@zackbart/connecta 0.34.1 → 0.36.0

package/dist/sent-secrets.js

@@ -1,24 +1,41 @@
+import { authCall, authMethod } from "./auth/native.js";
+import { Effect } from "effect";
 // Credentials and submitted private argument values used by one upstream request. Memory
 // only; never part of a context's public shape, a failure record, storage, or a log. Web APIs only.
-import { carryFailureFacts } from "./operator-record.js";
-import { ConnectorCallError } from "./errors.js";
+import { classificationCode, ConnectorCallError } from "./errors.js";
 import { credentialUrlViews } from "./credential-url.js";
+import { RequestScope, requestOwner } from "./runtime/request-scope.js";
+import { viewSecrets, wrapViewCredentials } from "./runtime/call.js";
 import { visitPrivateCallArguments } from "./argument-redaction.js";
-const REDACTED = "[redacted]";
+import { keptErrorName, redactedCopyOf } from "./redaction-identity.js";
+import { REDACTED } from "./redaction-marker.js";
 const encoder = new TextEncoder();
-const contexts = new WeakMap();
-const requests = new WeakMap();
-const wrappedCredentials = new WeakSet();
 const sensitiveName = /key|token|secret|password|auth|signature|session/i;
 const explicitSecretName = /secret|password/i;
+const identifierName = /(?:id|user(?:name)?|login|email)$|^public/i;
+// Continuation cursors are named tokens but are public result state, returned changed on the
+// next page; matching their fragments would corrupt the cursor the agent pages with.
+const continuationName = /^(?:next_?)?page_?token$|^(?:next|continuation|sync)_?token$/i;
 const headerLine = /(^|[\r\n])([\t ]*(?:cookie|set-cookie|[a-z0-9-]*(?:key|token|secret|auth|signature|session)[a-z0-9-]*)\s*:\s*)[^\r\n]*/gi;
 // Short credentials can match protocol fields or legitimate configuration.
 const MIN_SECRET_LENGTH = 8;
-// Form kinds, weakest first. A short private value redacts exact structured leaves and
-// withholds prose; longer private values and credentials are replaced wherever they occur.
-const SHORT = 1;
-const PRIVATE = 2;
-const CREDENTIAL = 3;
+// K: every contiguous run this long of a registered form is matched wherever it appears. It
+// equals MIN_SECRET_LENGTH, so every registered credential and every private value of at least K
+// units is fragment-indexed. Eight units keeps ordinary words, dates, counts and auth framing out
+// of the index: a public run must repeat eight consecutive units of a secret's form to match.
+const FRAGMENT_LENGTH = MIN_SECRET_LENGTH;
+// A private value shorter than this is matched only as a whole field value: a leaf, key, number,
+// boolean or decoded view equal to one of its forms. One to three units recur inside ordinary
+// words, counts and ids, so a substring match would rewrite them everywhere.
+const SUBSTRING_LENGTH = 4;
+// Form kinds, weakest first, by the length of the value they came from. A tiny private value
+// (1-3 units) is matched whole only. A short one (4-7) is also matched as a substring of payload
+// text and decoded views. Longer private values and credentials are matched whole and by every
+// K-unit run, wherever they occur.
+const TINY = 1;
+const SHORT = 2;
+const PRIVATE = 3;
+const CREDENTIAL = 4;
 // Submitted values register at most this many form code units and argument nodes. A form
 // that does not fit withholds every string long enough to contain it.
 const MAX_PRIVATE_FORM_CHARS = 524_288;
@@ -40,26 +57,103 @@ const POWERS = new Int32Array(FORM_PREFIX + 1);
 POWERS[0] = 1;
 for (let length = 1; length <= FORM_PREFIX; length++)
     POWERS[length] = Math.imul(POWERS[length - 1], HASH_BASE);
+// Fragments are indexed by two independent polynomial hashes, at most MAX_FRAGMENTS distinct ones
+// (8 bytes each, in a table at most half full); a larger set withholds every run of K units.
+const SECOND_BASE = 0x5b_d1_e9_95;
+const MAX_FRAGMENTS = 524_288;
+// A unit's weight in a K-unit window, first and second position, under each base.
+const [FIRST_TOP, FIRST_NEXT] = [POWERS[FRAGMENT_LENGTH - 1], POWERS[FRAGMENT_LENGTH - 2]];
+let [SECOND_TOP, SECOND_NEXT] = [1, 1];
+for (let length = 1; length < FRAGMENT_LENGTH; length++) {
+    SECOND_TOP = Math.imul(SECOND_TOP, SECOND_BASE);
+    if (length < FRAGMENT_LENGTH - 1)
+        SECOND_NEXT = Math.imul(SECOND_NEXT, SECOND_BASE);
+}
 // One redaction call visits at most this many structured entries, this deep. A string is
 // decoded at most MAX_DECODE_LEVELS JSON layers, counting nested JSON strings it was parsed from.
 const MAX_WALK_NODES = 1_048_576;
 const MAX_WALK_DEPTH = 512;
 const MAX_DECODE_LEVELS = 8;
+// A decoded layer is scanned only around the escapes it decoded, this far past the widest form
+// on each side: a match holding no newly decoded unit was already found a layer up. Wider forms
+// scan the whole layer.
+const MAX_WINDOW_UNITS = 4_096;
+// Leaves too large to match joined within the work budget are matched alone; a run crossing
+// two of them is matched this many units deep on each side of their seam.
+const SEAM_UNITS = 512;
+// Base64 or base64url text no declared field names is decoded and checked too: a whole view of
+// at least ENCODED_FIELD_UNITS, or a run inside one long enough to carry the smallest piece the
+// scan matches, up to MAX_ENCODED_LEVELS encodings deep. A run is a maximal span of base64 and
+// base64url units, decoded from its first. L units decode to floor(3L/4) bytes, so p bytes that
+// start a bytes into the encoding (a = 0, 1 or 2, its alignment) need L >= ceil(4(a + p)/3),
+// least at a = 0. Padding follows a run and is never counted, so a padded and an unpadded
+// encoding decode alike. The smallest piece is a short private value, four units and so at least
+// four bytes, when payload rules apply and one is registered: ceil(16/3) = 6 units. Otherwise it
+// is K units, at least eight bytes: ceil(32/3) = 11. A whole view needs no more than the first.
+const ENCODED_FIELD_UNITS = 6;
+const SHORT_RUN_UNITS = 6;
+const FRAGMENT_RUN_UNITS = 11;
+const MAX_ENCODED_LEVELS = 3;
+// Checked encoded content this long is remembered for the request, so a later pass over the
+// same bytes under the same set is not decoded and scanned again.
+const MEMO_UNITS = 4_096;
 // Work for one redaction call, across parsing and every scanned view. Credential-only sets
 // keep the multi-MiB document and skill-file reads they always allowed.
 const PRIVATE_SCAN_WORK = 64 * 1_048_576;
 const CREDENTIAL_SCAN_WORK = 1_024 * 1_048_576;
-// Connecta and MCP framing: these names, tag values, and typed facts are copied unchanged,
-// so a submitted value such as "text" or "true" cannot rewrite an envelope or its outcome.
+// Connecta, MCP and JSON-RPC framing: these names and tag values are fixed words, copied
+// unchanged, so a submitted value such as "text" or one holding the word "resource" cannot
+// rename an envelope member or rewrite a content type. They carry no downstream-chosen content
+// beyond the word itself. Any other key, and every other value, is checked like text.
 const FRAMING_KEYS = new Set(("content structuredContent isError _meta resultType dev.connecta/format type text data mimeType resource uri " +
     "blob annotations ok format valueFormat error code message stack name cause details retryable retryAfterMs " +
-    "nextAction uncertainCall result logs failure inputRequests requestState method params mode requestedSchema url").split(" "));
+    "nextAction uncertainCall result logs failure inputRequests requestState method params mode requestedSchema url " +
+    "jsonrpc id tools resources resourceTemplates uriTemplate contents prompts messages role arguments nextCursor " +
+    "title description inputSchema outputSchema size writeOutcome").split(" "));
 const TAGS = new Set(("type:text type:image type:audio type:resource type:resource_link format:json format:text format:paged " +
     "valueFormat:json valueFormat:text dev.connecta/format:json dev.connecta/format:text resultType:complete " +
-    "resultType:input_required mode:form mode:url method:elicitation/create jsonrpc:2.0").split(" "));
-const FACTS = new Set(["isError", "ok", "retryable", "retryAfterMs", "truncated", "hasMore"]);
-// Downstream and guest prose: a short private value anywhere in it withholds the whole string.
-const PROSE_KEYS = new Set(["message", "stack", "error", "logs", "text", "result"]);
+    "resultType:input_required mode:form mode:url method:elicitation/create jsonrpc:2.0 writeOutcome:unknown").split(" "));
+// Outcome flags: a boolean under these names is kept, since a boolean carries one bit whatever
+// produced it. A number or string under them is matched like any other.
+const FACTS = new Set(["isError", "ok", "retryable", "truncated", "hasMore"]);
+// An error's diagnostics. Its own accessors under these names, such as V8's stack, are read once
+// into its copy, as is whatever its chain answers for them; any other own accessor is never
+// invoked. Accessors its class chain defines are read once too.
+const ERROR_ACCESSORS = new Set(["stack", "message", "cause", "code", "name"]);
+// Parts the checker reads: text; a number's canonical text, withheld whole when it changes; a
+// declared base64 field, also decoded whole and withheld as the encoded marker; and the bytes a
+// typed array or ArrayBuffer holds, as byte-valued units, withheld whole when anything matches.
+const TEXT = 0;
+const NUMBER = 1;
+const BINARY = 2;
+const BYTES = 3;
+/** An accessor met while looking up an inherited field: never invoked. */
+const WITHHELD_ACCESSOR = Symbol("accessor");
+/** The engine's own getters for what a typed array, DataView or ArrayBuffer holds, so no
+ * subclass answers for them, and the built-in element types by the name a typed array reports. */
+const getter = (prototype, name) => Object.getOwnPropertyDescriptor(prototype, name).get;
+const TYPED = Object.getPrototypeOf(Uint8Array.prototype);
+const TYPED_NAME = getter(TYPED, Symbol.toStringTag);
+const TYPED_BUFFER = getter(TYPED, "buffer");
+const TYPED_OFFSET = getter(TYPED, "byteOffset");
+const TYPED_LENGTH = getter(TYPED, "byteLength");
+const VIEW_BUFFER = getter(DataView.prototype, "buffer");
+const VIEW_OFFSET = getter(DataView.prototype, "byteOffset");
+const VIEW_LENGTH = getter(DataView.prototype, "byteLength");
+const BUFFER_LENGTH = getter(ArrayBuffer.prototype, "byteLength");
+// Typed arrays whose elements are not their bytes; a Uint8Array's and a Uint8ClampedArray's are.
+const ELEMENTS = new Map(("Int8Array Int16Array Uint16Array Int32Array Uint32Array Float16Array Float32Array Float64Array " +
+    "BigInt64Array BigUint64Array")
+    .split(" ")
+    .map((name) => [name, globalThis[name]])
+    .filter((entry) => typeof entry[1] === "function"));
+const DECIMAL = Array.from({ length: 256 }, (_, byte) => String(byte));
+/** Wrapper objects JSON reads as their primitive, read from the engine's slot. */
+const BOXED = [
+    [String, String.prototype.valueOf],
+    [Number, Number.prototype.valueOf],
+    [Boolean, Boolean.prototype.valueOf],
+];
 /** Spend work that fits the call's remaining budget. Work that does not fit is refused
  * without spending, so its field is withheld while smaller fields can still be checked. */
 function spend(scan, work) {
@@ -68,15 +162,199 @@ function spend(scan, work) {
     scan.budget.work -= work;
     return true;
 }
-// Walk markers: a container was opened, or an entry is dropped from the copy.
-const OPEN = Symbol("open");
-const DROP = Symbol("drop");
-/** Define one entry on a copy. An own accessor here is Error.stack, already snapshotted. */
-function define(copy, item, key, name, value) {
-    const descriptor = Object.getOwnPropertyDescriptor(item, key);
-    Object.defineProperty(copy, name, "value" in descriptor
-        ? { ...descriptor, value, ...(name !== key ? { configurable: true } : {}) }
-        : { value, configurable: true, writable: true });
+/** Base64 fields MCP and Connecta declare: resource blobs, image and audio data, content a
+ * provider marks `format: "base64"`, and a REST body's `base64` beside its `contentType`. They
+ * are checked as the bytes they carry. `field` reads the snapshot, never the original again. */
+function binaryField(field, key) {
+    return ((key === "blob" && typeof field("uri") === "string") ||
+        (key === "data" && (field("type") === "image" || field("type") === "audio")) ||
+        (key === "content" && field("format") === "base64") ||
+        (key === "base64" && typeof field("contentType") === "string"));
+}
+function parse(text) {
+    try {
+        return { json: JSON.parse(text) };
+    }
+    catch {
+        return undefined; // Prose rather than serialized JSON.
+    }
+}
+/** A data property found on `item` or its prototypes, or undefined. An accessor on the way is
+ * never invoked: it reads as `accessor`. */
+function inherited(item, name, accessor) {
+    for (let at = item; at; at = Object.getPrototypeOf(at)) {
+        const descriptor = Object.getOwnPropertyDescriptor(at, name);
+        if (descriptor)
+            return "value" in descriptor ? descriptor.value : accessor;
+    }
+    return undefined;
+}
+/** The bytes a typed array, DataView or ArrayBuffer holds, copied into a fresh built-in
+ * Uint8Array through the engine's slots, with the element type of a typed array whose elements
+ * are not those bytes. Undefined for any other value. */
+function binaryOf(item) {
+    let held;
+    let elements;
+    if (ArrayBuffer.isView(item)) {
+        const name = TYPED_NAME.call(item);
+        const typed = name !== undefined;
+        held = new Uint8Array((typed ? TYPED_BUFFER : VIEW_BUFFER).call(item), (typed ? TYPED_OFFSET : VIEW_OFFSET).call(item), (typed ? TYPED_LENGTH : VIEW_LENGTH).call(item));
+        elements = ELEMENTS.get(name);
+    }
+    else {
+        if (!(item instanceof ArrayBuffer))
+            return undefined;
+        try {
+            BUFFER_LENGTH.call(item);
+        }
+        catch {
+            return undefined; // Its prototype, not an ArrayBuffer.
