@zackbart/connecta 0.34.1 → 0.36.0

package/dist/providers/_shared/rest/value-safety.js

@@ -28,15 +28,25 @@
 //    statuses but never its text (`withholdsErrors`), unless its review
 //    found its errors cannot echo a stored secret (`vendorErrors`).
 //
-// Residual risk, as with Infisical: a secret a person typed into a free-text
+// Residual risk: a secret a person typed into a free-text
 // name, description, log line, or identifier is out of scope.
 //
+// Sent-secret redaction runs first, in the provider kit's parse pass, so a
+// rule that decides on a value can find the placeholder where the vendor
+// wrote what the rule matches. Every such decision input fails closed
+// (#703): an altered type discriminator applies every resource rule; an
+// altered label or type makes a secret record or a header rule; an altered
+// URL scheme or parameter name withholds the whole URL or its value; an
+// altered key withholds its value; a placeholder that may stand for a
+// credential's public prefix withholds the remainder after it.
+//
 // The key-name rules combine Cloudflare's and Vercel's former engines.
 // URL policy and exemptions are reviewed per vendor in its table (`keep`,
 // `fields`, `scopeMaps`, `envBodies`, `embeddedUrls`).
 import { ConnectorCallError } from "../../../errors.js";
-/** What a removed secret reads as. */
-export const REDACTED = "[redacted]";
+import { bareReferenceEnd, characterReferenceEnd, REDACTED, redactionAltered, splitRemainder, } from "../../../redaction-marker.js";
+/** What a removed secret reads as: the placeholder sent-secret redaction writes too. */
+export { REDACTED };
 /** Credential vocabulary over normalized names, matched anywhere; mirrors `scripts/value-safety.mjs`. */
 export const CREDENTIAL_WORDS = [
     "token",
@@ -127,6 +137,8 @@ const LABELLED_VALUE_FIELDS = [...ENV_VALUE_FIELDS, "args", "text"];
 const URL_PARAM_CONTAINS = /token|secret|password|passwd|signature|^sig$|key|auth|code|jwt|credential|bypass/i;
 const URL_PARAM_SUFFIX = /(token|secret|password|passphrase|key|signature|sig|credential|auth|authorization|jwt)$/;
 const URL_SHAPE = /^[a-z][a-z0-9+.-]*:\/\//i;
+/** What makes a string text rather than one whole URL: whitespace, quotes, escapes, entities, Markdown. */
+const TEXT = /[\s<>"'`\\]|&(?:#|[a-z]+;)|\]\(/i;
 /** The fields of a header, cookie, or query rule that hold the matched or set value. */
 const HEADER_RULE_VALUES = ["value", "values", "args"];
 /** Keys whose absolute URL is a route or redirect destination. */
@@ -195,6 +207,48 @@ export function credentialName(name) {
 function isRecord(value) {
     return typeof value === "object" && value !== null && !Array.isArray(value);
 }
+/** A rule's test over one decision input; an input redaction altered passes it (#703). */
+function decides(input, test) {
+    return typeof input === "string" && (redactionAltered(input) || test(input));
+}
+/** Value safety's own `@keys` placeholders, which no redaction of a vendor's key wrote. */
+const PLACEHOLDER_KEYS = new WeakSet();
+/**
+ * Whether redaction altered one of a record's keys, so no key-based decision
+ * about it can be read (#703). Parsed JSON keeps its keys; text the kit
+ * redacted whole and a result hook parsed after it (NDJSON, log streams) can
+ * carry the placeholder in one.
+ */
+function keysAltered(value) {
+    return !PLACEHOLDER_KEYS.has(value) && Object.keys(value).some(redactionAltered);
+}
+/** What may come before a URL's first placeholder when redaction took part of its scheme or authority. */
+const SCHEME_PREFIX = /^(?:[a-z][a-z0-9+.-]*(?::\/{0,2})?)?$/i;
+/**
+ * Whether redaction altered the scheme a whole-string URL decision reads
+ * (#703): the text is no longer URL-shaped, everything before its first
+ * placeholder could begin a URL, and more than placeholders follows it. A
+ * URL a vendor sends holds no whitespace.
+ */
+function alteredScheme(text) {
+    if (!redactionAltered(text) || URL_SHAPE.test(text) || /\s/.test(text))
+        return false;
+    const at = text.indexOf(REDACTED);
+    return SCHEME_PREFIX.test(text.slice(0, at)) && text.slice(at).replaceAll(REDACTED, "") !== "";
+}
+/**
+ * Every place a parameter name can sit in a URL's path, query, or fragment:
+ * each run before an `=` since the last `/`, `?`, `&`, `#`, `;`, or `=`. A
+ * name redaction altered, or a separator it took, leaves the placeholder in
+ * one of them.
+ */
+function parameterNames(text) {
+    return text.split(/[/?&#;]/).flatMap((part) => part.split("=").slice(0, -1));
+}
+/** Whether a fragment carries a placeholder other than the one value safety writes for a withheld fragment. */
+function alteredFragment(fragment) {
+    return redactionAltered(fragment) && fragment !== REDACTED;
+}
 /** A URL without userinfo, credential query parameters, or a credential-looking fragment; anything unparseable is withheld. */
 function sanitizeUrl(value, credentials = true) {
     let url;
@@ -224,8 +278,24 @@ function sanitizeUrl(value, credentials = true) {
     // An ordinary URL comes back exactly as the vendor sent it.
     return changed ? url.toString() : value;
 }
-/** Signing parameters that are a credential in any URL, with their `=` plain or encoded. */
-const SIGNING_PARAM = /x-(?:amz|goog)-(?:signature|credential|security-token)(?:=|%(?:25)*3d|&#0*61;?|&#x0*3d;?|&equals;?|\\u003d)/gi;
+// Embedded URLs in reviewed REST text lose credential-bearing queries and
+// fragments. AWS and Google signing parameters are withheld globally. The
+// destination scanner also drives generic write admission for copied placeholders.
