EvidenceRef, type ExplorationSummary, ExtensionAppendInput, ExtensionDispatchSpec, ExternalIdentityInput, ExternalRegistry, ExtractNecessityInput, FINALIZE_SYNTHESIS_INSTRUCTION, FINISH_SCHEMA, FINISH_TOOL_NAME, FailRunError, FailoverTarget, FailoverTrigger, FallbackField, FallbackTrigger, FileModelKnowledgeStore, FileModelKnowledgeStoreOptions, FileTranscriptStore, FinishInfo, FinishValidationChild, FinishValidationInput, FinishValidationSpec, FinishValidationVerdict, FinishValidator, GET_CHILD_RESULT_SCHEMA, GET_CHILD_RESULT_TOOL_NAME, Gate, GateAudit, type GateRecord, GitWorktreeProvider, GitWorktreeProviderOptions, GraftBoot, HashVersion, HookVerdict, IMPLEMENTATION_PROFILE_LIMITS, INBOX_PROPOSAL_TTL_DAYS, IdentityInput, InMemoryStore, InMemoryTranscriptStore, InProcessRunner, IncrementalSynthesisResult, InvalidResolutionError, InvocationRole, type InvocationTable, type IsolationProvider, type IsolationSpec, Issue$1 as Issue, JournalCompatSubCode, JournalCompatibilityError, JournalEntry, JournalMatcher, JournalMissError, JournalOperation, JournalOrderViolation, JournalSerializationHook, type JournalStore, type Json, JsonSchema, JsonlFileStore, KB_ACTIVE_CLAIMS_CAP, KB_CARD_RENDER_BUDGET_CHARS, type KbProposal, type KbProposalTrigger, KeyDeriver, KeyRing, KeyedLimiter, KnowledgeCasError, type KnowledgeSnapshot, LARGE_VALUE_WARN_BYTES, LEGACY_LTID_PREFIX, LEGACY_SIGNATURE_INPUTS, LINEAGE_SIG_VERSION, LadderSpec, type LeasableStore, type Lease, LeaseHeldError, Ledger, LineageCounters, LineageIndex, LineageRef, LineageRelation, LineageStats, LogicalTaskId, MASKED_SECRET, MAX_CHILD_RESULT_PAGE_CHARS, MAX_DEPTH_CEILING, MatchResult, McpConfig, McpToolSource, MechanicalGateProfile, MechanicalGateVerdict, MemoryQuotaLimiter, type MetaLookupStore, type ModelCaps, ModelChoice, type ModelClaim, ModelEpochInputs, type ModelKnowledgeHandle, type ModelKnowledgeStore, ModelListConstraint, ModelRef, ModelRetry, ModelSpec, Msg, NoProgressDetector, NodeId, NodeLinkValue, NonSerializableValueError, ORCHESTRATE_WORKFLOW_NAME, OnEscalation, OperationDisposition, OrchestrateAcceptance, OrchestrateOptions, OrchestrateSynthesis, OrchestratorBudgetSpec, OrchestratorCapConfigError, OrchestratorExtension, OrchestratorExtensionIO, OrchestratorRuntime, Out, PARALLEL_AGENTS_SCHEMA, PROGRESS_REPORT_TOOL_NAME, ParallelSiteCounter, Part, PendingExternal, PendingToolTurn, PermissionConfig, PermissionGate, PermissionHook, PermissionPreset, PermissionRule, PermissionVerdict, type PhaseRow, PhaseTarget, PipelineCollected, PipelineOpts, PlanInvariantError, PriceTable, PricedUsage, type Pricing, type PricingTier, ProgressReport, type ProviderAdapter, QUOTA_WINDOW_MS, QualityFloors, QuotaCounters, type QuotaDecision, type QuotaEstimate, type QuotaLimiter, type QuotaReservationRequest, QuotaRule, QuotaWindowSnapshot, READ_CHILD_ARTIFACT_SCHEMA, READ_CHILD_ARTIFACT_TOOL_NAME, RESEARCH_PROFILE_LIMITS, REVIEW_PROFILE_LIMITS, ROLE_EFFORT_DEFAULTS, ROOT_ACCOUNT, ROOT_SCOPE, RUN_PROFILES, RUN_SETTLE_DECISION_TYPE, RandIdentityInput, RandPayload, ReconcileOptions, ReconcileResult, RefEntryAppender, RefEntryClassification, RefusalInfo, RepeatedClaim, ReplayDisposition, ReplayMode, ReplayPlanHashMismatch, Replayer, RepositoryResearchToolset, RepositoryResearchToolsetOptions, ResearchAgentProfileOptions, ResearchAgentProfileResult, ResearchEvidenceEntry, ResolutionArbiter, ResolutionAttempt, ResolutionBy, ResolutionFold, ResolutionLayer, ResolutionOutcome, ResolutionPayload, ResolvedInvocation, ResolvedToolset, ResumeHandle, ResumeOptions, ResumePreview, ResumeReport, RetryClass, RetryPolicy, ReuseConfig, RiskRuleValue, Role, RulvarError, RulvarErrorCode, RunAgentOptions, RunAuditVerdict, RunBudget, RunEventSink, type RunFilter, RunHandle, RunInternals, type RunMeta, RunOptions, RunOutcome, RunProfile, RunStateAudit, RunStatus, RuntimeEventSink, SANDBOX_AGENT_OPT_KEYS, SPAWN_AGENT_SCHEMA, SandboxBridge, SandboxBridgeOptions, SandboxError, SandboxHostToWorker, SandboxMethod, SandboxWorkerToHost, SchemaPair, SchemaSpec, SchemaValidationResult, ScopeSegment, ScriptRejected, ScriptRunner, ScrubNote, Semaphore, SerializationHook, Settled, ShellPatternRules, ShellSegment, ShellVerdict, SinglePhaseAppend, SpanMinter, SpanRegistry, SpawnAdmissionValue, SpawnAgentParams, SpawnKey, SpawnLineage, SpawnLineageOpt, SpawnOrigin, SpawnRecord, Spend, Stage, type StandardJSONSchemaV1, type StandardSchemaV1, StepIdentityInput, StructuredOutputTier, SuspendedAppend, SuspensionState, TOOL_NAME_PATTERN, type TaskClass, TaskDigest, TaskSpec, TerminalPatch, TerminationAccount, TerminationAccountSnapshot, TerminationDeniedValue, TerminationDeniedWriter, TerminationInitValue, TerminationLimits, TerminationResource, ToolCallRequest, ToolChoice, type ToolContext, ToolContextSeed, ToolContract, type ToolDef, type ToolEvents, type ToolExecutor, ToolInit, type ToolRisk, ToolRuntime, type ToolSource, type ToolSourceSession, ToolsOption, TranscriptSerializationHook, type TranscriptStore, TriggerClass, TtlState, Usage, UsageLimits, UsageSlice, VerifiedRecommendation, WAIT_FOR_EVENTS_SCHEMA, WAIT_FOR_EVENTS_TOOL_NAME, WAKE_SUMMARY_RENDER_BUDGET_CHARS, WakeBudgetBlock, WakeDigest, WakeTrigger, WireError, Workflow, WorkflowCallOpts, type WorkflowEvent, type WorkflowEventBody, WorkflowRegistry, admissionReserveUsd, affordableOutputTokens, agentErrorFromWire, agentErrorToWire, agentResultWire, agentScope, applyClaimOps, applyStructuredOutputTier, approachSigCoarse, approachSigOf, archiveDeprecatedModelOps, assertFencedWrites, atCompactionThreshold, auditRun, auditRuns, buildAbandonFold, buildAdapterRegistry, buildCostReport, buildDeriverRegistry, buildOrchestratorTools, buildTerminationInitValue, buildToolContext, canRideLoopTurn, canonicalIsolationTag, canonicalizeLadder, canonicalizeSchema, capIssues, capsHashOf, checkFloors, checkpointRefFor, childCoveragePrefix, claimExpired, claimExpiry, claimIssues, claimOpIssues, classifyAgentError, classifyAttemptOutcome, collectDeclaredLadders, compactMessages, compilePermissionChain, compilePermissionPreset, compileVerifiedLayer, costReportFromJournal, countsAgainstLimit, createCanonicalIdMinter, createCtx, createEngine, createSandboxBridge, currentOnlyKeyRing, decodeCheckpoint, dedupeRepeatedClaims, defineWorkflow, deriveContentKey, deriverV1, deriverV2, digestOf, dispositionHook, emptyDigestBlocks, emptyToolset, encodeCheckpoint, entryUsageSlices, escalateTool, evaluatePermission, evaluateReuse, evidencePreservedValidator, executeWorkflow, exhaustionCodeOf, extractCandidate, failoverTriggerOf, fallbackTriggerOf, filterClaimsForRun, finalizeFires, foldTermination, formatRePrompt, formatScopePath, hasFencedWrites, hasMetaLookup, hashRunArgs, hashRunOutput, hashWorkflowBody, hashWorkflowSource, identityJcs, implementationAgentProfile, isEscalated, isSchemaPairSpec, isStandardSchemaSpec, isStrictCompatibleSchema, kMaxOf, knowledgeHash, ladderLengthOf, ladderRungChoice, lastRunSettle, latestProgressReport, lexShellCommand, liftRetainedParts, lineageWeightOf, makeOrchestratorWorkflow, maskSecrets, maskSecretsDeep, maskSecretsJson, matchArgvPattern, matchShellCommand, mcp, memoryQuotaLimiter, mergeQuotaDenial, mergeUsageLimits, metaMatchesFilter, minMatchesValidator, modelEpochOf, modelKnowledgeCard, modelSpecIdentity, needsSeparateExtract, nextFailover, nodeLinkKey, normalizeApproachTag, normalizeEntry, normalizeFallbacks, orchestrate, parallelScope, parseModelRef, parseScopePath, phiInitialOf, pipelineScope, planNodeScope, priceEntryUsage, priceUsdOf, profileCard, profileRegistrySnapshotHash, progressReportTool, projectHistory, projectIdentity, projectToJsonSchema, proposalStatement, providerOf, quotaActualTokens, quotaEstimateTokens, quotaRuleAdmission, quotaRuleMatches, readRunMeta, readTerminationInit, reconcileRunMeta, reduceCriticalPath, reduceInvocationTable, registryKeyRing, remeasureQueue, replayDisposition, repositoryResearchToolset, requiredFieldsValidator, requiredSectionsValidator, researchAgentProfile, resolveModelInvocation, resolvePricing, resolveToolset, retryClassOf, retryDelayMs, reviewAgentProfile, roleConfiguredInRouting, roundOneDisposition, runAgent, runProfile, sanitizeTerminalText, sanitizeTokenCount, sanitizeUsage, sanitizeUsageDelta, scanJournalCompatibility, schemaHash, schemaHashOfSpec, selectStructuredOutputTier, shouldCompact, snapshotUsage, spawnDepthOf, summarizeInstruction, summarizeOutput, terminationConfigDrift, tierWithinCaps, toApprovalDecision, toJournalValue, tool, toolContract, toolsetHash, ttlState, usageViolations, validateEditorialCommit, validateEngineQuotaConfig, validateEntryShape, validateEscalationLimits, validateEscalationReport, validateQuotaRules, validateRetryPolicy, validateSchemaSpec, validateTerminationLimits, validateUsageLimits, workflowScope, workflowSourceRef, wrapJournalStore, wrapTranscriptStore };