+        }
+        held = new Uint8Array(item);
+    }
+    const bytes = new Uint8Array(held.length);
+    bytes.set(held);
+    return { bytes, elements };
+}
+/** A String, Number or Boolean wrapper's primitive, as JSON reads it; undefined otherwise. */
+function unboxed(item) {
+    for (const [type, valueOf] of BOXED) {
+        if (!(item instanceof type))
+            continue;
+        try {
+            return { value: valueOf.call(item) };
+        }
+        catch {
+            return undefined; // Its prototype, not a wrapper.
+        }
+    }
+    return undefined;
+}
+/** Bytes as a string of byte-valued code units, in bounded batches. */
+function latin1(bytes) {
+    const chunks = [];
+    for (let offset = 0; offset < bytes.length; offset += 0x8000)
+        chunks.push(String.fromCharCode(...bytes.subarray(offset, offset + 0x8000)));
+    return chunks.join("");
+}
+/** The UTF-8 text a string of byte-valued code units decodes to, invalid sequences replaced. */
+function utf8(binary) {
+    const bytes = new Uint8Array(binary.length);
+    for (let index = 0; index < binary.length; index++)
+        bytes[index] = binary.charCodeAt(index);
+    return new TextDecoder("utf-8", { fatal: false, ignoreBOM: true }).decode(bytes);
+}
+/** Base64 or base64url text decoded to byte-valued code units, or undefined when it is not. */
+function decodeBase64(text) {
+    let standard = text.includes("-") || text.includes("_") ? text.replace(/-/g, "+").replace(/_/g, "/") : text;
+    // An unpadded encoding cut one unit past a whole quad still decodes up to that quad.
+    let bare = standard.length;
+    while (bare > 0 && standard.charCodeAt(bare - 1) === 0x3d)
+        bare--;
+    if (bare % 4 === 1)
+        standard = standard.slice(0, bare - 1);
+    try {
+        return atob(standard);
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Base64 text without its trailing padding. */
+function unpadded(text) {
+    let end = text.length;
+    while (end > 0 && text.charCodeAt(end - 1) === 0x3d)
+        end--;
+    return end === text.length ? text : text.slice(0, end);
+}
+const BASE64_UNIT = new Uint8Array(65_536);
+for (const unit of "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/-_")
+    BASE64_UNIT[unit.charCodeAt(0)] = 1;
+/** Base64 or base64url runs worth decoding, padding aside: the whole text when it is one, at
+ * least ENCODED_FIELD_UNITS long, or each run inside it at least `minimum` long. */
+function encodedRuns(text, minimum) {
+    const runs = [];
+    for (let at = 0; at < text.length;) {
+        if (!BASE64_UNIT[text.charCodeAt(at)]) {
+            at++;
+            continue;
+        }
+        let end = at + 1;
+        while (end < text.length && BASE64_UNIT[text.charCodeAt(end)])
+            end++;
+        const run = end - at;
+        let padded = end;
+        while (padded < text.length && padded - end < 2 && text.charCodeAt(padded) === 0x3d)
+            padded++;
+        if (at === 0 && padded === text.length ? run >= ENCODED_FIELD_UNITS : run >= minimum)
+            runs.push(text.slice(at, end));
+        at = padded;
+    }
+    return runs;
+}
+/** Percent escapes decoded to the byte-valued units they name, or undefined when nothing
+ * decodes. With `form`, a `+` is a space too, as form encoding writes one, with or without a
+ * percent escape beside it. */
+function percentDecoded(text, form) {
+    let found = false;
+    const decoded = text.replace(form ? /%([0-9A-Fa-f]{2})|\+/g : /%([0-9A-Fa-f]{2})/g, (_, digits) => {
+        found = true;
+        return digits === undefined ? " " : String.fromCharCode(parseInt(digits, 16));
+    });
+    return found ? decoded : undefined;
+}
+function unescapeLayer(text) {
+    const parts = [];
+    const layer = { text: "", at: [], from: [], width: [] };
+    let [cursor, length] = [0, 0];
+    for (let index = text.indexOf("\\"); index >= 0 && index < text.length - 1; index = text.indexOf("\\", index)) {
+        const code = text.charCodeAt(index + 1);
+        let unit = shortEscape[code] ?? -1;
+        let width = 2;
+        if (unit < 0 && code === 0x75 && index + 6 <= text.length) {
+            unit = 0;
+            for (let offset = 2; offset < 6 && unit >= 0; offset++) {
+                const digit = hex(text.charCodeAt(index + offset));
+                unit = digit < 0 ? -1 : unit * 16 + digit;
+            }
+            width = 6;
+        }
+        if (unit < 0) {
+            index++;
+            continue;
+        }
+        parts.push(text.slice(cursor, index), String.fromCharCode(unit));
+        length += index - cursor;
+        layer.at.push(length++);
+        layer.from.push(index);
+        layer.width.push(width);
+        cursor = index + width;
+        index = cursor;
+    }
+    if (!layer.at.length)
+        return undefined;
+    parts.push(text.slice(cursor));
+    layer.text = parts.join("");
+    return layer;
+}
+/** The unit a decoded layer's unit came from in the text above it: the first unit of its
+ * escape, or with `last` the escape's final unit. */
+function above(layer, unit, last) {
+    const { at, from, width } = layer;
+    let [low, high] = [0, at.length];
+    while (low < high) {
+        const middle = (low + high) >>> 1;
+        if (at[middle] <= unit)
+            low = middle + 1;
+        else
+            high = middle;
+    }
+    const escape = low - 1;
+    if (escape < 0)
+        return unit;
+    if (at[escape] === unit)
+        return last ? from[escape] + width[escape] - 1 : from[escape];
+    return from[escape] + width[escape] + (unit - at[escape] - 1);
 }
 /** One payload-free warning per configured connector, regardless of requests. */
 export function shortSecretWarning() {
@@ -186,6 +464,158 @@ class Unescaped {
         return this.take(1, code);
     }
 }
+/** A view that sets aside an incomplete JSON escape its text ends with, keeping source
+ * offsets, and records where it began. Wrapped around every decoded layer, so an escape that
+ * only a later layer reveals is set aside there too. Only the final six units can be one. */
+class ClosedView {
+    from;
+    start = 0;
+    end = 0;
+    open = -1;
+    pending = [];
+    ended = false;
+    constructor(from) {
+        this.from = from;
+    }
+    next() {
+        while (!this.ended && this.pending.length < 7) {
+            const code = this.from.next();
+            if (code < 0) {
+                this.ended = true;
+                const tail = String.fromCharCode(...this.pending.map((unit) => unit.code));
+                const match = /\\(?:u[0-9a-fA-F]{0,3})?$/.exec(tail);
+                if (match) {
+                    this.open = this.pending[match.index].start;
+                    this.pending.length = match.index;
+                }
+            }
+            else
+                this.pending.push({ code, start: this.from.start, end: this.from.end });
+        }
+        const unit = this.pending.shift();
+        if (!unit)
+            return -1;
+        this.start = unit.start;
+        this.end = unit.end;
+        return unit.code;
+    }
+}
+function hexLetter(code) {
+    const lower = code | 0x20;
+    return lower >= 0x61 && lower <= 0x66;
+}
+/** Every K-unit run of every form of a value at least K long, as two independent 32-bit
+ * polynomial hashes in an open-addressed table: a match needs both to agree, so a false one is
+ * vanishingly rare and only ever redacts more. Index and scan are linear in the forms and the
+ * scanned text, whatever the number of values. A form's leading auth framing (`Bearer `,
+ * `token `) is public, so runs that start inside it are not indexed: a run holding K units of
+ * the value is indexed from the value's own forms. A run may start inside a percent escape
+ * whose `%` was cut away, or right after a `%` that is not the value's, so both cases of its
+ * first two hex letters are indexed. */
+class Fragments {
+    complete = true;
+    size = 0;
+    firsts = new Int32Array(1_024);
+    seconds = new Int32Array(1_024);
+    shift = 22;
+    /** One bit per first hash's top 16 mixed bits: a clear bit rules a run out in one load, so
+     * only a run that might match computes its second hash and probes the table. */
+    filter = new Int32Array(2_048);
+    constructor(forms) {
+        for (const [form, frame] of forms) {
+            let first = 0;
+            let second = 0;
+            for (let index = 0; index < form.length; index++) {
+                const old = index >= FRAGMENT_LENGTH ? form.charCodeAt(index - FRAGMENT_LENGTH) : 0;
+                const code = form.charCodeAt(index);
+                first = (Math.imul(first - Math.imul(old, FIRST_TOP), HASH_BASE) + code) | 0;
+                second = (Math.imul(second - Math.imul(old, SECOND_TOP), SECOND_BASE) + code) | 0;
+                const at = index + 1 - FRAGMENT_LENGTH;
+                if (at < frame)
+                    continue;
+                const [lead, next] = [form.charCodeAt(at), form.charCodeAt(at + 1)];
+                for (const a of hexLetter(lead) ? [0, (lead ^ 0x20) - lead] : [0])
+                    for (const b of hexLetter(next) ? [0, (next ^ 0x20) - next] : [0])
+                        this.insert((first + Math.imul(a, FIRST_TOP) + Math.imul(b, FIRST_NEXT)) | 0, (second + Math.imul(a, SECOND_TOP) + Math.imul(b, SECOND_NEXT)) | 0);
+                // Past capacity, every run of K units is withheld instead.
+                if (this.size > MAX_FRAGMENTS) {
+                    [this.complete, this.size, this.firsts, this.seconds] = [false, 0, new Int32Array(1), new Int32Array(1)];
+                    return;
+                }
+            }
+        }
+    }
+    /** Add one fragment; repeated runs, as in a self-similar credential, are stored once. */
+    insert(first, second) {
+        const mixed = Math.imul(first, 0x9e_37_79_b1);
+        this.filter[mixed >>> 21] |= 1 << ((mixed >>> 16) & 31);
+        const key = second || 1;
+        const mask = this.firsts.length - 1;
+        for (let slot = Math.imul(first, 0x9e_37_79_b1) >>> this.shift;; slot = (slot + 1) & mask) {
+            if (!this.seconds[slot]) {
+                this.firsts[slot] = first;
+                this.seconds[slot] = key;
+                // At most half full, so a probe ends quickly; past capacity the index is abandoned.
+                if (++this.size * 2 > this.firsts.length && this.size <= MAX_FRAGMENTS)
+                    this.grow();
+                return;
+            }
+            if (this.firsts[slot] === first && this.seconds[slot] === key)
+                return;
+        }
+    }
+    grow() {
+        const [firsts, seconds] = [this.firsts, this.seconds];
+        [this.firsts, this.seconds, this.shift, this.size] = [
+            new Int32Array(firsts.length * 2),
+            new Int32Array(firsts.length * 2),
+            this.shift - 1,
+            0,
+        ];
+        for (let slot = 0; slot < firsts.length; slot++)
+            if (seconds[slot])
+                this.insert(firsts[slot], seconds[slot]);
+    }
+    has(first, second) {
+        const key = second || 1;
+        const mask = this.firsts.length - 1;
+        for (let slot = Math.imul(first, 0x9e_37_79_b1) >>> this.shift; this.seconds[slot]; slot = (slot + 1) & mask)
+            if (this.firsts[slot] === first && this.seconds[slot] === key)
+                return true;
+        return false;
+    }
+    /** Scan text from `from` to `to`, percent hex folded as forms are, reporting each run's span. */
+    scan(text, from, to, spans, marks) {
+        if (!this.size)
+            return;
+        const codes = new Uint16Array(FRAGMENT_LENGTH);
+        const { filter } = this;
+        const base = spans.length;
+        let [first, percent, slot] = [0, 0, 0];
+        for (let at = from; at < to; at++) {
+            let code = text.charCodeAt(at);
+            if (code === 0x25)
+                percent = 2;
+            else if (percent) {
+                percent--;
+                if (code >= 0x61 && code <= 0x66)
+                    code -= 0x20;
+            }
+            first = (Math.imul(first - Math.imul(codes[slot], FIRST_TOP), HASH_BASE) + code) | 0;
+            codes[slot] = code;
+            slot = (slot + 1) & (FRAGMENT_LENGTH - 1);
+            const mixed = Math.imul(first, 0x9e_37_79_b1);
+            if ((filter[mixed >>> 21] & (1 << ((mixed >>> 16) & 31))) === 0 || at + 1 - from < FRAGMENT_LENGTH)
+                continue;
+            // The window's units, oldest first, are the ring from the next slot round.