+/** An `=`, plain or encoded, as a signing parameter's name ends with one. */
+const EQUALS = /=|%(?:25)*3d|&(?:amp(?:;|(?=#))|#0*38;?|#x0*26;?)*(?:#0*61;?|#x0*3d;?|equals;?)|\\u003d/iy;
+const EQUALS_BEFORE = new RegExp(`(?:${EQUALS.source})$`, "i");
+const AMP_REFERENCE = String.raw `&(?:amp(?:;|(?=#))|#0*38;?|#x0*26;?)*`;
+/** Fixed ASCII name units, matched in source coordinates without decoding or rewriting the text. */
+function signingName(text) {
+    return Array.from(text, (char) => {
+        const codes = [...new Set([char.toLowerCase().charCodeAt(0), char.toUpperCase().charCodeAt(0)])];
+        const hex = codes.map((code) => code.toString(16)).join("|");
+        const named = char === "-" ? "|(?:hyphen|dash);" : "";
+        return `(?:${char === "." ? "\\." : char}|%(?:25)*(?:${hex})|${AMP_REFERENCE}(?:#0*(?:${codes.join("|")});?|#x0*(?:${hex});?${named})|\\\\(?:u00|x)(?:${hex}))`;
+    }).join("");
+}
+/** Established signing names and withheld suffixes, retaining each unit's source spelling. */
+const SIGNING_PARAM = new RegExp(`${signingName("x-")}(?:${signingName("amz")}|${signingName("goog")})${signingName("-")}(?:(?:${["signature", "credential", "security-token"].map(signingName).join("|")})(?:${EQUALS.source})|\\[redacted\\])`, "gi");
 /**
  * One encoded character at the start of link text: a percent escape, an HTML
  * character reference, a `\u` or `\x` escape, or a Markdown backslash escape.
@@ -237,8 +307,6 @@ const TRAILING_ESCAPE = /(?:%(?:25){0,4}([0-9a-f]{2})|&(?:#0{0,6}(\d{1,7})|#x0{0
 const ESCAPES = /%([0-9a-f]{2})|&(?:#(\d{1,7})|#x([0-9a-f]{1,6})|([a-z]{2,8}));?|\\u([0-9a-f]{4})|\\x([0-9a-f]{2})|\\(?=[^a-z0-9])/gi;
 /** One slash however it is spelled, read forwards. */
 const SLASH = /\/|\\\/|%(?:25){0,4}2f|&#0{0,6}47;?|&#x0{0,6}2f;?|&sol;?|\\u002f|\\x2f/iy;
-/** An S3 endpoint host: global, regional, dual-stack, or accelerated. */
-const S3_ENDPOINT = String.raw `s3(?:[.-](?:dualstack|accelerate|external-1|[a-z]{2}(?:-[a-z]{1,12}){1,3}-\d{1,2})){0,2}\.amazonaws\.com`;
 const NAMED = {
     amp: "&",
     colon: ":",
@@ -259,10 +327,6 @@ const NAMED = {
     rsqb: "]",
     period: ".",
 };
-/** A host name's label character: the subdomain labels before a reviewed name are these alone. */
-const LABEL = /[a-z0-9.-]/i;
-/** The longest host name DNS allows: the bound on authority inspection. */
-const MAX_HOST = 253;
 /** The longest scheme read back from its `:`. */
 const MAX_SCHEME = 32;
 const SCHEME_CHAR = /[a-z0-9+.-]/i;
@@ -347,33 +411,6 @@ function authorityAt(text, at) {
         start--;
     return start < colon && (start === 0 || OPENS_LINK.test(text[start - 1])) ? start : -1;
 }
-/** Where a host's optional trailing dot and port end after `at`, or `-1` when a `:` holds no port (userinfo's password). */
-function afterPort(text, at) {
-    if (text[at] === ".")
-        at++;
-    if (text[at] !== ":")
-        return at;
-    let digits = at + 1;
-    while (digits - at <= 5 && /\d/.test(text[digits] ?? ""))
-        digits++;
-    return digits > at + 1 ? digits : -1;
-}
-/**
- * Whether a host or path segment ends at `at`: a slash, query, or fragment
- * however spelled, or the link's end. Never another
- * name character or an `@`: `file.notion.so@evil.com` names userinfo, and
- * `prod-files-secure@other` and `prod-files-securex` are other segments.