+export { AWAIT_SCHEMA, AbandonAttempt, AbandonFold, AbandonPayload, AbandonedSpendView, AbortClass, type AdaptiveEvents, AdmissionController, AdmissionDecision, AdmissionRejectedError, AdmissionStatsBefore, AdmitLineage, AdmitRejectReason, AdmitSpec, AdmitVerdict, AgentCallError, AgentError, type AgentEvents, AgentIdentityInput, type AgentInvocationRow, AgentOpts, AgentProfile, AgentProfilePermissions, AgentProfileTemplateOptions, AgentResult, AgentResultMeta, AgentStatus, ApproachSignatureInputs, ApprovalDecision, ApprovalIdentityInput, Artifact, AttemptOutcomeClass, AuditCategory, AuditRecord, AuditRunsOptions, BUDGET_ABORT_REASON, BaseAppend, BriefOpts, BudgetAccountView, BudgetDefaults, BudgetExhaustedError, BudgetExhaustionDiagnostics, BudgetHooks, BudgetReserve, type Bytes, CANCEL_AGENT_SCHEMA, CHECKPOINT_FORMAT_V1, CLAIM_STATEMENT_MAX_CHARS, CLAIM_TTL_DAYS, COMPACTION_SUMMARY_PREFIX, CURRENT_HASH_VERSION, CacheHint, CacheTtl, CanUseTool, CanonicalId, CanonicalIdentity, CanonicalLadderSpec, CanonicalModelSpec, ChatEvent, ChatRequest, CheckpointState, ChildArtifactPage, ChildIdentityInput, ChildResultPage, type ClaimClass, type ClaimOp, type ClaimStatus, ClaimValidationOptions, CollectOpts, CollectedTurn, CompactionConfig, CompiledPermissionChain, CompiledWorkflow, ConfigError, type CoreEvents, CostAttribution, CostAttributionFacts, CostReport, CreateEngineOptions, type CriticalPath, Ctx, DEFAULT_CHILD_BUDGET_FRACTION, DEFAULT_CHILD_RESULT_PAGE_CHARS, DEFAULT_CITATION_PATTERN, DEFAULT_COMPACTION_THRESHOLD, DEFAULT_ESCALATION_LIMITS, DEFAULT_EVIDENCE_MIN_SHARE, DEFAULT_FINISH_MAX_REPAIRS, DEFAULT_FLAT_RESERVE_USD, DEFAULT_MAX_CHILDREN_PER_NODE, DEFAULT_MAX_DEPTH, DEFAULT_MAX_OSCILLATIONS_PER_KEY, DEFAULT_MAX_PINNED_WORKTREES, DEFAULT_MAX_REVISIONS_PER_RUN, DEFAULT_MAX_TOTAL_SPAWNS, DEFAULT_MAX_TURNS, DEFAULT_MODEL_RETRY_ATTEMPTS, DEFAULT_NO_PROGRESS_TURNS, DEFAULT_PER_RUN_CONCURRENCY, DEFAULT_RETRY_POLICY, DEFAULT_STREAM_IDLE_TIMEOUT_MS, DEFAULT_SYNTHESIS_MAX_TURNS, DEFAULT_SYNTHESIS_NOTE_MAX_TURNS, DataKeyProvider, DebitResult, DeclaredLadder, DedupIndex, DedupNote, DedupedClaims, DerivedKey, DeriverRegistry, type DeterminismConfig, DeterminismError, type DeterminismEvents, type DeterminismMode, DispositionRule, DispositionTable, DonorCandidate, DonorRef, DroppedItem, EMIT_RESULT_TOOL, EMPTY_SCHEMA_HASH, EMPTY_TOOLSET_HASH, ESCALATE_TOOL_NAME, ESCALATION_REPORT_SCHEMA, ESCALATION_REQUEST_SCHEMA, EVENT_SEGMENT_STRIDE, EffectiveUsageLimits, Effort, Engine, EngineDefaults, EngineQuotaConfig, EngineQuotaRuntime, EntryKind, EntryRef, EntryStatus, EnvelopeEncryption, EnvelopeEncryptionOptions, ErrorClass, ErrorCode, ErrorPolicy, EscalatedResult, EscalationDecision, EscalationDecisionAbortedError, EscalationDigest, EscalationKind, EscalationLimits, EscalationOptions, EscalationReport, EscalationRequest, EventBus, type EvidenceRef, type ExecutorRegistry, type ExplorationSummary, ExtensionAppendInput, ExtensionDispatchSpec, ExternalIdentityInput, ExternalRegistry, ExtractNecessityInput, FINALIZE_SYNTHESIS_INSTRUCTION, FINISH_SCHEMA, FINISH_TOOL_NAME, FailRunError, FailoverTarget, FailoverTrigger, FallbackField, FallbackTrigger, FileModelKnowledgeStore, FileModelKnowledgeStoreOptions, FileTranscriptStore, FinishInfo, FinishValidationChild, FinishValidationInput, FinishValidationSpec, FinishValidationVerdict, FinishValidator, GET_CHILD_RESULT_SCHEMA, GET_CHILD_RESULT_TOOL_NAME, Gate, GateAudit, type GateRecord, GitWorktreeProvider, GitWorktreeProviderOptions, GraftBoot, HashVersion, HookVerdict, IMPLEMENTATION_PROFILE_LIMITS, INBOX_PROPOSAL_TTL_DAYS, IdentityInput, InMemoryStore, InMemoryTranscriptStore, InProcessRunner, IncrementalSynthesisResult, InvalidResolutionError, InvocationRole, type InvocationTable, type IsolatedExecContext, type IsolatedExecRequest, type IsolatedExecutorTag, type IsolationProvider, type IsolationSpec, Issue$1 as Issue, JOURNAL_ENVELOPE_MARKER, JournalCompatSubCode, JournalCompatibilityError, JournalEntry, JournalMatcher, JournalMissError, JournalOperation, JournalOrderViolation, JournalSerializationHook, type JournalStore, type Json, JsonSchema, JsonlFileStore, KB_ACTIVE_CLAIMS_CAP, KB_CARD_RENDER_BUDGET_CHARS, type KbProposal, type KbProposalTrigger, KeyDeriver, KeyRing, KeyedLimiter, KnowledgeCasError, type KnowledgeSnapshot, LARGE_VALUE_WARN_BYTES, LEGACY_LTID_PREFIX, LEGACY_SIGNATURE_INPUTS, LINEAGE_SIG_VERSION, LadderSpec, type LeasableStore, type Lease, LeaseHeldError, Ledger, LineageCounters, LineageIndex, LineageRef, LineageRelation, LineageStats, LogicalTaskId, MASKED_SECRET, MAX_CHILD_RESULT_PAGE_CHARS, MAX_DEPTH_CEILING, MatchResult, McpConfig, McpToolSource, MechanicalGateProfile, MechanicalGateVerdict, MemoryQuotaLimiter, type MetaLookupStore, type ModelCaps, ModelChoice, type ModelClaim, ModelEpochInputs, type ModelKnowledgeHandle, type ModelKnowledgeStore, ModelListConstraint, ModelRef, ModelRetry, ModelSpec, Msg, NoProgressDetector, NodeId, NodeLinkValue, NonSerializableValueError, ORCHESTRATE_WORKFLOW_NAME, OnEscalation, OperationDisposition, OrchestrateAcceptance, OrchestrateOptions, OrchestrateSynthesis, OrchestratorBudgetSpec, OrchestratorCapConfigError, OrchestratorExtension, OrchestratorExtensionIO, OrchestratorRuntime, Out, PARALLEL_AGENTS_SCHEMA, PROGRESS_REPORT_TOOL_NAME, ParallelSiteCounter, Part, PendingExternal, PendingToolTurn, PermissionConfig, PermissionGate, PermissionHook, PermissionPreset, PermissionRule, PermissionVerdict, type PhaseRow, PhaseTarget, PipelineCollected, PipelineOpts, PlanInvariantError, PriceTable, PricedUsage, type Pricing, type PricingTier, ProgressReport, type ProviderAdapter, QUOTA_WINDOW_MS, QualityFloors, QuotaCounters, type QuotaDecision, type QuotaEstimate, type QuotaLimiter, type QuotaReservationRequest, QuotaRule, QuotaWindowSnapshot, READ_CHILD_ARTIFACT_SCHEMA, READ_CHILD_ARTIFACT_TOOL_NAME, RESEARCH_PROFILE_LIMITS, REVIEW_PROFILE_LIMITS, ROLE_EFFORT_DEFAULTS, ROOT_ACCOUNT, ROOT_SCOPE, RUN_PROFILES, RUN_SETTLE_DECISION_TYPE, RandIdentityInput, RandPayload, ReconcileOptions, ReconcileResult, RefEntryAppender, RefEntryClassification, RefusalInfo, RepeatedClaim, ReplayDisposition, ReplayMode, ReplayPlanHashMismatch, Replayer, RepositoryResearchToolset, RepositoryResearchToolsetOptions, ResearchAgentProfileOptions, ResearchAgentProfileResult, ResearchEvidenceEntry, ResolutionArbiter, ResolutionAttempt, ResolutionBy, ResolutionFold, ResolutionLayer, ResolutionOutcome, ResolutionPayload, ResolvedInvocation, ResolvedToolset, ResumeHandle, ResumeOptions, ResumePreview, ResumeReport, RetryClass, RetryPolicy, ReuseConfig, RiskRuleValue, Role, RulvarError, RulvarErrorCode, RunAgentOptions, RunAuditVerdict, RunBudget, RunEventSink, RunExport, type RunFilter, RunHandle, RunInternals, type RunMeta, RunOptions, RunOutcome, RunProfile, RunStateAudit, RunStatus, RuntimeEventSink, SANDBOX_AGENT_OPT_KEYS, SPAWN_AGENT_SCHEMA, SandboxBridge, SandboxBridgeOptions, SandboxError, SandboxHostToWorker, SandboxMethod, SandboxWorkerToHost, SchemaPair, SchemaSpec, SchemaValidationResult, ScopeSegment, ScriptRejected, ScriptRunner, ScrubNote, SecretMasker, Semaphore, SerializationHook, Settled, ShellPatternRules, ShellSegment, ShellVerdict, SinglePhaseAppend, SpanMinter, SpanRegistry, SpawnAdmissionValue, SpawnAgentParams, SpawnKey, SpawnLineage, SpawnLineageOpt, SpawnOrigin, SpawnRecord, Spend, Stage, type