+            let second = 0;
+            for (let unit = 0; unit < FRAGMENT_LENGTH; unit++)
+                second = (Math.imul(second, SECOND_BASE) + codes[(slot + unit) & (FRAGMENT_LENGTH - 1)]) | 0;
+            if (this.has(first, second))
+                push(spans, base, at + 1 - FRAGMENT_LENGTH, at + 1, marks);
+        }
+    }
+}
 /** Merge one view's spans as they arrive, ends ascending. A span wholly inside an emitted
  * placeholder is that placeholder; a private value containing its text spans more. */
 function push(spans, base, start, end, marks) {
@@ -217,23 +647,144 @@ function markers(text) {
         marks.push(at);
     return marks;
 }
+/** Spans from every view and scanner, ordered and merged. */
+function merged(spans) {
+    const order = Array.from({ length: spans.length / 2 }, (_, index) => index * 2).sort((a, b) => spans[a] - spans[b]);
+    const out = [];
+    for (const at of order) {
+        if (out.length && out[out.length - 1] >= spans[at])
+            out[out.length - 1] = Math.max(out[out.length - 1], spans[at + 1]);
+        else
+            out.push(spans[at], spans[at + 1]);
+    }
+    return out;
+}
 /** Replace each merged span once, from the original text: no replacement can split another
  * view's match. Header-line scrubbing belongs to an actual echo. */
 function replace(text, spans) {
-    const order = Array.from({ length: spans.length / 2 }, (_, index) => index * 2).sort((a, b) => spans[a] - spans[b]);
+    const ranges = merged(headerValues(text, spans));
     const parts = [];
     let cursor = 0;
-    for (let index = 0; index < order.length;) {
-        const start = spans[order[index]];
-        let end = spans[order[index] + 1];
-        while (++index < order.length && spans[order[index]] <= end)
-            end = Math.max(end, spans[order[index] + 1]);
-        parts.push(text.slice(cursor, start), REDACTED);
-        cursor = end;
+    for (let index = 0; index < ranges.length; index += 2) {
+        parts.push(text.slice(cursor, ranges[index]), REDACTED);
+        cursor = ranges[index + 1];
     }
     parts.push(text.slice(cursor));
     return parts.join("").replace(headerLine, `$1$2${REDACTED}`);
 }
+/** A unit of a header line's name, as `headerLine` reads one. */
+function headerNameUnit(code) {
+    return ((code >= 0x61 && code <= 0x7a) || (code >= 0x41 && code <= 0x5a) || (code >= 0x30 && code <= 0x39) || code === 0x2d);
+}
+/** Whitespace as `headerLine`'s `\s` reads it around a header's `:`. */
+function headerSpace(text, at) {
+    return /\s/.test(text[at]);
+}
+/**
+ * The echo's spans with the value of every sensitive header line (`headerLine`'s names) added,
+ * read on the text before the echo is replaced (#703). An echoed private value can take part of a
+ * header's name, its `:`, or a credential prefix such as `Bearer `, so the line cannot be read
+ * after replacement; read here, the whole value goes, every cookie pair and any short tail with
+ * it. A line that is not a sensitive header keeps its text. One forward pass; nothing is kept.
+ */
+function headerValues(text, spans) {
+    const out = [...spans];
+    for (let line = 0; line < text.length;) {
+        let at = line;
+        while (at < text.length && (text[at] === " " || text[at] === "\t"))
+            at++;
+        const name = at;
+        while (at < text.length && headerNameUnit(text.charCodeAt(at)))
+            at++;
+        let next = at;
+        while (next < text.length && text[next] !== "\n" && text[next] !== "\r")
+            next++;
+        if (at > name) {
+            const word = text.slice(name, at).toLowerCase();
+            if (word === "cookie" || word === "set-cookie" || /key|token|secret|auth|signature|session/.test(word)) {
+                let colon = at;
+                while (colon < text.length && headerSpace(text, colon))
+                    colon++;
+                if (text[colon] === ":") {
+                    let value = colon + 1;
+                    while (value < text.length && headerSpace(text, value))
+                        value++;
+                    let end = value;
+                    while (end < text.length && text[end] !== "\n" && text[end] !== "\r")
+                        end++;
+                    if (end > value)
+                        out.push(value, end);
+                    next = Math.max(next, end);
+                }
+            }
+        }
+        line = next + 1;
+    }
+    return out;
+}
+/** Spans of the joined pieces, replaced in each piece they touch: a match across pieces leaves
+ * every other piece, and the structure around them, intact. */
+function replaceParts(parts, spans) {
+    if (!spans.length)
+        return parts;
+    const ranges = merged(spans);
+    let offset = 0;
+    let at = 0;
+    return parts.map((part) => {
+        const end = offset + part.length;
+        while (at < ranges.length && ranges[at + 1] <= offset)
+            at += 2;
+        const local = [];
+        for (let index = at; part && index < ranges.length && ranges[index] < end; index += 2)
+            local.push(Math.max(0, ranges[index] - offset), Math.min(part.length, ranges[index + 1] - offset));
+        offset = end;
+        return local.length ? replace(part, local) : part;
+    });
+}
+/** Spans of serialized JSON's leaf tokens, in order: each string's contents and each number. */
+function jsonTokens(text) {
+    const tokens = [];
+    for (let at = 0; at < text.length; at++) {
+        const code = text.charCodeAt(at);
+        if (code === 0x22) {
+            const start = at + 1;
+            for (at = start; at < text.length && text.charCodeAt(at) !== 0x22; at++)
+                if (text.charCodeAt(at) === 0x5c)
+                    at++;
+            tokens.push(start, at);
+        }
+        else if (code === 0x2d || (code >= 0x30 && code <= 0x39)) {
+            const start = at;
+            while (at + 1 < text.length && /[-+.0-9eE]/.test(text[at + 1]))
+                at++;
+            tokens.push(start, at + 1);
+        }
+    }
+    return tokens;
+}
+/** Pieces this set cannot fully check: withhold each one at least `limit` long, and every run
+ * of adjacent shorter pieces that together reach it. */
+function withholdRuns(parts, safe, limit) {
+    const out = [...safe];
+    let [start, length] = [0, 0];
+    const close = (end) => {
+        if (length >= limit)
+            for (let index = start; index < end; index++)
+                if (parts[index])
+                    out[index] = REDACTED;
+    };
+    for (let index = 0; index < parts.length; index++) {
+        if (parts[index].length < limit) {
+            length += parts[index].length;
+            continue;
+        }
+        close(index);
+        out[index] = REDACTED;
+        [start, length] = [index + 1, 0];
+    }
+    close(parts.length);
+    return out;
+}
 /** A run of one occurrence, whose step is set by the next occurrence that extends it. */
 const UNEXTENDED = { step: 0, stride: 0, stepHash: 0, stepPower: 0 };
 /** Runs ordered by their head check's due count: a binary min-heap. */
@@ -283,6 +834,8 @@ function hash(text) {
 class Matcher {
     /** The shortest form left unindexed; any string this long might contain it. */
     unindexed = Infinity;
+    /** The longest indexed form, whole: a match is never wider. */
+    widest = 0;
     root = new Int32Array(65_536);
     branches = new Map();
     child;
@@ -293,10 +846,10 @@ class Matcher {
     truncated = new Map();
     fail;
     longest;
-    short;
     starts;
     hashes;
-    constructor(forms) {
+    /** Forms of at least `spanKind` report spans; weaker ones only steer the open-tail search. */
+    constructor(forms, spanKind = PRIVATE) {
         // Credentials are indexed first; sorting is stable, so registration order is otherwise kept.
         const indexed = [];
         let units = 0;
@@ -307,12 +860,13 @@ class Matcher {
             else {
                 units += length;
                 indexed.push(entry);
+                this.widest = Math.max(this.widest, entry[0].length);
             }
         }
         const size = units + 1;
         [this.child, this.fail] = [new Int32Array(size), new Int32Array(size)];
         [this.unit, this.depth, this.longest] = [new Uint16Array(size), new Uint16Array(size), new Uint16Array(size)];
-        [this.kind, this.short] = [new Uint8Array(size), new Uint8Array(size)];
+        this.kind = new Uint8Array(size);
         const parent = new Int32Array(size);
         let states = 1;
         let longestForm = 0;
@@ -367,8 +921,7 @@ class Matcher {
             const state = order[index];
             const fail = this.depth[state] > 1 ? this.step(this.fail[parent[state]], this.unit[state]) : 0;
             this.fail[state] = fail;
-            this.longest[state] = this.kind[state] >= PRIVATE ? this.depth[state] : this.longest[fail];
-            this.short[state] = this.kind[state] === SHORT ? 1 : this.short[fail];
+            this.longest[state] = this.kind[state] >= spanKind ? this.depth[state] : this.longest[fail];
         }
         this.starts = new Int32Array(1 << (32 - Math.clz32(longestForm)));
         this.hashes = new Int32Array(this.starts.length);
@@ -390,7 +943,7 @@ class Matcher {
     }
     /** Scan one view, mapping each match back to the source units it came from. False when its
      * long-form checks exceed the remaining work or MAX_PENDING_RUNS, so the view is withheld. */
-    scan(units, found, budget, marks) {
+    scan(text, from, to, found, budget, marks) {
         let state = 0;
         let count = 0;
         let percent = 0;
@@ -399,7 +952,8 @@ class Matcher {
         let tails;
         const base = found.spans.length;
         const mask = this.starts.length - 1;
-        for (let code = units.next(); code >= 0; code = units.next()) {
+        for (let at = from; at < to; at++) {
+            let code = text.charCodeAt(at);
             if (code === 0x25)
                 percent = 2;
             else if (percent) {
@@ -407,15 +961,13 @@ class Matcher {
                 if (code >= 0x61 && code <= 0x66)
                     code -= 0x20;
             }
-            this.starts[count & mask] = units.start;
+            this.starts[count & mask] = at;
             this.hashes[count++ & mask] = rolling;
             rolling = (Math.imul(rolling, HASH_BASE) + code) | 0;
             state = this.step(state, code);
             const length = this.longest[state];
             if (length)
-                push(found.spans, base, this.starts[(count - length) & mask], units.end, marks);
-            if (this.short[state])
-                found.short = true;
+                push(found.spans, base, this.starts[(count - length) & mask], at + 1, marks);
             const groups = this.depth[state] === FORM_PREFIX ? this.truncated.get(state) : undefined;
             if (groups) {
                 if (CHECK_WORK * groups.length > budget.work)
@@ -440,7 +992,7 @@ class Matcher {
             while (runs?.items.length && runs.items[0].due === count) {
                 const run = runs.items[0];
                 if (run.group.hashes.has((rolling - Math.imul(run.before, run.group.power)) | 0))
-                    push(found.spans, base, run.start, units.end, marks);
+                    push(found.spans, base, run.start, at + 1, marks);
                 run.count--;
                 run.due += run.step;
                 run.before = (Math.imul(run.before, run.stepPower) + run.stepHash) | 0;
@@ -448,10 +1000,44 @@ class Matcher {
                 runs.settle();
             }
         }
-        if (this.kind[state] === SHORT && this.depth[state] === count)
-            found.exact = true;
         return true;
     }
+    /** The source start of the earliest suffix of a view that a form begins with but the view
+     * ends inside: any nonempty prefix of an indexed form, or a long form whose
+     * indexed prefix matched and whose length runs past the view. -1 when there is none. */
+    openAt(units) {
+        let state = 0;
+        let count = 0;
+        let percent = 0;
+        const mask = this.starts.length - 1;
+        // Long-form occurrences, as source start and the count by which the form would end.
+        const longs = [];
+        for (let code = units.next(); code >= 0; code = units.next()) {
+            if (code === 0x25)
+                percent = 2;
+            else if (percent) {
+                percent--;
+                if (code >= 0x61 && code <= 0x66)
+                    code -= 0x20;
+            }
+            this.starts[count++ & mask] = units.start;
+            state = this.step(state, code);
+            const groups = this.depth[state] === FORM_PREFIX ? this.truncated.get(state) : undefined;
+            if (groups && longs.length < 2 * MAX_PENDING_RUNS) {
+                const length = Math.max(...groups.map((group) => group.length));
+                longs.push(this.starts[(count - FORM_PREFIX) & mask], count - FORM_PREFIX + length);
+            }
+        }
+        const depth = this.depth[state];
+        let open = depth > 0 ? this.starts[(count - depth) & mask] : -1;
+        for (let index = 0; index < longs.length; index += 2) {
+            if (longs[index + 1] > count || longs.length >= 2 * MAX_PENDING_RUNS) {
+                open = open < 0 ? longs[index] : Math.min(open, longs[index]);
+                break;
+            }
+        }
+        return open;
+    }
     /** Add an occurrence to a run when it continues the run's step and stride. The prefix has
      * period `step`, so the text between occurrences is the prefix's first `step` units. */
     extend(run, count, start) {
@@ -474,51 +1060,113 @@ class Matcher {
         return true;
     }
 }
+/** Spans of a decoded layer's units, in the source text. */
+function toSource(layers, unit, last) {
+    for (let index = layers.length - 1; index >= 0; index--)
+        unit = above(layers[index], unit, last);
+    return unit;
+}
+/** The ranges of a decoded layer to scan: `reach` units on each side of every escape it decoded,
+ * merged, or the whole layer when that is no larger. */
+function windows(layer, reach) {
+    const length = layer.text.length;
+    if (reach > MAX_WINDOW_UNITS)
+        return [0, length];
+    const ranges = [];
+    let units = 0;
+    for (const unit of layer.at) {
+        const [start, end] = [Math.max(0, unit - reach + 1), Math.min(length, unit + reach)];
+        if (ranges.length && ranges[ranges.length - 1] >= start) {
+            units += end - ranges[ranges.length - 1];
+            ranges[ranges.length - 1] = end;
+        }
+        else {
+            units += end - start;
+            ranges.push(start, end);
+        }
+        if (units >= length)
+            return [0, length];
+    }
+    return ranges;
+}
 export class SentSecrets {
     /** Normalized form to its strongest kind. */
     forms = new Map();
+    /** A form's leading units that encode only public auth framing; absent is none. */
+    frames = new Map();
     recipients = new Set();
+    mintedStates = new Set();
+    /** Encoded content this set already found clean, and whether under payload rules, which
+     * cover envelope ones. Cleared whenever the set changes. */
+    memo = new Map();
     privateChars = 0;
+    /** The longest form; whether any comes from a value shorter than K; whether any is not ASCII. */
+    widestForm = 0;
+    smallForms = false;
+    unicodeForms = false;
     /** The shortest form left unregistered; any string this long might contain it. */
     unmatched = Infinity;
-    unicode = false;
     views = {};
-    store(form, kind) {
+    store(form, kind, frame = 0) {
         const prior = this.forms.get(form) ?? 0;
-        if (prior >= kind)
+        const priorFrame = prior ? (this.frames.get(form) ?? 0) : Infinity;
+        const nextFrame = Math.min(frame, priorFrame);
+        if (prior >= kind && nextFrame === priorFrame)
             return;
         if (kind !== CREDENTIAL && !prior) {
             if (this.privateChars + form.length > MAX_PRIVATE_FORM_CHARS)
                 return this.unregistered(form.length);
             this.privateChars += form.length;
         }
-        this.forms.set(form, kind);
-        this.unicode ||= /[\u0080-\uffff]/.test(form);
+        this.forms.set(form, Math.max(prior, kind));
+        if (nextFrame)
+            this.frames.set(form, nextFrame);
+        else
+            this.frames.delete(form);
+        this.widestForm = Math.max(this.widestForm, form.length);
+        this.smallForms ||= kind < PRIVATE;
+        this.unicodeForms ||= /[\u0080-\uffff]/.test(form);
         this.views = {};
+        this.memo = new Map();
         for (const recipient of this.recipients)
-            recipient.store(form, kind);
+            recipient.store(form, kind, frame);
     }
     unregistered(length) {
         if (length >= this.unmatched)
             return;
         this.unmatched = length;
         this.views = {};
+        this.memo = new Map();
         for (const recipient of this.recipients)
             recipient.unregistered(length);
     }
-    register(value, kind) {
-        const forms = [value, new URLSearchParams({ value }).toString().slice(6)];
-        try {
-            forms.push(encodeURIComponent(value), encodeURI(value));
-        }
-        catch {
-            // A lone surrogate has no URI form; its other forms remain.
