agent-sanitizer 2.34.7 → 2.34.8

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-sanitizer",
-  "version": "2.34.7",
+  "version": "2.34.8",
   "description": "Defend an agent against hidden-content injection: strip payload-capable invisible Unicode and ANSI, splice out human-invisible HTML, and flag data-exfil URLs in untrusted text before any model sees it.",
   "type": "module",
   "repository": {

package/src/html.mjs

@@ -36,7 +36,7 @@ import { unified } from "unified";
 import remarkParse from "remark-parse";
 import remarkGfm from "remark-gfm";
 import rehypeParse from "rehype-parse";
-import { visit, SKIP, EXIT } from "unist-util-visit";
+import { SKIP, EXIT } from "unist-util-visit";
 import {
   HTML_TAG_PRESENT,
   MD_LINK_HINT,
@@ -1374,14 +1374,93 @@ function hasDataSrc(el) {
 // there is exactly one parser configuration to reason about.
 const htmlParser = unified().use(rehypeParse, { fragment: true });
 
+/**
+ * Preorder depth-first walk of a unist tree, calling `visitor(node, index,
+ * parent)` on every node whose `type` is `test` (or on every node when `test` is
+ * null). `EXIT` ends the walk, `SKIP` leaves the node's children unvisited —
+ * the `unist-util-visit` contract, which is what the call sites here are
+ * written against.
+ *
+ * Spelled out rather than imported because `unist-util-visit` allocates a fresh
+ * ancestors array and a closure per node, and on a document that is one long
+ * flat sibling list — 32k `<p>` elements per megabyte of ordinary HTML — that
+ * turns a linear walk super-linear: 3480 ms against this walk's 62 ms over the
+ * same 4 MB tree. The three parallel arrays are the stack, so the walk itself
+ * allocates nothing per node.
+ * @param {any} tree
+ * @param {string | null} test
+ * @param {(node: any, index: number | undefined, parent: any) => unknown} visitor
+ */
+function walk(tree, test, visitor) {
+  /** @type {any[]} */
+  const nodes = [tree];
+  /** @type {Array<number | undefined>} */
+  const indices = [undefined];
+  /** @type {any[]} */
+  const parents = [undefined];
+  while (nodes.length > 0) {
+    const node = nodes.pop();
+    const index = indices.pop();
+    const parent = parents.pop();
+    const result =
+      test === null || node.type === test
+        ? visitor(node, index, parent)
+        : undefined;
+    if (result === EXIT) return;
+    if (result === SKIP) continue;
+    const children = node.children;
+    if (children === undefined) continue;
+    for (let i = children.length - 1; i >= 0; i--) {
+      nodes.push(children[i]);
+      indices.push(i);
+      parents.push(node);
+    }
+  }
+}
+
+/**
+ * `parse` with its most recent (input, tree) pair remembered.
+ *
+ * Layers 2 and 3 each parse the SAME tool output: `sanitizeHtml` tokenizes it to
+ * decide the source-vs-markdown branch, and `detectExfil` tokenizes it again to
+ * read `src`/`href` off the elements — two full parse5 runs and two full
+ * micromark runs over one document, which is most of what the HTML layer costs
+ * on ordinary prose. Every consumer only READS the tree (the sole AST mutation
+ * in this module is over a css-tree value parsed per style string), so one tree
+ * is safe to hand to both.
+ *
+ * One entry, replaced on every miss, so the retained footprint is one tree for
+ * the document most recently sanitized — the tree that call had allocated
+ * anyway. A miss re-parses and answers identically, so the cache can never
+ * change a verdict, only what one costs.
+ * @param {(text: string) => any} parse
+ * @returns {(text: string) => any}
+ */
+function lastParseCached(parse) {
+  /** @type {string | null} */
+  let cachedText = null;
+  /** @type {any} */
+  let cachedTree = null;
+  return (text) => {
+    if (cachedText === text) return cachedTree;
+    // The key is recorded only AFTER the parse returns. A parse that throws —
+    // which is how a pathologically nested fragment reaches the fail-closed
+    // withhold — must leave the entry untouched, or the next call for that same
+    // text hits a key whose tree came from a DIFFERENT document and gets a
+    // verdict about the wrong input instead of the withhold.
+    const tree = parse(text);
+    cachedText = text;
+    cachedTree = tree;
+    return tree;
+  };
+}
+
 /**
  * Parse `html` as an HTML fragment with the real tokenizer (parse5, via rehype).
  * @param {string} html
  * @returns {any}
  */
-function parseFragment(html) {
-  return htmlParser.parse(html);
-}
+const parseFragment = lastParseCached((html) => htmlParser.parse(html));
 