StandardJSONSchemaV1, type StandardSchemaV1, StepIdentityInput, StructuredOutputTier, SuspendedAppend, SuspensionState, TOOL_NAME_PATTERN, type TaskClass, TaskDigest, TaskSpec, TerminalPatch, TerminationAccount, TerminationAccountSnapshot, TerminationDeniedValue, TerminationDeniedWriter, TerminationInitValue, TerminationLimits, TerminationResource, ToolCallRequest, ToolChoice, type ToolContext, ToolContextSeed, ToolContract, type ToolDef, type ToolEvents, type ToolExecutor, type ToolExecutorProvider, ToolInit, type ToolRisk, ToolRuntime, type ToolSource, type ToolSourceSession, ToolsOption, TranscriptSerializationHook, type TranscriptStore, TriggerClass, TtlState, Usage, UsageLimits, UsageSlice, VerifiedRecommendation, WAIT_FOR_EVENTS_SCHEMA, WAIT_FOR_EVENTS_TOOL_NAME, WAKE_SUMMARY_RENDER_BUDGET_CHARS, WakeBudgetBlock, WakeDigest, WakeTrigger, WireError, Workflow, WorkflowCallOpts, type WorkflowEvent, type WorkflowEventBody, WorkflowRegistry, admissionReserveUsd, affordableOutputTokens, agentErrorFromWire, agentErrorToWire, agentResultWire, agentScope, applyClaimOps, applyStructuredOutputTier, approachSigCoarse, approachSigOf, archiveDeprecatedModelOps, assertFencedWrites, atCompactionThreshold, auditRun, auditRuns, buildAbandonFold, buildAdapterRegistry, buildCostReport, buildDeriverRegistry, buildOrchestratorTools, buildTerminationInitValue, buildToolContext, canRideLoopTurn, canonicalIsolationTag, canonicalizeLadder, canonicalizeSchema, capIssues, capsHashOf, checkFloors, checkpointRefFor, childCoveragePrefix, claimExpired, claimExpiry, claimIssues, claimOpIssues, classifyAgentError, classifyAttemptOutcome, collectDeclaredLadders, compactMessages, compilePermissionChain, compilePermissionPreset, compileSecretMasker, compileVerifiedLayer, constantTimeEqual, costReportFromJournal, countsAgainstLimit, createCanonicalIdMinter, createCtx, createEngine, createEnvelopeEncryption, createSandboxBridge, currentOnlyKeyRing, decodeCheckpoint, dedupeRepeatedClaims, defineWorkflow, deriveContentKey, deriverV1, deriverV2, digestOf, dispositionHook, emptyDigestBlocks, emptyToolset, encodeCheckpoint, entryUsageSlices, escalateTool, evaluatePermission, evaluateReuse, evidencePreservedValidator, executeWorkflow, exhaustionCodeOf, extractCandidate, failoverTriggerOf, fallbackTriggerOf, filterClaimsForRun, finalizeFires, foldTermination, formatRePrompt, formatScopePath, hasFencedWrites, hasMetaLookup, hashRunArgs, hashRunOutput, hashWorkflowBody, hashWorkflowSource, identityJcs, implementationAgentProfile, isEscalated, isSchemaPairSpec, isStandardSchemaSpec, isStrictCompatibleSchema, kMaxOf, knowledgeHash, ladderLengthOf, ladderRungChoice, lastRunSettle, latestProgressReport, lexShellCommand, liftRetainedParts, lineageWeightOf, localKeyProvider, makeOrchestratorWorkflow, maskSecrets, maskSecretsDeep, maskSecretsJson, matchArgvPattern, matchShellCommand, mcp, memoryQuotaLimiter, mergeQuotaDenial, mergeUsageLimits, metaMatchesFilter, minMatchesValidator, modelEpochOf, modelKnowledgeCard, modelSpecIdentity, needsSeparateExtract, nextFailover, nodeLinkKey, normalizeApproachTag, normalizeEntry, normalizeFallbacks, orchestrate, parallelScope, parseModelRef, parseScopePath, phiInitialOf, pipelineScope, planNodeScope, priceEntryUsage, priceUsdOf, profileCard, profileRegistrySnapshotHash, progressReportTool, projectHistory, projectIdentity, projectToJsonSchema, proposalStatement, providerOf, quotaActualTokens, quotaEstimateTokens, quotaRuleAdmission, quotaRuleMatches, readRunMeta, readTerminationInit, reconcileRunMeta, reduceAuditTrail, reduceCriticalPath, reduceInvocationTable, registryKeyRing, remeasureQueue, replayDisposition, repositoryResearchToolset, requiredFieldsValidator, requiredSectionsValidator, researchAgentProfile, resolveModelInvocation, resolvePricing, resolveToolset, retryClassOf, retryDelayMs, reviewAgentProfile, roleConfiguredInRouting, roundOneDisposition, runAgent, runProfile, sanitizeTerminalText, sanitizeTokenCount, sanitizeUsage, sanitizeUsageDelta, scanJournalCompatibility, schemaHash, schemaHashOfSpec, selectStructuredOutputTier, shouldCompact, snapshotUsage, spawnDepthOf, summarizeInstruction, summarizeOutput, terminationConfigDrift, tierWithinCaps, toApprovalDecision, toJournalValue, tool, toolContract, toolsetHash, ttlState, usageViolations, validateEditorialCommit, validateEngineQuotaConfig, validateEntryShape, validateEscalationLimits, validateEscalationReport, validateQuotaRules, validateRetryPolicy, validateSchemaSpec, validateTerminationLimits, validateUsageLimits, workflowScope, workflowSourceRef, wrapJournalStore, wrapTranscriptStore };

package/dist/index.js

@@ -1,4 +1,4 @@
-import { createHash, getRandomValues, randomUUID } from "node:crypto";
+import { createCipheriv, createDecipheriv, createHash, createHmac, getRandomValues, hkdfSync, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
 import { appendFileSync, mkdirSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
 import path, { dirname, join, resolve, sep } from "node:path";
 import { Client } from "@modelcontextprotocol/sdk/client";
@@ -491,6 +491,338 @@ function maskSecretsDeep(value) {
 function maskSecretsJson(value) {
 	return maskSecretsDeep(value);
 }
+/**
+* Compiles the redaction policy: the DEFAULT credential pattern set
+* plus host-defined patterns (RV-217), for the telemetry boundary
+* (events and traces; never the journal, where lossless encryption is
+* the right tool). String patterns compile as global regexes; RegExp
+* patterns are recompiled with the global flag when it is missing, so
+* replace-all semantics always hold. An invalid pattern is a typed
+* ConfigError at compile time, before anything runs under the policy.
+*/
+function compileSecretMasker(patterns = [], site = "redaction.patterns") {
+	const raw = patterns;
+	if (!Array.isArray(raw)) throw new ConfigError(`${site} must be an array of RegExp or string patterns`);
+	const compiled = raw.map((pattern, index) => {
+		const at = `${site}[${String(index)}]`;
+		if (pattern instanceof RegExp) return pattern.flags.includes("g") ? pattern : new RegExp(pattern.source, `${pattern.flags}g`);
+		if (typeof pattern !== "string" || pattern === "") throw new ConfigError(`${at} must be a RegExp or a nonempty pattern string`);
+		try {
+			return new RegExp(pattern, "g");
+		} catch (thrown) {
+			throw new ConfigError(`${at} is not a valid regular expression: ${thrown instanceof Error ? thrown.message : String(thrown)}`);
+		}
+	});
+	const maskText = (text) => {
+		let masked = maskSecrets(text);
+		for (const pattern of compiled) masked = masked.replace(pattern, MASKED_SECRET);
+		return masked;
+	};
+	const maskDeep = (value) => deepMap(value, maskText);
+	return {
+		maskText,
+		maskDeep
+	};
+}
+/** Shared deep string walk preserving identity when nothing changed. */
+function deepMap(value, mapText) {
+	if (typeof value === "string") {
+		const masked = mapText(value);
+		return masked === value ? value : masked;
+	}
+	if (Array.isArray(value)) {
+		let changed = false;
+		const next = value.map((item) => {
+			const masked = deepMap(item, mapText);
+			if (masked !== item) changed = true;
+			return masked;
+		});
+		return changed ? next : value;
+	}
+	if (value !== null && typeof value === "object") {
+		let changed = false;
+		const next = {};
+		for (const [key, item] of Object.entries(value)) {
+			const masked = deepMap(item, mapText);
+			if (masked !== item) changed = true;
+			next[key] = masked;
+		}
+		return changed ? next : value;
+	}
+	return value;
+}
+//#endregion
+//#region src/l0/encryption.ts
+/**
+* Envelope encryption over the serialization hook (RV-217): the
+* reference implementation of "PII never persists in plaintext". The
+* hook seam (l0/serialization.ts) is the single policy point between
+* the engine and persistence; this module puts real cryptography on
+* it, KMS-shaped.
