@zackbart/connecta 0.29.0 → 0.31.0

package/dist/sent-secrets.js

@@ -1,8 +1,9 @@
-// Credentials used by one upstream request. Memory only; never part of a context's public
-// shape, a failure record, storage, or a log. Web APIs only.
+// Credentials and submitted private argument values used by one upstream request. Memory
+// only; never part of a context's public shape, a failure record, storage, or a log. Web APIs only.
 import { carryFailureFacts } from "./operator-record.js";
 import { ConnectorCallError } from "./errors.js";
 import { credentialUrlViews } from "./credential-url.js";
+import { visitPrivateCallArguments } from "./argument-redaction.js";
 const REDACTED = "[redacted]";
 const encoder = new TextEncoder();
 const contexts = new WeakMap();
@@ -10,8 +11,73 @@ const requests = new WeakMap();
 const wrappedCredentials = new WeakSet();
 const sensitiveName = /key|token|secret|password|auth|signature|session/i;
 const explicitSecretName = /secret|password/i;
+const headerLine = /(^|[\r\n])([\t ]*(?:cookie|set-cookie|[a-z0-9-]*(?:key|token|secret|auth|signature|session)[a-z0-9-]*)\s*:\s*)[^\r\n]*/gi;
 // Short credentials can match protocol fields or legitimate configuration.
 const MIN_SECRET_LENGTH = 8;
+// Form kinds, weakest first. A short private value redacts exact structured leaves and
+// withholds prose; longer private values and credentials are replaced wherever they occur.
+const SHORT = 1;
+const PRIVATE = 2;
+const CREDENTIAL = 3;
+// Submitted values register at most this many form code units and argument nodes. A form
+// that does not fit withholds every string long enough to contain it.
+const MAX_PRIVATE_FORM_CHARS = 524_288;
+const MAX_ARGUMENT_NODES = 4_096;
+const MAX_ARGUMENT_DEPTH = 32;
+// The matcher indexes each form's first FORM_PREFIX units, credentials first, up to
+// MAX_MATCHER_UNITS for every registration together. A longer form is confirmed by a rolling
+// hash once its prefix matches. A form left out withholds every string long enough to contain it.
+// Forms sharing a prefix and a length share each check, and overlapping prefix occurrences in
+// self-similar text share one run of checks. A scanned view holds at most MAX_PENDING_RUNS, and
+// each check, which costs about as much as scanning two code units, is paid for from the call's
+// work budget before it is queued; a view that needs more is withheld.
+const FORM_PREFIX = 256;
+const MAX_MATCHER_UNITS = 524_288;
+const MAX_PENDING_RUNS = 16_384;
+const CHECK_WORK = 4;
+const HASH_BASE = 0x01_00_01_93;
+const POWERS = new Int32Array(FORM_PREFIX + 1);
+POWERS[0] = 1;
+for (let length = 1; length <= FORM_PREFIX; length++)
+    POWERS[length] = Math.imul(POWERS[length - 1], HASH_BASE);
+// One redaction call visits at most this many structured entries, this deep. A string is
+// decoded at most MAX_DECODE_LEVELS JSON layers, counting nested JSON strings it was parsed from.
+const MAX_WALK_NODES = 1_048_576;
+const MAX_WALK_DEPTH = 512;
+const MAX_DECODE_LEVELS = 8;
+// Work for one redaction call, across parsing and every scanned view. Credential-only sets
+// keep the multi-MiB document and skill-file reads they always allowed.
+const PRIVATE_SCAN_WORK = 64 * 1_048_576;
+const CREDENTIAL_SCAN_WORK = 1_024 * 1_048_576;
+// Connecta and MCP framing: these names, tag values, and typed facts are copied unchanged,
+// so a submitted value such as "text" or "true" cannot rewrite an envelope or its outcome.
+const FRAMING_KEYS = new Set(("content structuredContent isError _meta resultType dev.connecta/format type text data mimeType resource uri " +
+    "blob annotations ok format valueFormat error code message stack name cause details retryable retryAfterMs " +
+    "nextAction uncertainCall result logs failure inputRequests requestState method params mode requestedSchema url").split(" "));
+const TAGS = new Set(("type:text type:image type:audio type:resource type:resource_link format:json format:text format:paged " +
+    "valueFormat:json valueFormat:text dev.connecta/format:json dev.connecta/format:text resultType:complete " +
+    "resultType:input_required mode:form mode:url method:elicitation/create jsonrpc:2.0").split(" "));
+const FACTS = new Set(["isError", "ok", "retryable", "retryAfterMs", "truncated", "hasMore"]);
+// Downstream and guest prose: a short private value anywhere in it withholds the whole string.
+const PROSE_KEYS = new Set(["message", "stack", "error", "logs", "text", "result"]);
+/** Spend work that fits the call's remaining budget. Work that does not fit is refused
+ * without spending, so its field is withheld while smaller fields can still be checked. */
+function spend(scan, work) {
+    if (work > scan.budget.work)
+        return false;
+    scan.budget.work -= work;
+    return true;
+}
+// Walk markers: a container was opened, or an entry is dropped from the copy.