-        }
+    /** Every form of `value`. Its first `frame` units are public auth framing, which no form's
+     * fragment index starts in: a base64 form's framing ends at its last unit encoding only it. */
+    register(value, kind, frame = 0) {
+        const encodings = (text) => {
+            const forms = [text, new URLSearchParams({ value: text }).toString().slice(6)];
+            try {
+                forms.push(encodeURIComponent(text), encodeURI(text));
+            }
+            catch {
+                // A lone surrogate has no URI form; its other forms remain.
+            }
+            return forms;
+        };
+        const forms = encodings(value);
+        const partial = frame > 0 && frame < Infinity;
+        const framing = partial ? encodings(value.slice(0, frame)).map((form) => form.length) : [];
         const encoded = base64(value);
-        forms.push(encoded, encoded.replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, ""));
-        for (const form of forms)
+        const bytes = partial ? Math.floor((encoder.encode(value.slice(0, frame)).length * 4) / 3) : 0;
+        for (const form of [encoded, encoded.replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "")]) {
+            forms.push(form);
+            framing.push(bytes);
+        }
+        forms.forEach((form, index) => {
+            const framed = frame === Infinity ? frame : frame ? (framing[index] ?? 0) : 0;
             for (const variant of wireForms(form))
-                this.store(variant, kind);
+                this.store(variant, kind, framed);
+        });
     }
     /** The request receives existing and future secrets from every context. */
     include(source) {
@@ -526,19 +1174,27 @@ export class SentSecrets {
             return;
         source.recipients.add(this);
         for (const [form, kind] of source.forms)
-            this.store(form, kind);
+            this.store(form, kind, source.frames.get(form) ?? 0);
         this.unregistered(source.unmatched);
     }
-    add(value) {
+    /** A credential, as sent and in the auth framings a vendor may echo it with. Its first
+     * `frame` units, such as a header's `Basic `, are framing too. */
+    add(value, frame = 0) {
         if (value.length < MIN_SECRET_LENGTH)
             return;
-        for (const form of [value, `Bearer ${value}`, `token ${value}`])
-            this.register(form, CREDENTIAL);
+        this.register(value, CREDENTIAL, frame);
+        for (const framing of ["Bearer ", "token "])
+            this.register(framing + value, CREDENTIAL, framing.length + frame);
     }
     /** Explicit secrets use the same floor as every other credential. */
     secret(value) {
         this.add(value);
     }
+    /** An identifier sent beside a credential, such as a confidential client's ID or a Basic
+     * username: matched whole only, since consent URLs and metadata carry its parts by design. */
+    identifier(value) {
+        this.add(value, Infinity);
+    }
     /** Submitted writeOnly strings and numbers join this request's set, including property
      * names inside a private object. Empty strings, booleans, and null carry no text. */
     arguments(args, schema) {
@@ -550,7 +1206,7 @@ export class SentSecrets {
                 return;
             if (value.length > MAX_PRIVATE_FORM_CHARS)
                 return this.unregistered(value.length);
-            this.register(value, value.length < MIN_SECRET_LENGTH ? SHORT : PRIVATE);
+            this.register(value, value.length < SUBSTRING_LENGTH ? TINY : value.length < MIN_SECRET_LENGTH ? SHORT : PRIVATE);
         };
         const collect = (value, depth) => {
             if (++nodes > MAX_ARGUMENT_NODES || depth > MAX_ARGUMENT_DEPTH)
@@ -570,37 +1226,42 @@ export class SentSecrets {
         };
         visitPrivateCallArguments(args, schema, (value) => collect(value, 0));
     }
-    /** Structural fields must be refused, never repaired into different URLs. */
+    /** Structural fields must be refused, never repaired into different URLs. A field the checker
+     * would change under the boundary's rules is refused: one holding a whole form or any K-unit
+     * run of one, in any view of the lattice. With `ignoreCase`, as for a host URL parsing
+     * lowercased, the lowercased field is also checked against lowercased forms. */
     contains(value, ignoreCase = false) {
-        if (value.length >= this.unmatched)
+        if (value.length >= Math.min(this.unmatched, this.unmatched < Infinity ? FRAGMENT_LENGTH : Infinity))
             return true;
         if (!this.forms.size)
             return false;
-        const found = { spans: [], short: false, exact: false };
-        const lower = () => new Matcher([...this.forms].flatMap(([form, kind]) => wireForms(form.toLowerCase()).map((low) => [low, kind])));
-        const matcher = ignoreCase ? (this.views.lower ??= lower()) : this.matcher();
-        if (value.length >= matcher.unindexed)
+        if (this.checked([value], [TEXT], this.scan(false))[0] !== value)
             return true;
-        const scanned = matcher.scan(new Source(ignoreCase ? value.toLowerCase() : value), found, { work: Infinity });
-        return !scanned || found.spans.length > 0;
+        return ignoreCase && this.folded().contains(value.toLowerCase());
     }
     containsUrl(value) {
         const { hosts, components, joined } = credentialUrlViews(value);
         return (hosts.some((host) => this.contains(host, true)) || [...components, ...joined].some((view) => this.contains(view)));
     }
     header(value) {
-        this.add(value);
         const framed = /^(?:Bearer|token|Basic)\s+(.+)$/i.exec(value);
+        this.add(value, framed ? value.length - framed[1].length : 0);
         if (!framed)
             return;
         this.add(framed[1]);
         if (/^Basic\s/i.test(value)) {
             try {
                 const decoded = atob(framed[1].replace(/-/g, "+").replace(/_/g, "/"));
-                this.add(decoded);
                 const colon = decoded.indexOf(":");
+                // Beside a password long enough to register, the username is an identifier, such as
+                // a client ID; beside none or a placeholder, it is the credential itself.
+                const paired = colon !== -1 && decoded.length - colon - 1 >= MIN_SECRET_LENGTH;
+                this.add(decoded, paired ? colon + 1 : 0);
                 if (colon !== -1) {
-                    this.add(decoded.slice(0, colon));
+                    if (paired)
+                        this.identifier(decoded.slice(0, colon));
+                    else
+                        this.add(decoded.slice(0, colon));
                     this.secret(decoded.slice(colon + 1));
                 }
             }
@@ -630,7 +1291,7 @@ export class SentSecrets {
         for (const [name, value] of url.searchParams) {
             if (explicitSecretName.test(name))
                 this.secret(value);
-            else if (sensitiveName.test(name))
+            else if (sensitiveName.test(name) && !continuationName.test(name))
                 this.add(value);
         }
         // The OAuth SDK sends token requests as form data. Do not read a body
@@ -647,15 +1308,80 @@ export class SentSecrets {
     }
     /** Serialized wire text about to be returned, stored, or paged, under payload rules. */
     text(value) {
-        return this.idle() ? value : this.wire(value, this.scan(true), 0, true, 0);
+        return this.idle() ? value : this.project(value, this.scan(true)).value;
     }
-    /** Copy only what changes, including non-enumerable Error fields; never retain a raw cause.
-     * Payload rules apply where downstream or guest data enters; envelopes repeat literal
-     * replacement. */
+    /** A plain-data snapshot of `value` with every match removed: own enumerable data properties
+     * (an error's own fields, non-enumerable ones included), read once each. Accessors are never
+     * invoked, except an error's stack and the accessors its class defines, read once into the
+     * copy. The original object is never returned, so nothing read later can differ from what was
+     * checked. Payload rules apply where downstream or guest data enters; the envelope pass at the
+     * agent boundary repeats every check except short private values, which would rewrite
+     * Connecta's own identifiers, counts and addresses. `values` applies payload rules to every
+     * value of a parsed vendor body but keeps its object keys, which result safety and projections
+     * match by name: a renamed key would hide a field from the rule that withholds it. JSON inside
+     * a string is a value, so its keys are still checked. The connector's result and failures are
+     * checked again under payload rules, keys included, at the `api()` boundary and the invocation. */
     redact(value, mode = "payload") {
         if (this.idle())
             return value;
-        return this.walk(value, this.scan(mode !== "envelope"), mode === "prose" || typeof value === "string", 0, 0);
+        return this.project(value, this.scan(mode !== "envelope"), mode === "values").value;
+    }
+    /** Whether payload redaction would change anything in `value`, for fields that must be
+     * refused rather than rewritten. */
+    changes(value) {
+        return !this.idle() && this.project(value, this.scan(true)).changed;
+    }
+    /** Relay state and links Connecta minted and authenticates are framing, not payload: they
+     * hold sealed downstream state or Connecta's own facts, never downstream text or arguments,
+     * and a coincidental match must not corrupt them. Never admit downstream-authored state
+     * here. Exact value membership survives JSON serialization within this request. */
+    mintedState(value) {
+        this.mintedStates.add(value);
+        return value;
+    }
+    /** Base64, or base64url with `url`, of bytes Connecta returns to an agent. No later pass
+     * reads through an encoding the output does not declare, so the bytes are checked first: as
+     * byte-valued units, as UTF-8 text, and through any base64 they carry, then the encoding
+     * itself. Content holding a match encodes the placeholder instead. Downstream content takes
+     * payload rules. `claims` is JSON Connecta assembled, such as a page cursor: its own names,
+     * counts and fingerprints beside downstream values it already redacted under payload rules.
+     * Every string in it is checked under payload rules, since each downstream value a cursor
+     * holds is one, and the whole text and its encoding under the boundary's, so Connecta's keys
+     * and counts never meet a short private value. Checked so, it is remembered as clean for later
+     * passes over the same set. */
+    encode(bytes, { url = false, claims = false } = {}) {
+        const binary = latin1(bytes);
+        const finish = (text) => {
+            const encoded = btoa(text);
+            return url ? encoded.replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "") : encoded;
+        };
+        if (this.idle())
+            return finish(binary);
+        const encoded = finish(binary);
+        const clean = claims
+            ? this.claimsClean(binary, encoded)
+            : this.checked([encoded], [BINARY], this.scan(true))[0] === encoded;
+        if (!clean)
+            return finish(REDACTED);
+        if (claims || encoded.length >= MEMO_UNITS)
+            this.memo.set(encoded, true);
+        return encoded;
+    }
+    /** Text pieces a provider reads as one lane, such as rich-text runs with metadata between
+     * them: checked joined, each match replaced in every piece it touches. */
+    parts(parts) {
+        if (this.idle())
+            return parts;
+        return this.checked(parts, parts.map(() => TEXT), this.scan(true));
+    }
+    /** Complete and unfinished forms in bounded text, all found against its original bytes.
+     * Replacing a complete match first could hide a longer open match containing it. Even a
+     * one-unit shared prefix is withheld: a read boundary gives no evidence it is public text.