+*
+* The envelope pattern, exactly as cloud KMS services frame it:
+*
+* - A DataKeyProvider is the KMS seam. It mints a fresh DATA key and
+*   returns it in two forms (plaintext for this process's memory,
+*   wrapped for storage), and it unwraps previously wrapped keys. The
+*   shipped `localKeyProvider` derives its key-encryption key from a
+*   host secret via HKDF-SHA256; an AWS KMS provider maps 1:1 onto
+*   GenerateDataKey and Decrypt (the guide shows the sketch), and
+*   tenant-scoped keys are providers constructed per tenant (the
+*   `info` input partitions one master secret into unrelated KEKs).
+* - All provider calls are ASYNC and happen ONCE, in
+*   `createEnvelopeEncryption`, never per entry: the hook contract is
+*   synchronous, so the factory unwraps everything up front and the
+*   hooks run on in-memory data keys. Entries carry the WRAPPED key in
+*   every envelope, so decrypt needs only the provider registration,
+*   not a live KMS on the read path.
+* - Payload encryption is AES-256-GCM with a random IV per write and
+*   the entry identity as ASSOCIATED DATA (`seq` and `key` for journal
+*   entries, the ref for transcript blobs), so a ciphertext moved to a
+*   different entry fails authentication instead of decrypting into
+*   the wrong place.
+* - Journal entries keep the kernel ordering/identity fields plus the
+*   operational timestamps and spanId in plaintext (stores index and
+*   humans operate on them; none carry payload content); EVERYTHING
+*   else (value, error, usage, servedBy, cost attribution, refs) is
+*   inside the ciphertext. `fromStored(toStored(e))` reproduces the
+*   entry, so replay, content keys, and the folds are untouched.
+* - Reads of NON-enveloped stored data fail closed by default
+*   (`plaintextReads: 'reject'`); `'passthrough'` is the explicit
+*   migration mode for stores with pre-encryption history.
+*
+* Docs: https://docs.rulvar.com/guide/data-protection
+*/
+const HKDF_SALT = "rulvar-envelope-kek-v1";
+const GCM_IV_BYTES = 12;
+const GCM_TAG_BYTES = 16;
+const DATA_KEY_BYTES = 32;
+/**
+* The local reference DataKeyProvider: the key-encryption key is
+* HKDF-SHA256(secret, info), data keys are random 32-byte AES keys,
+* and wrapping is AES-256-GCM under the KEK. `info` partitions one
+* master secret into unrelated KEKs (tenant-scoped keys: one provider
+* per tenant with `info: tenantId`); a provider with different
+* secret or info CANNOT unwrap this provider's keys. For production
+* KMS, implement the same interface over GenerateDataKey/Decrypt.
+*/
+function localKeyProvider(options) {
+	const raw = options.secret;
+	if ((typeof raw !== "string" || raw === "") && !(raw instanceof Uint8Array)) throw new ConfigError("localKeyProvider secret must be a nonempty string or bytes");
+	if (raw instanceof Uint8Array && raw.length < 16) throw new ConfigError("localKeyProvider secret bytes must be at least 16 bytes");
+	const keyId = options.keyId ?? "local:v1";
+	if (typeof keyId !== "string" || keyId === "") throw new ConfigError("localKeyProvider keyId must be a nonempty string when given");
+	const kek = Buffer.from(hkdfSync("sha256", typeof raw === "string" ? Buffer.from(raw, "utf8") : Buffer.from(raw), Buffer.from(HKDF_SALT, "utf8"), Buffer.from(options.info ?? "", "utf8"), DATA_KEY_BYTES));
+	return {
+		keyId,
+		async generateDataKey() {
+			const plaintext = randomBytes(DATA_KEY_BYTES);
+			const iv = randomBytes(GCM_IV_BYTES);
+			const cipher = createCipheriv("aes-256-gcm", kek, iv);
+			const ct = Buffer.concat([cipher.update(plaintext), cipher.final()]);
+			const wrapped = Buffer.concat([
+				iv,
+				cipher.getAuthTag(),
+				ct
+			]);
+			return {
+				plaintext: new Uint8Array(plaintext),
+				wrapped: new Uint8Array(wrapped)
+			};
+		},
+		async unwrapDataKey(wrapped) {
+			const buffer = Buffer.from(wrapped);
+			if (buffer.length <= 28) throw new ConfigError("localKeyProvider: the wrapped data key is truncated");
+			const iv = buffer.subarray(0, GCM_IV_BYTES);
+			const tag = buffer.subarray(GCM_IV_BYTES, 28);
+			const ct = buffer.subarray(28);
+			const decipher = createDecipheriv("aes-256-gcm", kek, iv);
+			decipher.setAuthTag(tag);
+			try {
+				const plaintext = Buffer.concat([decipher.update(ct), decipher.final()]);
+				return new Uint8Array(plaintext);
+			} catch {
+				throw new ConfigError(`localKeyProvider '${keyId}': cannot unwrap the data key (wrong secret, wrong info partition, or a corrupted wrapped key)`);
+			}
+		}
+	};
+}
+/** The journal envelope marker; a stored entry's whole value is this. */
+const JOURNAL_ENVELOPE_MARKER = "__rulvarEnvelope";
+/** The transcript blob envelope magic (version 1). */
+const BLOB_MAGIC = Buffer.from("RVE1", "utf8");
+/**
+* Plaintext fields of a stored journal entry: the kernel
+* ordering/identity fields the hook contract pins, plus the
+* operational metadata stores index and operators read (timestamps,
+* spanId). None carry payload content.
+*/
+const CLEAR_FIELDS = [
+	"hashVersion",
+	"seq",
+	"ref",
+	"scope",
+	"key",
+	"ordinal",
+	"kind",
+	"status",
+	"spanId",
+	"startedAt",
+	"endedAt"
+];
+function b64(bytes) {
+	return Buffer.from(bytes).toString("base64");
+}
+function isEnvelope(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
+	const keys = Object.keys(value);
+	if (keys.length !== 1 || keys[0] !== "__rulvarEnvelope") return false;
+	const env = value[JOURNAL_ENVELOPE_MARKER];
+	return typeof env === "object" && env !== null && env.v === 1 && typeof env.keyId === "string" && typeof env.wrapped === "string" && typeof env.iv === "string" && typeof env.tag === "string" && typeof env.data === "string";
+}
+/**
+* Builds the envelope-encryption SerializationHook. All DataKeyProvider
+* calls happen HERE (the hook itself is synchronous, on in-memory data
+* keys): a fresh data key is minted and wrapped for this instance, and
+* every historical wrapped key is unwrapped for the read path.
