@bitkyc08/opencodex 2.42.0 → 2.43.0

package/src/generated/model-metadata.ts

@@ -38,7 +38,7 @@ const PROVIDER_ALIASES: Record<string, string> = {
 type Row = readonly [id: string, contextWindow?: number | null, maxTokens?: number | null, input?: string | null, reasoning?: 0 | 1 | null, wireModelId?: string | null, costInput?: number | null, costOutput?: number | null, costCacheRead?: number | null, costCacheWrite?: number | null];
 const DATA: Record<string, readonly Row[]> = {
   "amazon-bedrock": [["anthropic.claude-3-5-haiku-20241022-v1:0",200000,8192,"text,image",0,null,0.8,4,0.08,1],["anthropic.claude-3-5-sonnet-20240620-v1:0",200000,8192,"text,image",0,null,3,15,0.3,3.75],["anthropic.claude-3-5-sonnet-20241022-v2:0",200000,8192,"text,image",0,null,3,15,0.3,3.75],["anthropic.claude-3-haiku-20240307-v1:0",200000,4096,"text,image",0,null,0.25,1.25,0,0],["anthropic.claude-3-opus-20240229-v1:0",200000,4096,"text,image",0,null,15,75,0,0],["anthropic.claude-3-sonnet-20240229-v1:0",200000,4096,"text,image",0,null,3,15,0,0],["anthropic.claude-fable-5",1000000,128000,"text,image",1,null,10,50,1,12.5],["anthropic.claude-opus-4-6-v1",1000000,128000,"text,image",1,null,5,25,0.5,6.25],["anthropic.claude-opus-4-7",1000000,128000,"text,image",1,null,5,25,0.5,6.25],["anthropic.claude-opus-4-8",1000000,128000,"text,image",1,null,5,25,0.5,6.25],["anthropic.claude-opus-5",1000000,128000,"text,image",1,null,5,25,0.5,6.25],["anthropic.claude-sonnet-5",1000000,128000,"text,image",1,null,2,10,0.2,2.5],["au.anthropic.claude-haiku-4-5-20251001-v1:0",200000,64000,"text,image",1,null,1,5,0.1,1.25],["au.anthropic.claude-opus-4-6-v1",1000000,128000,"text,image",1,null,16.5,82.5,0.5,6.25],["au.anthropic.claude-opus-4-8",1000000,128000,"text,image",1,null,5,25,0.5,6.25],["au.anthropic.claude-opus-5",1000000,128000,"text,image",1,null,5,25,0.5,6.25],["au.anthropic.claude-sonnet-4-5-20250929-v1:0",200000,64000,"text,image",1,null,3,15,0.3,3.75],["au.anthropic.claude-sonnet-4-6",1000000,128000,"text,image",1,null,3.3,16.5,0.33,4.125],["au.anthropic.claude-sonnet-5",1000000,128000,"text,image",1,null,2,10,0.2,2.5],["cohere.command-r-plus-v1:0",128000,4096,"text",0,null,3,15,0,0],["cohere.command-r-v1:0",128000,4096,"text",0,null,0.5,1.5,0,0],["deepseek.v3-v1:0",163840,81920,"text",1,null,0.58,1.68,0,0],["deepseek.v3.2",163840,81920,"text",1,null,0.62,1.85,0,0],["deepseek.v3.2-v1:0",163840,81920,"text",1,null,0.62,1.85,0,0],["eu.anthropic.claude-3-5-haiku-20241022-v1:0",200000,8192,"text,image",0,null,0.8,4,0.08,1],["eu.anthropic.claude-3-5-sonnet-20240620-v1:0",200000,8192,"text,image",0,null,3,15,0.3,3.75],["eu.anthropic.claude-3-5-sonnet-20241022-v2:0",200000,8192,"text,image",0,null,3,15,0.3,3.75],["eu.anthropic.claude-3-7-sonnet-20250219-v1:0",200000,8192,"text,image",0,null,3,15,0.3,3.75],["eu.anthropic.claude-3-haiku-20240307-v1:0",200000,4096,"text,image",0,null,0.25,1.25,0,0],["eu.anthropic.claude-3-opus-20240229-v1:0",200000,4096,"text,image",0,null,15,75,0,0],["eu.anthropic.claude-3-sonnet-20240229-v1:0",200000,4096,"text,image",0,null,3,15,0,0],["eu.anthropic.claude-fable-5",1000000,128000,"text,image",1,null,10,50,1,12.5],["eu.anthropic.claude-haiku-4-5-20251001-v1:0",200000,64000,"text,image",1,null,1.1,5.5,0.11,1.375],["eu.anthropic.claude-opus-4-1-20250805-v1:0",200000,32000,"text,image",1,null,15,75,1.5,18.75],["eu.anthropic.claude-opus-4-20250514-v1:0",200000,32000,"text,image",1,null,15,75,1.5,18.75],["eu.anthropic.claude-opus-4-5-20251101-v1:0",200000,64000,"text,image",1,null,5.5,27.5,0.55,6.875],["eu.anthropic.claude-opus-4-6-v1",1000000,128000,"text,image",1,null,5,25,0.5,6.25],["eu.anthropic.claude-opus-4-7",1000000,128000,"text,image",1,null,5.5,27.5,0.55,6.875],["eu.anthropic.claude-opus-4-8",1000000,128000,"text,image",1,null,5.5,27.5,0.55,6.875],["eu.anthropic.claude-opus-5",1000000,128000,"text,image",1,null,5.5,27.5,0.55,6.875],["eu.anthropic.claude-sonnet-4-20250514-v1:0",200000,64000,"text,image",1,null,3,15,0.3,3.75],["eu.anthropic.claude-sonnet-4-5-20250929-v1:0",200000,64000,"text,image",1,null,3,15,0.3,3.75],["eu.anthropic.claude-sonnet-4-6",1000000,64000,"text,image",1,null,3,15,0.3,3.75],["eu.anthropic.claude-sonnet-5",1000000,128000,"text,image",1,null,2,10,0.2,2.5],["global.amazon.nova-2-lite-v1:0",128000,4096,"text,image",1,null,0.33,2.75,0,0],["global.anthropic.claude-fable-5",1000000,128000,"text,image",1,null,10,50,1,12.5],["global.anthropic.claude-haiku-4-5-20251001-v1:0",200000,64000,"text,image",1,null,1,5,0.1,1.25],["global.anthropic.claude-opus-4-5-20251101-v1:0",200000,64000,"text,image",1,null,5,25,0.5,6.25],["global.anthropic.claude-opus-4-6-v1",1000000,128000,"text,image",1,null,5,25,0.5,6.25],["global.anthropic.claude-opus-4-7",1000000,128000,"text,image",1,null,5,25,0.5,6.25],["global.anthropic.claude-opus-4-8",1000000,128000,"text,image",1,null,5,25,0.5,6.25],["global.anthropic.claude-opus-5",1000000,128000,"text,image",1,null,5,25,0.5,6.25],["global.anthropic.claude-sonnet-4-20250514-v1:0",200000,64000,"text,image",1,null,3,15,0.3,3.75],["global.anthropic.claude-sonnet-4-5-20250929-v1:0",200000,64000,"text,image",1,null,3,15,0.3,3.75],["global.anthropic.claude-sonnet-4-6",1000000,64000,"text,image",1,null,3,15,0.3,3.75],["global.anthropic.claude-sonnet-5",1000000,128000,"text,image",1,null,2,10,0.2,2.5],["google.gemma-3-27b-it",202752,8192,"text,image",0,null,0.12,0.2,0,0],["google.gemma-3-4b-it",128000,4096,"text,image",0,null,0.04