+     * Each decoded layer sets aside a trailing escape the read cut short, which is withheld. */
+    redactOpenTail(text) {
+        if (this.idle())
+            return text;
+        return this.checked([text], [TEXT], this.scan(true), true)[0];
     }
     /** Credentials alone: later calls keep the private arguments they submit, and cached
      * catalogs never depend on one request's arguments. */
@@ -672,6 +1398,25 @@ export class SentSecrets {
     matcher() {
         return (this.views.matcher ??= new Matcher(this.forms));
     }
+    /** Short private forms, matched as substrings of payload text. */
+    shortMatcher() {
+        if (this.views.short === undefined) {
+            const forms = [...this.forms].filter(([, kind]) => kind === SHORT);
+            this.views.short = forms.length ? new Matcher(forms, SHORT) : null;
+        }
+        return this.views.short;
+    }
+    /** Forms with no indexed fragment, such as identifiers, matched whole. */
+    wholeMatcher() {
+        if (this.views.whole === undefined) {
+            const forms = [...this.forms].filter(([form, kind]) => kind >= PRIVATE && (this.frames.get(form) ?? 0) > form.length - FRAGMENT_LENGTH);
+            this.views.whole = forms.length ? new Matcher(forms) : null;
+        }
+        return this.views.whole;
+    }
+    fragments() {
+        return (this.views.fragments ??= new Fragments([...this.forms].filter(([, kind]) => kind >= PRIVATE).map(([form]) => [form, this.frames.get(form) ?? 0])));
+    }
     credentials() {
         if (!this.privateChars && this.unmatched === Infinity)
             return this;
@@ -679,266 +1424,912 @@ export class SentSecrets {
             const view = new SentSecrets();
             for (const [form, kind] of this.forms)
                 if (kind === CREDENTIAL)
-                    view.store(form, kind);
+                    view.store(form, kind, this.frames.get(form) ?? 0);
             this.views.credentials = view;
         }
         return this.views.credentials;
     }
-    /** Strings at least this long might hold a form that was never matched. */
-    floor(scan) {
-        return Math.min(scan.payload ? this.unmatched : Infinity, this.matcher().unindexed);
+    /** Every form lowercased, for fields such as hosts that reach output lowercased. */
+    folded() {
+        if (!this.views.folded) {
+            const view = new SentSecrets();
+            for (const [form, kind] of this.forms)
+                for (const low of wireForms(form.toLowerCase()))
+                    view.store(low, kind, this.frames.get(form) ?? 0);
+            this.views.folded = view;
+        }
+        return this.views.folded;
+    }
+    /** The shortest text that might hold something this set cannot check, which is withheld: a
+     * K-unit run of a value too large to register (or a whole short one), or of a form past the
+     * fragment index's or a matcher's capacity. Envelope scans rely on the payload scans for
+     * unregistered values. */
+    limit(scan) {
+        let limit = this.fragments().complete ? Infinity : FRAGMENT_LENGTH;
+        limit = Math.min(limit, this.wholeMatcher()?.unindexed ?? Infinity);
+        if (scan.payload && this.unmatched < Infinity)
+            limit = Math.min(limit, this.unmatched, FRAGMENT_LENGTH);
+        if (scan.payload)
+            limit = Math.min(limit, this.shortMatcher()?.unindexed ?? Infinity);
+        return limit;
     }
-    /** Every raw and JSON-unescaped match, mapped to source spans before any replacement. Text
-     * decodes one more layer while the last one could still hold an escape, up to
-     * MAX_DECODE_LEVELS counting the JSON strings it came from. Work beyond the call's budget
-     * or that depth returns undefined, which withholds the string. */
-    find(text, scan, escapes, level) {
-        const found = { spans: [], short: false, exact: false };
+    /** Whether an open tail could begin a form this set never registered or indexed. */
+    uncheckedTail() {
+        return this.unmatched < Infinity || this.matcher().unindexed < Infinity;
+    }
+    /** A form whole: a leaf, key, number, boolean or decoded view equal to one, as it stands or
+     * under JSON escapes. This is how a tiny private value is matched. */
+    whole(text) {
+        let view = text;
+        for (let layer = 0; view !== undefined && layer <= MAX_DECODE_LEVELS; layer++) {
+            if (view.length <= this.widestForm && this.forms.has(view.includes("%") ? wireForms(view)[0] : view))
+                return true;
+            // An escape is at most six units for one, so a longer text cannot decode to a form.
+            view = view.length <= 6 * this.widestForm && view.includes("\\") ? unescapeLayer(view)?.text : undefined;
+        }
+        return false;
+    }
+    /** Every K-unit run of a registered form, every identifier form, and in payload text every
+     * short private form, in the raw text and each JSON-unescaped layer, mapped to source spans
+     * before any replacement. A layer decodes while the one above holds an escape; each is scanned
+     * only around the escapes it decoded, since any other match was found a layer up. Work beyond
+     * the call's budget returns undefined, which withholds the text. */
+    spansOf(text, scan, short) {
+        const spans = [];
+        const fragments = this.fragments();
+        const matchers = [this.wholeMatcher(), short ? this.shortMatcher() : null].filter((matcher) => matcher !== null);
+        const scanners = Number(fragments.size > 0) + matchers.length;
+        if (!scanners)
+            return { spans, deep: false };
         const marks = markers(text);
-        for (let layer = 0, more = true; more; layer++) {
-            if (level + layer > MAX_DECODE_LEVELS || !spend(scan, 2 * text.length * (layer + 1)))
+        if (!spend(scan, 2 * text.length * scanners))
+            return undefined;
+        fragments.scan(text, 0, text.length, spans, marks);
+        for (const matcher of matchers)
+            if (!matcher.scan(text, 0, text.length, { spans }, scan.budget, marks))
                 return undefined;
-            let units = new Source(text);
-            for (let depth = 0; depth < layer; depth++)
-                units = new Unescaped(units);
-            if (!this.matcher().scan(units, found, scan.budget, marks))
+        const reach = Math.max(FRAGMENT_LENGTH, ...matchers.map((matcher) => matcher.widest));
+        const layers = [];
+        for (let upper = text; upper.includes("\\");) {
+            // Decoding a layer copies text past its escapes, far cheaper per unit than scanning it.
+            if (!spend(scan, Math.ceil(upper.length / 8)))
+                return undefined;
+            const layer = unescapeLayer(upper);
+            if (!layer)
+                break;
+            if (layers.length === MAX_DECODE_LEVELS)
+                return { spans, deep: true };
+            layers.push(layer);
+            const ranges = windows(layer, reach);
+            let units = 0;
+            for (let at = 0; at < ranges.length; at += 2)
+                units += ranges[at + 1] - ranges[at];
+            if (!spend(scan, 2 * units * scanners))
                 return undefined;
-            more = escapes && (units instanceof Unescaped ? units.decoded > 0 && units.slashes > 0 : text.includes("\\"));
+            const local = [];
+            for (let at = 0; at < ranges.length; at += 2) {
+                const [start, end] = [ranges[at], ranges[at + 1]];
+                fragments.scan(layer.text, start, end, local, undefined);
+                for (const matcher of matchers)
+                    if (!matcher.scan(layer.text, start, end, { spans: local }, scan.budget))
+                        return undefined;
+            }
+            const ordered = merged(local);
+            const base = spans.length;
+            for (let at = 0; at < ordered.length; at += 2)
+                push(spans, base, toSource(layers, ordered[at], false), toSource(layers, ordered[at + 1] - 1, true) + 1, marks);
+            upper = layer.text;
+        }
+        // Auth framing is never indexed, but an echo carrying it goes whole, as a header line does.
+        for (let at = 0; at < spans.length; at += 2) {
+            const framing = /(?:Bearer|token)(?: |\+|%20)$/.exec(text.slice(Math.max(0, spans[at] - 9), spans[at]));
+            if (framing)
+                spans[at] -= framing[0].length;
         }
-        return found;
+        return { spans, deep: false };
     }
-    /** A structured leaf, property name, or prose. A short private form withholds prose
-     * wherever it occurs, and a leaf only when the whole leaf is that form. */
-    string(value, scan, prose, level = 0) {
-        if (value.length >= this.floor(scan))
-            return REDACTED;
-        const found = this.find(value, scan, true, level);
-        if (!found || (scan.payload && (prose ? found.short : found.exact)))
-            return REDACTED;
-        return found.spans.length ? replace(value, found.spans) : value;
+    /** Add the span of an unfinished form the text ends inside, at any decoded layer. */
+    openSpans(text, spans) {
+        let open = -1;
+        for (let layer = 0, more = true; more; layer++) {
+            if (layer > MAX_DECODE_LEVELS) {
+                spans.push(0, text.length);
+                return;
+            }
+            let units = new Source(text);
+            const closed = [];
+            let decoded;
+            for (let depth = 0; depth <= layer; depth++) {
+                const view = new ClosedView(units);
+                closed.push(view);
+                units = depth < layer ? (decoded = new Unescaped(view)) : view;
+            }
+            const at = this.matcher().openAt(units);
+            for (const start of [at, ...closed.map((view) => view.open)])
+                if (start >= 0)
+                    open = open < 0 ? start : Math.min(open, start);
+            more = layer === 0 ? text.includes("\\") : decoded.decoded > 0 && decoded.slashes > 0;
+        }
+        if (open >= 0)
+            spans.push(open, text.length);
     }
-    /** A number, boolean, or null matching by its canonical text becomes a placeholder string. */
-    scalar(value, scan) {
-        const text = String(value);
-        if ((typeof value === "number" || typeof value === "bigint") && text.length >= this.floor(scan))
-            return REDACTED;
-        const found = this.find(text, scan, false, 0);
-        return !found || found.exact || found.spans.length ? REDACTED : value;
-    }
-    /** JSON objects, arrays, and string literals are parsed and walked, nested JSON strings
-     * included; their serialized bytes must then hold no literal the walk cannot see, such as
-     * one spanning tokens. Other text is prose or a structured leaf. */
-    wire(value, scan, depth, prose, level) {
-        if (value.length >= this.floor(scan))
-            return REDACTED;
-        if (level < MAX_DECODE_LEVELS && /^\s*["[{]/.test(value) && spend(scan, value.length)) {
-            let parsed;
-            try {
-                parsed = { json: JSON.parse(value) };
+    /** The one string checker. Every string that can reach an agent, an executor or storage is
+     * checked here, under the whole lattice: projection leaves and numbers, object keys, declared
+     * binary fields, the bytes of typed arrays and ArrayBuffers, cursor claims and every encoding
+     * Connecta produces, error fields, provider lanes, bounded reads and structural fields.
+     * `parts` is one lane: matched joined, raw and through its JSON layers, each match replaced in
+     * every part it touches, a tiny private value withholding a part it equals, and every part
+     * withheld that the set cannot fully check. Then every text and declared binary part is
+     * decoded in each of its text views (see textViews), its base64 and base64url runs and a
+     * declared field's whole content are decoded and checked as bytes, UTF-8 and nested base64,
+     * and so are byte parts; a part a decoded view matches is withheld whole. Each decode is
+     * charged to the call's budget, and a part it cannot pay for is withheld. A `bounded` lane is
+     * text cut short, which also loses an unfinished tail. Nothing else matches a string that is
+     * returned: the matching steps below are called only from here. */
+    checked(parts, kinds, scan, bounded = false) {
+        const safe = this.safeParts(parts, kinds, scan, bounded);
+        this.encodedLeaves(parts, kinds, safe, scan);
+        return safe;
+    }
+    /** Cursor claims: the whole text and its encoding under the boundary's rules, then every
+     * string in the JSON under payload rules. Keys and numbers are Connecta's own names and
+     * counts: a downstream value enters a cursor only as a string. */
+    claimsClean(binary, encoded) {
+        if (this.checked([encoded], [BINARY], this.scan(false))[0] !== encoded)
+            return false;
+        const text = utf8(binary);
+        const parsed = parse(text);
+        const strings = [];
+        const collect = (value) => {
+            if (typeof value === "string")
+                strings.push(value);
+            else if (value !== null && typeof value === "object")
+                for (const item of Object.values(value))
+                    collect(item);
+        };
+        if (parsed)
+            collect(parsed.json);
+        else
+            strings.push(text);
+        const scan = this.scan(true);
+        return strings.every((claim) => !this.project(claim, scan).changed);
+    }
+    /** The shortest base64 run inside a view that is decoded: long enough to carry the smallest
+     * piece this scan matches (see SHORT_RUN_UNITS). */
+    runUnits(scan) {
+        return scan.payload && this.shortMatcher() ? SHORT_RUN_UNITS : FRAGMENT_RUN_UNITS;
+    }
+    /** The text views base64 is found in: the text; one layer of its JSON escapes decoded; its
+     * percent escapes decoded; and its form decoding, a `+` read as a space with any percent
+     * escapes decoded, whether or not it holds one. Two decodes chained, such as percent escapes
+     * inside JSON escapes, are not a view. Undefined when the work budget cannot pay for them. */
+    textViews(text, scan) {
+        const escaped = text.includes("\\");
+        const percent = text.includes("%");
+        const plus = text.includes("+");
+        const decodes = Number(escaped) + Number(percent) + Number(plus);
+        if (!decodes)
+            return [text];
+        if (!spend(scan, decodes * Math.ceil(text.length / 8)))
+            return undefined;
+        const views = [text];
+        for (const view of [
+            escaped ? unescapeLayer(text)?.text : undefined,
+            percent ? percentDecoded(text, false) : undefined,
+            plus ? percentDecoded(text, true) : undefined,
+        ])
+            if (view !== undefined && !views.includes(view))
+                views.push(view);
+        return views;
+    }
+    /** Text and declared binary parts carrying base64 or base64url, in any text view, the whole
+     * view or a run inside it, and byte parts, whose decoded bytes or their UTF-8 text hold a
+     * match are withheld whole: no later pass reads through an encoding the output does not
+     * declare. A declared field is also decoded whole, as its reader decodes it. Every part's
+     * decoded views are matched together, as one lane between unmatched separators. Each decode
+     * is paid for from the call's work budget; a part the budget cannot check is withheld. */
+    encodedLeaves(parts, kinds, safe, scan) {
+        // A run decodes to a group of views, once per call however many parts repeat it, and so do
+        // byte parts; each part's groups are recorded as (part, group) pairs. Group -1 is content
+        // the work budget could not check, which withholds every part holding it.
+        const views = [];
+        const viewGroups = [];
+        const groups = new Map();
+        const byteGroups = new Map();
+        const pairLeaves = [];
+        const pairGroups = [];
+        let size = 0;
+        const minimum = this.runUnits(scan);
+        /** Views of bytes: the bytes themselves unless the lane already matched them, their UTF-8
+         * text when a form is not ASCII, and the base64 they carry. */
+        const add = (binary, group, level, self = true) => {
+            if (self) {
+                views.push(binary);
+                viewGroups.push(group);
             }
-            catch {
-                // Not JSON.