 /**
  * @param {string} htmlValue
@@ -1391,7 +1470,7 @@ function parseHtmlTag(htmlValue) {
   const tree = parseFragment(htmlValue);
   /** @type {any} */
   let firstElement = null;
-  visit(tree, "element", (node) => {
+  walk(tree, "element", (node) => {
     firstElement = node;
     return EXIT;
   });
@@ -1606,7 +1685,7 @@ function scanFragmentTree(html, tree) {
   const warned = newWarned();
   // @ts-ignore -- visit callback returns EXIT/SKIP only on matches; implicit undefined return is intentional
   // eslint-disable-next-line consistent-return
-  visit(tree, (/** @type {any} */ node) => {
+  walk(tree, null, (/** @type {any} */ node) => {
     const isComment = node.type === "comment";
     if (isComment || isHiddenElement(node)) {
       /* c8 ignore start -- parse5 omits positions only on recovery-synthesized
@@ -1635,6 +1714,20 @@ function scanFragmentTree(html, tree) {
 
 const mdParser = unified().use(remarkParse).use(remarkGfm);
 
+/** The markdown tree for `text`, cached the same way {@link parseFragment} is.
+ * @type {(text: string) => any} */
+const parseMarkdown = lastParseCached((text) => mdParser.parse(text));
+
+// A `code` node is a FENCED or INDENTED block and nothing else, so either a
+// three-run of backticks/tildes or a line opening on a four-column indent must
+// appear somewhere in the text for one to exist. CommonMark expands a tab to
+// the next four-column tab stop, so fewer than four spaces followed by a tab is
+// an indent too ("  \tfoo" is a code block) — hence ` *\t` rather than `\t`.
+// Read over the whole document and deliberately loose (a stray ``` anywhere is
+// enough to parse), because the only sound direction to be wrong in here is
+// towards parsing.
+const MARKDOWN_CODE_HINT = /```|~~~|^(?: {4}| *\t)/m;
+
 // A markup-declaration-open (`<!`) or processing-instruction-ish (`<?`) start.
 // Inside an inline html node these begin a *bogus comment* unless they open a
 // proper `<!--…-->` comment (handled on the fast path) — `<!bogus>`, `<?php?>`,
@@ -1688,7 +1781,7 @@ function commentSpans(value) {
   const tree = parseFragment(value);
   /** @type {Map<number, number>} */
   const spans = new Map();
-  visit(tree, "comment", (/** @type {any} */ node) => {
+  walk(tree, "comment", (/** @type {any} */ node) => {
     if (node.position)
       spans.set(node.position.start.offset, node.position.end.offset);
   });
@@ -1916,7 +2009,7 @@ const FLOW_HTML_PARENTS = new Set([
  * @returns {{ ranges: SpliceRange[], warned: ReturnType<typeof newWarned> }}
  */
 function scanMarkdown(text) {
-  const tree = mdParser.parse(text);
+  const tree = parseMarkdown(text);
   /** @type {SpliceRange[]} */
   const ranges = [];
   const warned = newWarned();
@@ -1924,7 +2017,7 @@ function scanMarkdown(text) {
   // Flow html blocks carry complete markup, so rehype locates comments/hidden
   // elements precisely within them; block-local offsets are shifted to
   // document coordinates.
-  visit(tree, "html", (/** @type {any} */ node, _index, parent) => {
+  walk(tree, "html", (/** @type {any} */ node, _index, parent) => {
     if (!FLOW_HTML_PARENTS.has(parent?.type)) return;
     const base = node.position.start.offset;
     const sub = scanHtmlFragment(text.slice(base, node.position.end.offset));
@@ -1944,7 +2037,7 @@ function scanMarkdown(text) {
   // are walked as part of their root in document order, so the walk is skipped
   // for them here to avoid double-scanning and to keep the absorb state flowing
   // across those boundaries.
-  visit(tree, (/** @type {any} */ node) => {
+  walk(tree, null, (/** @type {any} */ node) => {
     if (!PHRASING_ROOTS.has(node.type)) return;
     if (!hasHtmlLeaf(node)) return;
     scanInlineChildren(node, text, ranges, warned);
@@ -1969,8 +2062,9 @@ function scanMarkdown(text) {
  * @returns {boolean}
  */
 function hasMarkdownCode(text) {
+  if (!MARKDOWN_CODE_HINT.test(text)) return false;
   let found = false;
-  visit(mdParser.parse(text), "code", () => {
+  walk(parseMarkdown(text), "code", () => {
     found = true;
     return EXIT;
   });
@@ -2564,7 +2658,7 @@ function extractHtmlUrls(text) {
   const tree = parseFragment(text);
   /** @type {Array<{ url: string, isImage: boolean, autoFetched: boolean, context: "resource" | "form" | "refresh" }>} */
   const urls = [];
-  visit(tree, "element", (/** @type {any} */ node) => {
+  walk(tree, "element", (/** @type {any} */ node) => {
     // hast element nodes always carry a `properties` object (parse5 sets it).
     const props = node.properties;
     const isImage = node.tagName === "img";
@@ -2640,8 +2734,8 @@ export function detectExfil(text) {
   try {
     // Remark AST handles markdown links/images/definitions (balanced parens,
     // reference links) correctly, unlike a hand-rolled regex.
-    const tree = mdParser.parse(text);
-    visit(tree, (node) => {
+    const tree = parseMarkdown(text);
+    walk(tree, null, (node) => {
       if (
         node.type !== "link" &&
         node.type !== "image" &&