,0.08,0,0],["jp.anthropic.claude-haiku-4-5-20251001-v1:0",200000,64000,"text,image",1,null,1,5,0.1,1.25],["jp.anthropic.claude-opus-4-7",1000000,128000,"text,image",1,null,5,25,0.5,6.25],["jp.anthropic.claude-opus-4-8",1000000,128000,"text,image",1,null,5,25,0.5,6.25],["jp.anthropic.claude-opus-5",1000000,128000,"text,image",1,null,5,25,0.5,6.25],["jp.anthropic.claude-sonnet-4-5-20250929-v1:0",200000,64000,"text,image",1,null,3,15,0.3,3.75],["jp.anthropic.claude-sonnet-4-6",1000000,64000,"text,image",1,null,3,15,0.3,3.75],["jp.anthropic.claude-sonnet-5",1000000,128000,"text,image",1,null,2,10,0.2,2.5],["meta.llama3-1-405b-instruct-v1:0",128000,4096,"text",0,null,2.4,2.4,0,0],["meta.llama3-1-70b-instruct-v1:0",128000,4096,"text",0,null,0.72,0.72,0,0],["meta.llama3-1-8b-instruct-v1:0",128000,4096,"text",0,null,0.22,0.22,0,0],["minimax.minimax-m2",204608,128000,"text",1,null,0.3,1.2,0,0],["minimax.minimax-m2.1",204800,131072,"text",1,null,0.3,1.2,0,0],["minimax.minimax-m2.5",196608,98304,"text",1,null,0.3,1.2,0,0],["mistral.devstral-2-123b",256000,8192,"text",0,null,0.4,2,0,0],["mistral.magistral-small-2509",128000,40000,"text,image",1,null,0.5,1.5,0,0],["mistral.ministral-3-14b-instruct",128000,4096,"text",0,null,0.2,0.2,0,0],["mistral.ministral-3-3b-instruct",256000,8192,"text,image",0,null,0.1,0.1,0,0],["mistral.ministral-3-8b-instruct",128000,4096,"text",0,null,0.15,0.15,0,0],["mistral.mistral-large-2402-v1:0",128000,4096,"text",0,null,0.5,1.5,0,0],["mistral.mistral-large-3-675b-instruct",256000,8192,"text,image",0,null,0.5,1.5,0,0],["mistral.pixtral-large-2502-v1:0",128000,8192,"text,image",0,null,2,6,0,0],["mistral.voxtral-mini-3b-2507",128000,4096,"text",0,null,0.04,0.04,0,0],["mistral.voxtral-small-24b-2507",32000,8192,"text",0,null,0.15,0.35,0,0],["moonshot.kimi-k2-thinking",262143,16000,"text",1,null,0.6,2.5,0,0],["moonshotai.kimi-k2.5",262143,16000,"text,image",1,null,0.6,3,0,0],["nvidia.nemotron-nano-12b-v2",128000,4096,"text,image",0,null,0.2,0.6,0,0],["nvidia.nemotron-nano-3-30b",128000,4096,"text",1,null,0.06,0.24,0,0],["nvidia.nemotron-nano-9b-v2",128000,4096,"text",0,null,0.06,0.23,0,0],["nvidia.nemotron-super-3-120b",262144,131072,"text",1,null,0.15,0.65,0,0],["openai.gpt-5.4",272000,128000,"text,image",1,null,2.75,16.5,0.275,0],["openai.gpt-5.5",272000,128000,"text,image",1,null,5.5,33,0.55,0],["openai.gpt-5.6-luna",373000,128000,"text,image",1,null,1,6,0.1,1.25],["openai.gpt-5.6-sol",373000,128000,"text,image",1,null,5,30,0.5,6.25],["openai.gpt-5.6-terra",373000,128000,"text,image",1,null,2.5,15,0.25,3.125],["openai.gpt-oss-120b",128000,16384,"text",1,null,0.15,0.6,0,0],["openai.gpt-oss-120b-1:0",128000,16384,"text",1,null,0.15,0.6,0,0],["openai.gpt-oss-20b",128000,16384,"text",1,null,0.07,0.3,0,0],["openai.gpt-oss-20b-1:0",128000,16384,"text",1,null,0.07,0.3,0,0],["openai.gpt-oss-safeguard-120b",128000,16384,"text",0,null,0.15,0.6,0,0],["openai.gpt-oss-safeguard-20b",128000,16384,"text",0,null,0.07,0.2,0,0],["qwen.qwen3-235b-a22b-2507-v1:0",262144,131072,"text",0,null,0.22,0.88,0,0],["qwen.qwen3-32b-v1:0",16384,16384,"text",1,null,0.15,0.6,0,0],["qwen.qwen3-coder-30b-a3b-v1:0",262144,131072,"text",0,null,0.15,0.6,0,0],["qwen.qwen3-coder-480b-a35b-v1:0",131072,65536,"text",0,null,0.22,1.8,0,0],["qwen.qwen3-coder-next",131072,65536,"text",1,null,0.22,1.8,0,0],["qwen.qwen3-next-80b-a3b",262000,262000,"text",0,null,0.14,1.4,0,0],["qwen.qwen3-vl-235b-a22b",262000,262000,"text,image",0,null,0.3,1.5,0,0],["us.amazon.nova-lite-v1:0",300000,8192,"text,image",0,null,0.06,0.24,0.015,0],["us.amazon.nova-micro-v1:0",128000,8192,"text",0,null,0.035,0.14,0.00875,0],["us.amazon.nova-premier-v1:0",1000000,16384,"text,image",1,null,2.5,12.5,0,0],["us.amazon.nova-pro-v1:0",300000,8192,"text,image",0,null,0.8,3.2,0.2,0],["us.anthropic.claude-3-7-sonnet-20250219-v1:0",200000,8192,"text,image",0,null,3,15,0.3,3.75],["us.anthropic.claude-fable-5",1000000,128000,"text,image",1,null,10,50,1,12.5],["us.anthropic.claude-haiku-4-5-20251001-v1:0",200000,64000,"text,image",1,null,1,5,0.1,1.25],["us.anthropic.claude-opus-4-1-20250805-v1:0",200000,32000,"text,image",1,null,15,75,1.5,18.75],["us.anthropic.claude-opus-4-20250514-v1:0",200000,32000,"text,image",1,null,15,75,1.5,18.75],["us.anthropic.claude-opus-4-5-20251101-v1:0",200000,64000,"text,image",1,null,5,25,0.5,6.25],["us.anthropic.claude-opus-4-6-v1",1000000,128000,"text,image",1,null,5,25,0.5,6.25],["us.anthropic.claude-opus-4-7",1000000,128000,"text,image",1,null,5,25,0.5,6.25],["us.anthropic.claude-opus-4-8",1000000,128000,"text,image",1,null,5,25,0.5,6.25],["us.anthropic.claude-opus-5",1000000,128000,"text,image",1,null,5,25,0.5,6.25],["us.anthropic.claude-sonnet-4-20250514-v1:0",200000,64000,"text,image",1,null,3,15,0.3,3.75],["us.anthropic.claude-sonnet-4-5-20250929-v1:0",200000,64000,"text,image",1,null,3,15,0.3,3.75],["us.anthropic.claude-sonnet-4-6",1000000,64000,"text,image",1,null,3,15,0.3,3.75],["us.anthropic.claude-sonnet-5",1000000,128000,"text,image",1,null,2,10,0.2,2.5],["us.deepseek.r1-v1:0",128000,32768,"text",1,null,1.35,5.4,0,0],["us.meta.llama3-2-11b-instruct-v1:0",128000,4096,"text,image",0,null,0.16,0.16,0,0],["us.meta.llama3-2-1b-instruct-v1:0",131000,4096,"text",0,null,0.1,0.1,0,0],["us.meta.llama3-2-3b-instruct-v1:0",131000,4096,"text",0,null,0.15,0.15,0,0],["us.meta.llama3-2-90b-instruct-v1:0",128000,4096,"text,image",0,null,0.72,0.72,0,0],["us.meta.llama3-3-70b-instruct-v1:0",128000,4096,"text",0,null,0.72,0.72,0,0],["us.meta.llama4-maverick-17b-instruct-v1:0",1000000,16384,"text,image",0,null,0.24,0.97,0,0],["us.meta.llama4-scout-17b-instruct-v1:0",3500000,16384,"text,image",0,null,0.17,0.66,0,0],["writer.palmyra-x4-v1:0",122880,8192,"text",1,null,2.5,10,0,0],["writer.palmyra-x5-v1:0",1040000,8192,"text",1,null,0.6,6,0,0],["xai.grok-4.3",1000000,131072,"text,image",1,null,1.25,2.5,0.2,0],["zai.glm-4.7",204800,131072,"text",1,null,0.6,2.2,0,0],["zai.glm-4.7-flash",200000,131072,"text",1,null,0.07,0.4,0,0],["zai.glm-5",202752,101376,"text",1,null,1,3.2,0,0]],