- */
-function boundary(text, at) {
-    if (at < 0)
-        return false;
-    if (at >= text.length)
-        return true;
-    if (endsLink(text.charCodeAt(at), text[at]))
-        return true;
-    SLASH.lastIndex = at;
-    return SLASH.test(text) || opener(text, at) !== undefined;
-}
 /** Whether the `#` at `at` belongs to a numeric character reference (`&#38;`) rather than opening a fragment. */
 function reference(text, at) {
     return text.charCodeAt(at - 1) === 0x26 && /[0-9x]/i.test(text[at + 1] ?? "");
@@ -394,47 +431,21 @@ function endsValue(text, at) {
     // `\/` is a JSON-escaped slash inside the value; any other backslash escapes what follows it.
     return code === 0x5c && text.charCodeAt(at + 1) !== 0x2f;
 }
-const HOST_MATCHERS = new WeakMap();
-function hostMatcher(hosts) {
-    let matcher = HOST_MATCHERS.get(hosts);
-    if (!matcher) {
-        matcher = {
-            endpoint: new RegExp(`^${S3_ENDPOINT}$`, "i"),
-            domains: hosts.domains.map((host) => host.toLowerCase()),
-            buckets: hosts.buckets.map((bucket) => bucket.toLowerCase()),
-        };
-        HOST_MATCHERS.set(hosts, matcher);
-    }
-    return matcher;
-}
-/** The end of a reviewed file authority, read only at the current URL's host. */
-function fileHost(text, start, matcher) {
-    let end = start;
-    while (end < text.length && end - start <= MAX_HOST && LABEL.test(text[end]))
-        end++;
-    if (end === start || end - start > MAX_HOST)
-        return undefined;
-    const port = afterPort(text, end);
-    if (!boundary(text, port))
-        return undefined;
-    const name = text.slice(start, end).toLowerCase().replace(/\.$/, "");
-    if (matcher.domains.some((domain) => name === domain || name.endsWith(`.${domain}`)))
-        return end;
-    if (matcher.buckets.some((bucket) => name.startsWith(`${bucket}.`) && matcher.endpoint.test(name.slice(bucket.length + 1)))) {
-        return end;
-    }
-    if (!matcher.endpoint.test(name))
-        return undefined;
-    SLASH.lastIndex = port;
-    if (!SLASH.test(text))
-        return undefined;
-    const segment = SLASH.lastIndex;
-    for (const bucket of matcher.buckets) {
-        const after = segment + bucket.length;
-        if (text.slice(segment, after).toLowerCase() === bucket && boundary(text, after))
-            return after;
-    }
-    return undefined;
+/**
+ * Where a word at `start` holds a placeholder in place of a link's scheme
+ * and host (`[redacted]/pkg?token=…`, `https:[redacted]…`), or `-1`:
+ * redaction took the authority that makes text a link (#703). A Markdown
+ * label (`[redacted](…)`) is not one; its destination is read as a link.
+ */
+function markerLed(text, start) {
+    let at = start;
+    while (at < text.length && at - start <= MAX_SCHEME + 3 && /[a-z0-9+.:/-]/i.test(text[at]))
+        at++;
+    return text.startsWith(REDACTED, at) &&
+        text[at + REDACTED.length] !== "(" &&
+        SCHEME_PREFIX.test(text.slice(start, at))
+        ? at
+        : -1;
 }
 /** The authority immediately after a destination's scheme and slashes, however escaped. */
 function destinationHost(text, start) {
@@ -472,11 +483,9 @@ function markdownStart(text, at) {
 }
 /**
  * Read a destination once. Admission ends at its actual CommonMark close,
- * counting balanced and escaped parentheses. Redaction with a query keeps
- * its separate fail-closed span through whitespace, a quote, or an angle
- * bracket, since parentheses can also be part of a signed value.
+ * counting balanced and escaped parentheses, before inspecting its query.
  */
-function linkSpan(text, start, host, inline, redact) {
+function linkSpan(text, start, host, inline) {
     let depth = 0;
     let escaped = false;
     let cut = -1;
@@ -496,7 +505,7 @@ function linkSpan(text, start, host, inline, redact) {
             else if (code === 0x29 && depth-- === 0)
                 break;
         }
-        if (host === undefined || end < host || cut >= 0)
+        if (end < host || cut >= 0)
             continue;
         if (code === 0x3f || (code === 0x23 && !reference(text, end))) {
             cut = end;
@@ -510,27 +519,26 @@ function linkSpan(text, start, host, inline, redact) {
             }
         }
     }
-    if (redact && cut >= 0) {
-        while (end < text.length && !endsLink(text.charCodeAt(end), text[end]))
-            end++;
-    }
     return { cut, open, end };
 }
 /**
- * Scan destinations, including ones at other hosts, so an outer URL owns
- * every byte of its path and query. A nested scheme or // cannot re-anchor
- * file-host matching. Each consumed span is skipped in full; admission and
- * redaction choose their own span boundary, and both stay linear.
+ * Visit each destination once, respecting its CommonMark close and encoded
+ * delimiters. Redaction (`failClosed`) also reads a link whose scheme and
+ * host redaction took (#703); admission never does.
  */
-function* hostLinks(text, hosts, redact) {
-    const matcher = hosts ? hostMatcher(hosts) : undefined;
-    // The first URL delimiter in the current text run also protects relative
-    // paths/queries such as /proxy/https://… and image?url=//… .
-    let firstReference = -1;
+function* linkSpans(text, failClosed = false) {
+    const markers = failClosed && redactionAltered(text);
     for (let at = 0; at < text.length; at++) {
         const char = text[at];
-        if (endsLink(text.charCodeAt(at), char)) {
-            firstReference = -1;
+        const marker = markers && (at === 0 || OPENS_LINK.test(text[at - 1])) ? markerLed(text, at) : -1;
+        if (marker >= 0) {
+            // A placeholder opening a word stands where a link's scheme and host may have been.
+            // Its run is read once, query or not, and the scan resumes after it.