+const OPEN = Symbol("open");
+const DROP = Symbol("drop");
+/** Define one entry on a copy. An own accessor here is Error.stack, already snapshotted. */
+function define(copy, item, key, name, value) {
+    const descriptor = Object.getOwnPropertyDescriptor(item, key);
+    Object.defineProperty(copy, name, "value" in descriptor
+        ? { ...descriptor, value, ...(name !== key ? { configurable: true } : {}) }
+        : { value, configurable: true, writable: true });
+}
 /** One payload-free warning per configured connector, regardless of requests. */
 export function shortSecretWarning() {
     let warned = false;
@@ -23,81 +89,500 @@ export function shortSecretWarning() {
         logger.warn("[connecta] Credentials shorter than 8 characters are not redacted from echoes; use longer secrets.", fact);
     };
 }
-function literal(value) {
-    return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+/** Percent escapes compare case-insensitively: hex letters within two units after `%` fold
+ * to uppercase in forms and scanned text alike. A match can begin inside that pair, so a
+ * form's first one or two letters may arrive folded as well. */
+function wireForms(value) {
+    const fold = (text) => text.replace(/[a-f]/g, (letter) => letter.toUpperCase());
+    const form = value.replace(/%[^%]?[^%]?/g, fold);
+    return [...new Set([form, fold(form.slice(0, 1)) + form.slice(1), fold(form.slice(0, 2)) + form.slice(2)])];
 }
-/** Percent escapes are case insensitive; the credential's other bytes are not. */
-function wirePattern(value) {
-    return value
-        .split(/(%[0-9a-f]{2})/i)
-        .map((part) => /^%[0-9a-f]{2}$/i.test(part)
-        ? `%${part
-            .slice(1)
-            .split("")
-            .map((char) => (/[a-f]/i.test(char) ? `[${char.toUpperCase()}${char.toLowerCase()}]` : char))
-            .join("")}`
-        : literal(part))
-        .join("");
-}
-const jsonEscape = /\\(?:u[0-9a-fA-F]{4}|["\\/bfnrt])/g;
-const shortEscape = {
-    '"': '"',
-    "\\": "\\",
-    "/": "/",
-    b: "\b",
-    f: "\f",
-    n: "\n",
-    r: "\r",
-    t: "\t",
-};
 function base64(value) {
     let binary = "";
     for (const byte of encoder.encode(value))
         binary += String.fromCharCode(byte);
     return btoa(binary);
 }
+class Source {
+    text;
+    start = 0;
+    end = 0;
+    constructor(text) {
+        this.text = text;
+    }
+    next() {
+        if (this.end >= this.text.length)
+            return -1;
+        this.start = this.end++;
+        return this.text.charCodeAt(this.start);
+    }
+}
+const shortEscape = { 34: 34, 47: 47, 92: 92, 98: 8, 102: 12, 110: 10, 114: 13, 116: 9 };
+/** A hex digit's value, or -1. */
+function hex(code) {
+    const lower = code | 0x20;
+    return code >= 0x30 && code <= 0x39 ? code - 0x30 : lower >= 0x61 && lower <= 0x66 ? lower - 0x57 : -1;
+}
+/** One layer of JSON string escapes decoded. It counts the escapes it decoded and the
+ * backslashes it produced, which tell whether another layer could decode more. */
+class Unescaped {
+    from;
+    start = 0;
+    end = 0;
+    decoded = 0;
+    slashes = 0;
+    codes = new Int32Array(8);
+    starts = new Int32Array(8);
+    ends = new Int32Array(8);
+    head = 0;
+    size = 0;
+    constructor(from) {
+        this.from = from;
+    }
+    fill(count) {
+        for (; this.size < count; this.size++) {
+            const code = this.from.next();
+            if (code < 0)
+                return false;
+            const at = (this.head + this.size) & 7;
+            this.codes[at] = code;
+            this.starts[at] = this.from.start;
+            this.ends[at] = this.from.end;
+        }
+        return true;
+    }
+    at(offset) {
+        return this.codes[(this.head + offset) & 7];
+    }
+    take(count, code) {
+        this.start = this.starts[this.head];
+        this.end = this.ends[(this.head + count - 1) & 7];
+        this.head = (this.head + count) & 7;
+        this.size -= count;
+        if (count > 1)
+            this.decoded++;
+        if (code === 0x5c)
+            this.slashes++;
+        return code;
+    }
+    next() {
+        if (!this.fill(1))
+            return -1;
+        const code = this.at(0);
+        if (code === 0x5c && this.fill(2)) {
+            const escaped = shortEscape[this.at(1)];
+            if (escaped !== undefined)
+                return this.take(2, escaped);
+            if (this.at(1) === 0x75 && this.fill(6)) {
+                let unit = 0;
+                for (let offset = 2; offset < 6 && unit >= 0; offset++) {
+                    const digit = hex(this.at(offset));
+                    unit = digit < 0 ? -1 : unit * 16 + digit;
+                }
+                if (unit >= 0)
+                    return this.take(6, unit);
+            }
+        }
+        return this.take(1, code);
+    }
+}
+/** Merge one view's spans as they arrive, ends ascending. A span wholly inside an emitted
+ * placeholder is that placeholder; a private value containing its text spans more. */
+function push(spans, base, start, end, marks) {
+    if (marks) {
+        let low = 0;
+        let high = marks.length;
+        while (low < high) {
+            const middle = (low + high) >>> 1;
+            if (marks[middle] <= start)
+                low = middle + 1;
+            else
+                high = middle;
+        }
+        if (low && end <= marks[low - 1] + REDACTED.length)
+            return;
+    }
+    while (spans.length > base && spans[spans.length - 1] >= start) {
+        start = Math.min(start, spans[spans.length - 2]);
+        spans.length -= 2;
+    }
+    spans.push(start, end);
+}
+function markers(text) {
+    let at = text.indexOf(REDACTED);
+    if (at < 0)
+        return undefined;
+    const marks = [];
+    for (; at >= 0; at = text.indexOf(REDACTED, at + REDACTED.length))
+        marks.push(at);
+    return marks;
+}
+/** Replace each merged span once, from the original text: no replacement can split another
+ * view's match. Header-line scrubbing belongs to an actual echo. */
+function replace(text, spans) {
+    const order = Array.from({ length: spans.length / 2 }, (_, index) => index * 2).sort((a, b) => spans[a] - spans[b]);
+    const parts = [];
+    let cursor = 0;
+    for (let index = 0; index < order.length;) {
+        const start = spans[order[index]];
+        let end = spans[order[index] + 1];
+        while (++index < order.length && spans[order[index]] <= end)
+            end = Math.max(end, spans[order[index] + 1]);
+        parts.push(text.slice(cursor, start), REDACTED);
+        cursor = end;
+    }
+    parts.push(text.slice(cursor));
+    return parts.join("").replace(headerLine, `$1$2${REDACTED}`);
+}
+/** A run of one occurrence, whose step is set by the next occurrence that extends it. */
+const UNEXTENDED = { step: 0, stride: 0, stepHash: 0, stepPower: 0 };
+/** Runs ordered by their head check's due count: a binary min-heap. */
+class Runs {
+    items = [];
+    add(run) {
+        let at = this.items.length;
+        for (let parent = (at - 1) >> 1; at && this.items[parent].due > run.due; parent = (at - 1) >> 1) {
+            this.items[at] = this.items[parent];
+            at = parent;
+        }
+        this.items[at] = run;
+    }
+    /** Restore the order after the earliest run's head advanced, dropping it once empty. */
+    settle() {
+        // An empty run leaves, and the last run sifts down from the root in its place.