-  "anthropic": [["claude-3-5-sonnet-20240620",200000,8192,"text,image",0,null,3,15,0.3,3.75],["claude-3-5-sonnet-20241022",200000,8192,"text,image",0,null,3,15,0.3,3.75],["claude-3-haiku-20240307",200000,4096,"text,image",0,null,0.25,1.25,0.03,0.3],["claude-fable-5",1000000,128000,"text,image",1,null,10,50,1,12.5],["claude-haiku-4-5",200000,64000,"text,image",1,null,1,5,0.1,1.25],["claude-haiku-4-5-20251001",200000,64000,"text,image",1,null,1,5,0.1,1.25],["claude-opus-4-0",200000,32000,"text,image",1,null,15,75,1.5,18.75],["claude-opus-4-1",200000,32000,"text,image",1,null,15,75,1.5,18.75],["claude-opus-4-1-20250805",200000,32000,"text,image",1,null,15,75,1.5,18.75],["claude-opus-4-20250514",200000,32000,"text,image",1,null,15,75,1.5,18.75],["claude-opus-4-5",200000,64000,"text,image",1,null,5,25,0.5,6.25],["claude-opus-4-5-20251101",200000,64000,"text,image",1,null,5,25,0.5,6.25],["claude-opus-4-6",1000000,128000,"text,image",1,null,5,25,0.5,6.25],["claude-opus-4-6[1m]",1000000,128000,"text,image",1,"claude-opus-4-6",5,25,0.5,6.25],["claude-opus-4-7",1000000,128000,"text,image",1,null,5,25,0.5,6.25],["claude-opus-4-7[1m]",1000000,128000,"text,image",1,"claude-opus-4-7",5,25,0.5,6.25],["claude-opus-4-8",1000000,128000,"text,image",1,null,5,25,0.5,6.25],["claude-opus-4-8[1m]",1000000,128000,"text,image",1,"claude-opus-4-8",5,25,0.5,6.25],["claude-opus-5",1000000,128000,"text,image",1,null,5,25,0.5,6.25],["claude-sonnet-4-0",200000,64000,"text,image",1,null,3,15,0.3,3.75],["claude-sonnet-4-20250514",200000,64000,"text,image",1,null,3,15,0.3,3.75],["claude-sonnet-4-5",1000000,64000,"text,image",1,null,3,15,0.3,3.75],["claude-sonnet-4-5-20250929",1000000,64000,"text,image",1,null,3,15,0.3,3.75],["claude-sonnet-4-6",1000000,128000,"text,image",1,null,3,15,0.3,3.75],["claude-sonnet-4-6[1m]",1000000,64000,"text,image",1,"claude-sonnet-4-6",3,15,0.3,3.75],["claude-sonnet-5",1000000,128000,"text,image",1,null,2,10,0.2,2.5]],
+  "anthropic": [["claude-3-5-sonnet-20240620",200000,8192,"text,image",0,null,3,15,0.3,3.75],["claude-3-5-sonnet-20241022",200000,8192,"text,image",0,null,3,15,0.3,3.75],["claude-3-haiku-20240307",200000,4096,"text,image",0,null,0.25,1.25,0.03,0.3],["claude-fable-5",1000000,128000,"text,image",1,null,10,50,1,12.5],["claude-fable-5-1",1000000,128000,"text,image",1,null,10,50,0.25,12.5],["claude-haiku-4-5",200000,64000,"text,image",1,null,1,5,0.1,1.25],["claude-haiku-4-5-20251001",200000,64000,"text,image",1,null,1,5,0.1,1.25],["claude-opus-4-0",200000,32000,"text,image",1,null,15,75,1.5,18.75],["claude-opus-4-1",200000,32000,"text,image",1,null,15,75,1.5,18.75],["claude-opus-4-1-20250805",200000,32000,"text,image",1,null,15,75,1.5,18.75],["claude-opus-4-20250514",200000,32000,"text,image",1,null,15,75,1.5,18.75],["claude-opus-4-5",200000,64000,"text,image",1,null,5,25,0.5,6.25],["claude-opus-4-5-20251101",200000,64000,"text,image",1,null,5,25,0.5,6.25],["claude-opus-4-6",1000000,128000,"text,image",1,null,5,25,0.5,6.25],["claude-opus-4-6[1m]",1000000,128000,"text,image",1,"claude-opus-4-6",5,25,0.5,6.25],["claude-opus-4-7",1000000,128000,"text,image",1,null,5,25,0.5,6.25],["claude-opus-4-7[1m]",1000000,128000,"text,image",1,"claude-opus-4-7",5,25,0.5,6.25],["claude-opus-4-8",1000000,128000,"text,image",1,null,5,25,0.5,6.25],["claude-opus-4-8[1m]",1000000,128000,"text,image",1,"claude-opus-4-8",5,25,0.5,6.25],["claude-opus-5",1000000,128000,"text,image",1,null,5,25,0.5,6.25],["claude-sonnet-4-0",200000,64000,"text,image",1,null,3,15,0.3,3.75],["claude-sonnet-4-20250514",200000,64000,"text,image",1,null,3,15,0.3,3.75],["claude-sonnet-4-5",1000000,64000,"text,image",1,null,3,15,0.3,3.75],["claude-sonnet-4-5-20250929",1000000,64000,"text,image",1,null,3,15,0.3,3.75],["claude-sonnet-4-6",1000000,128000,"text,image",1,null,3,15,0.3,3.75],["claude-sonnet-4-6[1m]",1000000,64000,"text,image",1,"claude-sonnet-4-6",3,15,0.3,3.75],["claude-sonnet-5",1000000,128000,"text,image",1,null,2,10,0.2,2.5]],
   "azure-openai": [["gpt-4.1",1047576,32768,"text,image",0,null,2,8,0.5,0],["gpt-4o",128000,16384,"text,image",0,null,2.5,10,1.25,0],["gpt-4o-mini",128000,16384,"text,image",0,null,0.15,0.6,0.075,0],["o3",200000,100000,"text,image",1,null,2,8,0.5,0],["o3-mini",200000,100000,"text",1,null,1.1,4.4,0.55,0]],
   "cerebras": [["gemma-4-31b",131072,40960,"text,image",1,null,0.99,1.49,0,0],["gpt-oss-120b",131072,40960,"text",1,null,0.35,0.75,0,0],["llama3.1-8b",32000,8000,"text",0,null,0.1,0.1,0,0],["qwen-3-235b-a22b-instruct-2507",131000,32000,"text",0,null,0.6,1.2,0,0],["qwen-3-coder-480b",131072,32768,"text",0,null,0,0,0,0],["zai-glm-4.6",131072,32768,"text",0,null,0,0,0,0],["zai-glm-4.7",131072,40960,"text",1,null,2.25,2.75,2.25,0]],
   "deepseek": [["deepseek-v4-flash",1048576,384000,"text",1,null,0.14,0.28,0.0028,0],["deepseek-v4-pro",1048576,384000,"text",1,null,0.435,0.87,0.003625,0]],