+            if (this.unicodeForms && /[\x80-\xff]/.test(binary)) {
+                if (!spend(scan, Math.ceil(binary.length / 8)))
+                    return false;
+                views.push(utf8(binary));
+                viewGroups.push(group);
+            }
+            if (level < MAX_ENCODED_LEVELS)
+                for (const run of encodedRuns(binary, minimum)) {
+                    if (!spend(scan, Math.ceil(run.length / 8)))
+                        return false;
+                    const inner = decodeBase64(run);
+                    if (inner && !add(inner, group, level + 1))
+                        return false;
+                }
+            return true;
+        };
+        const groupOf = (run) => {
+            let group = groups.get(run);
+            if (group === undefined) {
+                group = size++;
+                const bytes = spend(scan, Math.ceil(run.length / 8)) ? decodeBase64(run) : null;
+                if (bytes === null || (bytes && !add(bytes, group, 1)))
+                    group = -1;
+                groups.set(run, group);
             }
-            if (parsed) {
-                const { json } = parsed;
-                const walked = this.walk(json, scan, prose && typeof json === "string", depth, level + 1);
-                const text = walked === json ? value : JSON.stringify(walked);
-                const found = this.find(text, scan, false, level);
-                return found && !found.spans.length && text.length < this.floor(scan) ? text : REDACTED;
+            return group;
+        };
+        const bytesGroup = (bytes) => {
+            let group = byteGroups.get(bytes);
+            if (group === undefined) {
+                group = size++;
+                if (!add(bytes, group, 1, false))
+                    group = -1;
+                byteGroups.set(bytes, group);
             }
+            return group;
+        };
+        leaves: for (let index = 0; index < parts.length; index++) {
+            // The part as text matching left it: a run it replaced in place, such as a registered base64
+            // form, leaves no decodable remnant of K units; a match only decoding reveals withholds all.
+            // Binary and bytes any match changed are withheld whole already.
+            const kind = kinds[index];
+            const text = safe[index];
+            if (kind === NUMBER || text === REDACTED || this.memo.get(text) === true)
+                continue;
+            if ((!scan.payload && this.memo.has(text)) || (kind !== TEXT && text !== parts[index]))
+                continue;
+            const pair = (group) => {
+                if (group < 0) {
+                    safe[index] = REDACTED;
+                    return false;
+                }
+                pairLeaves.push(index);
+                pairGroups.push(group);
+                return true;
+            };
+            if (kind === BYTES) {
+                pair(bytesGroup(text));
+                continue;
+            }
+            const textViews = this.textViews(text, scan);
+            if (!textViews) {
+                safe[index] = REDACTED;
+                continue;
+            }
+            for (const view of textViews)
+                for (const run of encodedRuns(view, minimum))
+                    if (!pair(groupOf(run)))
+                        continue leaves;
+            if (kind === BINARY)
+                pair(groupOf(unpadded(text)));
         }
-        return this.string(value, scan, prose, level);
+        if (!views.length)
+            return;
+        const matched = new Uint8Array(size);
+        const withhold = (at) => (matched[viewGroups[at]] = 1);
+        try {
+            if (scan.payload && this.smallForms)
+                views.forEach((view, at) => this.whole(view) && withhold(at));
+            const lane = views.join("￿");
+            const matches = this.spansOf(lane, scan, scan.payload);
+            if (!matches)
+                return views.forEach((_, at) => withhold(at));
+            if (matches.deep)
+                views.forEach((view, at) => view.includes("\\") && withhold(at));
+            const starts = [];
+            for (let at = 0, offset = 0; at < views.length; offset += views[at++].length + 1)
+                starts.push(offset);
+            const ranges = merged(matches.spans);
+            for (let at = 0; at < ranges.length; at += 2) {
+                let [low, high] = [0, starts.length];
+                while (low < high) {
+                    const middle = (low + high) >>> 1;
+                    if (starts[middle] <= ranges[at])
+                        low = middle + 1;
+                    else
+                        high = middle;
+                }
+                for (let view = Math.max(0, low - 1); view < starts.length && starts[view] < ranges[at + 1]; view++)
+                    withhold(view);
+            }
+        }
+        finally {
+            for (let pair = 0; pair < pairLeaves.length; pair++)
+                if (matched[pairGroups[pair]])
+                    safe[pairLeaves[pair]] = REDACTED;
+        }
+    }
+    /** The parts' joined text, matched once, with each part's replacement. A tiny or short
+     * private value equal to a whole part withholds it. A number or a serialized container that
+     * a match touches is withheld whole. A bounded lane also loses an unfinished tail, and is
+     * withheld whole when the set could not tell where one begins. */
+    safeParts(parts, kinds, scan, bounded) {
+        if (!parts.length)
+            return parts;
+        const text = parts.join("");
+        // A form too large to register or index could begin anywhere in what was read.
+        const matches = bounded && this.uncheckedTail() ? undefined : this.spansOf(text, scan, scan.payload);
+        if (bounded && (!matches || matches.deep))
+            return parts.map((part) => part && REDACTED);
+        if (bounded)
+            this.openSpans(text, matches.spans);
+        let safe = matches ? replaceParts(parts, matches.spans) : this.leafByLeaf(parts, scan);
+        if (matches?.deep)
+            safe = safe.map((next, index) => (parts[index].includes("\\") ? REDACTED : next));
+        if (scan.payload && this.smallForms)
+            safe = safe.map((next, index) => (this.whole(parts[index]) ? REDACTED : next));
+        const limit = this.limit(scan);
+        if (limit < Infinity)
+            safe = withholdRuns(parts, safe, limit);
+        return safe.map((next, index) => (next !== parts[index] && kinds[index] === NUMBER ? REDACTED : next));
+    }
+    /** Leaves too large to match joined within the work budget: each is matched alone, in order,
+     * and one that does not fit is withheld without spending what a smaller one needs. A run
+     * crossing from one kept leaf into the next, through any short leaves between them, is then
+     * matched SEAM_UNITS deep on each side of the seam. */
+    leafByLeaf(parts, scan) {
+        const spans = parts.map((part) => {
+            const matches = this.spansOf(part, scan, scan.payload);
+            return !matches || (matches.deep && part.includes("\\")) ? undefined : matches.spans;
+        });
+        let pieces = [];
+        const seam = () => {
+            const text = pieces.map((piece) => piece.text).join("");
+            const matches = pieces.length > 1 ? this.spansOf(text, scan, scan.payload) : { spans: [], deep: false };
+            const ranges = matches ? merged(matches.spans) : [];
+            let offset = 0;
+            for (const piece of pieces) {
+                const end = offset + piece.text.length;
+                if (!matches || matches.deep)
+                    spans[piece.index] = undefined;
+                for (let at = 0; at < ranges.length; at += 2)
+                    if (ranges[at] < end && ranges[at + 1] > offset)
+                        spans[piece.index]?.push(piece.start + Math.max(0, ranges[at] - offset), piece.start + Math.min(piece.text.length, ranges[at + 1] - offset));
+                offset = end;
+            }
+            pieces = [];
+        };
+        parts.forEach((part, index) => {
+            if (!spans[index])
+                return seam();
+            if (part.length <= 2 * SEAM_UNITS)
+                return void pieces.push({ index, start: 0, text: part });
+            pieces.push({ index, start: 0, text: part.slice(0, SEAM_UNITS) });
+            seam();
+            pieces.push({ index, start: part.length - SEAM_UNITS, text: part.slice(-SEAM_UNITS) });
+        });
+        seam();
+        return parts.map((part, index) => {
+            const own = spans[index];
+            return !own ? part && REDACTED : own.length ? replace(part, own) : part;
+        });
     }
-    /** Iterative and copy-on-write: only containers on a changed path are copied. A container's
-     * entries are counted against the node budget before it is walked; a cycle or a container
-     * past MAX_WALK_DEPTH is withheld, and one past the node budget is checked as serialized text. */
-    walk(value, scan, prose, depth, level) {
-        const stack = [];
+    /** Serialized JSON whose keys, syntax and leaves together hold a K-unit run of a form: one
+     * spanning tokens, which no leaf holds alone, withholds the whole text. A run inside one
+     * string or number is a leaf's, already matched in the projection. */
+    spansTokens(text, scan) {
+        if (!this.fragments().size)
+            return false;
+        if (!spend(scan, 2 * text.length))
+            return true;
+        const spans = [];
+        this.fragments().scan(text, 0, text.length, spans, undefined);
+        if (!spans.length)
+            return false;
+        const tokens = jsonTokens(text);
+        const ranges = merged(spans);
+        for (let at = 0; at < ranges.length; at += 2) {
+            let [low, high] = [0, tokens.length / 2];
+            while (low < high) {
+                const middle = (low + high) >>> 1;
+                if (tokens[middle * 2 + 1] <= ranges[at])
+                    low = middle + 1;
+                else
+                    high = middle;
+            }
+            if (low * 2 >= tokens.length || tokens[low * 2] > ranges[at] || tokens[low * 2 + 1] < ranges[at + 1])
+                return true;
+        }
+        return false;
+    }
+    /** The output boundary. One walk reads every field once, from its descriptor, and projects
+     * every string and number leaf in serialization order, nested JSON strings parsed and errors'
+     * own fields included, declared binary fields and the bytes and numbers typed binary holds
+     * among them; the one checker matches the joined projection, so a form split across adjacent
+     * leaves is found, and only the affected piece of each leaf is written back. Keys and scalars
+     * go through the same checker alone. Fixed framing words and tags, outcome booleans, and on an
+     * error its classification code and a name its registered class gives it (redaction-identity's
+     * fixed allowlist) are kept: nothing downstream chooses them. Every other field is matched,
+     * whatever its name; an error's other name is projected like any field and withheld whole when
+     * anything changes any part of it.
+     *
+     * What returns is what was checked, and only JSON data: strings, numbers, booleans, null,
+     * plain objects and arrays, a fresh built-in Uint8Array, and error copies. A caller's container
+     * is returned as it stands only as verified plain data, so a later read returns the same
+     * values: its prototype is Object.prototype, Array.prototype or null, nothing on its chain is a
+     * toJSON, it holds no symbol field and an array no field but its indices (a hole checked
+     * through its prototypes), every field is a data property this walk read, and nothing in it
+     * changed. Anything else is a copy. An error always is, of its own class, with the accessors in
+     * ERROR_ACCESSORS and those its chain defines read once into fields and a toJSON shadowed, never
+     * read; an object of any other class is plain data, its chain's accessors unread; an array that
+     * is not plain is a plain array of its indices; a String, Number or Boolean wrapper is its
+     * primitive. A typed array, DataView or ArrayBuffer becomes a fresh Uint8Array of the bytes it
+     * held, which are checked as bytes, and as numbers with any other elements it held. A function
+     * or symbol is withheld. A container's own accessor is never invoked: its copy leaves it out,
+     * or holds the placeholder at an array index. A toJSON is called once, as serialization would,
+     * and replaced by its checked result. A change copies every container on its path on first
+     * write, so no caller's value is ever mutated, and a container past the node budget is
+     * withheld whole. Copies hold writable, configurable data properties and keep the identity
+     * facts registered in redaction-identity. */
+    project(value, scan, keepKeys = false) {
+        const parts = [];
+        const kinds = [];
+        const frames = [];
+        const slots = [];
+        const owners = [];
+        // Structural changes found while walking: a withheld or checked field, a copied container.
+        const replaced = [];
+        // Caller's arrays that are not plain data: copied even where nothing in them changed.
+        const copied = [];
+        const nested = [];
         const active = new Set();
-        const visit = (item, prose, depth) => {
-            if (typeof item === "string")
-                return this.wire(item, scan, depth, prose, level);
-            if (item === null || typeof item === "number" || typeof item === "bigint" || typeof item === "boolean")
-                return scan.payload ? this.scalar(item, scan) : item;
+        // Keys and scalars repeat across rows; each is checked once per call.
+        const seen = { keys: new Map(), scalars: new Map() };
+        // Errors' unregistered names, as walked: a copy whose name changed holds the placeholder.
+        const named = [];
+        // Typed binary: where its copy was put, and the leaves its numbers and bytes span.
+        const binaries = [];
+        // The accessors each prototype's chain defines, found once per call.
+        const chains = new Map();
+        let changed = false;
+        const touch = (owner) => {
+            changed = true;
+            if (owner >= 0)
+                nested[owner].dirty = true;
+        };
+        const withheld = (owner) => {
+            touch(owner);
+            return REDACTED;
+        };
+        /** A key or scalar's text, through the one checker alone. */
+        const check = (cache, text, kind) => {
+            let result = cache.get(text);
+            if (result === undefined)
+                cache.set(text, (result = this.checked([text], [kind], scan)[0]));
+            return result;
+        };
+        const replace = (frame, slot, next, owner) => {
+            replaced.push([frame, slot, next]);
+            touch(owner);
+        };
+        const leaf = (text, kind, frame, slot, owner) => {
+            parts.push(text);
+            kinds.push(kind);
+            frames.push(frame);
+            slots.push(slot);
+            owners.push(owner);
+        };
+        /** A field put on a copy or on parsed JSON: an array index by assignment, any other key as a
+         * writable, configurable data property, enumerable as it was. A frozen or read-only original
+         * never makes a write throw, and no inherited setter runs. */
+        const put = (holder, slot, next, enumerable = true) => {
+            if (typeof slot === "number")
+                holder[slot] = next;
+            else
+                Object.defineProperty(holder, slot, {
+                    value: next,
+                    writable: true,
+                    configurable: true,
+                    enumerable: Object.getOwnPropertyDescriptor(holder, slot)?.enumerable ?? enumerable,
+                });
+        };
+        /** A caller's container copied from its descriptors, never invoking an accessor: an array as
+         * a plain array of its indices, a hole staying one and an accessor the placeholder; a plain
+         * object as its own data fields. */
+        const shallow = (frame) => {
+            const item = frame.target;
+            if (Array.isArray(item)) {
+                const length = item.length;
+                const out = [];
+                out.length = length;
+                for (let index = 0; index < length; index++) {
+                    const descriptor = Object.getOwnPropertyDescriptor(item, index);
+                    if (descriptor)
+                        out[index] = "value" in descriptor ? descriptor.value : REDACTED;
+                }
+                return redactedCopyOf(item, out);
+            }
+            const out = Object.create(Object.getPrototypeOf(item));
+            for (const name of Object.getOwnPropertyNames(item)) {
+                const descriptor = Object.getOwnPropertyDescriptor(item, name);
+                if ("value" in descriptor)
+                    put(out, name, descriptor.value, descriptor.enumerable);
+            }
+            return redactedCopyOf(item, out);
+        };
+        // toJSON results, which replace their container in its slot and may be copied after.