+        const run = this.items[0].count ? this.items[0] : this.items.pop();
+        const size = this.items.length;
+        if (!size)
+            return;
+        let at = 0;
+        for (let child = 1; child < size; child = at * 2 + 1) {
+            if (child + 1 < size && this.items[child + 1].due < this.items[child].due)
+                child++;
+            if (this.items[child].due >= run.due)
+                break;
+            this.items[at] = this.items[child];
+            at = child;
+        }
+        this.items[at] = run;
+    }
+}
+/** A polynomial hash of code units, modulo 2^32. Equal text always hashes equally, so a
+ * collision can only redact more. */
+function hash(text) {
+    let value = 0;
+    for (let index = 0; index < text.length; index++)
+        value = (Math.imul(value, HASH_BASE) + text.charCodeAt(index)) | 0;
+    return value;
+}
+/** Aho-Corasick over registered forms: amortized constant work per scanned code unit, however
+ * many forms are registered, reporting the longest form ending at each unit. Only a bounded
+ * prefix of each form is indexed. A longer form is confirmed where its prefix matches by the
+ * view's rolling hash once the form's last unit arrives, so no text is read twice; checks are
+ * budgeted, and their queue is bounded. States live in typed arrays: the root's transitions in a
+ * table, each state's first child inline, and only further branches in a map. */
+class Matcher {
+    /** The shortest form left unindexed; any string this long might contain it. */
+    unindexed = Infinity;
+    root = new Int32Array(65_536);
+    branches = new Map();
+    child;
+    unit;
+    depth;
+    kind;
+    /** Forms longer than FORM_PREFIX, by the state their prefix reaches. */
+    truncated = new Map();
+    fail;
+    longest;
+    short;
+    starts;
+    hashes;
+    constructor(forms) {
+        // Credentials are indexed first; sorting is stable, so registration order is otherwise kept.
+        const indexed = [];
+        let units = 0;
+        for (const entry of [...forms].sort((a, b) => b[1] - a[1])) {
+            const length = Math.min(entry[0].length, FORM_PREFIX);
+            if (units + length > MAX_MATCHER_UNITS)
+                this.unindexed = Math.min(this.unindexed, entry[0].length);
+            else {
+                units += length;
+                indexed.push(entry);
+            }
+        }
+        const size = units + 1;
+        [this.child, this.fail] = [new Int32Array(size), new Int32Array(size)];
+        [this.unit, this.depth, this.longest] = [new Uint16Array(size), new Uint16Array(size), new Uint16Array(size)];
+        [this.kind, this.short] = [new Uint8Array(size), new Uint8Array(size)];
+        const parent = new Int32Array(size);
+        let states = 1;
+        let longestForm = 0;
+        for (const [form, kind] of indexed) {
+            const length = Math.min(form.length, FORM_PREFIX);
+            let state = 0;
+            for (let index = 0; index < length; index++) {
+                const code = form.charCodeAt(index);
+                let next = this.next(state, code);
+                if (!next) {
+                    next = states++;
+                    if (!state)
+                        this.root[code] = next;
+                    else if (!this.child[state])
+                        this.child[state] = next;
+                    else
+                        this.branches.set(state * 65_536 + code, next);
+                    parent[next] = state;
+                    this.unit[next] = code;
+                    this.depth[next] = this.depth[state] + 1;
+                }
+                state = next;
+            }
+            if (length === form.length)
+                this.kind[state] = Math.max(this.kind[state], kind);
+            else {
+                const groups = this.truncated.get(state) ?? [];
+                this.truncated.set(state, groups);
+                const group = groups.find((group) => group.length === form.length);
+                if (group)
+                    group.hashes.add(hash(form));
+                else {
+                    let power = 1;
+                    for (let index = 0; index < form.length; index++)
+                        power = Math.imul(power, HASH_BASE);
+                    groups.push({ length: form.length, power, hashes: new Set([hash(form)]) });
+                }
+            }
+            longestForm = Math.max(longestForm, length);
+        }
+        // Breadth-first, by a counting sort on depth: a failure link and its outputs depend only on
+        // shallower states.