package/src/integrations/journal.ts

@@ -26,7 +26,7 @@ import { isIntegrationClientId, type IntegrationClientId } from "./registry";
  *
  * This union is re-declared, not imported, in two other places -- the management
  * route envelope and the GUI adapter -- because neither imports across that
- * boundary. `tests/integrations-journal.test.ts` asserts the three agree, since
+ * boundary. `tests/clients/integrations-journal.test.ts` asserts the three agree, since
  * nothing else can: a kind persisted here and missing there renders as a raw
  * key with no type error anywhere.
  */
@@ -64,6 +64,44 @@ export interface JournalEntry {
 
 export const SNAPSHOT_RETENTION = 10;
 
+/**
+ * A deletion, expressed as an APPEND.
+ *
+ * The alternative -- rewriting journal.jsonl without the row -- breaks all three
+ * things this file's header promises. `appendOperation` commits and nothing
+ * else, so a read-modify-write would race any concurrent append; a torn write
+ * would truncate the whole log rather than one trailing line, which
+ * `listOperations` is built to tolerate; and no lock covers this file, because
+ * append-only never needed one (writer-lock.ts guards `<configPath>.lock`,
+ * which is a client config, not this).
+ *
+ * "journal rows always survive" (pruneSnapshots below) is a promise about
+ * RETENTION, not about the user. An operator deleting their own row is not
+ * retention, and the physical line does in fact survive -- this record is laid
+ * over it.
+ */
+export interface JournalTombstone {
+  /** opId this row retires. */
+  tombstone: string;
+  at: string;
+  /** Management principal that asked. Never a token, never a path. */
+  by: string;
+}
+
+function isTombstone(value: unknown): value is JournalTombstone {
+  return typeof value === "object" && value !== null
+    && typeof (value as { tombstone?: unknown }).tombstone === "string";
+}
+
+/** Retire one operation. Append-only, exactly like `appendOperation`. */
+export function appendTombstone(
+  record: JournalTombstone,
+  dir: string = integrationsDir(),
+): void {
+  ensureDir(journalPath(dir));
+  appendFileSync(journalPath(dir), `${JSON.stringify(record)}\n`, { encoding: "utf8", mode: 0o600 });
+}
+
 /**
  * Does the file on disk still hold what this operation left behind?
  *
@@ -159,16 +197,34 @@ export function listOperations(
     return [];
   }
   const rows: JournalEntry[] = [];
+  /*
+   * Collected in the SAME pass, before any filtering. A tombstone carries no
+   * clientId -- it names an opId -- so a pass that filtered by client first
+   * would drop the tombstone and resurrect the row on the per-client route
+   * while the global route hid it. The two routes read the same log and must
+   * agree.
+   */
+  const retired = new Set<string>();
   for (const line of raw.split("\n")) {
     if (!line.trim()) continue;
     try {
-      const parsed = JSON.parse(line) as JournalEntry;
-      if (!clientId || parsed.clientId === clientId) rows.push(parsed);
+      const parsed: unknown = JSON.parse(line);
+      if (isTombstone(parsed)) {
+        retired.add(parsed.tombstone);
+        continue;
+      }
+      const entry = parsed as JournalEntry;
+      if (!clientId || entry.clientId === clientId) rows.push(entry);
     } catch {
       // Torn line from an interrupted append; the rest of the log is still good.
     }
   }
-  return rows.reverse().slice(0, limit);
+  /*
+   * Filter AFTER the whole file is read, never during. A tombstone is always
+   * appended after the row it retires, so an in-loop check would miss every one.
+   */
+  const live = retired.size === 0 ? rows : rows.filter(row => !retired.has(row.opId));
+  return live.reverse().slice(0, limit);
 }
 
 export function findOperation(opId: string, dir: string = integrationsDir()): JournalEntry | null {
@@ -211,6 +267,11 @@ export function countSnapshots(
  * Keep the newest N snapshot files per client; journal rows always survive.
  * Structured rather than throwing or swallowing: a swallowed failure would let
  * credential-bearing snapshots pile up while every operation reported success.
+ *
+ * A user-deleted row no longer occupies a retention slot: `listOperations`
+ * hides retired rows, so the keep window below slides down by one for each
+ * deletion. The direction is safe -- an older backup is kept rather than
+ * collected -- but "ten backups per client" counts LIVE rows, not operations.
  */
 export function pruneSnapshots(
   clientId: IntegrationClientId,