+            const host = marker + REDACTED.length;
+            const span = linkSpan(text, host, host, false);
+            const start = at;
+            at = Math.max(at, span.end - 1);
+            yield { ...span, start, host };
             continue;
         }
         if (char === "]" && text[at + 1] === "(") {
@@ -538,19 +546,10 @@ function* hostLinks(text, hosts, redact) {
             if (destination !== undefined) {
                 const angle = text[destination] === "<";
                 const start = destination + (angle ? 1 : 0);
-                const authority = destinationHost(text, start);
-                // Generic policy inspects a relative destination's own query/fragment.
-                // Host policy must still attribute the leading authority to the vendor.
-                const host = matcher
-                    ? authority === undefined
-                        ? undefined
-                        : fileHost(text, authority, matcher)
-                    : (authority ?? start);
-                const span = linkSpan(text, start, host, !angle, redact);
+                const host = destinationHost(text, start) ?? start;
+                const span = linkSpan(text, start, host, !angle);
                 at = Math.max(destination, span.end) - 1;
-                firstReference = -1;
-                if (host !== undefined)
-                    yield span;
+                yield { ...span, start, host };
                 continue;
             }
         }
@@ -561,37 +560,16 @@ function* hostLinks(text, hosts, redact) {
                 SLASH.lastIndex = next;
                 if (SLASH.test(text)) {
                     const authority = SLASH.lastIndex;
-                    const start = authorityAt(text, authority);
-                    // Global parameter scanning needs no host attribution. This also
-                    // catches a URL after a log label such as `download:https://…`.
-                    // File-host policy keeps the stricter authority/proxy boundary.
-                    if (!matcher || (start >= 0 && (firstReference < 0 || firstReference >= start))) {
-                        const host = matcher ? fileHost(text, authority, matcher) : authority;
-                        const span = linkSpan(text, authority, host, false, redact);
-                        at = span.end - 1;
-                        firstReference = -1;
-                        if (host !== undefined)
-                            yield span;
-                        continue;
-                    }
+                    const begin = authorityAt(text, authority);
+                    const span = linkSpan(text, authority, authority, false);
+                    const start = begin >= 0 ? begin : at;
+                    at = span.end - 1;
+                    yield { ...span, start, host: authority };
                 }
-                if (firstReference < 0)
-                    firstReference = at;
             }
         }
-        if (firstReference < 0 && (char === ":" || char === "?" || (char === "#" && !reference(text, at)))) {
-            firstReference = at;
-        }
     }
 }
-/**
- * `text` with every pre-signed link withheld: at one of `hosts` (Notion's
- * file storage, say), its whole query and fragment; anywhere, a signing
- * parameter's value. Everything else comes back byte for byte.
- */
-export function withholdSignedLinks(text, hosts) {
-    return withholdSigningParams(withholdLinkQueries(text, hosts));
-}
 /** A credential-named parameter in a URL, rather than an assignment in prose. */
 function credentialQuery(text) {
     let decoded = decodeLinkText(text, false);
@@ -605,8 +583,12 @@ function credentialQuery(text) {
         decoded = next;
     }
     const fragment = decoded.indexOf("#");
-    if (fragment >= 0 && /token|secret|key|code|auth/i.test(decodeLinkText(decoded.slice(fragment + 1))))
-        return true;
+    if (fragment >= 0) {
+        const words = decodeLinkText(decoded.slice(fragment + 1));
+        // A fragment redaction altered cannot be read (#703).
+        if (/token|secret|key|code|auth/i.test(words) || alteredFragment(words))
+            return true;
+    }
     const query = fragment < 0 ? decoded : decoded.slice(0, fragment);
     for (let at = query[0] === "?" ? 1 : 0; at < query.length;) {
         const next = query.indexOf("&", at);
@@ -614,6 +596,10 @@ function credentialQuery(text) {
         const pair = decodeLinkText(query.slice(at, end));
         const equals = pair.indexOf("=");
         at = end + 1;
+        // A component redaction altered with no readable name (its name, or its `=`, taken) may be a
+        // credential parameter's value, however encoded (#703).
+        if (pair !== REDACTED && redactionAltered(equals < 0 ? pair : pair.slice(0, equals)))
+            return true;
         if (equals < 0)
             continue;
         const name = pair.slice(0, equals);
@@ -625,42 +611,62 @@ function credentialQuery(text) {
     return false;
 }
 /** Remove a link's entire query/fragment, keeping its surrounding syntax. */
-function withholdLinkQueries(text, hosts) {
+function withholdLinkQueries(text) {
     let out = "";
     let copied = 0;
-    for (const { cut, open, end } of hostLinks(text, hosts, hosts !== undefined)) {
-        if (cut < 0)
-            continue;
-        if (!hosts && !credentialQuery(text.slice(cut, end)))
+    for (const { cut, open, end, start, host } of linkSpans(text, true)) {
+        // A parameter name redaction altered cannot be read, so the whole link goes (#703).
+        const whole = alteredLink(text.slice(host, end));
+        if (!whole && (cut < 0 || !credentialQuery(text.slice(cut, end))))
             continue;
+        const from = Math.max(whole ? start : cut, copied);
+        // A reference's final semicolon belongs to the withheld query, not the surrounding prose.
+        // Search only this disjoint span, once, even when it ends in a long punctuation run.