+        const offsets = new Int32Array(FORM_PREFIX + 2);
+        for (let state = 1; state < states; state++)
+            offsets[this.depth[state] + 1]++;
+        for (let depth = 1; depth < offsets.length; depth++)
+            offsets[depth] += offsets[depth - 1];
+        const order = new Int32Array(states);
+        for (let state = 1; state < states; state++)
+            order[offsets[this.depth[state]]++] = state;
+        for (let index = 0; index < states - 1; index++) {
+            const state = order[index];
+            const fail = this.depth[state] > 1 ? this.step(this.fail[parent[state]], this.unit[state]) : 0;
+            this.fail[state] = fail;
+            this.longest[state] = this.kind[state] >= PRIVATE ? this.depth[state] : this.longest[fail];
+            this.short[state] = this.kind[state] === SHORT ? 1 : this.short[fail];
+        }
+        this.starts = new Int32Array(1 << (32 - Math.clz32(longestForm)));
+        this.hashes = new Int32Array(this.starts.length);
+    }
+    /** The child reached by one code unit, or 0. A first child is stored with its unit. */
+    next(state, code) {
+        if (!state)
+            return this.root[code];
+        const child = this.child[state];
+        return child && this.unit[child] === code ? child : (this.branches.get(state * 65_536 + code) ?? 0);
+    }
+    step(state, code) {
+        for (;;) {
+            const next = this.next(state, code);
+            if (next || !state)
+                return next;
+            state = this.fail[state];
+        }
+    }
+    /** Scan one view, mapping each match back to the source units it came from. False when its
+     * long-form checks exceed the remaining work or MAX_PENDING_RUNS, so the view is withheld. */
+    scan(units, found, budget, marks) {
+        let state = 0;
+        let count = 0;
+        let percent = 0;
+        let rolling = 0;
+        let runs;
+        let tails;
+        const base = found.spans.length;
+        const mask = this.starts.length - 1;
+        for (let code = units.next(); code >= 0; code = units.next()) {
+            if (code === 0x25)
+                percent = 2;
+            else if (percent) {
+                percent--;
+                if (code >= 0x61 && code <= 0x66)
+                    code -= 0x20;
+            }
+            this.starts[count & mask] = units.start;
+            this.hashes[count++ & mask] = rolling;
+            rolling = (Math.imul(rolling, HASH_BASE) + code) | 0;
+            state = this.step(state, code);
+            const length = this.longest[state];
+            if (length)
+                push(found.spans, base, this.starts[(count - length) & mask], units.end, marks);
+            if (this.short[state])
+                found.short = true;
+            const groups = this.depth[state] === FORM_PREFIX ? this.truncated.get(state) : undefined;
+            if (groups) {
+                if (CHECK_WORK * groups.length > budget.work)
+                    return false;
+                budget.work -= CHECK_WORK * groups.length;
+                const before = this.hashes[(count - FORM_PREFIX) & mask];
+                const start = this.starts[(count - FORM_PREFIX) & mask];
+                runs ??= new Runs();
+                tails ??= new Map();
+                for (const group of groups) {
+                    const tail = tails.get(group);
+                    if (tail?.count && this.extend(tail, count, start))
+                        continue;
+                    if (runs.items.length >= MAX_PENDING_RUNS)
+                        return false;
+                    const due = count - FORM_PREFIX + group.length;
+                    const run = { group, count: 1, due, before, start, last: count, lastStart: start, ...UNEXTENDED };
+                    tails.set(group, run);
+                    runs.add(run);
+                }
+            }
+            while (runs?.items.length && runs.items[0].due === count) {
+                const run = runs.items[0];
+                if (run.group.hashes.has((rolling - Math.imul(run.before, run.group.power)) | 0))
+                    push(found.spans, base, run.start, units.end, marks);
+                run.count--;
+                run.due += run.step;
+                run.before = (Math.imul(run.before, run.stepPower) + run.stepHash) | 0;
+                run.start += run.stride;
+                runs.settle();
+            }
+        }
+        if (this.kind[state] === SHORT && this.depth[state] === count)
+            found.exact = true;
+        return true;
+    }
+    /** Add an occurrence to a run when it continues the run's step and stride. The prefix has
+     * period `step`, so the text between occurrences is the prefix's first `step` units. */
+    extend(run, count, start) {
+        const step = count - run.last;
+        const stride = start - run.lastStart;
+        if (run.step ? step !== run.step || stride !== run.stride : step > FORM_PREFIX)
+            return false;
+        if (!run.step) {
+            const mask = this.starts.length - 1;
+            run.step = step;
+            run.stride = stride;
+            run.stepPower = POWERS[step];
+            // The rolling hashes before both occurrences differ by the units between them.
+            const previous = Math.imul(this.hashes[(run.last - FORM_PREFIX) & mask], run.stepPower);
+            run.stepHash = (this.hashes[(count - FORM_PREFIX) & mask] - previous) | 0;
+        }
+        run.count++;
+        run.last = count;
+        run.lastStart = start;
+        return true;
+    }
+}
 export class SentSecrets {
-    values = new Set();
-    matcher;
-    unicode = false;
+    /** Normalized form to its strongest kind. */
+    forms = new Map();
     recipients = new Set();
-    form(value) {
-        if (this.values.has(value))
+    privateChars = 0;
+    /** The shortest form left unregistered; any string this long might contain it. */
+    unmatched = Infinity;
+    unicode = false;
+    views = {};
+    store(form, kind) {
+        const prior = this.forms.get(form) ?? 0;
+        if (prior >= kind)
             return;
-        this.values.add(value);
-        this.matcher = undefined;
-        this.unicode ||= [...value].some((char) => char.charCodeAt(0) > 127);
+        if (kind !== CREDENTIAL && !prior) {
+            if (this.privateChars + form.length > MAX_PRIVATE_FORM_CHARS)
+                return this.unregistered(form.length);
+            this.privateChars += form.length;
+        }
+        this.forms.set(form, kind);
+        this.unicode ||= /[\u0080-\uffff]/.test(form);
+        this.views = {};
+        for (const recipient of this.recipients)
+            recipient.store(form, kind);
+    }
+    unregistered(length) {
+        if (length >= this.unmatched)
+            return;
+        this.unmatched = length;
+        this.views = {};
         for (const recipient of this.recipients)
-            recipient.form(value);
+            recipient.unregistered(length);
     }
-    /** The request receives existing and future credentials from every context. */
+    register(value, kind) {
+        const forms = [value, new URLSearchParams({ value }).toString().slice(6)];
+        try {
+            forms.push(encodeURIComponent(value), encodeURI(value));
+        }
+        catch {
+            // A lone surrogate has no URI form; its other forms remain.