package/src/integrations/store.ts

@@ -12,6 +12,7 @@
  */
 import {
   appendOperation,
+  appendTombstone,
   captureSnapshot,
   clearPruneFailure,
   countSnapshots,
@@ -22,6 +23,7 @@ import {
   readMaintenance,
   readSnapshot,
   type JournalEntry,
+  type JournalTombstone,
   type MaintenanceState,
   type SnapshotRef,
 } from "./journal";
@@ -42,6 +44,8 @@ export interface IntegrationStateStore {
   putRecord(record: OwnershipRecord): void;
   dropRecord(clientId: IntegrationClientId): void;
   appendJournal(entry: JournalEntry): void;
+  /** Retire one operation. Append-only; see journal.ts `appendTombstone`. */
+  retireOperation(record: JournalTombstone): void;
   listOperations(clientId?: IntegrationClientId, limit?: number): JournalEntry[];
   findOperation(opId: string): JournalEntry | null;
   captureSnapshot(clientId: IntegrationClientId, opId: string, text: string | null): SnapshotRef;
@@ -78,6 +82,7 @@ export function createIntegrationStateStore(root: string = integrationsDir()): I
     putRecord: record => writeRecord(record, dir),
     dropRecord: clientId => deleteRecord(clientId, dir),
     appendJournal: entry => appendOperation(entry, dir),
+    retireOperation: record => appendTombstone(record, dir),
     listOperations: (clientId, limit) => listOperations(clientId, limit, dir),
     findOperation: opId => findOperation(opId, dir),
     captureSnapshot: (clientId, opId, text) => captureSnapshot(clientId, opId, text, dir),

package/src/lab/events/limits.ts

@@ -33,6 +33,8 @@ const FORBIDDEN_EXACT_KEYS = new Set([
 
 const RAW_POSIX_PATH_RE =
   /(?:^|[^A-Za-z0-9._~/])\/(?:(?=$|[^A-Za-z0-9._~/])|(?!\/)(?![ \t\r\n])(?:\/|[^/\0\r\n]+)+\/?(?=$|[^A-Za-z0-9._~/]))/u;
+const ASCII_URL_WHITESPACE_RE = /[\t\r\n]/g;
+const FILE_URI_RE = /(?:^|[^A-Za-z0-9+.-])file:/i;
 
 function fieldPath(base: string, key: string | number): string {
   return base ? `${base}.${String(key)}` : String(key);
@@ -80,6 +82,8 @@ export function enforceEventStructureLimits(
     }
     if (
       /^[A-Za-z]:\\/.test(value) ||
+      FILE_URI_RE.test(value) ||
+      FILE_URI_RE.test(value.replace(ASCII_URL_WHITESPACE_RE, "")) ||
       RAW_POSIX_PATH_RE.test(value) ||
       value.includes("\\Users\\")
     ) {

package/src/lib/destination-policy.ts

@@ -145,6 +145,25 @@ function isBenchmarkDnsAnswer(address: string, assessment: DestinationAssessment
   return embedded.kind === "private" && embedded.detail === "benchmark address";
 }
 
+/**
+ * Mihomo (Clash.Meta) fake-IP DNS answers IPv6 queries from `fdfe:dcba:9876::/48` — its
+ * documented default `fake-ip-range6` (#3462). That prefix sits inside ULA `fc00::/7`, so
+ * `classifyIpv6` reports it as a private-network address and, unlike the IPv4 benchmark
+ * range, nothing about the address itself marks it synthetic. The exception is therefore
+ * narrower than the benchmark one: exact /48 match, DNS answers only (a literal URL still
+ * rejects), and only behind the `allowMihomoIpv6FakeIp` opt-in that the outbound caller
+ * derives from a scheme-matched proxy it then binds the request to.
+ */
+const MIHOMO_IPV6_FAKE_IP_PREFIX = [0xfdfe, 0xdcba, 0x9876] as const;
+
+function isMihomoIpv6FakeIpAnswer(address: string, assessment: DestinationAssessment | null): boolean {
+  if (assessment?.kind !== "private" || assessment.detail !== "private-network address") return false;
+  if (isIP(address) !== 6) return false;
+  const hextets = ipv6Hextets(normalizeHostname(address));
+  if (!hextets) return false;
+  return MIHOMO_IPV6_FAKE_IP_PREFIX.every((group, index) => hextets[index] === group);
+}
+
 function firstIpv6Hextet(hostname: string): number | null {
   const head = hostname.split(":")[0];
   if (!head) return 0;
@@ -385,7 +404,13 @@ export function assessUrlDestination(url: string): UrlDestinationAssessment | nu
  */
 export async function resolvePublicAddresses(
   url: string,
-  options?: string | { context?: string; allowPrivateNetwork?: boolean; allowBenchmarkAddresses?: boolean },
+  options?: string | {
+    context?: string;
+    allowPrivateNetwork?: boolean;
+    allowBenchmarkAddresses?: boolean;
+    /** Mihomo IPv6 fake-IP (`fdfe:dcba:9876::/48`) DNS answers; see `isMihomoIpv6FakeIpAnswer`. */
+    allowMihomoIpv6FakeIp?: boolean;
+  },
 ): Promise<{
   hostname: string;
   addresses: { address: string; family: number }[];
@@ -396,6 +421,7 @@ export async function resolvePublicAddresses(
     : options?.context?.trim() || "image URL";
   const privateNetworkAllowed = typeof options === "object" && options?.allowPrivateNetwork === true;
   const benchmarkAllowed = typeof options === "object" && options?.allowBenchmarkAddresses === true;
+  const mihomoIpv6Allowed = typeof options === "object" && options?.allowMihomoIpv6FakeIp === true;
   let hostname: string;
   try {
     hostname = normalizeHostname(new URL(url.trim()).hostname);
@@ -440,7 +466,10 @@ export async function resolvePublicAddresses(
       // fake-IP DNS, not a LAN provider. Accept it without allowPrivateNetwork and
       // do not mark the destination private, so the caller's HTTP(S)_PROXY path
       // still applies (credit #1748).
-      if (benchmarkAllowed && isBenchmarkDnsAnswer(address, assessment)) {
+      if (
+        (benchmarkAllowed && isBenchmarkDnsAnswer(address, assessment))
+        || (mihomoIpv6Allowed && isMihomoIpv6FakeIpAnswer(address, assessment))
+      ) {
         validatedAddresses.push({ address, family: ipKind === 4 || ipKind === 6 ? ipKind : (family || 4) });
         continue;
       }

package/src/lib/errors.ts

@@ -127,6 +127,28 @@ function isPermissionMessage(text: string): boolean {
   );
 }
 