+        const ampersand = text.slice(from, end).lastIndexOf("&");
+        const referenceEnd = ampersand < 0 ? -1 : characterReferenceEnd(text, from + ampersand);
         let keep = end;
-        while (keep > cut + 1 && TRAILING.test(text[keep - 1])) {
+        while (keep > from + 1 && TRAILING.test(text[keep - 1])) {
             // A signing pass may already have replaced the final parameter. Its
             // closing bracket belongs to the value, not the surrounding Markdown.
-            if (text.endsWith(REDACTED, keep))
+            if (keep === referenceEnd || text.endsWith(REDACTED, keep))
                 break;
             keep--;
         }
         // A query with nothing in it.
-        if (keep <= cut + 1)
+        if (keep <= from + 1)
             continue;
-        out += `${text.slice(copied, cut)}${open}${REDACTED}`;
+        out += `${text.slice(copied, from)}${whole ? "" : open}${REDACTED}`;
         copied = keep;
     }
     return copied === 0 ? text : out + text.slice(copied);
 }
+/** Whether redaction altered a parameter name in a link's own path, query, or fragment (#703). */
+function alteredLink(link) {
+    return redactionAltered(link) && parameterNames(decodeLinkText(link)).some(redactionAltered);
+}
 function withholdSigningParams(anchored) {
     let out = "";
     let copied = 0;
     SIGNING_PARAM.lastIndex = 0;
-    for (let match = SIGNING_PARAM.exec(anchored); match; match = SIGNING_PARAM.exec(anchored)) {
-        const start = match.index + match[0].length;
+    let signing = SIGNING_PARAM.exec(anchored);
+    let altered = alteredParameter(anchored, 0);
+    while (signing || altered) {
+        const named = signing ? signing.index + signing[0].length : -1;
+        const alteredStart = altered?.start ?? -1;
+        const boundary = altered?.value ?? -1;
+        // A complete altered-name boundary takes precedence over its withheld family suffix.
+        const inferred = alteredStart >= 0 && (named < 0 || alteredStart < signing.index || (alteredStart < named && boundary > named));
+        const start = inferred ? alteredStart : named;
         // Skip an existing complete placeholder, but still remove any suffix.
         const already = anchored.startsWith(REDACTED, start);
-        let end = already ? start + REDACTED.length : start;
-        while (end < anchored.length && !endsValue(anchored, end))
-            end++;
+        const from = inferred && altered?.value !== undefined ? altered.value : already ? start + REDACTED.length : start;
+        const end = valueEnd(anchored, from, inferred && altered?.value === undefined);
+        // Resume both scans after this value, as one scan would.
         SIGNING_PARAM.lastIndex = end;
+        if (named >= 0 && named <= end)
+            signing = SIGNING_PARAM.exec(anchored);
+        if (altered && altered.start <= end)
+            altered = alteredParameter(anchored, end);
         if (end === start || (already && end === start + REDACTED.length))
             continue;
         out += `${anchored.slice(copied, start)}${REDACTED}`;
@@ -668,18 +674,79 @@ function withholdSigningParams(anchored) {
     }
     return copied === 0 ? anchored : out + anchored.slice(copied);
 }
+const NAME_CHAR = /[\w.%~;-]/;
+const NAME_ESCAPE = new RegExp(Array.from("abcdefghijklmnopqrstuvwxyz0123456789_.~-", signingName).join("|"), "iy");
+/** Where a parameter's value ends, reading placeholders and character references whole (#703). */
+function valueEnd(text, at, inferred) {
+    while (at < text.length) {
+        const reference = Math.max(characterReferenceEnd(text, at, inferred), bareReferenceEnd(text, at, inferred));
+        if (text.startsWith(REDACTED, at))
+            at += REDACTED.length;
+        else if (reference > at)
+            at = reference;
+        else if (endsValue(text, at))
+            break;
+        else
+            at++;
+    }
+    return at;
+}
+/**
+ * The next placeholder that may hide a signing parameter, at or after `from`,
+ * and its value boundary when a name is recognized (#703). Redaction may have taken a signing name, its
+ * `=`, and the start of its value, so a placeholder followed by any of a
+ * value's base64 or base64url characters (`+`, `/`, `=`, `-`, `_` included)
+ * or `%` escapes goes with them, however short. References count when they
+ * spell credential data or an ampersand, including a short numeric prefix
+ * when no semicolon ends the reference. One inside a name ending at an
+ * encoded `=` (`&#61;`, `\u003d`) gives that value's start. A placeholder
+ * right after an `=` with nothing readable after it is a withheld value.
+ * Each placeholder is read once, resuming after its run.
+ */
+function alteredParameter(text, from) {
+    for (let at = text.indexOf(REDACTED, from); at >= 0;) {
+        const tail = splitRemainder(text, at, endsValue);
+        // Read a possible name before inferring a value remainder: a name's encoded `=` or dash
+        // can otherwise look like the end of the remainder. A leading partial reference belongs
+        // to the name too; the placeholder may have removed its opening characters.
+        if (!EQUALS_BEFORE.test(text.slice(Math.max(0, at - 64), at))) {
+            // The tail already read any earlier placeholders. Only its last one can lead a
+            // name beyond that tail; keep the redaction start so no earlier data is exposed.
+            let end = text.lastIndexOf(REDACTED, tail.end - REDACTED.length) + REDACTED.length;
+            while (end < text.length) {
+                EQUALS.lastIndex = end;
+                if (EQUALS.test(text))
+                    return { start: at, value: EQUALS.lastIndex };
+                NAME_ESCAPE.lastIndex = end;
+                // A later placeholder gets its own scan; never look ahead across it twice.