package/src/invisible.mjs

@@ -405,6 +405,13 @@ const EMOJI_BASE = /\p{Extended_Pictographic}/u;
 // following ZWJ (🏳️‍🌈 = flag base, VS16, ZWJ, rainbow; 👁️‍🗨️), so the joiner's real
 // left neighbor for the emoji test is the pictograph, not the selector.
 const VARIATION_SELECTOR = new RegExp(`[${VS}]`, "u");
+// Code-point twins of the four single-character classes above, memoized: the
+// carve analysis asks these per invisible (and per neighbour), and a Unicode
+// property class costs far more than a table hit. See memoizedCpPredicate.
+const isEmojiLeft = memoizedCpPredicate(EMOJI_LEFT);
+const isEmojiBase = memoizedCpPredicate(EMOJI_BASE);
+const isKeycapBase = memoizedCpPredicate(KEYCAP_BASE);
+const isVariationSelectorCp = memoizedCpPredicate(VARIATION_SELECTOR);
 // U+FE0F (VS16) forces emoji presentation, U+FE0E (VS15) forces text
 // presentation (☺︎ vs ☺); either one directly after a pictograph is part of a
 // visible glyph, not a hidden variation-selector run.
@@ -462,11 +469,10 @@ const IVS_MAX = 0xe01ef;
 const CJK_IDEOGRAPH_RE =
   /[\p{Unified_Ideograph}\u{F900}-\u{FAFF}\u{2F800}-\u{2FA1F}]/u;
 
-/** True when `ch` is a CJK ideograph (the only base an ideographic variation
- * selector legitimately follows). @param {string} ch @returns {boolean} */
-function isCjkIdeograph(ch) {
-  return CJK_IDEOGRAPH_RE.test(ch);
-}
+/** True when `cp` is a CJK ideograph (the only base an ideographic variation
+ * selector legitimately follows). -1 (past a string boundary) is not.
+ * @type {(cp: number) => boolean} */
+const isCjkIdeograph = memoizedCpPredicate(CJK_IDEOGRAPH_RE);
 
 // Brahmic consonants: the only base a virama does half-form/conjunct work on.
 // A bare or base-less halant + ZWJ carries no rendering and is a smuggling
@@ -485,15 +491,11 @@ function isCjkIdeograph(ch) {
 // against the script it claims.
 export { BRAHMIC_CONSONANT_RANGES } from "./joining-type.mjs";
 
-/** True when `ch` is a Brahmic consonant. Takes a CHARACTER, like its sibling
- * predicates here (`isCjkIdeograph`, `isJoinControl`), over the code-point
- * `isBrahmicConsonant` it wraps in ./joining-type.mjs, where every predicate
- * takes a code point.
- * @param {string} ch @returns {boolean} */
-function isBrahmicConsonantChar(ch) {
-  return (
-    ch !== "" && isBrahmicConsonant(/** @type {number} */ (ch.codePointAt(0)))
-  );
+/** True when the code point `cp` is a Brahmic consonant; -1 (past a string
+ * boundary) is not. A thin sign-guard over ./joining-type.mjs's table lookup.
+ * @param {number} cp @returns {boolean} */
+function isBrahmicConsonantCp(cp) {
+  return cp >= 0 && isBrahmicConsonant(cp);
 }
 