+/**
+ * Geographic / network-location denials. Google's Cloud Code Assist API returns these as
+ * HTTP 400 `FAILED_PRECONDITION: User location is not supported for the API use.` — the
+ * request is well-formed, the caller's location is refused. Treated as a permission-class
+ * rejection, never as an invalid request (#3467).
+ */
+const LOCATION_UNSUPPORTED_PATTERNS = [
+  "location is not supported",
+  "location not supported",
+  "unsupported location",
+  "region is not supported",
+  "unsupported region",
+  "country is not supported",
+  "not supported in your country",
+  "not supported in your region",
+] as const;
+
+export function isLocationUnsupportedMessage(text: string): boolean {
+  const lower = text.toLowerCase();
+  return LOCATION_UNSUPPORTED_PATTERNS.some(needle => lower.includes(needle));
+}
+
 /**
  * Client cancelled / closed the turn. Matches ONLY abort phrases this codebase
  * produces — "client closed request during web-search" (src/web-search/loop.ts),
@@ -244,6 +266,15 @@ export function classifyError(status: number, type: string, message: string): Oc
   ) {
     return { message, type: "authentication_error", code: "invalid_api_key" };
   }
+  // An explicit permission enum must not acquire a more specific inferred reason.
+  if (type === "PERMISSION_DENIED" || text.includes("permission_denied")) {
+    return { message, type: "permission_error", code: "permission_denied" };
+  }
+  // Location denials outrank generic permission / subscription wording, but never an
+  // authoritative 5xx. Message-only adapter terminals arrive here with inferred 403.
+  if (status < 500 && (type === "location_not_supported" || isLocationUnsupportedMessage(text))) {
+    return { message, type: "permission_error", code: "location_not_supported" };
+  }
   // Subscription labels are valid only in a known permission context.
   if (
     (status === 403 || type === "permission_error") &&
@@ -352,6 +383,9 @@ export function inferHttpStatusFromAdapterMessage(message: string): number {
   // Strong authentication signals win when a message contains mixed auth and
   // subscription/permission wording.
   if (isAuthenticationMessage(lower)) return 401;
+  // A location denial is a permission-class rejection; keep it aligned with the
+  // `permission_error` envelope status so message-only and classified paths agree.
+  if (isLocationUnsupportedMessage(lower)) return 403;
   if (isSubscriptionGateMessage(lower) || isPermissionMessage(lower)) return 403;
   // Same precedence rule as classifyCursorError: an explicit gRPC FAILED_PRECONDITION is a
   // structured, deterministic rejection, so it outranks the overload keywords that routinely
@@ -359,6 +393,11 @@ export function inferHttpStatusFromAdapterMessage(message: string): number {
   // the message matched "unavailable" and returned a retryable 503, so clients kept retrying
   // a rejection that can never succeed.
   if (lower.includes("failed_precondition") || lower.includes("failed precondition")) return 400;
+  // Bytes the upstream itself produced and then mangled are a provider protocol failure, not a
+  // malformed client request. This must sit ahead of the generic "malformed" -> 400 branch so a
+  // combo can fail over instead of returning a terminal 4xx the caller cannot act on. Scoped to
+  // the "malformed upstream" phrase our adapters emit; plain "malformed" keeps its 400 verdict.
+  if (lower.includes("malformed upstream")) return 502;
   if (
     lower.includes("unavailable") ||
     lower.includes("overloaded") ||

package/src/lib/provider-outbound.ts

@@ -7,7 +7,7 @@ import {
   resolvePublicAddresses,
 } from "./destination-policy";
 import { pinnedHttpGet, pinnedHttpPost } from "./pinned-http";
-import { outboundProxyConfigured } from "./proxy-env";
+import { effectiveProxyFor, outboundProxyConfigured } from "./proxy-env";
 import { publicProviderBaseUrl } from "./provider-url";
 
 type ProviderGetInit = Omit<RequestInit, "body" | "method" | "redirect">;
@@ -19,6 +19,14 @@ export interface ProviderOutboundDependencies {
   resolveAddresses?: typeof resolvePublicAddresses;
   pinnedGet?: typeof pinnedHttpGet;
   pinnedPost?: typeof pinnedHttpPost;
+  /**
+   * Canonical-URL proof for the transparent fake-IP exception (Clash TUN mode
+   * without proxy env). Injected so this transport core stays decoupled from
+   * the registry module; production compares the final request URL against the
+   * registry's own fixed discovery URL. Defaults to "not canonical" so a caller
+   * that forgets the seam fails closed, never open.
+   */
+  isCanonicalUrl?: (name: string, url: string) => boolean;
 }
 
 export class ProviderOutboundPolicyError extends Error {
@@ -33,6 +41,41 @@ function configuredProxyFor(): boolean {
   return outboundProxyConfigured();
 }
 
+/**
+ * Registry-owned fake-IP transparency exception (Clash/Surge/Mihomo TUN mode).
+ *
+ * Under TUN mode the packet path intercepts the fake-IP destination itself, so a
+ * canonical registry destination whose local DNS answers include Clash fake-IP
+ * space (198.18.0.0/15) is reachable by pin-connecting through the TUN — no
+ * outbound HTTP(S) proxy env is required. The exception is deliberately narrow:
+ *
+ * - hostname-only: a literal 198.18.x.x URL never reaches it (the literal gate
+ *   in `resolvePublicAddresses` rejects before DNS answers are examined);
+ * - canonical-URL-only: `isCanonicalUrl` must prove the FINAL request URL is
+ *   the registry's own fixed discovery URL for this provider (not merely that
+ *   the provider NAME matches — OAuth/forward names match any baseUrl by
+ *   design, and the bearer is pinned to the registry destination independently
+ *   in `buildModelsRequest`). A retargeted row or a renamed custom row sends
+ *   its credential to the registry URL anyway, so the proof must be on the URL
+ *   actually fetched. The check is injected so the transport core stays
+ *   decoupled from the registry module;
+ * - per-answer validation: benchmark and public answers may coexist. The exception
+ *   does not admit loopback/RFC1918/link-local/metadata companions; those still
+ *   follow the resolver's private-network policy. Benchmark admission leaves
+ *   `privateNetwork` false; proxy/NO_PROXY semantics are unchanged.
+ *
+ * Image/Lab fetch never passes the underlying flag and is unaffected.
+ */
+function transparentFakeIpException(
+  url: string,
+  parsed: URL,
+  isCanonicalUrl: (name: string, url: string) => boolean,
+  name: string,
+): boolean {
+  if (noProxyMatches(parsed)) return false;
+  return isCanonicalUrl(name, url);
+}
+
 function normalizeProxyHostname(hostname: string): string {
   const normalized = hostname.trim().toLowerCase().replace(/\.+$/, "");
   return normalized.startsWith("[") && normalized.endsWith("]")
@@ -139,9 +182,15 @@ async function providerOutboundRequest(
   }
   const parsed = postUrl ?? new URL(url);
   const proxyConfigured = configuredProxyFor();
+  // Snapshot the scheme-matched proxy once, before the DNS await, so admission and transport
+  // below reason about the same value. `null` here means "no proxy fetch would actually use",
+  // even if some other proxy variable is set.
+  const effectiveProxy = effectiveProxyFor(parsed);
+  const allowMihomoIpv6FakeIp = effectiveProxy !== null && !noProxyMatches(parsed);
   const resolveAddresses = dependencies.resolveAddresses ?? resolvePublicAddresses;
   const pinnedGet = dependencies.pinnedGet ?? pinnedHttpGet;
   const pinnedPost = dependencies.pinnedPost ?? pinnedHttpPost;
+  const isCanonicalUrl = dependencies.isCanonicalUrl ?? (() => false);
   const allowPrivate = providerAllowsPrivateNetwork(name, provider);
   let resolved: Awaited<ReturnType<typeof resolvePublicAddresses>>;
   try {
@@ -154,7 +203,21 @@ async function providerOutboundRequest(
       // destination or being pin-connected to the fake-IP (credit #1748). A NO_PROXY
       // match is a direct route, so it keeps the benchmark answer rejected. Image/Lab
       // fetch never passes this flag.
-      allowBenchmarkAddresses: proxyConfigured && !noProxyMatches(parsed),
+      //
+      // TUN-mode transparency: with no proxy env, Clash/Surge/Mihomo TUN still
+      // intercepts the fake-IP destination itself, so the REGISTRY's own fixed
+      // discovery URL stays reachable by pin-connecting through the TUN. The
+      // proof is on the final request URL — not the provider name — because an
+      // OAuth/forward name matches any baseUrl by design while the bearer is
+      // pinned to the registry destination independently.
+      allowBenchmarkAddresses: (proxyConfigured && !noProxyMatches(parsed))
+        || transparentFakeIpException(url, parsed, isCanonicalUrl, name),
+      // Mihomo IPv6 fake-IP (fdfe:dcba:9876::/48) answers are admitted on a stricter gate
+      // than the benchmark range: the proxy must be the one fetch will use for this URL's
+      // scheme, and the request below is then bound to it explicitly (#3462). A ULA answer
+      // is otherwise indistinguishable from a real private host, so proxy presence alone
+      // is not enough.
+      allowMihomoIpv6FakeIp,
     });
   } catch (error) {
     const dnsResolutionFailed = error instanceof DestinationDnsResolutionError
@@ -169,7 +232,10 @@ async function providerOutboundRequest(
   }
   if (proxyConfigured && !resolved.privateNetwork) {
     warnProxyBoundaryOnce();
-    return globalThis.fetch(url, { ...init, method, redirect: "manual" });
+    // When the Mihomo exception could have admitted an answer, pin the transport to the
+    // proxy the admission assumed instead of letting fetch re-infer it from the environment.
+    const proxy = allowMihomoIpv6FakeIp ? effectiveProxy : undefined;
+    return globalThis.fetch(url, { ...init, method, redirect: "manual", ...(proxy ? { proxy } : {}) });
   }
   if (proxyConfigured && resolved.privateNetwork && !noProxyMatches(parsed)) {
     const hostname = normalizeProxyHostname(parsed.hostname);