+                if (text.startsWith(REDACTED, end))
+                    break;
+                else if (NAME_CHAR.test(text[end]))
+                    end++;
+                else if (NAME_ESCAPE.test(text))
+                    end = NAME_ESCAPE.lastIndex;
+                else {
+                    const reference = bareReferenceEnd(text, end, true);
+                    if (reference === end)
+                        break;
+                    end = reference;
+                }
+            }
+        }
+        if (tail.readable)
+            return { start: at };
+        at = text.indexOf(REDACTED, Math.max(tail.end, at + REDACTED.length));
+    }
+    return undefined;
+}
 /**
  * Reviewed REST text policy: only credential-bearing URL queries/fragments
  * change. Ordinary links, including external proxies, retain their bytes.
- * Literal AWS/Google signing names are withheld anywhere, as in #818.
+ * The established AWS/Google signing names are withheld in their source spelling anywhere.
  */
 export function withholdEmbeddedUrls(text) {
     return withholdSigningParams(withholdLinkQueries(text));
 }
-/** Every string inside a JSON value through `withholdSignedLinks`; unchanged values keep their identity. */
-export function withholdSignedLinksIn(value, hosts, depth = 0) {
-    return mapStrings(value, (text) => withholdSignedLinks(text, hosts), depth);
-}
 /** Apply the reviewed text policy to a selected value or vendor error body. */
 export function withholdEmbeddedUrlsIn(value) {
     return mapStrings(value, withholdEmbeddedUrls, 0);
@@ -732,19 +799,20 @@ function decodeLinkText(text, percent = true) {
  * Only the link's own destination is read: a Markdown link ends at its
  * closing `)`, so `[f](…?a=1)[redacted]` is ordinary text after it.
  * The word alone (`unredacted`) or the placeholder away from a file link is
- * a person's text. When `hosts` is supplied, require its actual authority
- * to match that policy, preserving Notion's external-proxy boundary.
+ * a person's text. Every destination uses the same policy regardless of host.
  */
-export function carriesWithheldLink(value, hosts) {
-    const pending = [{ value }];
-    const ancestors = new WeakSet();
-    const inspect = (text) => {
-        for (const { cut, end } of hostLinks(text, hosts, false)) {
+export function carriesWithheldLink(value) {
+    return carriesString(value, (text) => {
+        for (const { cut, end } of linkSpans(text)) {
             if (cut >= 0 && decodeLinkText(text.slice(cut, end)).includes(REDACTED))
                 return true;
         }
         return false;
-    };
+    });
+}
+function carriesString(value, inspect) {
+    const pending = [{ value }];
+    const ancestors = new WeakSet();
     // JSON structure is bounded by the admitted request's bytes. Visit every key
     // and value iteratively, without imposing a smaller node/depth limit. Reject
     // cycles from direct callers; repeated non-cyclic references remain valid.
@@ -760,7 +828,7 @@ export function carriesWithheldLink(value, hosts) {
                 continue;
             }
             if (ancestors.has(item)) {
-                throw new ConnectorCallError("invalid_args", "Not sent: URL admission cannot inspect cyclic JSON.");
+                throw new ConnectorCallError("invalid_args", "Not sent: value admission cannot inspect cyclic JSON.");
             }
             ancestors.add(item);
             pending.push({ value: item, leave: true });
@@ -779,6 +847,25 @@ export function carriesWithheldLink(value, hosts) {
     }
     return false;
 }
+/** Whole marker values and withheld destinations are refused; paths and queries also refuse containment. */
+export function refuseWithheldValues(value, title, containment = false) {
+    if (!carriesString(value, (text) => {
+        const decoded = decodeLinkText(text);
+        if (containment)
+            return redactionAltered(text) || redactionAltered(decoded);
+        if (decoded === REDACTED)
+            return true;
+        for (const candidate of [text, decoded])
+            for (const { start, end } of linkSpans(candidate))
+                if (redactionAltered(decodeLinkText(candidate.slice(start, end))))
+                    return true;
+        return false;
+    }))
+        return;
+    throw new ConnectorCallError("invalid_args", containment
+        ? `Not sent: ${title} path or query contains a withheld placeholder ([redacted]). Supply the original path/query value or omit the parameter.`
+        : `Not sent: ${title} arguments contain a whole withheld value ([redacted]) or a withheld link. Supply the original value/link or omit the field. Longer prose may mention the marker.`);
+}
 /** Refuse a withheld destination copied into customer data, before any dispatch. */
 export function refuseWithheldLinks(value, title) {
     if (!carriesWithheldLink(value))
@@ -867,24 +954,52 @@ function labelsOf(value) {
         labels.push(target["key"]);
     return labels;
 }
-/** Whether a record's label names a credential, so its value or args are one. */
+/**
+ * Whether a record's label names a credential, so its value or args are one.
+ * A label redaction altered, or keys that may hide one, does too (#703).