+*/
+async function createEnvelopeEncryption(options) {
+	const provider = options.provider;
+	if (typeof provider !== "object" || provider === null || typeof provider.keyId !== "string" || provider.keyId === "" || typeof provider.generateDataKey !== "function" || typeof provider.unwrapDataKey !== "function") throw new ConfigError("createEnvelopeEncryption: provider must implement DataKeyProvider (keyId, generateDataKey, unwrapDataKey)");
+	const plaintextReads = options.plaintextReads ?? "reject";
+	if (plaintextReads !== "reject" && plaintextReads !== "passthrough") throw new ConfigError("createEnvelopeEncryption: plaintextReads must be 'reject' or 'passthrough'");
+	const realProvider = options.provider;
+	const current = await realProvider.generateDataKey();
+	if (current.plaintext.length !== DATA_KEY_BYTES) throw new ConfigError(`createEnvelopeEncryption: the provider returned a ${String(current.plaintext.length)}-byte data key; AES-256-GCM needs exactly ${String(DATA_KEY_BYTES)}`);
+	const ring = /* @__PURE__ */ new Map();
+	ring.set(b64(current.wrapped), Buffer.from(current.plaintext));
+	for (const wrapped of options.historicalWrappedKeys ?? []) {
+		const plaintext = await realProvider.unwrapDataKey(wrapped);
+		if (plaintext.length !== DATA_KEY_BYTES) throw new ConfigError(`createEnvelopeEncryption: a historical wrapped key unwrapped to ${String(plaintext.length)} bytes; AES-256-GCM needs exactly ${String(DATA_KEY_BYTES)}`);
+		ring.set(b64(wrapped), Buffer.from(plaintext));
+	}
+	const keyId = realProvider.keyId;
+	const currentWrappedB64 = b64(current.wrapped);
+	const currentKey = ring.get(currentWrappedB64);
+	const keyFor = (envelopeKeyId, wrappedB64, site) => {
+		const key = ring.get(wrappedB64);
+		if (key === void 0) throw new ConfigError(`${site}: the stored envelope carries a data key (keyId '${envelopeKeyId}') that this process has not registered; pass it in historicalWrappedKeys so the factory can unwrap it, and check the provider secret and info match the writing deployment`);
+		return key;
+	};
+	const encrypt = (key, aad, plaintext) => {
+		const iv = randomBytes(GCM_IV_BYTES);
+		const cipher = createCipheriv("aes-256-gcm", key, iv);
+		cipher.setAAD(aad);
+		const ct = Buffer.concat([cipher.update(plaintext), cipher.final()]);
+		return {
+			v: 1,
+			keyId,
+			wrapped: currentWrappedB64,
+			iv: iv.toString("base64"),
+			tag: cipher.getAuthTag().toString("base64"),
+			data: ct.toString("base64")
+		};
+	};
+	const decrypt = (key, aad, env, site) => {
+		const decipher = createDecipheriv("aes-256-gcm", key, Buffer.from(env.iv, "base64"));
+		decipher.setAAD(aad);
+		decipher.setAuthTag(Buffer.from(env.tag, "base64"));
+		try {
+			return Buffer.concat([decipher.update(Buffer.from(env.data, "base64")), decipher.final()]);
+		} catch {
+			throw new ConfigError(`${site}: envelope authentication failed (a tampered ciphertext, or a ciphertext moved to a different entry; the entry identity is associated data)`);
+		}
+	};
+	return {
+		hook: {
+			journal: {
+				toStored(e) {
+					const clear = {};
+					const rest = {};
+					for (const [field, fieldValue] of Object.entries(e)) if (CLEAR_FIELDS.includes(field)) clear[field] = fieldValue;
+					else rest[field] = fieldValue;
+					const aad = Buffer.from(`journal:${String(e.seq)}:${e.key}`, "utf8");
+					const envelope = encrypt(currentKey, aad, Buffer.from(JSON.stringify(rest), "utf8"));
+					return {
+						...clear,
+						value: { [JOURNAL_ENVELOPE_MARKER]: envelope }
+					};
+				},
+				fromStored(e) {
+					if (!isEnvelope(e.value)) {
+						if (plaintextReads === "passthrough") return e;
+						throw new ConfigError(`envelope encryption: stored entry seq ${String(e.seq)} is not enveloped and plaintextReads is 'reject'; enable 'passthrough' only for a deliberate migration of pre-encryption history`);
+					}
+					const env = e.value[JOURNAL_ENVELOPE_MARKER];
+					const key = keyFor(env.keyId, env.wrapped, "envelope encryption (journal read)");
+					const aad = Buffer.from(`journal:${String(e.seq)}:${e.key}`, "utf8");
+					const rest = JSON.parse(decrypt(key, aad, env, "envelope encryption (journal read)").toString("utf8"));
+					const clear = {};
+					for (const field of CLEAR_FIELDS) if (e[field] !== void 0) clear[field] = e[field];
+					return {
+						...clear,
+						...rest
+					};
+				}
+			},
+			transcripts: {
+				toStored(ref, blob) {
+					const iv = randomBytes(GCM_IV_BYTES);
+					const cipher = createCipheriv("aes-256-gcm", currentKey, iv);
+					cipher.setAAD(Buffer.from(`blob:${ref}`, "utf8"));
+					const ct = Buffer.concat([cipher.update(Buffer.from(blob)), cipher.final()]);
+					const keyIdBytes = Buffer.from(keyId, "utf8");
+					const wrappedBytes = Buffer.from(currentWrappedB64, "base64");
+					const header = Buffer.alloc(4);
+					header.writeUInt16BE(keyIdBytes.length, 0);
+					header.writeUInt16BE(wrappedBytes.length, 2);
+					return new Uint8Array(Buffer.concat([
+						BLOB_MAGIC,
+						header,
+						keyIdBytes,
+						wrappedBytes,
+						iv,
+						cipher.getAuthTag(),
+						ct
+					]));
+				},
+				fromStored(ref, blob) {
+					const buffer = Buffer.from(blob);
+					if (buffer.length < BLOB_MAGIC.length || !buffer.subarray(0, 4).equals(BLOB_MAGIC)) {
+						if (plaintextReads === "passthrough") return blob;
+						throw new ConfigError(`envelope encryption: stored blob '${ref}' is not enveloped and plaintextReads is 'reject'; enable 'passthrough' only for a deliberate migration`);
+					}
+					let offset = BLOB_MAGIC.length;
+					const keyIdLen = buffer.readUInt16BE(offset);
+					const wrappedLen = buffer.readUInt16BE(offset + 2);
+					offset += 4;
+					const envelopeKeyId = buffer.subarray(offset, offset + keyIdLen).toString("utf8");
+					offset += keyIdLen;
+					const wrappedB64 = buffer.subarray(offset, offset + wrappedLen).toString("base64");
+					offset += wrappedLen;
+					const iv = buffer.subarray(offset, offset + GCM_IV_BYTES);
+					const tag = buffer.subarray(offset + GCM_IV_BYTES, offset + GCM_IV_BYTES + GCM_TAG_BYTES);
+					const ct = buffer.subarray(offset + GCM_IV_BYTES + GCM_TAG_BYTES);
+					const decipher = createDecipheriv("aes-256-gcm", keyFor(envelopeKeyId, wrappedB64, `envelope encryption (blob '${ref}')`), iv);
+					decipher.setAAD(Buffer.from(`blob:${ref}`, "utf8"));
+					decipher.setAuthTag(tag);
+					try {
+						return new Uint8Array(Buffer.concat([decipher.update(ct), decipher.final()]));
+					} catch {
+						throw new ConfigError(`envelope encryption: blob '${ref}' authentication failed (tampered ciphertext or a ciphertext moved between refs; the ref is associated data)`);
+					}
+				}
+			}
+		},
+		keyId,
+		wrappedDataKey: new Uint8Array(current.wrapped)
+	};
+}
+/** Guards against non-constant-time comparisons in host key checks. */
+function constantTimeEqual(a, b) {
+	if (a.length !== b.length) return false;
+	return timingSafeEqual(Buffer.from(a), Buffer.from(b));
+}
 //#endregion
 //#region src/vendor/ulid.ts
 /**
@@ -2902,6 +3234,7 @@ function tool(init) {
 		executor: init.executor ?? "inprocess",
 		needsApproval: init.needsApproval ?? false,
 		...init.version === void 0 ? {} : { version: init.version },
+		...init.executorSpec === void 0 ? {} : { executorSpec: init.executorSpec },
 		...init.risk === void 0 ? {} : { risk: init.risk },
 		execute: init.execute
 	};
@@ -2956,7 +3289,7 @@ function isToolDef(spec) {
 * without one, string entries fail with the same unknown-name error as
 * a miss, so nothing outside the declared registry is ever reachable.
 */
-async function resolveToolset(specs, session, toolsets) {
+async function resolveToolset(specs, session, toolsets, executors) {
 	if (specs === void 0 || specs.length === 0) return emptyToolset();
 	const tools = [];
 	for (const spec of specs) {
@@ -2983,7 +3316,7 @@ async function resolveToolset(specs, session, toolsets) {
 	for (const def of tools) {
 		if (!TOOL_NAME_PATTERN.test(def.name)) throw new ConfigError(`imported tool name '${def.name}' must match ^[a-zA-Z0-9_-]{1,64}$; namespace it with the source prefix option`);
 		if (seen.has(def.name)) throw new ConfigError(`duplicate tool name '${def.name}' in one toolset; disambiguate with the MCP prefix option`);
-		if (def.executor !== "inprocess") throw new ConfigError(`tool '${def.name}' declares executor '${def.executor}', but this engine implements only 'inprocess' in v1`);
+		if (def.executor !== "inprocess" && !(executors?.has(def.executor) ?? false)) throw new ConfigError(`tool '${def.name}' declares executor '${def.executor}', but no such executor is registered; register one via createEngine({ executors }) (https://docs.rulvar.com/guide/isolated-executor)`);
 		seen.set(def.name, def);
 	}
 	const contracts = tools.map((def) => toolContract(def));
@@ -3941,6 +4274,90 @@ function reviewAgentProfile(options = {}) {
 	};
 }
 //#endregion
+//#region src/engine/audit.ts
+function record(entry, fields) {
+	return {
+		seq: entry.seq,
+		at: entry.startedAt,
+		scope: entry.scope,
+		...fields
+	};
+}
+/**
+* Folds a loaded journal into the audit trail, in seq order. Pass the
+* FULL entry list (`Engine.stores.journal.load(runId)` or
+* `exportRun(runId).entries`); filtering is the reducer's job.