 // ─── Blank-filler carve-out (Braille / archaic Hangul) ───────────────────────
@@ -528,11 +530,12 @@ const GATED_BLANK_RE = new RegExp("[\\u115F\\u1160\\u2800\\u3164\\uFFA0]", "u");
 // Script_Extensions=Braille — no character is shared with another script).
 const BRAILLE_RE = /\p{Script=Braille}/u;
 
+const isBrailleScript = memoizedCpPredicate(BRAILLE_RE);
+
 /** A real (non-blank) Braille cell — the anchoring neighbour for a U+2800 blank.
- * @param {string} ch @returns {boolean} */
-function isBrailleCell(ch) {
-  const cp = ch ? ch.codePointAt(0) : -1;
-  return cp !== BRAILLE_BLANK && BRAILLE_RE.test(ch);
+ * @param {number} cp @returns {boolean} */
+function isBrailleCell(cp) {
+  return cp !== BRAILLE_BLANK && isBrailleScript(cp);
 }
 
 // Script=Hangul, straight from the runtime's Unicode data. NOT
@@ -542,28 +545,61 @@ function isBrailleCell(ch) {
 // thereby preserve — a Hangul filler in text with no Hangul in it at all.
 const HANGUL_RE = /\p{Script=Hangul}/u;
 
+const isHangulScript = memoizedCpPredicate(HANGUL_RE);
+
 /** A Hangul jamo/syllable (NOT itself one of the fillers) — the anchoring
- * neighbour for a Hangul filler. @param {string} ch @returns {boolean} */
-function isHangul(ch) {
-  const cp = ch ? /** @type {number} */ (ch.codePointAt(0)) : -1;
+ * neighbour for a Hangul filler. @param {number} cp @returns {boolean} */
+function isHangul(cp) {
   if (HANGUL_FILLERS.has(cp)) return false; // a filler cannot anchor another filler
-  return HANGUL_RE.test(ch);
+  return isHangulScript(cp);
 }
 
-// code point -> CHECKS category, projected from the SAME three code-point sets
-// the CHECKS regexes are built from, in CHECKS order so a code point in two sets
-// gets the category the regexes would report first. Every CHECKS class holds
+// The carve analysis runs once per code point of every prompt and every tool
+// output, so its per-code-point state is held in TYPED arrays of small integer
+// codes rather than arrays of category strings: `Uint8Array` costs one byte per
+// code point with no pointer to trace, where a `(string|null)[]` costs a machine
+// word per entry and hands the collector one more object graph to walk on every
+// blocking hook call. These are the codes; CODE_CATEGORY projects them back onto
+// the public CATEGORY strings at the boundary, so nothing outside this module
+// sees them.
+const CODE_VISIBLE = 0;
+const CODE_CF = 1;
+const CODE_VS = 2;
+const CODE_BLANK = 3;
+
+// Preserve kinds, in the same one-byte-per-code-point spirit. KIND_NONE is the
+// zero value, so a freshly allocated `kind` array already reads "payload" —
+// which is the fail-closed default this analysis wants.
+const KIND_NONE = 0;
+const KIND_JOINER = 1;
+const KIND_EMOJIVS = 2;
+const KIND_TAG = 3;
+const KIND_STDVS = 4;
+const KIND_IVS = 5;
+const KIND_BLANK = 6;
+
+/** Small code -> CHECKS category, indexed by the CODE_* values above. In CHECKS
+ * order, so a code point in two sets reports the category the regexes would
+ * report first. @type {(string|null)[]} */
+const CODE_CATEGORY = [
+  null,
+  CATEGORY.CF,
+  CATEGORY.VARIATION_SELECTORS,
+  CATEGORY.BLANK_FILLERS,
+];
+
+// code point -> CODE_* above, projected from the SAME three code-point sets the
+// CHECKS regexes are built from, in CHECKS order. Every CHECKS class holds
 // single code points under the `u` flag, so a lookup and a `.test` answer
 // identically; test/invisible-fast-path.test.mjs pins that over the whole
 // code-point space, because a code point dropped here is one the scatter gate
-// stops counting. A lookup rather than the regexes because this runs once per
-// code point of every prompt and tool output.
-/** @type {Map<number, string>} */
+// stops counting.
+/** @type {Map<number, number>} */
 const TRACKED_INVISIBLE = new Map();
-for (const [code, codepoints] of /** @type {[string, Iterable<number>][]} */ ([
-  [CATEGORY.CF, CF_CODEPOINTS],
-  [CATEGORY.VARIATION_SELECTORS, [...VS].map((ch) => ch.codePointAt(0))],
-  [CATEGORY.BLANK_FILLERS, [...BLANK_NON_CF].map((ch) => ch.codePointAt(0))],
+for (const [code, codepoints] of /** @type {[number, Iterable<number>][]} */ ([
+  [CODE_CF, CF_CODEPOINTS],
+  [CODE_VS, [...VS].map((ch) => ch.codePointAt(0))],
+  [CODE_BLANK, [...BLANK_NON_CF].map((ch) => ch.codePointAt(0))],
 ]))
   for (const cp of codepoints)
     if (!TRACKED_INVISIBLE.has(cp)) TRACKED_INVISIBLE.set(cp, code);
@@ -573,32 +609,87 @@ for (const [code, codepoints] of /** @type {[string, Iterable<number>][]} */ ([
 const MIN_TRACKED_CP = Math.min(...TRACKED_INVISIBLE.keys());
 