+ */
 function credentialLabelled(value) {
-    return isRecord(value) && labelsOf(value).some(credentialName);
+    if (!isRecord(value))
+        return false;
+    const target = value["target"];
+    return (keysAltered(value) ||
+        (isRecord(target) && keysAltered(target)) ||
+        labelsOf(value).some((label) => decides(label, credentialName)));
+}
+/** A record typed as a secret (`secret_text`); a type redaction altered may have been one (#703). */
+function typedSecret(value) {
+    return keysAltered(value) || decides(value["type"], (type) => /secret/i.test(type));
+}
+/** A list item typed as an environment variable; a type redaction altered may have been one (#703). */
+function envTyped(value) {
+    if (!isRecord(value))
+        return false;
+    return keysAltered(value) || decides(String(value["type"]), (type) => /env/i.test(type));
 }
-/** A header, cookie, or query rule (`request.headers`, `header`, `cookie`, `query`, …). */
+/** A header, cookie, or query rule (`request.headers`, `header`, `cookie`, `query`, …); likewise (#703). */
 function headerLike(value) {
-    return isRecord(value) && typeof value["type"] === "string" && /header|cookie|query/i.test(value["type"]);
+    return isRecord(value) && (keysAltered(value) || decides(value["type"], (type) => /header|cookie|query/i.test(type)));
 }
 /** A route-like object: its `headers` are set on requests or responses. */
 function routeLike(value) {
-    return ["src", "source", "dest", "destination"].some((key) => key in value);
+    return keysAltered(value) || ["src", "source", "dest", "destination"].some((key) => key in value);
 }
 /** Every value of a headers map, or of a list of `{ key, value }` header pairs, withheld. */
 function headerValues(value) {
     if (isRecord(value))
         return Object.fromEntries(Object.keys(value).map((name) => [name, REDACTED]));
     if (Array.isArray(value)) {
-        return value.map((item) => (isRecord(item) && "value" in item ? { ...item, value: REDACTED } : item));
+        // A pair whose keys redaction altered may hold its value under any of them (#703).
+        return value.map((item) => !isRecord(item)
+            ? item
+            : keysAltered(item)
+                ? Object.fromEntries(Object.entries(item).map(([key, entry]) => [
+                    key,
+                    key === "value" || redactionAltered(key) ? withheld(entry) : entry,
+                ]))
+                : "value" in item
+                    ? { ...item, value: REDACTED }
+                    : item);
     }
     return value;
 }
@@ -959,7 +1074,7 @@ function applyPath(body, raw, transform) {
             if (!Array.isArray(current))
                 return current;
             return current.map((item) => {
-                if (segment === "[?env]" && !/env/i.test(String(isRecord(item) ? item["type"] : "")))
+                if (segment === "[?env]" && !envTyped(item))
                     return item;
                 if (segment === "[?credential]" && !credentialLabelled(item))
                     return item;
@@ -979,7 +1094,9 @@ function applyPath(body, raw, transform) {
         if (segment === "@keys") {
             if (!isRecord(current))
                 return current;
-            return Object.fromEntries(Object.values(current).map((item, position) => [`${REDACTED} ${position + 1}`, item]));
+            const keyed = Object.fromEntries(Object.values(current).map((item, position) => [`${REDACTED} ${position + 1}`, item]));
+            PLACEHOLDER_KEYS.add(keyed);
+            return keyed;
         }
         if (!isRecord(current) || !Object.hasOwn(current, segment))
             return current;
@@ -1003,7 +1120,8 @@ function scrubEnv(value, depth) {
     if (depth > 32)
         return REDACTED;
     if (Array.isArray(value)) {
-        return value.map((item) => (typeof item === "string" && item.includes("=") ? REDACTED : scrubEnv(item, depth + 1)));
+        // A `NAME=value` string, or one whose name and `=` redaction may have taken (#703).
+        return value.map((item) => typeof item === "string" && (item.includes("=") || redactionAltered(item)) ? REDACTED : scrubEnv(item, depth + 1));
     }
     if (!isRecord(value))
         return value;
@@ -1041,6 +1159,34 @@ function scrubValues(value, depth) {
     }
     return out;
 }
+/** Every rule's paths and withheld fields: the rule for an object whose type redaction altered (#703). */
+const ANY_RULE = new WeakMap();
+function anyRule(resources) {
+    let rule = ANY_RULE.get(resources);
+    if (!rule) {
+        const paths = Object.values(resources.rules).flatMap((each) => [...(each.paths ?? []), ...(each.withheld ?? [])]);
+        rule = { reason: "A type redaction altered may be any reviewed resource.", paths: [...new Set(paths)] };
+        ANY_RULE.set(resources, rule);
+    }
+    return rule;
+}
+/**
+ * What a record's type discriminator selects. A type redaction altered, or
+ * one an altered key may hide, selects every rule at once (#703).
+ */
+function typed(record, key, rules, any) {
+    const type = record[key];
+    if (redactionAltered(type) || (type === undefined && keysAltered(record)))
+        return any();
+    return typeof type === "string" && Object.hasOwn(rules, type) ? rules[type] : undefined;
+}
+/** What the discriminator of the object an event carries (`data.object`) selects, for its partial copies. */
+function typedInner(record, key, rules, any) {
+    const inner = record[key];
+    if (isRecord(inner))
+        return typed(inner, key, rules, any);
+    return inner === undefined && keysAltered(record) ? any() : undefined;
+}
 /**
  * Apply resource rules to every discriminated object in a body, innermost
  * first, and to the partial copies events carry beside one. Records the
@@ -1054,10 +1200,9 @@ function resourcePass(value, resources, verbatim, depth) {
     if (!isRecord(value))
         return value;
     let out = Object.fromEntries(Object.entries(value).map(([key, item]) => [key, resourcePass(item, resources, verbatim, depth + 1)]));
-    const ruleFor = (type) => typeof type === "string" && Object.hasOwn(resources.rules, type) ? resources.rules[type] : undefined;
+    const any = () => anyRule(resources);
     // An event's `previous_attributes` is a partial copy of `data.object`: every reviewed path applies to it.