+        const serialized = new Set();
+        /** A caller's container walked in a slot. A toJSON result is remembered there, so a copy it
+         * gets replaces it in that slot. */
+        const walked = (frame, item, slot, owned) => {
+            const own = { target: item, shared: !owned, parent: frame, slot };
+            if (!owned && serialized.has(item))
+                (frame.children ??= new Map()).set(slot, own);
+            return own;
+        };
+        const writable = (frame) => {
+            if (!frame.shared)
+                return frame.target;
+            if (!frame.copy) {
+                frame.copy = shallow(frame);
+                put(writable(frame.parent), frame.slot, frame.copy);
+            }
+            return frame.copy;
+        };
+        /** The accessors a prototype's chain defines below Object.prototype, by name. */
+        const accessorsOf = (prototype) => {
+            let names = chains.get(prototype);
+            if (!names) {
+                names = [];
+                for (let at = prototype; at && at !== Object.prototype; at = Object.getPrototypeOf(at))
+                    for (const name of Object.getOwnPropertyNames(at)) {
+                        const descriptor = Object.getOwnPropertyDescriptor(at, name);
+                        if (descriptor && !("value" in descriptor) && !names.includes(name))
+                            names.push(name);
+                    }
+                chains.set(prototype, names);
+            }
+            return names;
+        };
+        const visit = (item, frame, slot, depth, level, owner, owned) => {
+            if (typeof item === "string") {
+                if (this.mintedStates.has(item))
+                    return item;
+                if (level < MAX_DECODE_LEVELS && /^\s*["[{]/.test(item) && spend(scan, item.length)) {
+                    const parsed = parse(item);
+                    if (parsed) {
+                        const entry = { frame, slot, json: undefined, owner, crossing: false, dirty: false };
+                        entry.crossing = this.spansTokens(item, scan);
+                        const index = nested.push(entry) - 1;
+                        // Parsed JSON is this walk's own, so it is written in place.
+                        const holder = { target: entry, shared: false, parent: undefined, slot: "json" };
+                        entry.json = visit(parsed.json, holder, "json", depth + 1, level + 1, index, true);
+                        return item;
+                    }
+                }
+                leaf(item, TEXT, frame, slot, owner);
+                return item;
+            }
+            if (typeof item === "number" || typeof item === "bigint") {
+                leaf(String(item), NUMBER, frame, slot, owner);
+                return item;
+            }
+            if (typeof item === "boolean" || item === null)
+                return check(seen.scalars, String(item), NUMBER) === String(item) ? item : withheld(owner);
+            // A function carries no data, and every exit's serializer would call a toJSON it holds; a
+            // symbol carries none either. Both are withheld.
+            if (typeof item === "function" || typeof item === "symbol")
+                return withheld(owner);
             if (typeof item !== "object")
                 return item;
             if (active.has(item) || depth > MAX_WALK_DEPTH)
-                return REDACTED;
-            const names = Array.isArray(item) ? undefined : Object.getOwnPropertyNames(item);
-            const size = names ? names.length : item.length;
+                return withheld(owner);
+            active.add(item);
+            try {
+                return container(item, frame, slot, depth, level, owner, owned);
+            }
+            catch {
+                return withheld(owner); // A proxy trap or a toJSON that threw.
+            }
+            finally {
+                active.delete(item);
+            }
+        };
+        /** A child that changed: written into parsed JSON this walk owns, or recorded as a change
+         * to a caller's container. */
+        const settle = (frame, slot, next, owner) => {
+            if (frame.shared)
+                return replace(frame, slot, next, owner);
+            put(frame.target, slot, next);
+            touch(owner);
+        };
+        /** Entries within the node budget are walked; a container past it is withheld whole. */
+        const fits = (size) => {
             if (size > scan.budget.nodes)
-                return this.serialized(item, scan, level);
+                return false;
             scan.budget.nodes -= size;
-            if (!size)
-                return item;
-            active.add(item);
-            const typed = item instanceof Error || typeof item.retryable === "boolean";
-            stack.push({ item, names, size, index: 0, prose, depth, typed, key: "", name: "", field: undefined });
-            return OPEN;
+            return true;
         };
-        // Settle the top frame's next entry, drop it, or open its container.
-        const enter = (frame) => {
-            const { item, names } = frame;
-            if (!names)
-                return visit((frame.field = item[frame.index]), frame.prose, frame.depth + 1);
-            const key = (frame.key = frame.name = names[frame.index]);
-            const descriptor = Object.getOwnPropertyDescriptor(item, key);
-            let prose = PROSE_KEYS.has(key);
-            if (descriptor && "value" in descriptor)
-                frame.field = descriptor.value;
-            // V8 lazily renders Error.stack through an own accessor. Snapshot it
-            // before rebuilding an error, so its diagnostic is redacted too.
-            else if (key === "stack" && item instanceof Error) {
-                frame.field = item.stack;
-                prose = true;
-            }
-            // JSON and errors carry data properties. A downstream-authored getter
-            // is not a safe way to expose a diagnostic to an agent.
-            else
-                return DROP;
-            const field = frame.field;
-            if (!FRAMING_KEYS.has(key))
-                frame.name = this.string(key, scan, false);
-            if ((typeof field === "string" && TAGS.has(`${key}:${field}`)) ||
-                (FACTS.has(key) && (typeof field === "boolean" || typeof field === "number")))
-                return field;
-            if (frame.typed && (key === "code" || key === "name") && typeof field === "string")
-                return this.credentials().string(field, { ...scan, payload: false }, false);
-            if (key === "blob" && "uri" in item && typeof field === "string")
-                return this.blob(field, scan);
-            const child = key === "content" ? this.joinedContent(field, scan, frame.depth, level) : field;
-            return visit(child, prose, frame.depth + 1);
+        /** A declared base64 field: a leaf the checker also decodes whole, unless this set already
+         * found the same content clean. */
+        const declared = (text, frame, slot, owner) => {
+            if (this.memo.get(text) !== true && (scan.payload || !this.memo.has(text)))
+                leaf(text, BINARY, frame, slot, owner);
+            return text;
         };
-        // Record a settled entry. The first change copies the container's earlier entries.
-        const settle = (frame, value) => {
-            const { item, names, index } = frame;
-            if (!frame.copy) {
-                if (value === frame.field && frame.name === frame.key)
-                    return;
-                if (!names)
-                    frame.copy = item.slice(0, index);
+        /** Typed binary as the fresh Uint8Array of its bytes. Its leaves are the numbers JSON shows
+         * for it and for its copy, each element's and each byte's, and its bytes; a match in any
+         * withholds it whole, as does a size past the node budget. */
+        const typed = ({ bytes, elements }, frame, slot, owner) => {
+            const numbers = elements ? new elements(bytes.buffer) : undefined;
+            if (!fits(bytes.length + (numbers?.length ?? 0) + 1) || !spend(scan, Math.ceil(bytes.length / 8)))
+                return withheld(owner);
+            // The leaves write nowhere: the copy's slot is settled once they are checked.
+            const sink = { target: [], shared: false, parent: undefined, slot };
+            const start = parts.length;
+            if (numbers)
+                for (let index = 0; index < numbers.length; index++)
+                    leaf(String(numbers[index]), NUMBER, sink, index, owner);
+            for (let index = 0; index < bytes.length; index++)
+                leaf(DECIMAL[bytes[index]], NUMBER, sink, index, owner);
+            leaf(latin1(bytes), BYTES, sink, 0, owner);
+            binaries.push([frame, slot, owner, start, parts.length]);
+            return bytes;
+        };
+        const container = (item, frame, slot, depth, level, owner, owned) => {
+            const error = item instanceof Error;
+            if (!error && !owned) {
+                const held = binaryOf(item);
+                if (held)
+                    return typed(held, frame, slot, owner);
+                const primitive = unboxed(item);
+                if (primitive)
+                    return visit(primitive.value, frame, slot, depth + 1, level, owner, false);
+                // What serialization would read: a toJSON result, checked in place of the container.
+                const toJSON = inherited(item, "toJSON", WITHHELD_ACCESSOR);
+                if (toJSON === WITHHELD_ACCESSOR)
+                    return withheld(owner);
+                if (typeof toJSON === "function") {
+                    const result = toJSON.call(item, String(slot));
+                    if (result !== null && typeof result === "object")
+                        serialized.add(result);
+                    return visit(result, frame, slot, depth + 1, level, owner, false);
+                }
+            }
+            return Array.isArray(item)
+                ? list(item, frame, slot, depth, level, owner, owned)
+                : record(item, error, frame, slot, depth, level, owner, owned);
+        };
+        /** An array's indices, each read once. A caller's array stands only as verified plain data;
+         * one that is not is copied as a plain array of its indices, which drops other fields. */
+        const list = (item, frame, slot, depth, level, owner, owned) => {
+            const length = item.length;
+            if (!fits(length))
+                return withheld(owner);
+            const own = walked(frame, item, slot, owned);
+            for (let index = 0; index < length; index++) {
+                const descriptor = Object.getOwnPropertyDescriptor(item, index);
+                if (!descriptor) {
+                    // A hole serializes as what its prototypes hold at its index: a data field is checked
+                    // and copied in, an accessor is withheld unread, and nothing leaves the hole as it is.
+                    const found = owned ? undefined : inherited(item, String(index), WITHHELD_ACCESSOR);
+                    if (found === WITHHELD_ACCESSOR)
+                        replace(own, index, REDACTED, owner);
+                    else if (found !== undefined) {
+                        replaced.push([own, index, found]);
+                        const next = visit(found, own, index, depth + 1, level, owner, owned);
+                        if (next !== found)
+                            settle(own, index, next, owner);
+                    }
+                    continue;
+                }
+                if (!("value" in descriptor)) {
+                    replace(own, index, REDACTED, owner);
+                    continue;
+                }
+                const next = visit(descriptor.value, own, index, depth + 1, level, owner, owned);
+                if (next !== descriptor.value)
+                    settle(own, index, next, owner);
+            }
+            // Fields other than its indices are not read: JSON, which the MCP wire, the result stash and
+            // every executor marshal with, never serializes them, and listing them would allocate a
+            // string per index.
+            if (!owned && (Object.getPrototypeOf(item) !== Array.prototype || Object.getOwnPropertySymbols(item).length > 0))
+                copied.push(own);
+            return item;
+        };
+        const record = (item, error, frame, slot, depth, level, owner, owned) => {
+            const names = Object.getOwnPropertyNames(item);
+            if (!fits(names.length))
+                return withheld(owner);
+            const prototype = Object.getPrototypeOf(item);
+            let plain = owned ||
+                (!error &&
+                    (prototype === Object.prototype || prototype === null) &&
+                    Object.getOwnPropertySymbols(item).length === 0);
+            // Every field is read once, and every decision below reads what was read.
+            const keys = [];
+            const values = [];
+            const visible = [];
+            for (const name of names) {
+                const descriptor = Object.getOwnPropertyDescriptor(item, name);
+                if (!descriptor)
+                    continue;
+                // An error is never replaced by its toJSON: its copy shadows one.
+                if ("value" in descriptor)
+                    values.push(error && name === "toJSON" ? undefined : descriptor.value);
+                else if (error && descriptor.get && ERROR_ACCESSORS.has(name)) {
+                    // V8 renders Error.stack through an own accessor: it is read once into the copy.
+                    try {
+                        values.push(Reflect.apply(descriptor.get, item, []));
+                    }
+                    catch {
+                        continue; // A getter that throws leaves its field out of the copy.
+                    }
+                }
                 else {
-                    frame.copy = item instanceof Error ? Object.create(Object.getPrototypeOf(item)) : {};
-                    for (const key of names.slice(0, index))
-                        define(frame.copy, item, key, key, item[key]);
+                    // Never invoked: the container is copied without it.
+                    plain = false;
+                    continue;
                 }
+                keys.push(name);
+                visible.push(descriptor.enumerable === true);
             }
-            if (!names)
-                frame.copy[index] = value;
-            else if (value !== DROP)
-                define(frame.copy, item, frame.key, frame.name, value);
+            // A key is checked like any text; an error's toJSON shadow keeps its name, so it shadows.
+            // `keepKeys` leaves the walked value's own keys, never those of JSON inside a string.
+            const rename = (key) => FRAMING_KEYS.has(key) || (error && key === "toJSON") || (keepKeys && level === 0 && !error)
+                ? key
+                : check(seen.keys, key, TEXT);
+            const renamed = keys.map(rename);
+            if (renamed.some((name, index) => name !== keys[index]))
+                plain = false;
+            // An error's copy is of its class. Every accessor its chain defines, such as DOMException's
+            // name and message or an SDK error's status, and whatever the chain answers for the names
+            // in ERROR_ACCESSORS, is read once and held as a checked field under its checked name, so
+            // no later read of the copy invokes a getter. A toJSON, data or accessor, is never read: the
+            // copy shadows it, so no serializer can run. Any other copy is plain data.
+            let extras;
+            if (error && prototype) {
+                for (const name of [...ERROR_ACCESSORS, ...accessorsOf(prototype)]) {
+                    if (name === "toJSON" || keys.includes(name) || extras?.some(([taken]) => taken === name))
+                        continue;
+                    if (!(name in item))
+                        continue;
+                    try {
+                        (extras ??= []).push([name, Reflect.get(item, name)]);
+                    }
+                    catch {
+                        (extras ??= []).push([name, undefined]); // A getter that throws leaves its field shadowed.