 /**
- * The CHECKS category code (a CATEGORY value) a code point belongs to, or null
- * when it is not payload-capable (an ordinary visible character).
+ * The CODE_* class a code point belongs to, or CODE_VISIBLE when it is not
+ * payload-capable (an ordinary visible character).
  * @param {number} cp
- * @returns {string | null}
+ * @returns {number}
  */
 function classifyCp(cp) {
-  if (cp < MIN_TRACKED_CP) return null;
-  return TRACKED_INVISIBLE.get(cp) ?? null;
+  if (cp < MIN_TRACKED_CP) return CODE_VISIBLE;
+  return TRACKED_INVISIBLE.get(cp) ?? CODE_VISIBLE;
 }
 
+// Distinct code points a memoizedCpPredicate will remember. Comfortably above
+// the character repertoire of any real document (and of every test corpus here)
+// while bounding what a single hostile paste can make one predicate retain.
+const CP_PREDICATE_MEMO_CAP = 4096;
+
 /**
- * The CHECKS category code (a CATEGORY value) a single code point belongs to,
- * or null when it is not payload-capable (an ordinary visible character).
- * @param {string} ch  one code point
- * @returns {string | null}
+ * A code-point predicate backed by a single-code-point RegExp, memoized on the
+ * code point.
+ *
+ * The carve analysis asks these of the same handful of code points over and
+ * over — a document is a few hundred distinct characters repeated — and each
+ * ask otherwise costs a `String.fromCodePoint` allocation plus a Unicode
+ * property-class match. The memo is a pure accelerator: it answers exactly what
+ * the RegExp answers, for the same input, forever (a code point's Unicode
+ * properties do not change inside a process).
+ *
+ * The entry cap is a MEMORY policy, not a scan bound: past it the predicate
+ * still answers every code point, just without recording new ones, so no input
+ * can change a verdict by overflowing the table — only by giving up the speed-up
+ * it would otherwise have had.
+ * @param {RegExp} re  single-code-point matcher
+ * @returns {(cp: number) => boolean}
+ */
+function memoizedCpPredicate(re) {
+  /** @type {Map<number, boolean>} */
+  const memo = new Map();
+  return (cp) => {
+    if (cp < 0) return false; // past a string boundary: the "" neighbour
+    const hit = memo.get(cp);
+    if (hit !== undefined) return hit;
+    const answer = re.test(String.fromCodePoint(cp));
+    if (memo.size < CP_PREDICATE_MEMO_CAP) memo.set(cp, answer);
+    return answer;
+  };
+}
+
+/**
+ * `text` as its code points, in the units the String iterator yields — the same
+ * sequence `Array.from(text)` produces (an unpaired surrogate stands alone as
+ * itself), as numbers rather than one heap-allocated one-character string each.
+ * Every carve-analysis predicate reads a code point, so the numbers are the
+ * whole requirement: a 256 KB paste that would cost a quarter of a million
+ * short-lived strings per pass costs one buffer, and the collector stays out of
+ * a blocking hook.
+ * @param {string} text
+ * @returns {Int32Array}
  */
-function classify(ch) {
-  return classifyCp(/** @type {number} */ (ch.codePointAt(0)));
+function codePointArray(text) {
+  const cps = new Int32Array(text.length);
+  let n = 0;
+  for (let i = 0; i < text.length; i++) {
+    const unit = text.charCodeAt(i);
+    let cp = unit;
+    if (unit >= 0xd800 && unit <= 0xdbff && i + 1 < text.length) {
+      const low = text.charCodeAt(i + 1);
+      if (low >= 0xdc00 && low <= 0xdfff) {
+        cp = (unit - 0xd800) * 0x400 + (low - 0xdc00) + 0x10000;
+        i++;
+      }
+    }
+    cps[n++] = cp;
+  }
+  return n === cps.length ? cps : cps.subarray(0, n);
 }
 