+*/
+function reduceAuditTrail(entries) {
+	const trail = [];
+	for (const entry of entries) {
+		if ((entry.kind === "external" || entry.kind === "approval") && entry.status === "suspended") {
+			trail.push(record(entry, {
+				category: "suspension",
+				type: entry.kind,
+				summary: `${entry.kind} suspension opened` + (entry.deadlineAt === void 0 ? "" : ` (deadline ${entry.deadlineAt})`),
+				...entry.value === void 0 ? {} : { value: entry.value }
+			}));
+			continue;
+		}
+		if (entry.kind === "resolution") {
+			const payload = entry.resolution;
+			if (payload === void 0) continue;
+			trail.push(record(entry, {
+				category: "resolution",
+				by: payload.by,
+				target: payload.target,
+				summary: `suspension #${String(payload.target)} resolved by ${payload.by}` + (payload.decisionRef === void 0 ? "" : ` (class decision #${String(payload.decisionRef)})`),
+				value: payload.value
+			}));
+			continue;
+		}
+		if (entry.kind === "abandon") {
+			const payload = entry.abandon;
+			if (payload === void 0) continue;
+			trail.push(record(entry, {
+				category: "abandon",
+				target: payload.target,
+				by: `decision #${String(payload.authorizedBy)}`,
+				summary: `#${String(payload.target)} abandoned: ${payload.reason}`
+			}));
+			continue;
+		}
+		if (entry.kind === "termination.denied") {
+			trail.push(record(entry, {
+				category: "termination-denied",
+				by: "engine",
+				summary: "a termination-limit action was denied",
+				...entry.value === void 0 ? {} : { value: entry.value }
+			}));
+			continue;
+		}
+		if (entry.kind === "decision") {
+			const value = entry.value;
+			const decisionType = typeof value?.decisionType === "string" ? value.decisionType : void 0;
+			if (decisionType === void 0) continue;
+			if (decisionType === "run_settle") {
+				trail.push(record(entry, {
+					category: "run-settle",
+					by: "engine",
+					type: decisionType,
+					summary: `run settled ${typeof value?.runStatus === "string" ? value.runStatus : "unknown"}`,
+					...entry.value === void 0 ? {} : { value: entry.value }
+				}));
+				continue;
+			}
+			trail.push(record(entry, {
+				category: "decision",
+				by: "engine",
+				type: decisionType,
+				summary: `engine decision ${decisionType}`,
+				...entry.value === void 0 ? {} : { value: entry.value }
+			}));
+		}
+	}
+	return trail;
+}
+//#endregion
 //#region src/journal/identity.ts
 /**
 * Content-addressed entry identity (M1-T04): IdentityInput records per
@@ -9951,7 +10368,10 @@ async function executeToolCall(options) {
 		issues: validation.issues.map((issue) => issue.message)
 	}, "error");
 	try {
-		const value = await def.execute(validation.value, runtime.contextFor(call.name));
+		let value;
+		if (def.executor === "inprocess") value = await def.execute(validation.value, runtime.contextFor(call.name));
+		else if (runtime.executeExternal !== void 0) value = await runtime.executeExternal(def, validation.value);
+		else return finish({ error: `tool '${call.name}' declares executor '${def.executor}' but no executor is registered` }, "error");
 		const serialized = toJournalValue(value === void 0 ? null : value, `tool '${call.name}'`);
 		options.retryCounts.delete(call.name);
 		return finish(serialized, "ok");
@@ -12706,6 +13126,33 @@ function setLongTimeout(onDue, dueAtMs, now = Date.now) {
 	} };
 }
 //#endregion
+//#region src/runtime/executor.ts
+/**
+* Isolated-executor dispatch helpers (RV-216). The engine routes a
+* non-inprocess tool call through the registered ToolExecutorProvider;
+* this module derives the stable per-call idempotency key the provider
+* receives, so an at-least-once retry of a side-effecting tool can be
+* folded into effectively-once.
+*
+* Public contract: https://docs.rulvar.com/guide/isolated-executor.
+*/
+/**
+* Derives the idempotency key for one isolated tool dispatch. The key is
+* a pure function of the run, the tool name, and the JCS-canonical
+* arguments, so the same logical call always yields the same key
+* (byte-identical reruns dedupe) and distinct calls never collide. The
+* key never enters run identity; it exists only for the provider's own
+* side-effect deduplication.
+*/
+function deriveExecIdempotencyKey(runId, tool, args) {
+	const canonical = jcsSerialize({
+		runId,
+		tool,
+		args
+	});
+	return createHash("sha256").update(canonical, "utf8").digest("hex");
+}
+//#endregion
 //#region src/engine/ctx.ts
 /**
 * Ctx primitives (M1-T07) plus the parallel/pipeline composition semantics
@@ -12977,7 +13424,7 @@ function createCtx(internals, rootWorkflow) {
 			if (escalation.flavor === "B" && escalation.deadlineMs === void 0) throw new ConfigError("escalation flavor 'B' requires an explicit deadlineMs");
 		}
 		const declaredTools = opts.tools ?? profile?.tools ?? [];
-		const toolset = await resolveToolset(escalation === void 0 ? declaredTools : [...declaredTools, escalateTool()], { runId: internals.runId }, internals.defaults.toolsets);
+		const toolset = await resolveToolset(escalation === void 0 ? declaredTools : [...declaredTools, escalateTool()], { runId: internals.runId }, internals.defaults.toolsets, internals.executors === void 0 ? void 0 : new Set(Object.keys(internals.executors)));
 		const layers = [
 			callLayer,
 			profileLayer,
@@ -13499,6 +13946,38 @@ function createCtx(internals, rootWorkflow) {
 					};
 				}
 			};
+			if (internals.executors !== void 0) {
+				const executors = internals.executors;
+				toolRuntime.executeExternal = async (def, args) => {
+					const tag = def.executor;
+					const provider = executors[tag];
+					if (provider === void 0) throw new ConfigError(`no executor registered for '${def.executor}'; register one via createEngine({ executors }) (https://docs.rulvar.com/guide/isolated-executor)`);
+					const toolSpanId = internals.spans.mint(spanId);
+					return provider.run({
+						executor: tag,
+						tool: def.name,
+						args,
+						spec: def.executorSpec ?? null,
+						ctx: {
+							runId: internals.runId,
+							spanId: toolSpanId,
+							agentType,
+							idempotencyKey: deriveExecIdempotencyKey(internals.runId, def.name, args),
+							signal: toolSignal,
+							log: (level, msg, data) => internals.events.emit(data === void 0 ? {
+								type: "log",
+								level,
+								msg
+							} : {
+								type: "log",
+								level,
+								msg,
+								data
+							}, toolSpanId)
+						}
+					});
+				};
+			}
 		}
 		const runAgentOptions = {
 			prompt,
@@ -15949,7 +16428,7 @@ var EventBus = class {
 	runId;
 	spans;
 	now;
-	maskEvents;
+	mask;
 	subscribers = /* @__PURE__ */ new Set();
 	listeners = /* @__PURE__ */ new Set();
 	seq;
@@ -15959,12 +16438,12 @@ var EventBus = class {
 		this.runId = options.runId;
 		this.spans = options.spans;
 		this.now = options.now ?? realNow;
-		this.maskEvents = options.maskEvents ?? true;
+		this.mask = options.maskEvents ?? true ? options.mask ?? maskSecretsDeep : void 0;
 		this.seq = options.firstSeq ?? 0;
 	}
 	emit(body, spanId, replayed) {
 		const parentSpanId = this.spans.parentOf(spanId);
-		const safeBody = this.maskEvents ? maskSecretsDeep(body) : body;
+		const safeBody = this.mask === void 0 ? body : this.mask(body);
 		const event = {
 			runId: this.runId,
 			seq: this.seq++,
@@ -16564,9 +17043,12 @@ function liftRunCompletion(candidate) {
 * sensitive-derived metadata, not a value safe to publish (see the
 * `argsHash` field docs).
 */
-function hashRunArgs(args) {
+function hashRunArgs(args, options) {
 	if (args === void 0) return;
-	return createHash("sha256").update(jcsSerialize(args), "utf8").digest("hex");
+	const canonical = jcsSerialize(args);
+	const salt = options?.salt;
+	if (salt === void 0) return createHash("sha256").update(canonical, "utf8").digest("hex");
+	return createHmac("sha256", Buffer.from(salt, "utf8")).update(canonical, "utf8").digest("hex");
 }
 /**
 * sha256 hex over the JCS canonical serialization of a run's result
@@ -16595,6 +17077,7 @@ function createEngine(options) {
 	const journal = options.serialization?.journal === void 0 ? rawJournal : wrapJournalStore(rawJournal, options.serialization.journal);
 	const transcripts = options.serialization?.transcripts === void 0 ? rawTranscripts : wrapTranscriptStore(rawTranscripts, options.serialization.transcripts);
 	const maskEvents = options.redaction?.maskEvents ?? true;
+	const eventMasker = options.redaction?.patterns === void 0 ? void 0 : compileSecretMasker(options.redaction.patterns, "createEngine redaction.patterns");