-    const inner = out[resources.key];
-    const innerRule = isRecord(inner) ? ruleFor(inner[resources.key]) : undefined;
+    const innerRule = typedInner(value, resources.key, resources.rules, any);
     if (innerRule) {
         for (const partial of resources.partials ?? []) {
             let copy = out[partial];
@@ -1068,7 +1213,7 @@ function resourcePass(value, resources, verbatim, depth) {
             out = { ...out, [partial]: copy };
         }
     }
-    const rule = ruleFor(out[resources.key]);
+    const rule = typed(value, resources.key, resources.rules, any);
     if (!rule)
         return out;
     for (const path of rule.paths ?? [])
@@ -1101,22 +1246,33 @@ function heuristic(value, exempt) {
             // generic names in customer data must retain their original bytes.
             if (!exempt.reviewedUrls)
                 return URL_SHAPE.test(current) ? sanitizeUrl(current) : current;
-            const whole = URL_SHAPE.test(current) && !/[\s<>"'`\\]|&(?:#|[a-z]+;)|\]\(/i.test(current);
-            return whole ? sanitizeUrl(current, false) : current;
+            // A placeholder's own brackets are not Markdown; a URL whose scheme redaction
+            // altered may still carry userinfo, so it is withheld whole (#703).
+            const altered = redactionAltered(current);
+            if (TEXT.test(altered ? current.replaceAll(REDACTED, "") : current))
+                return current;
+            if (altered && alteredScheme(current))
+                return REDACTED;
+            return URL_SHAPE.test(current) ? sanitizeUrl(current, false) : current;
         }
         if (Array.isArray(current))
             return current.map((item) => walk(item, trail, parent, depth + 1));
         if (!isRecord(current))
             return current;
-        const labelled = credentialLabelled(current) || (typeof current["type"] === "string" && /secret/i.test(current["type"]));
-        const destination = parent === "delivery" || "endpoint" in current || "deliveryFormat" in current;
+        const labelled = credentialLabelled(current) || typedSecret(current);
+        const placeholders = PLACEHOLDER_KEYS.has(current);
+        const destination = parent === "delivery" || "endpoint" in current || "deliveryFormat" in current || keysAltered(current);
         const out = {};
         const verbatim = exempt.verbatim.get(current);
         for (const [key, item] of Object.entries(current)) {
             const path = [...trail, key];
             const normalized = normalizedName(key);
             const review = Object.hasOwn(exempt.fields, key) ? exempt.fields[key] : undefined;
-            if (review?.verdict === "redact") {
+            if (!placeholders && redactionAltered(key)) {
+                // A key redaction altered may have named a credential (#703).
+                out[key] = withheld(item);
+            }
+            else if (review?.verdict === "redact") {
                 out[key] = withheld(item);
             }
             else if (labelled && LABELLED_VALUE_FIELDS.includes(key)) {
@@ -1153,8 +1309,11 @@ function heuristic(value, exempt) {
             else if (key === "headers" && routeLike(current)) {
                 out[key] = headerValues(item);
             }
-            else if (DESTINATION_KEYS.includes(key) && typeof item === "string" && URL_SHAPE.test(item)) {
+            else if (DESTINATION_KEYS.includes(key) &&
+                typeof item === "string" &&
+                (URL_SHAPE.test(item) || alteredScheme(item))) {
                 // An external destination can carry its secret in the path; relative paths stay.
+                // One whose scheme redaction altered does not parse, so it is withheld (#703).
                 out[key] = originOnly(item);
             }
             else if (typeof item === "string" && verbatim?.has(key)) {
@@ -1208,27 +1367,26 @@ export function valueSafety(table, index) {
                 }
                 const resources = table.embeddedUrls.resources;
                 if (resources) {
+                    // A type redaction altered takes every resource's reviewed text paths (#703).
+                    const all = [...new Set(Object.values(resources.paths).flat())];
+                    const any = () => all;
                     const scan = (value, depth) => {
                         if (depth > MAX_DEPTH || value === null || typeof value !== "object")
                             return value;
                         if (Array.isArray(value))
                             return value.map((item) => scan(item, depth + 1));
                         let clean = Object.fromEntries(Object.entries(value).map(([key, item]) => [key, scan(item, depth + 1)]));
-                        const inner = clean[resources.key];
-                        const innerType = isRecord(inner) ? inner[resources.key] : undefined;
-                        if (typeof innerType === "string" && Object.hasOwn(resources.paths, innerType)) {
+                        const innerPaths = typedInner(value, resources.key, resources.paths, any);
+                        if (innerPaths) {
                             for (const partial of resources.partials ?? []) {
                                 if (!Object.hasOwn(clean, partial))
                                     continue;
-                                for (const path of resources.paths[innerType])
+                                for (const path of innerPaths)
                                     clean[partial] = applyPath(clean[partial], path, withholdEmbeddedUrlsIn);
                             }
                         }
-                        const type = clean[resources.key];
-                        if (typeof type === "string" && Object.hasOwn(resources.paths, type)) {
-                            for (const path of resources.paths[type])
-                                clean = applyPath(clean, path, withholdEmbeddedUrlsIn);
-                        }
+                        for (const path of typed(value, resources.key, resources.paths, any) ?? [])
+                            clean = applyPath(clean, path, withholdEmbeddedUrlsIn);
                         return clean;
                     };
                     out = scan(out, 0);