+        }
+        const encoded = base64(value);
+        forms.push(encoded, encoded.replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, ""));
+        for (const form of forms)
+            for (const variant of wireForms(form))
+                this.store(variant, kind);
+    }
+    /** The request receives existing and future secrets from every context. */
     include(source) {
         if (source === this)
             return;
         source.recipients.add(this);
-        for (const value of source.values)
-            this.form(value);
+        for (const [form, kind] of source.forms)
+            this.store(form, kind);
+        this.unregistered(source.unmatched);
     }
     add(value) {
         if (value.length < MIN_SECRET_LENGTH)
             return;
-        for (const form of [value, `Bearer ${value}`, `token ${value}`]) {
-            this.form(form);
-            this.form(encodeURIComponent(form));
-            this.form(encodeURI(form));
-            this.form(new URLSearchParams({ value: form }).toString().slice(6));
-            const encoded = base64(form);
-            this.form(encoded);
-            this.form(encoded.replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, ""));
-        }
+        for (const form of [value, `Bearer ${value}`, `token ${value}`])
+            this.register(form, CREDENTIAL);
     }
     /** Explicit secrets use the same floor as every other credential. */
     secret(value) {
         this.add(value);
     }
+    /** Submitted writeOnly strings and numbers join this request's set, including property
+     * names inside a private object. Empty strings, booleans, and null carry no text. */
+    arguments(args, schema) {
+        if (!schema)
+            return;
+        let nodes = 0;
+        const submit = (value) => {
+            if (!value)
+                return;
+            if (value.length > MAX_PRIVATE_FORM_CHARS)
+                return this.unregistered(value.length);
+            this.register(value, value.length < MIN_SECRET_LENGTH ? SHORT : PRIVATE);
+        };
+        const collect = (value, depth) => {
+            if (++nodes > MAX_ARGUMENT_NODES || depth > MAX_ARGUMENT_DEPTH)
+                return this.unregistered(1);
+            if (typeof value === "string")
+                submit(value);
+            else if (typeof value === "number" || typeof value === "bigint")
+                submit(String(value));
+            else if (value !== null && typeof value === "object")
+                for (const key of Object.keys(value)) {
+                    if (nodes > MAX_ARGUMENT_NODES)
+                        return;
+                    if (!Array.isArray(value))
+                        submit(key);
+                    collect(value[key], depth + 1);
+                }
+        };
+        visitPrivateCallArguments(args, schema, (value) => collect(value, 0));
+    }
     /** Structural fields must be refused, never repaired into different URLs. */
     contains(value, ignoreCase = false) {
-        return [...this.values].some((secret) => new RegExp(wirePattern(secret), ignoreCase ? "i" : "").test(value));
+        if (value.length >= this.unmatched)
+            return true;
+        if (!this.forms.size)
+            return false;
+        const found = { spans: [], short: false, exact: false };
+        const lower = () => new Matcher([...this.forms].flatMap(([form, kind]) => wireForms(form.toLowerCase()).map((low) => [low, kind])));
+        const matcher = ignoreCase ? (this.views.lower ??= lower()) : this.matcher();
+        if (value.length >= matcher.unindexed)
+            return true;
+        const scanned = matcher.scan(new Source(ignoreCase ? value.toLowerCase() : value), found, { work: Infinity });
+        return !scanned || found.spans.length > 0;
     }
     containsUrl(value) {
         const { hosts, components, joined } = credentialUrlViews(value);
@@ -160,200 +645,252 @@ export class SentSecrets {
             }
         }
     }
+    /** Serialized wire text about to be returned, stored, or paged, under payload rules. */
     text(value) {
-        if (this.values.size === 0)
-            return value;
-        const original = value;
-        // Replace longer forms first so a raw token cannot leave its prefix or
-        // encoded suffix behind. Literal matches only: ordinary diagnostics stay.
-        this.matcher ??= new RegExp([literal(REDACTED), ...[...this.values].sort((a, b) => b.length - a.length).map(wirePattern)].join("|"), "gu");
-        // A single pass never scans a newly inserted placeholder as credential
-        // text. Protect existing placeholders when another boundary runs too.
-        value = value.replace(this.matcher, REDACTED);
-        if (value.includes("\\"))
-            value = this.escapedText(value);
-        // Ordinary skill bytes, including example credential header names, stay
-        // exact. Header-line scrubbing belongs to an actual credential echo.
-        if (value === original)
+        return this.idle() ? value : this.wire(value, this.scan(true), 0, true, 0);
+    }
+    /** Copy only what changes, including non-enumerable Error fields; never retain a raw cause.
+     * Payload rules apply where downstream or guest data enters; envelopes repeat literal
+     * replacement. */
+    redact(value, mode = "payload") {
+        if (this.idle())
             return value;
-        return value.replace(/(^|[\r\n])([\t ]*(?:cookie|set-cookie|[a-z0-9-]*(?:key|token|secret|auth|signature|session)[a-z0-9-]*)\s*:\s*)[^\r\n]*/gi, `$1$2${REDACTED}`);
+        return this.walk(value, this.scan(mode !== "envelope"), mode === "prose" || typeof value === "string", 0, 0);
+    }
+    /** Credentials alone: later calls keep the private arguments they submit, and cached
+     * catalogs never depend on one request's arguments. */
+    redactCredentials(value) {
+        return this.credentials().redact(value, "envelope");
+    }
+    idle() {
+        return !this.forms.size && this.unmatched === Infinity;
+    }
+    scan(payload) {
+        const work = this.privateChars || this.unmatched < Infinity ? PRIVATE_SCAN_WORK : CREDENTIAL_SCAN_WORK;
+        return { budget: { work, nodes: MAX_WALK_NODES }, payload };
+    }
+    matcher() {
+        return (this.views.matcher ??= new Matcher(this.forms));
+    }
+    credentials() {
+        if (!this.privateChars && this.unmatched === Infinity)
+            return this;
+        if (!this.views.credentials) {
+            const view = new SentSecrets();
+            for (const [form, kind] of this.forms)
+                if (kind === CREDENTIAL)
+                    view.store(form, kind);
+            this.views.credentials = view;
+        }
+        return this.views.credentials;
+    }
+    /** Strings at least this long might hold a form that was never matched. */
+    floor(scan) {
+        return Math.min(scan.payload ? this.unmatched : Infinity, this.matcher().unindexed);