package/src/lib/proxy-env.ts

@@ -16,3 +16,25 @@ export function outboundProxyConfigured(
 ): boolean {
   return OUTBOUND_PROXY_ENV_KEYS.some(key => proxyEnvPresent(key, env));
 }
+
+/**
+ * The proxy URL that Bun's fetch will actually use for `url`, or null when none applies.
+ *
+ * Bun selects by scheme: `HTTPS_PROXY` for `https:` targets, `HTTP_PROXY` for `http:`.
+ * `ALL_PROXY` is deliberately not consulted here — fetch does not honour it, so a caller
+ * that needs "this request will ride the proxy" as a precondition must not count it.
+ * Presence of *some* proxy variable (`outboundProxyConfigured`) is not that guarantee.
+ */
+export function effectiveProxyFor(
+  url: URL,
+  env: ProxyEnvMap = process.env,
+): string | null {
+  const key: ProxyEnvKey | null = url.protocol === "https:"
+    ? "HTTPS_PROXY"
+    : url.protocol === "http:"
+      ? "HTTP_PROXY"
+      : null;
+  if (!key) return null;
+  const value = env[key]?.trim() || env[key.toLowerCase()]?.trim();
+  return value ? value : null;
+}

package/src/lib/redact-folding.ts

@@ -0,0 +1,176 @@
+/**
+ * Characters that render as a colon separator. Folded to `:` in the matching
+ * view so a look-alike cannot hide a header from the label pattern.
+ */
+const COLON_CONFUSABLES = new Set([
+  "\uFF1A", "\uFE55", "\uFE13", "\uA789", "\u02D0", "\u2236",
+  "\u205A", "\u0589", "\u1361", "\u16EC", "\u1803", "\u2982", "\u2AF6", "\uFE30",
+]);
+
+/**
+ * Characters dropped from the matching view: anything with no visible width
+ * that could split a label into pieces the pattern no longer recognizes.
+ * `\p{Default_Ignorable_Code_Point}` is the systematic answer — it covers the
+ * zero-width set, the bidi isolates and marks, the Mongolian vowel separator,
+ * and the variation selectors in one property instead of a list that review
+ * keeps finding another member of. `\p{Cf}` and combining marks are folded too.
+ */
+const INVISIBLE_FORMAT = /[\p{Default_Ignorable_Code_Point}\p{Cf}\p{Mn}\p{Me}]/u;
+
+/**
+ * HTML named character references.
+ *
+ * A hand-picked list is a coverage promise nobody can keep — review found
+ * `ⅈ`, `ⅇ`, and `ⅆ` decoding to compatibility letters that
+ * NFKD already maps onto `i`, `e`, and `d`, and the WHATWG table holds roughly
+ * 2200 entries. Neither Bun nor Node exposes that table, and pulling in a
+ * dependency to spell a header name is the wrong trade for this path.
+ *
+ * So names are not resolved at all. A named reference sitting inside a
+ * credential label is folded to a single placeholder character of unknown
+ * identity, and the label alternation accepts that placeholder wherever a
+ * letter may appear. Every named entity is covered, present and future,
+ * without claiming to know what any of them mean.
+ */
+const NAMED_ENTITY_PLACEHOLDER = "\u0001";
+
+/**
+ * The handful of named references that spell a SEPARATOR rather than a letter.
+ * These have to resolve exactly, because the placeholder stands in for a letter
+ * position and a separator is structure, not a character of the name.
+ */
+const SEPARATOR_ENTITIES = new Map<string, string>([
+  ["colon", ":"], ["semi", ";"], ["equals", "="], ["quot", '"'], ["apos", "'"],
+  ["lt", "<"], ["gt", ">"], ["amp", "&"], ["sol", "/"], ["lowbar", "_"],
+  ["hyphen", "-"], ["dash", "-"], ["ndash", "-"], ["mdash", "-"], ["minus", "-"],
+  ["period", "."], ["comma", ","], ["num", "#"], ["nbsp", " "],
+]);
+
+/**
+ * Latin look-alikes for the ASCII letters that appear in credential labels.
+ * Cyrillic `а`/`е`, Greek `ο`, fullwidth forms and the mathematical alphabets
+ * all render as the label to a human, so the matching view folds them back.
+ * NFKD handles the width/font variants; this table covers the cross-script
+ * homoglyphs NFKD deliberately leaves alone.
+ */
+const LETTER_CONFUSABLES = new Map<string, string>([
+  // Cyrillic
+  ["\u0430", "a"], ["\u0435", "e"], ["\u043E", "o"], ["\u0440", "p"], ["\u0441", "c"],
+  ["\u0445", "x"], ["\u0443", "y"], ["\u04BB", "h"], ["\u0455", "s"], ["\u0456", "i"],
+  ["\u0458", "j"], ["\u043A", "k"], ["\u0442", "t"], ["\u0432", "b"], ["\u043C", "m"],
+  ["\u043D", "h"], ["\u0501", "d"], ["\u0503", "g"], ["\u051B", "q"], ["\u051D", "w"],
+  ["\u04CF", "l"], ["\u0261", "g"], ["\u04AB", "c"], ["\u04BD", "e"], ["\u0459", "k"],
+  // Greek
+  ["\u03B1", "a"], ["\u03BF", "o"], ["\u03C1", "p"], ["\u03BD", "v"], ["\u03BA", "k"],
+  ["\u03B5", "e"], ["\u03C4", "t"], ["\u03B9", "i"], ["\u03C5", "u"], ["\u03C7", "x"],
+  ["\u03B7", "n"], ["\u03BC", "u"], ["\u03C3", "o"], ["\u03B2", "b"], ["\u03B3", "y"],
+  // Latin extended / other
+  ["\u0131", "i"], ["\u0269", "i"], ["\u1D0F", "o"], ["\u0280", "r"], ["\u01BF", "p"],
+  ["\u0578", "n"], ["\u057D", "u"], ["\u0585", "o"], ["\u0581", "g"], ["\u2044", "/"],
+]);
+
+/**
+ * Build a folded copy plus an index map back to the original string, so the
+ * match runs on normalized text while the output keeps every byte the match did
+ * not cover.
+ */