 	const defaults = options.defaults ?? {};
 	if (defaults.retry !== void 0) validateRetryPolicy(defaults.retry, "createEngine defaults.retry");
 	if (options.concurrency?.perRun !== void 0) requirePositiveInteger(options.concurrency.perRun, "createEngine concurrency.perRun");
@@ -16618,6 +17101,8 @@ function createEngine(options) {
 	}
 	validateDeterminismConfig(options.determinism);
 	validateEngineQuotaConfig(options.quota);
+	if (options.security?.argsHashSalt !== void 0 && (typeof options.security.argsHashSalt !== "string" || options.security.argsHashSalt === "")) throw new ConfigError("createEngine security.argsHashSalt must be a nonempty string when given");
+	const argsHashSalt = options.security?.argsHashSalt;
 	const quotaRuntime = options.quota === void 0 ? void 0 : {
 		limiter: options.quota.limiter,
 		...options.quota.tenant === void 0 ? {} : { tenant: options.quota.tenant },
@@ -16657,6 +17142,7 @@ function createEngine(options) {
 			spans,
 			now: realNow,
 			maskEvents,
+			...eventMasker === void 0 ? {} : { mask: (body) => eventMasker.maskDeep(body) },
 			firstSeq: telemetryBase
 		});
 		const rootSpanId = spans.mint();
@@ -16773,6 +17259,7 @@ function createEngine(options) {
 			pricingOf,
 			runSignal: controller.signal,
 			...defaults.isolation === void 0 ? {} : { isolation: defaults.isolation },
+			...options.executors === void 0 ? {} : { executors: options.executors },
 			...options.onEscalation === void 0 ? {} : { onEscalation: options.onEscalation },
 			external,
 			mintTranscriptRef: () => `${runId}/t${transcriptCounter++}`,
@@ -16783,7 +17270,7 @@ function createEngine(options) {
 		if (resumeCtx === void 0) {
 			argsBinding.argsProvided = args !== void 0;
 			try {
-				const argsHash = hashRunArgs(args);
+				const argsHash = hashRunArgs(args, argsHashSalt === void 0 ? void 0 : { salt: argsHashSalt });
 				if (argsHash !== void 0) argsBinding.argsHash = argsHash;
 			} catch {}
 		} else {
@@ -17044,6 +17531,42 @@ function createEngine(options) {
 			preview
 		};
 	}
+	/** Portable export through the policy point (RV-217). */
+	async function exportRun(runId) {
+		const entries = await journal.load(runId);
+		const meta = await readRunMeta(journal, runId);
+		const blobs = [];
+		for (const ref of await transcripts.list(runId)) {
+			const data = await transcripts.get(ref);
+			if (data !== null) blobs.push({
+				ref,
+				data
+			});
+		}
+		if (entries.length === 0 && meta === void 0 && blobs.length === 0) throw new ConfigError(`exportRun: run '${runId}' does not exist in this engine's stores`);
+		return {
+			runId,
+			...meta === void 0 ? {} : { meta },
+			entries,
+			blobs
+		};
+	}
+	/** Import under the original runId; refuses an existing run (RV-217). */
+	async function importRun(bundle) {
+		const raw = bundle;
+		if (typeof raw !== "object" || raw === null || typeof raw.runId !== "string" || raw.runId === "" || !Array.isArray(raw.entries) || !Array.isArray(raw.blobs)) throw new ConfigError("importRun: the bundle must be a RunExport (runId, entries, blobs)");
+		const runId = bundle.runId;
+		const existingMeta = await readRunMeta(journal, runId);
+		const existingEntries = await journal.load(runId);
+		const existingBlobs = await transcripts.list(runId);
+		if (existingMeta !== void 0 || existingEntries.length > 0 || existingBlobs.length > 0) throw new ConfigError(`importRun: run '${runId}' already exists in the target stores; an import never interleaves with live history (delete the run first if replacement is intended)`);
+		for (const entry of bundle.entries) await journal.append(runId, entry);
+		for (const blob of bundle.blobs) await transcripts.put(blob.ref, blob.data);
+		if (bundle.meta !== void 0) await journal.putMeta({
+			...bundle.meta,
+			runId
+		});
+	}
 	/** Retention cascade (OQ-20 executed at M8-T04): blobs, then journal. */
 	async function deleteRun(runId, opts) {
 		const refs = await transcripts.list(runId);
@@ -17108,6 +17631,8 @@ function createEngine(options) {
 		},
 		deleteRun,
 		pruneRun,
+		exportRun,
+		importRun,
 		profileCard: (names) => {
 			const registered = defaults.profiles ?? {};
 			if (names === void 0) return profileCard(registered, defaults.toolsets);
@@ -17405,4 +17930,4 @@ function createSandboxBridge(ctx, options) {
 	};
 }
 //#endregion
-export { AWAIT_SCHEMA, AdmissionController, AdmissionRejectedError, AgentCallError, BUDGET_ABORT_REASON, BudgetExhaustedError, CANCEL_AGENT_SCHEMA, CHECKPOINT_FORMAT_V1, CLAIM_STATEMENT_MAX_CHARS, CLAIM_TTL_DAYS, COMPACTION_SUMMARY_PREFIX, CURRENT_HASH_VERSION, ConfigError, DEFAULT_CHILD_BUDGET_FRACTION, DEFAULT_CHILD_RESULT_PAGE_CHARS, DEFAULT_CITATION_PATTERN, DEFAULT_COMPACTION_THRESHOLD, DEFAULT_ESCALATION_LIMITS, DEFAULT_EVIDENCE_MIN_SHARE, DEFAULT_FINISH_MAX_REPAIRS, DEFAULT_FLAT_RESERVE_USD, DEFAULT_MAX_CHILDREN_PER_NODE, DEFAULT_MAX_DEPTH, DEFAULT_MAX_OSCILLATIONS_PER_KEY, DEFAULT_MAX_PINNED_WORKTREES, DEFAULT_MAX_REVISIONS_PER_RUN, DEFAULT_MAX_TOTAL_SPAWNS, DEFAULT_MAX_TURNS, DEFAULT_MODEL_RETRY_ATTEMPTS, DEFAULT_NO_PROGRESS_TURNS, DEFAULT_PER_RUN_CONCURRENCY, DEFAULT_RETRY_POLICY, DEFAULT_STREAM_IDLE_TIMEOUT_MS, DEFAULT_SYNTHESIS_MAX_TURNS, DEFAULT_SYNTHESIS_NOTE_MAX_TURNS, DedupIndex, DeterminismError, EMIT_RESULT_TOOL, EMPTY_SCHEMA_HASH, EMPTY_TOOLSET_HASH, ESCALATE_TOOL_NAME, ESCALATION_REPORT_SCHEMA, ESCALATION_REQUEST_SCHEMA, EVENT_SEGMENT_STRIDE, EscalationDecisionAbortedError, EventBus, ExternalRegistry, FINALIZE_SYNTHESIS_INSTRUCTION, FINISH_SCHEMA, FINISH_TOOL_NAME, FailRunError, FileModelKnowledgeStore, FileTranscriptStore, GET_CHILD_RESULT_SCHEMA, GET_CHILD_RESULT_TOOL_NAME, GitWorktreeProvider, IMPLEMENTATION_PROFILE_LIMITS, INBOX_PROPOSAL_TTL_DAYS, InMemoryStore, InMemoryTranscriptStore, InProcessRunner, InvalidResolutionError, JournalCompatibilityError, JournalMatcher, JournalMissError, JournalOrderViolation, JsonlFileStore, KB_ACTIVE_CLAIMS_CAP, KB_CARD_RENDER_BUDGET_CHARS, KeyedLimiter, KnowledgeCasError, LARGE_VALUE_WARN_BYTES, LEGACY_LTID_PREFIX, LEGACY_SIGNATURE_INPUTS, LINEAGE_SIG_VERSION, LeaseHeldError, LineageIndex, MASKED_SECRET, MAX_CHILD_RESULT_PAGE_CHARS, MAX_DEPTH_CEILING, ModelRetry, NoProgressDetector, NonSerializableValueError, ORCHESTRATE_WORKFLOW_NAME, OrchestratorCapConfigError, PARALLEL_AGENTS_SCHEMA, PROGRESS_REPORT_TOOL_NAME, ParallelSiteCounter, PlanInvariantError, QUOTA_WINDOW_MS, READ_CHILD_ARTIFACT_SCHEMA, READ_CHILD_ARTIFACT_TOOL_NAME, RESEARCH_PROFILE_LIMITS, REVIEW_PROFILE_LIMITS, ROLE_EFFORT_DEFAULTS, ROOT_ACCOUNT, ROOT_SCOPE, RUN_PROFILES, RUN_SETTLE_DECISION_TYPE, ReplayPlanHashMismatch, Replayer, ResolutionArbiter, ResolutionFold, RulvarError, RunBudget, SANDBOX_AGENT_OPT_KEYS, SPAWN_AGENT_SCHEMA, SandboxError, ScriptRejected, Semaphore, SpanRegistry, TOOL_NAME_PATTERN, TerminationAccount, WAIT_FOR_EVENTS_SCHEMA, WAIT_FOR_EVENTS_TOOL_NAME, WAKE_SUMMARY_RENDER_BUDGET_CHARS, admissionReserveUsd, affordableOutputTokens, agentErrorFromWire, agentErrorToWire, agentResultWire, agentScope, applyClaimOps, applyStructuredOutputTier, approachSigCoarse, approachSigOf, archiveDeprecatedModelOps, assertFencedWrites, atCompactionThreshold, auditRun, auditRuns, buildAbandonFold, buildAdapterRegistry, buildCostReport, buildDeriverRegistry, buildOrchestratorTools, buildTerminationInitValue, buildToolContext, canRideLoopTurn, canonicalIsolationTag, canonicalizeLadder, canonicalizeSchema, capIssues, capsHashOf, checkFloors, checkpointRefFor, childCoveragePrefix, claimExpired, claimExpiry, claimIssues, claimOpIssues, classifyAgentError, classifyAttemptOutcome, collectDeclaredLadders, compactMessages, compilePermissionChain, compilePermissionPreset, compileVerifiedLayer, costReportFromJournal, countsAgainstLimit, createCanonicalIdMinter, createCtx, createEngine, createSandboxBridge, currentOnlyKeyRing, decodeCheckpoint, dedupeRepeatedClaims, defineWorkflow, deriveContentKey, deriverV1, deriverV2, digestOf, dispositionHook, emptyDigestBlocks, emptyToolset, encodeCheckpoint, entryUsageSlices, escalateTool, evaluatePermission, evaluateReuse, evidencePreservedValidator, executeWorkflow, exhaustionCodeOf, extractCandidate, failoverTriggerOf, fallbackTriggerOf, filterClaimsForRun, finalizeFires, foldTermination, formatRePrompt, formatScopePath, hasFencedWrites, hasMetaLookup, hashRunArgs, hashRunOutput, hashWorkflowBody, hashWorkflowSource, identityJcs, implementationAgentProfile, isEscalated, isSchemaPairSpec, isStandardSchemaSpec, isStrictCompatibleSchema, kMaxOf, knowledgeHash, ladderLengthOf, ladderRungChoice, lastRunSettle, latestProgressReport, lexShellCommand, liftRetainedParts, lineageWeightOf, makeOrchestratorWorkflow, maskSecrets, maskSecretsDeep, maskSecretsJson, matchArgvPattern, matchShellCommand, mcp, memoryQuotaLimiter, mergeQuotaDenial, mergeUsageLimits, metaMatchesFilter, minMatchesValidator, modelEpochOf, modelKnowledgeCard, modelSpecIdentity, needsSeparateExtract, nextFailover, nodeLinkKey, normalizeApproachTag, normalizeEntry, normalizeFallbacks, orchestrate, parallelScope, parseModelRef, parseScopePath, phiInitialOf, pipelineScope, planNodeScope, priceEntryUsage, priceUsdOf, profileCard, profileRegistrySnapshotHash, progressReportTool, projectHistory, projectIdentity, projectToJsonSchema, proposalStatement, providerOf, quotaActualTokens, quotaEstimateTokens, quotaRuleAdmission, quotaRuleMatches, readRunMeta, readTerminationInit, reconcileRunMeta, reduceCriticalPath, reduceInvocationTable, registryKeyRing, remeasureQueue, replayDisposition, repositoryResearchToolset, requiredFieldsValidator, requiredSectionsValidator, researchAgentProfile, resolveModelInvocation, resolvePricing, resolveToolset, retryClassOf, retryDelayMs, reviewAgentProfile, roleConfiguredInRouting, roundOneDisposition, runAgent, runProfile, sanitizeTerminalText, sanitizeTokenCount, sanitizeUsage, sanitizeUsageDelta, scanJournalCompatibility, schemaHash, schemaHashOfSpec, selectStructuredOutputTier, shouldCompact, snapshotUsage, spawnDepthOf, summarizeInstruction, summarizeOutput, terminationConfigDrift, tierWithinCaps, toApprovalDecision, toJournalValue, tool, toolContract, toolsetHash, ttlState, usageViolations, validateEditorialCommit, validateEngineQuotaConfig, validateEntryShape, validateEscalationLimits, validateEscalationReport, validateQuotaRules, validateRetryPolicy, validateSchemaSpec, validateTerminationLimits, validateUsageLimits, workflowScope, workflowSourceRef, wrapJournalStore, wrapTranscriptStore };
+export { AWAIT_SCHEMA, AdmissionController, AdmissionRejectedError, AgentCallError, BUDGET_ABORT_REASON, BudgetExhaustedError, CANCEL_AGENT_SCHEMA, CHECKPOINT_FORMAT_V1, CLAIM_STATEMENT_MAX_CHARS, CLAIM_TTL_DAYS, COMPACTION_SUMMARY_PREFIX, CURRENT_HASH_VERSION, ConfigError, DEFAULT_CHILD_BUDGET_FRACTION, DEFAULT_CHILD_RESULT_PAGE_CHARS, DEFAULT_CITATION_PATTERN, DEFAULT_COMPACTION_THRESHOLD, DEFAULT_ESCALATION_LIMITS, DEFAULT_EVIDENCE_MIN_SHARE, DEFAULT_FINISH_MAX_REPAIRS, DEFAULT_FLAT_RESERVE_USD, DEFAULT_MAX_CHILDREN_PER_NODE, DEFAULT_MAX_DEPTH, DEFAULT_MAX_OSCILLATIONS_PER_KEY, DEFAULT_MAX_PINNED_WORKTREES, DEFAULT_MAX_REVISIONS_PER_RUN, DEFAULT_MAX_TOTAL_SPAWNS, DEFAULT_MAX_TURNS, DEFAULT_MODEL_RETRY_ATTEMPTS, DEFAULT_NO_PROGRESS_TURNS, DEFAULT_PER_RUN_CONCURRENCY, DEFAULT_RETRY_POLICY, DEFAULT_STREAM_IDLE_TIMEOUT_MS, DEFAULT_SYNTHESIS_MAX_TURNS, DEFAULT_SYNTHESIS_NOTE_MAX_TURNS, DedupIndex, DeterminismError, EMIT_RESULT_TOOL, EMPTY_SCHEMA_HASH, EMPTY_TOOLSET_HASH, ESCALATE_TOOL_NAME, ESCALATION_REPORT_SCHEMA, ESCALATION_REQUEST_SCHEMA, EVENT_SEGMENT_STRIDE, EscalationDecisionAbortedError, EventBus, ExternalRegistry, FINALIZE_SYNTHESIS_INSTRUCTION, FINISH_SCHEMA, FINISH_TOOL_NAME, FailRunError, FileModelKnowledgeStore, FileTranscriptStore, GET_CHILD_RESULT_SCHEMA, GET_CHILD_RESULT_TOOL_NAME, GitWorktreeProvider, IMPLEMENTATION_PROFILE_LIMITS, INBOX_PROPOSAL_TTL_DAYS, InMemoryStore, InMemoryTranscriptStore, InProcessRunner, InvalidResolutionError, JOURNAL_ENVELOPE_MARKER, JournalCompatibilityError, JournalMatcher, JournalMissError, JournalOrderViolation, JsonlFileStore, KB_ACTIVE_CLAIMS_CAP, KB_CARD_RENDER_BUDGET_CHARS, KeyedLimiter, KnowledgeCasError, LARGE_VALUE_WARN_BYTES, LEGACY_LTID_PREFIX, LEGACY_SIGNATURE_INPUTS, LINEAGE_SIG_VERSION, LeaseHeldError, LineageIndex, MASKED_SECRET, MAX_CHILD_RESULT_PAGE_CHARS, MAX_DEPTH_CEILING, ModelRetry, NoProgressDetector, NonSerializableValueError, ORCHESTRATE_WORKFLOW_NAME, OrchestratorCapConfigError, PARALLEL_AGENTS_SCHEMA, PROGRESS_REPORT_TOOL_NAME, ParallelSiteCounter, PlanInvariantError, QUOTA_WINDOW_MS, READ_CHILD_ARTIFACT_SCHEMA, READ_CHILD_ARTIFACT_TOOL_NAME, RESEARCH_PROFILE_LIMITS, REVIEW_PROFILE_LIMITS, ROLE_EFFORT_DEFAULTS, ROOT_ACCOUNT, ROOT_SCOPE, RUN_PROFILES, RUN_SETTLE_DECISION_TYPE, ReplayPlanHashMismatch, Replayer, ResolutionArbiter, ResolutionFold, RulvarError, RunBudget, SANDBOX_AGENT_OPT_KEYS, SPAWN_AGENT_SCHEMA, SandboxError, ScriptRejected, Semaphore, SpanRegistry, TOOL_NAME_PATTERN, TerminationAccount, WAIT_FOR_EVENTS_SCHEMA, WAIT_FOR_EVENTS_TOOL_NAME, WAKE_SUMMARY_RENDER_BUDGET_CHARS, admissionReserveUsd, affordableOutputTokens, agentErrorFromWire, agentErrorToWire, agentResultWire, agentScope, applyClaimOps, applyStructuredOutputTier, approachSigCoarse, approachSigOf, archiveDeprecatedModelOps, assertFencedWrites, atCompactionThreshold, auditRun, auditRuns, buildAbandonFold, buildAdapterRegistry, buildCostReport, buildDeriverRegistry, buildOrchestratorTools, buildTerminationInitValue, buildToolContext, canRideLoopTurn, canonicalIsolationTag, canonicalizeLadder, canonicalizeSchema, capIssues, capsHashOf, checkFloors, checkpointRefFor, childCoveragePrefix, claimExpired, claimExpiry, claimIssues, claimOpIssues, classifyAgentError, classifyAttemptOutcome, collectDeclaredLadders, compactMessages, compilePermissionChain, compilePermissionPreset, compileSecretMasker, compileVerifiedLayer, constantTimeEqual, costReportFromJournal, countsAgainstLimit, createCanonicalIdMinter, createCtx, createEngine, createEnvelopeEncryption, createSandboxBridge, currentOnlyKeyRing, decodeCheckpoint, dedupeRepeatedClaims, defineWorkflow, deriveContentKey, deriverV1, deriverV2, digestOf, dispositionHook, emptyDigestBlocks, emptyToolset, encodeCheckpoint, entryUsageSlices, escalateTool, evaluatePermission, evaluateReuse, evidencePreservedValidator, executeWorkflow, exhaustionCodeOf, extractCandidate, failoverTriggerOf, fallbackTriggerOf, filterClaimsForRun, finalizeFires, foldTermination, formatRePrompt, formatScopePath, hasFencedWrites, hasMetaLookup, hashRunArgs, hashRunOutput, hashWorkflowBody, hashWorkflowSource, identityJcs, implementationAgentProfile, isEscalated, isSchemaPairSpec, isStandardSchemaSpec, isStrictCompatibleSchema, kMaxOf, knowledgeHash, ladderLengthOf, ladderRungChoice, lastRunSettle, latestProgressReport, lexShellCommand, liftRetainedParts, lineageWeightOf, localKeyProvider, makeOrchestratorWorkflow, maskSecrets, maskSecretsDeep, maskSecretsJson, matchArgvPattern, matchShellCommand, mcp, memoryQuotaLimiter, mergeQuotaDenial, mergeUsageLimits, metaMatchesFilter, minMatchesValidator, modelEpochOf, modelKnowledgeCard, modelSpecIdentity, needsSeparateExtract, nextFailover, nodeLinkKey, normalizeApproachTag, normalizeEntry, normalizeFallbacks, orchestrate, parallelScope, parseModelRef, parseScopePath, phiInitialOf, pipelineScope, planNodeScope, priceEntryUsage, priceUsdOf, profileCard, profileRegistrySnapshotHash, progressReportTool, projectHistory, projectIdentity, projectToJsonSchema, proposalStatement, providerOf, quotaActualTokens, quotaEstimateTokens, quotaRuleAdmission, quotaRuleMatches, readRunMeta, readTerminationInit, reconcileRunMeta, reduceAuditTrail, reduceCriticalPath, reduceInvocationTable, registryKeyRing, remeasureQueue, replayDisposition, repositoryResearchToolset, requiredFieldsValidator, requiredSectionsValidator, researchAgentProfile, resolveModelInvocation, resolvePricing, resolveToolset, retryClassOf, retryDelayMs, reviewAgentProfile, roleConfiguredInRouting, roundOneDisposition, runAgent, runProfile, sanitizeTerminalText, sanitizeTokenCount, sanitizeUsage, sanitizeUsageDelta, scanJournalCompatibility, schemaHash, schemaHashOfSpec, selectStructuredOutputTier, shouldCompact, snapshotUsage, spawnDepthOf, summarizeInstruction, summarizeOutput, terminationConfigDrift, tierWithinCaps, toApprovalDecision, toJournalValue, tool, toolContract, toolsetHash, ttlState, usageViolations, validateEditorialCommit, validateEngineQuotaConfig, validateEntryShape, validateEscalationLimits, validateEscalationReport, validateQuotaRules, validateRetryPolicy, validateSchemaSpec, validateTerminationLimits, validateUsageLimits, workflowScope, workflowSourceRef, wrapJournalStore, wrapTranscriptStore };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rulvar/core",
-  "version": "1.57.0",
+  "version": "1.59.0",
   "description": "Rulvar core: L0 contracts, journal kernel, ctx primitives, agent runtime, model router, tool system, dynamic orchestrator, InMemory and JSONL stores, event stream.",
   "type": "module",
   "license": "Apache-2.0",