     }
-    /** Skill supporting files may contain arbitrary bytes, including credential echoes. */
-    blob(value) {
+    /** Every raw and JSON-unescaped match, mapped to source spans before any replacement. Text
+     * decodes one more layer while the last one could still hold an escape, up to
+     * MAX_DECODE_LEVELS counting the JSON strings it came from. Work beyond the call's budget
+     * or that depth returns undefined, which withholds the string. */
+    find(text, scan, escapes, level) {
+        const found = { spans: [], short: false, exact: false };
+        const marks = markers(text);
+        for (let layer = 0, more = true; more; layer++) {
+            if (level + layer > MAX_DECODE_LEVELS || !spend(scan, 2 * text.length * (layer + 1)))
+                return undefined;
+            let units = new Source(text);
+            for (let depth = 0; depth < layer; depth++)
+                units = new Unescaped(units);
+            if (!this.matcher().scan(units, found, scan.budget, marks))
+                return undefined;
+            more = escapes && (units instanceof Unescaped ? units.decoded > 0 && units.slashes > 0 : text.includes("\\"));
+        }
+        return found;
+    }
+    /** A structured leaf, property name, or prose. A short private form withholds prose
+     * wherever it occurs, and a leaf only when the whole leaf is that form. */
+    string(value, scan, prose, level = 0) {
+        if (value.length >= this.floor(scan))
+            return REDACTED;
+        const found = this.find(value, scan, true, level);
+        if (!found || (scan.payload && (prose ? found.short : found.exact)))
+            return REDACTED;
+        return found.spans.length ? replace(value, found.spans) : value;
+    }
+    /** A number, boolean, or null matching by its canonical text becomes a placeholder string. */
+    scalar(value, scan) {
+        const text = String(value);
+        if ((typeof value === "number" || typeof value === "bigint") && text.length >= this.floor(scan))
+            return REDACTED;
+        const found = this.find(text, scan, false, 0);
+        return !found || found.exact || found.spans.length ? REDACTED : value;
+    }
+    /** JSON objects, arrays, and string literals are parsed and walked, nested JSON strings
+     * included; their serialized bytes must then hold no literal the walk cannot see, such as
+     * one spanning tokens. Other text is prose or a structured leaf. */
+    wire(value, scan, depth, prose, level) {
+        if (value.length >= this.floor(scan))
+            return REDACTED;
+        if (level < MAX_DECODE_LEVELS && /^\s*["[{]/.test(value) && spend(scan, value.length)) {
+            let parsed;
+            try {
+                parsed = { json: JSON.parse(value) };
+            }
+            catch {
+                // Not JSON.
+            }
+            if (parsed) {
+                const { json } = parsed;
+                const walked = this.walk(json, scan, prose && typeof json === "string", depth, level + 1);
+                const text = walked === json ? value : JSON.stringify(walked);
+                const found = this.find(text, scan, false, level);
+                return found && !found.spans.length && text.length < this.floor(scan) ? text : REDACTED;
+            }
+        }
+        return this.string(value, scan, prose, level);
+    }
+    /** Iterative and copy-on-write: only containers on a changed path are copied. A container's
+     * entries are counted against the node budget before it is walked; a cycle or a container
+     * past MAX_WALK_DEPTH is withheld, and one past the node budget is checked as serialized text. */
+    walk(value, scan, prose, depth, level) {
+        const stack = [];
+        const active = new Set();
+        const visit = (item, prose, depth) => {
+            if (typeof item === "string")
+                return this.wire(item, scan, depth, prose, level);
+            if (item === null || typeof item === "number" || typeof item === "bigint" || typeof item === "boolean")
+                return scan.payload ? this.scalar(item, scan) : item;
+            if (typeof item !== "object")
+                return item;
+            if (active.has(item) || depth > MAX_WALK_DEPTH)
+                return REDACTED;
+            const names = Array.isArray(item) ? undefined : Object.getOwnPropertyNames(item);
+            const size = names ? names.length : item.length;
+            if (size > scan.budget.nodes)
+                return this.serialized(item, scan, level);
+            scan.budget.nodes -= size;
+            if (!size)
+                return item;
+            active.add(item);
+            const typed = item instanceof Error || typeof item.retryable === "boolean";
+            stack.push({ item, names, size, index: 0, prose, depth, typed, key: "", name: "", field: undefined });
+            return OPEN;
+        };
+        // Settle the top frame's next entry, drop it, or open its container.
+        const enter = (frame) => {
+            const { item, names } = frame;
+            if (!names)
+                return visit((frame.field = item[frame.index]), frame.prose, frame.depth + 1);
+            const key = (frame.key = frame.name = names[frame.index]);
+            const descriptor = Object.getOwnPropertyDescriptor(item, key);
+            let prose = PROSE_KEYS.has(key);
+            if (descriptor && "value" in descriptor)
+                frame.field = descriptor.value;
+            // V8 lazily renders Error.stack through an own accessor. Snapshot it
+            // before rebuilding an error, so its diagnostic is redacted too.
+            else if (key === "stack" && item instanceof Error) {
+                frame.field = item.stack;
+                prose = true;
+            }
+            // JSON and errors carry data properties. A downstream-authored getter
+            // is not a safe way to expose a diagnostic to an agent.
+            else
+                return DROP;
+            const field = frame.field;
+            if (!FRAMING_KEYS.has(key))
+                frame.name = this.string(key, scan, false);
+            if ((typeof field === "string" && TAGS.has(`${key}:${field}`)) ||
+                (FACTS.has(key) && (typeof field === "boolean" || typeof field === "number")))
+                return field;
+            if (frame.typed && (key === "code" || key === "name") && typeof field === "string")
+                return this.credentials().string(field, { ...scan, payload: false }, false);
+            if (key === "blob" && "uri" in item && typeof field === "string")
+                return this.blob(field, scan);
+            const child = key === "content" ? this.joinedContent(field, scan, frame.depth, level) : field;
+            return visit(child, prose, frame.depth + 1);
+        };
+        // Record a settled entry. The first change copies the container's earlier entries.