+                    }
+                }
+                if (!keys.includes("toJSON") && inherited(item, "toJSON", WITHHELD_ACCESSOR) !== undefined)
+                    (extras ??= []).push(["toJSON", undefined]);
+            }
+            // A container walked as it stands: a caller's, copied on first write, or parsed JSON this
+            // walk owns, written in place. Any other is copied now, field by field.
+            const own = plain
+                ? walked(frame, item, slot, owned)
+                : {
+                    target: Object.create(error || prototype === null ? prototype : Object.prototype),
+                    shared: false,
+                    parent: frame,
+                    slot,
+                };
+            const out = own.target;
+            const field = (name) => values[keys.indexOf(name)];
+            const count = keys.length + (extras?.length ?? 0);
+            for (let index = 0; index < count; index++) {
+                const extra = index >= keys.length ? extras[index - keys.length] : undefined;
+                const key = extra ? extra[0] : keys[index];
+                const value = extra ? extra[1] : values[index];
+                const name = extra ? rename(key) : renamed[index];
+                // Two keys renamed alike keep the first; the second's leaves write nowhere.
+                const target = !plain && Object.hasOwn(out, name) ? { target: {}, shared: false, parent: undefined, slot: name } : own;
+                let next;
+                if ((typeof value === "string" && TAGS.has(`${key}:${value}`)) ||
+                    (typeof value === "boolean" && FACTS.has(key)) ||
+                    (error && typeof value === "string" && key === "code" && classificationCode(value) !== undefined))
+                    next = value;
+                // An error's name is kept only as one its registered class gives it. Any other is a field
+                // like any other, projected with its neighbours, and withheld whole once anything changes
+                // any part of it; the copy keeps its class.
+                else if (error && key === "name" && typeof value === "string" && keptErrorName(prototype, value))
+                    next = value;
+                else if (typeof value === "string" && binaryField(field, key))
+                    next = declared(value, target, name, owner);
+                else {
+                    next = visit(value, target, name, depth + 1, level, owner, owned);
+                    if (error && key === "name" && typeof value === "string" && target === own)
+                        named.push([out, name, value]);
+                }
+                if (target !== own)
+                    continue;
+                if (!plain)
+                    put(out, name, next, extra ? false : visible[index]);
+                else if (next !== value)
+                    settle(own, name, next, owner);
+            }
+            if (plain)
+                return item;
+            touch(owner);
+            return redactedCopyOf(item, out);
         };
-        let settled = visit(value, prose, depth);
-        while (stack.length) {
-            const frame = stack[stack.length - 1];
-            if (settled === OPEN)
-                settled = enter(frame);
-            if (settled === OPEN)
-                continue;
-            settle(frame, settled);
-            settled = OPEN;
-            if (++frame.index < frame.size)
-                continue;
-            stack.pop();
-            active.delete(frame.item);
-            const { item, copy } = frame;
-            settled = !copy ? item : item instanceof Error ? carryFailureFacts(item, copy) : copy;
+        const root = { target: { value: undefined }, shared: false, parent: undefined, slot: "value" };
+        root.target["value"] = visit(value, root, "value", 0, 0, -1, false);
+        const safe = this.checked(parts, kinds, scan);
+        // Structure first, then the leaves inside it and typed binary, then nested JSON from the
+        // innermost out.
+        // A slot replaced by a toJSON result walked there takes the copy that result already got,
+        // never the original.
+        for (const [frame, slot, next] of replaced) {
+            const child = frame.children?.get(slot);
+            put(writable(frame), slot, child && child.target === next && child.copy ? child.copy : next);
         }
-        return settled;
-    }
-    /** A container larger than the node budget is scanned as serialized text, Error fields
-     * included: kept unchanged when nothing registered appears, otherwise withheld whole. */
-    serialized(item, scan, level) {
-        let text;
-        try {
-            text = JSON.stringify(item, (_key, value) => value instanceof Error
-                ? Object.fromEntries(Object.getOwnPropertyNames(value).map((name) => [name, Reflect.get(value, name)]))
-                : value);
-        }
-        catch {
-            // A cycle or bigint cannot be serialized, so the container is withheld.
+        for (const frame of copied)
+            writable(frame);
+        let marker;
+        for (let index = 0; index < parts.length; index++) {
+            const next = safe[index];
+            const kind = kinds[index];
+            if (next === parts[index]) {
+                if (kind === BINARY && next.length >= MEMO_UNITS)
+                    this.memo.set(next, scan.payload);
+                continue;
+            }
+            const holder = writable(frames[index]);
+            // Declared binary is withheld as the encoded marker, itself checked; a typed number on an
+            // error is dropped rather than turned into text.
+            if (kind === BINARY) {
+                const encoded = btoa(REDACTED);
+                marker ??= this.checked([encoded], [BINARY], scan)[0] === encoded ? encoded : "";
+            }
+            put(holder, slots[index], kind === BINARY ? marker : kind === NUMBER && holder instanceof Error ? undefined : next);
+            touch(owners[index]);
         }
-        if (text === undefined || text.length >= this.floor(scan))
-            return REDACTED;
-        const found = this.find(text, scan, true, level);
-        return found && !found.spans.length && !(scan.payload && found.short) ? item : REDACTED;
-    }
-    /** Skill supporting files may contain arbitrary bytes, including echoes. */
-    blob(value, scan) {
-        let binary;
-        try {
-            binary = atob(value);
+        for (const [frame, slot, owner, start, end] of binaries) {
+            let clean = true;
+            for (let index = start; clean && index < end; index++)
+                clean = safe[index] === parts[index];
+            if (clean)
+                continue;
+            put(writable(frame), slot, REDACTED);
+            touch(owner);
         }
-        catch {
-            return this.string(value, scan, false);
-        }
-        // Byte-valued code units match ASCII forms directly. Bytes are data, never prose.
-        let redacted = this.string(binary, scan, false);
-        if (this.unicode && redacted !== REDACTED) {
-            // A UTF-8 view also detects non-ASCII and mixed escaped echoes. Never re-encode that
-            // view: an arbitrary supporting file may contain invalid UTF-8 or a leading BOM.
-            const view = new TextDecoder("utf-8", { fatal: false, ignoreBOM: true }).decode(Uint8Array.from(redacted, (char) => char.charCodeAt(0)));
-            if (this.string(view, scan, false) !== view)
-                redacted = REDACTED;
-        }
-        const encoded = redacted === binary ? value : btoa(redacted);
-        // A file's encoding can itself equal a secret. Withhold that file as
-        // a valid encoded placeholder, never insert prose into its base64 field.
-        if (this.string(encoded, scan, false) === encoded)
-            return encoded;
-        const withheld = btoa(REDACTED);
-        return this.string(withheld, scan, false) === withheld ? withheld : "";
-    }
-    /** Match across blocks before isError/JSON unwrapping concatenates them. */
-    joinedContent(value, scan, depth, level) {
-        if (!Array.isArray(value))
-            return value;
-        const blocks = value.filter((block) => block?.type === "text" && typeof block.text === "string");
-        if (blocks.length < 2)
-            return value;
-        for (const separator of ["", "\n"]) {
-            const joined = blocks.map((block) => block.text).join(separator);
-            const redacted = this.wire(joined, scan, depth, true, level);
-            if (redacted === blocks.map((block) => this.wire(block.text, scan, depth, true, level)).join(separator))
+        for (let index = nested.length - 1; index >= 0; index--) {
+            const entry = nested[index];
+            if (!entry.crossing && !entry.dirty)
                 continue;
-            let first = true;
-            return value.map((block) => {
-                if (!blocks.includes(block))
-                    return block;
-                const text = first ? redacted : "";
-                first = false;
-                return { ...block, text };
-            });
+            put(writable(entry.frame), entry.slot, entry.crossing ? REDACTED : JSON.stringify(entry.json));
+            touch(entry.owner);
         }
-        return value;
+        for (const [copy, slot, name] of named)
+            if (copy[slot] !== name)
+                put(copy, slot, REDACTED);
+        return { value: root.target["value"], changed };
     }
 }
 export function sentSecretsFor(ctx) {
-    let secrets = contexts.get(ctx);
-    if (!secrets) {
-        secrets = new SentSecrets();
-        contexts.set(ctx, secrets);
-    }
-    sentSecretsForRequest(ctx.requestScope ?? ctx).include(secrets);
-    return secrets;
+    return viewSecrets(ctx);
 }
 /** One identity per upstream request, including all discovery and call work. */
 export function sentSecretsForRequest(scope, secrets) {
-    let request = requests.get(scope);
-    if (!request) {
-        request = secrets ?? new SentSecrets();
-        requests.set(scope, request);
-    }
-    else if (secrets) {
+    const retained = requestOwner(scope).retained;
+    const request = (retained.secrets ??= secrets ?? new SentSecrets());
+    if (secrets)
         request.include(secrets);
-    }
     return request;
 }
 /** The agent-facing choke point. Apply to values before bridge serialization
  * and to serialized wire text, so JSON escapes and structured strings share
  * the same rule. Payloads were redacted where they entered; this boundary
- * repeats credential and literal private-value replacement around Connecta's
- * own envelopes, whose identifiers and counts are never private data. */
+ * repeats every check but short private values around Connecta's own
+ * envelopes, whose identifiers and counts are never private data. */
 export function redactAgentOutput(secrets, value) {
     return secrets.redact(value, "envelope");
 }
@@ -948,50 +2339,62 @@ export function redactAgentOutput(secrets, value) {
 export function agentOutputOperations(create, requestScope) {
     return Object.fromEntries(Object.keys(create(requestScope ?? {})).map((name) => [
         name,
-        async (...args) => {
+        authMethod((...args) => Effect.suspend(() => {
             const scope = requestScope ?? {};
             const secrets = sentSecretsForRequest(scope);
-            try {
-                return redactAgentOutput(secrets, await create(scope)[name](...args));
-            }
-            catch (error) {
-                throw redactAgentOutput(secrets, error);
-            }
-        },
+            const owner = requestOwner(scope);
+            if (!owner.open)
+                return Effect.fail(owner.controller.signal.reason);
+            return authCall(create(scope)[name], args).pipe(Effect.provideService(RequestScope, requestOwner(scope)), Effect.map((value) => redactAgentOutput(secrets, value)), Effect.mapError((error) => redactAgentOutput(secrets, error)));
+        })),
     ]));
 }
-/** Slot reads cover custom handlers too, including keys put in query strings. */
+/** Slot reads cover custom handlers too, including keys put in query strings. A field named
+ * as an identifier (an application or client ID, a username, a public key) is matched whole. */
+export function registerCredentialValues(secrets, values) {
+    for (const [field, value] of Object.entries(values ?? {})) {
+        if (explicitSecretName.test(field))
+            secrets.secret(value);
+        else if (identifierName.test(field))
+            secrets.identifier(value);
+        else
+            secrets.add(value);
+    }
+}
 export function trackCredentialReads(ctx) {
-    if (!ctx.credential || wrappedCredentials.has(ctx))
-        return;
-    wrappedCredentials.add(ctx);
-    const credential = ctx.credential;
-    ctx.credential = {
-        async get(field) {
-            const value = await credential.get(field);
-            if (value) {
-                const secrets = sentSecretsFor(ctx);
-                if (field && explicitSecretName.test(field))
-                    secrets.secret(value);
-                else
-                    secrets.add(value);
-            }
-            return value;
-        },
-        async getAll() {
-            const values = await credential.getAll();
-            for (const [field, value] of Object.entries(values ?? {})) {
-                if (explicitSecretName.test(field))
-                    sentSecretsFor(ctx).secret(value);
-                else
-                    sentSecretsFor(ctx).add(value);
-            }
-            return values;
-        },
-    };
+    wrapViewCredentials(ctx);
 }
+/** A connector's result or error as it enters: every connector's credentials and the
+ * request's private arguments, under payload rules. */
 export function redactSentSecrets(ctx, value) {
-    return sentSecretsFor(ctx).redact(value);
+    return requestSentSecrets(ctx).redact(value);
+}
+/** Everything the context's request sent: every connector's credentials and the
+ * request's private arguments, which a context's own set does not hold. */
+export function requestSentSecrets(ctx) {
+    sentSecretsFor(ctx);
+    return sentSecretsForRequest(ctx.requestScope ?? ctx);
+}
+/** Downstream text, or a parsed body, about to be cut short, trimmed, normalized or
+ * extracted from. Redact it whole first: a cut through an echoed form can leave a remnant
+ * shorter than any fragment the output boundary matches, and a normalized number or
+ * extracted substring may no longer hold the form at all. */
+export function redactBeforeCut(ctx, value) {
+    return requestSentSecrets(ctx).redact(value);
+}
+/** Base64, or base64url with `url`, of bytes or UTF-8 text Connecta returns to an agent: a
+ * download, an attachment, a REST body, a page cursor. Every such encoding goes through here,
+ * since no later pass reads through an encoding the output does not declare: the content is
+ * checked first with the request's set, and content holding a match encodes the placeholder.
+ * A cursor passes `claims`: connecta's own counts and fingerprints beside downstream values it
+ * already redacted (`redactSentSecrets`), checked under the boundary's rules. */
+export function encodeForAgent(ctx, content, options) {
+    return requestSentSecrets(ctx).encode(typeof content === "string" ? encoder.encode(content) : content, options);
+}
+/** Downstream text read only up to a bound, as a field an agent reads: whole forms are
+ * replaced, and so is a tail that begins one the read stopped inside. */
+export function redactBoundedRead(ctx, text) {
+    return requestSentSecrets(ctx).redactOpenTail(text);
 }
 /** Sanitize listing facts before any cache or consumer receives them. A name
  * cannot be rewritten without changing dispatch, and dropping one entry would