+export function foldForMatching(value: string, decodeEscapes = true): { folded: string; map: number[] } {
+  let folded = "";
+  const map: number[] = [];
+  // Serialization escapes are ALIASES for the label, not decoration: a JSON
+  // `\u0069`, a percent-encoded `%69`, and an XML `&#105;` all spell the same
+  // field name to whatever parses the body, while spelling something else to a
+  // literal matcher. Decode them into the matching view (one folded character
+  // per escape, with the whole escape mapped back to its start) so
+  // `author\u0069zation`, `author%69zation`, and `author&#105;zation` are the
+  // label they claim to be.
+  const decodeEscape = (at: number): { ch: string; width: number } | null => {
+    // JSON `\uXXXX`, INCLUDING a surrogate pair. Decoding the halves
+    // independently left `\uD835\uDD69` as two lone surrogates, so the
+    // mathematical letter they spell was never normalized as one code point.
+    const json = /^\\u([0-9a-fA-F]{4})/.exec(value.slice(at, at + 6));
+    if (json) {
+      const high = parseInt(json[1]!, 16);
+      if (high >= 0xd800 && high <= 0xdbff) {
+        const low = /^\\u([0-9a-fA-F]{4})/.exec(value.slice(at + 6, at + 12));
+        const lowCode = low ? parseInt(low[1]!, 16) : NaN;
+        if (lowCode >= 0xdc00 && lowCode <= 0xdfff) {
+          return { ch: String.fromCharCode(high, lowCode), width: 12 };
+        }
+      }
+      return { ch: String.fromCharCode(high), width: 6 };
+    }
+    // Percent encoding is UTF-8: consecutive `%XX` bytes form ONE character.
+    // Decoding each byte on its own turned `%D0%B5` into two unrelated
+    // Latin-1 characters instead of the Cyrillic `е` the fold would have
+    // recognized.
+    const pct = /^(?:%[0-9a-fA-F]{2})+/.exec(value.slice(at, at + 24));
+    if (pct) {
+      try {
+        const decoded = decodeURIComponent(pct[0]);
+        if (decoded.length >= 1) {
+          // Consume only the bytes that produced the FIRST character, so the
+          // rest of the sequence is decoded on the next iteration.
+          const first = String.fromCodePoint(decoded.codePointAt(0)!);
+          const bytes = new TextEncoder().encode(first).length;
+          return { ch: first, width: bytes * 3 };
+        }
+      } catch {
+        const single = parseInt(pct[0].slice(1, 3), 16);
+        return { ch: String.fromCharCode(single), width: 3 };
+      }
+    }
+    const xml = /^&#(x[0-9a-fA-F]{1,6}|[0-9]{1,7});/.exec(value.slice(at, at + 11));
+    if (xml) {
+      const raw = xml[1]!;
+      const code = raw[0] === "x" || raw[0] === "X"
+        ? parseInt(raw.slice(1), 16)
+        : parseInt(raw, 10);
+      if (Number.isFinite(code) && code > 0 && code <= 0x10ffff) {
+        return { ch: String.fromCodePoint(code), width: xml[0].length };
+      }
+    }
+    // HTML named references. `&colon;` and the other separator names are
+    // resolved exactly; anything else folds to the opaque placeholder so the
+    // label still matches without pretending to know the character.
+    const named = /^&([A-Za-z][A-Za-z0-9]{1,31});/.exec(value.slice(at, at + 34));
+    if (named) {
+      const separator = SEPARATOR_ENTITIES.get(named[1]!.toLowerCase());
+      return { ch: separator ?? NAMED_ENTITY_PLACEHOLDER, width: named[0].length };
+    }
+    return null;
+  };
+  // Iterate by CODE POINT, not UTF-16 code unit: a supplementary character
+  // (mathematical letters, variation selectors above the BMP) is two units, so
+  // a per-unit loop hands each half to the property tests separately and
+  // neither half matches anything. `𝕩-api-key` and a U+E0100 inside a label
+  // both walked straight past the fold that way.
+  let i = 0;
+  while (i < value.length) {
+    const escaped = decodeEscapes ? decodeEscape(i) : null;
+    const ch = escaped ? escaped.ch : String.fromCodePoint(value.codePointAt(i)!);
+    const width = escaped ? escaped.width : ch.length;
+    if (INVISIBLE_FORMAT.test(ch)) {
+      i += width;
+      continue;
+    }
+    const mapped = COLON_CONFUSABLES.has(ch)
+      ? ":"
+      : LETTER_CONFUSABLES.get(ch.toLowerCase())
+        // NFKD collapses fullwidth, circled, and mathematical letter variants
+        // onto their ASCII base.
+        ?? (ch.normalize("NFKD").length === 1 ? ch.normalize("NFKD") : ch);
+    // One folded unit per source code point keeps the offset map aligned; a
+    // multi-unit fold would desynchronize it, so those keep the original.
+    folded += mapped.length === 1 ? mapped : ch;
+    // One map entry per EMITTED UTF-16 unit. An escaped supplementary
+    // character emits two units, and giving it one entry desynchronized every
+    // later offset — the mask then landed mid-token and left part of the
+    // credential behind.
+    const emittedText = mapped.length === 1 ? mapped : ch;
+    for (let k = 0; k < emittedText.length; k += 1) map.push(i);
+    i += width;
+  }
+  map.push(value.length);
+  return { folded, map };
+}