+        const settle = (frame, value) => {
+            const { item, names, index } = frame;
+            if (!frame.copy) {
+                if (value === frame.field && frame.name === frame.key)
+                    return;
+                if (!names)
+                    frame.copy = item.slice(0, index);
+                else {
+                    frame.copy = item instanceof Error ? Object.create(Object.getPrototypeOf(item)) : {};
+                    for (const key of names.slice(0, index))
+                        define(frame.copy, item, key, key, item[key]);
+                }
+            }
+            if (!names)
+                frame.copy[index] = value;
+            else if (value !== DROP)
+                define(frame.copy, item, frame.key, frame.name, value);
+        };
+        let settled = visit(value, prose, depth);
+        while (stack.length) {
+            const frame = stack[stack.length - 1];
+            if (settled === OPEN)
+                settled = enter(frame);
+            if (settled === OPEN)
+                continue;
+            settle(frame, settled);
+            settled = OPEN;
+            if (++frame.index < frame.size)
+                continue;
+            stack.pop();
+            active.delete(frame.item);
+            const { item, copy } = frame;
+            settled = !copy ? item : item instanceof Error ? carryFailureFacts(item, copy) : copy;
+        }
+        return settled;
+    }
+    /** A container larger than the node budget is scanned as serialized text, Error fields
+     * included: kept unchanged when nothing registered appears, otherwise withheld whole. */
+    serialized(item, scan, level) {
+        let text;
+        try {
+            text = JSON.stringify(item, (_key, value) => value instanceof Error
+                ? Object.fromEntries(Object.getOwnPropertyNames(value).map((name) => [name, Reflect.get(value, name)]))
+                : value);
+        }
+        catch {
+            // A cycle or bigint cannot be serialized, so the container is withheld.
+        }
+        if (text === undefined || text.length >= this.floor(scan))
+            return REDACTED;
+        const found = this.find(text, scan, true, level);
+        return found && !found.spans.length && !(scan.payload && found.short) ? item : REDACTED;
+    }
+    /** Skill supporting files may contain arbitrary bytes, including echoes. */
+    blob(value, scan) {
         let binary;
         try {
             binary = atob(value);
         }
         catch {
-            return this.text(value);
+            return this.string(value, scan, false);
         }
-        const forms = [...this.values].map((secret) => Array.from(encoder.encode(secret), (byte) => String.fromCharCode(byte)).join(""));
-        const pattern = new RegExp(forms
-            .sort((a, b) => b.length - a.length)
-            .map(literal)
-            .join("|"), "g");
-        let redacted = this.text(binary.replace(pattern, REDACTED));
-        if (this.unicode) {
-            // atob returns byte-valued code units. A UTF-8 view also detects mixed
-            // literal/JSON-escaped Unicode echoes. Never re-encode that view: an
-            // arbitrary supporting file may contain invalid UTF-8 or a leading BOM.
+        // Byte-valued code units match ASCII forms directly. Bytes are data, never prose.
+        let redacted = this.string(binary, scan, false);
+        if (this.unicode && redacted !== REDACTED) {
+            // A UTF-8 view also detects non-ASCII and mixed escaped echoes. Never re-encode that
+            // view: an arbitrary supporting file may contain invalid UTF-8 or a leading BOM.
             const view = new TextDecoder("utf-8", { fatal: false, ignoreBOM: true }).decode(Uint8Array.from(redacted, (char) => char.charCodeAt(0)));
-            if (this.text(view) !== view)
+            if (this.string(view, scan, false) !== view)
                 redacted = REDACTED;
         }
         const encoded = redacted === binary ? value : btoa(redacted);
-        // A file's encoding can itself equal a credential. Withhold that file as
+        // A file's encoding can itself equal a secret. Withhold that file as
         // a valid encoded placeholder, never insert prose into its base64 field.
-        if (this.text(encoded) === encoded)
+        if (this.string(encoded, scan, false) === encoded)
             return encoded;
         const withheld = btoa(REDACTED);
-        return this.text(withheld) === withheld ? withheld : "";
-    }
-    /** Decode bounded windows with source spans, including twice-escaped JSON.
-     * Scratch space follows credential length, never the whole skill file. */
-    escapedText(source) {
-        const step = 65_536;
-        let longest = 0;
-        for (const value of this.values)
-            longest = Math.max(longest, value.length);
-        // Each of two Unicode escape layers expands a code unit at most sixfold.
-        const overlap = 36 * longest + 12;
-        const output = [];
-        let copied = 0;
-        for (let offset = 0; offset < source.length;) {
-            let view = source.slice(offset, offset + step + overlap);
-            let starts;
-            let ends;
-            const matches = [];
-            for (let pass = 0; pass < 2 && view.includes("\\"); pass++) {
-                const parts = [];
-                const nextStarts = new Uint32Array(view.length);
-                const nextEnds = new Uint32Array(view.length);
-                let cursor = 0;
-                let length = 0;
-                const copy = (end) => {
-                    if (cursor < end)
-                        parts.push(view.slice(cursor, end));
-                    for (; cursor < end; cursor++, length++) {
-                        nextStarts[length] = starts?.[cursor] ?? cursor;
-                        nextEnds[length] = ends?.[cursor] ?? cursor + 1;
-                    }
-                };
-                for (const match of view.matchAll(jsonEscape)) {
-                    copy(match.index);
-                    const code = match[0].slice(1);
-                    parts.push(code.startsWith("u") ? String.fromCharCode(parseInt(code.slice(1), 16)) : shortEscape[code]);
-                    nextStarts[length] = starts?.[match.index] ?? match.index;
-                    cursor = match.index + match[0].length;
-                    nextEnds[length++] = ends?.[cursor - 1] ?? cursor;
-                }
-                if (cursor === 0)
-                    break;
-                copy(view.length);
-                view = parts.join("");
-                starts = nextStarts.subarray(0, length);
-                ends = nextEnds.subarray(0, length);
-                for (const match of view.matchAll(this.matcher)) {
-                    const start = starts[match.index];
-                    if (match[0] !== REDACTED && start < step)
-                        matches.push({ start, end: ends[match.index + match[0].length - 1] });
-                }
-            }
-            matches.sort((a, b) => a.start - b.start || b.end - a.end);
-            let rewritten = "";
-            let cursor = 0;
-            for (let i = 0; i < matches.length; i++) {
-                const match = matches[i];
-                let end = match.end;
-                while (matches[i + 1] && matches[i + 1].start <= end)
-                    end = Math.max(end, matches[++i].end);
-                rewritten += source.slice(offset + cursor, offset + match.start) + REDACTED;
-                cursor = end;
-            }
-            if (cursor) {
-                output.push(source.slice(copied, offset), rewritten);
-                copied = offset + cursor;
-            }
-            let boundary = step;
-            if (starts && ends) {
-                // Keep the next window at an original escape boundary. Starting at
-                // the second slash of a JSON pair changes its meaning and can leave
-                // an invalid escape immediately before a redaction placeholder.
-                let left = 0;
-                let right = ends.length;
-                while (left < right) {
-                    const middle = (left + right) >>> 1;
-                    if (ends[middle] <= step)
-                        left = middle + 1;
-                    else
-                        right = middle;
-                }
-                if (left < starts.length)
-                    boundary = Math.min(step, starts[left]);
-            }
-            offset += Math.max(boundary, cursor);
-        }
-        return output.length ? output.join("") + source.slice(copied) : source;
-    }
-    /** Copy, including non-enumerable Error fields; never retain a raw cause. */
-    redact(value) {
-        if (this.values.size === 0)
-            return value;
-        const seen = new Map();
-        let changed = false;
-        const text = (value) => {
-            const redacted = this.text(value);
-            changed ||= redacted !== value;
-            return redacted;
-        };
-        const visit = (item) => {
-            if (typeof item === "string")
-                return text(item);
-            if (item === null || typeof item !== "object")
-                return item;
-            const prior = seen.get(item);
-            if (prior)
-                return prior;
-            const copy = Array.isArray(item)
-                ? []
-                : item instanceof Error
-                    ? Object.create(Object.getPrototypeOf(item))
-                    : {};
-            seen.set(item, copy);
-            for (const [key, descriptor] of Object.entries(Object.getOwnPropertyDescriptors(item))) {
-                // V8 lazily renders Error.stack through an own accessor. Snapshot it
-                // before rebuilding an error, so its diagnostic is redacted too.
-                if (key === "stack" && item instanceof Error && !("value" in descriptor)) {
-                    Object.defineProperty(copy, key, { value: visit(item.stack), configurable: true, writable: true });
-                    continue;
-                }
-                // JSON and errors carry data properties. A downstream-authored getter
-                // is not a safe way to expose a diagnostic to an agent.
-                if (!("value" in descriptor)) {
-                    changed = true;
-                    continue;
-                }
-                const redactedKey = text(key);
-                const blob = key === "blob" && "uri" in item && typeof descriptor.value === "string";
-                const field = key === "content"
-                    ? this.joinedContent(descriptor.value)
-                    : blob
-                        ? this.blob(descriptor.value)
-                        : descriptor.value;
-                changed ||= field !== descriptor.value;
-                Object.defineProperty(copy, redactedKey, {
-                    ...descriptor,
-                    value: blob ? field : visit(field),
-                    ...(redactedKey !== key ? { configurable: true } : {}),
-                });
-            }
-            return item instanceof Error ? carryFailureFacts(item, copy) : copy;
-        };
-        const copy = visit(value);
-        return changed ? copy : value;
+        return this.string(withheld, scan, false) === withheld ? withheld : "";
     }
     /** Match across blocks before isError/JSON unwrapping concatenates them. */
-    joinedContent(value) {
+    joinedContent(value, scan, depth, level) {
         if (!Array.isArray(value))
             return value;
         const blocks = value.filter((block) => block?.type === "text" && typeof block.text === "string");
@@ -361,8 +898,8 @@ export class SentSecrets {
             return value;
         for (const separator of ["", "\n"]) {
             const joined = blocks.map((block) => block.text).join(separator);
-            const redacted = this.text(joined);
-            if (redacted === blocks.map((block) => this.text(block.text)).join(separator))
+            const redacted = this.wire(joined, scan, depth, true, level);
+            if (redacted === blocks.map((block) => this.wire(block.text, scan, depth, true, level)).join(separator))
                 continue;
             let first = true;
             return value.map((block) => {
@@ -399,9 +936,11 @@ export function sentSecretsForRequest(scope, secrets) {
 }
 /** The agent-facing choke point. Apply to values before bridge serialization
  * and to serialized wire text, so JSON escapes and structured strings share
- * the same rule. Intake redaction protects caches independently of this edge. */
+ * the same rule. Payloads were redacted where they entered; this boundary
+ * repeats credential and literal private-value replacement around Connecta's
+ * own envelopes, whose identifiers and counts are never private data. */
 export function redactAgentOutput(secrets, value) {
-    return secrets.redact(value);
+    return secrets.redact(value, "envelope");
 }
 /** Wrap the complete operation table, including rejections. Adding an operation
  * cannot add an unredacted exit. A direct invocation owns a fresh scope unless
@@ -459,7 +998,7 @@ export function redactSentSecrets(ctx, value) {
  * publish a partial catalog, so refuse the complete listing instead. */
 export function redactCatalog(ctx, tools) {
     sentSecretsFor(ctx);
-    const redacted = sentSecretsForRequest(ctx.requestScope ?? ctx).redact(tools);
+    const redacted = sentSecretsForRequest(ctx.requestScope ?? ctx).redactCredentials(tools);
     if (redacted.some((tool, index) => tool.name !== tools[index].name)) {
         throw new ConnectorCallError("connector_call_failed", "Downstream catalog contains a tool name that echoes a sent credential; refusing the complete catalog.", { retryable: false });
     }