 /**
- * True when `text` holds at least one code point {@link classify} calls
- * invisible. Walks UTF-16 units directly rather than iterating code-point
- * strings, so a clean multi-MB paste is answered without allocating one string
- * per character; surrogates are paired exactly as the String iterator pairs
- * them, an unpaired one classifying as the lone surrogate it is.
+ * True when `text` holds at least one code point {@link classifyCp} calls
+ * invisible. Walks UTF-16 units directly rather than building the code-point
+ * array, so a clean multi-MB paste is answered without allocating anything;
+ * surrogates are paired exactly as the String iterator pairs them, an unpaired
+ * one classifying as the lone surrogate it is.
  * @param {string} text
  * @returns {boolean}
  */
@@ -612,7 +703,7 @@ function hasInvisibleCodePoint(text) {
         i++;
       }
     }
-    if (classifyCp(cp) !== null) return true;
+    if (classifyCp(cp) !== CODE_VISIBLE) return true;
   }
   return false;
 }
@@ -636,15 +727,13 @@ function codePointLength(text) {
  * @param {string} jt @returns {boolean} */
 const isCursiveLetter = (jt) => jt === "D" || jt === "R" || jt === "L";
 
-/** The Joining_Type of a single-code-point string, or "U" for "" (boundary).
- * @param {string} ch @returns {string} */
-const jtOf = (ch) =>
-  ch ? joiningType(/** @type {number} */ (ch.codePointAt(0))) : "U";
+/** The Joining_Type of a code point, or "U" for -1 (past a string boundary).
+ * @param {number} cp @returns {string} */
+const jtOf = (cp) => (cp < 0 ? "U" : joiningType(cp));
 
-/** True when `ch` is itself a ZWNJ/ZWJ (used to reject joiner runs).
- * @param {string} ch @returns {boolean} */
-function isJoinControl(ch) {
-  const cp = ch ? ch.codePointAt(0) : -1;
+/** True when `cp` is itself a ZWNJ/ZWJ (used to reject joiner runs).
+ * @param {number} cp @returns {boolean} */
+function isJoinControl(cp) {
   return cp === ZWNJ || cp === ZWJ;
 }
 
@@ -658,18 +747,18 @@ function isJoinControl(ch) {
  * between two joiners hides the joiner-RUN until a first pass removes it, after
  * which a second pass strips the now-adjacent joiners — non-idempotent. Join
  * controls (ZWNJ/ZWJ) are deliberately NOT skipped: they are the run signal.
- * Returns "" past the string boundary.
- * @param {string[]} cps @param {number} i @param {number} dir  -1 or +1
- * @returns {string}
+ * Returns -1 past the string boundary (the old "" neighbour).
+ * @param {Int32Array} cps @param {number} i @param {number} dir  -1 or +1
+ * @returns {number}
  */
 function effectiveNeighbor(cps, i, dir) {
   for (let j = i + dir; j >= 0 && j < cps.length; j += dir) {
-    const ch = cps[j];
-    if (jtOf(ch) === "T") continue;
-    if (!isJoinControl(ch) && classify(ch) !== null) continue;
-    return ch;
+    const cp = cps[j];
+    if (jtOf(cp) === "T") continue;
+    if (!isJoinControl(cp) && classifyCp(cp) !== CODE_VISIBLE) continue;
+    return cp;
   }
-  return "";
+  return -1;
 }
 
 /**
@@ -680,15 +769,19 @@ function effectiveNeighbor(cps, i, dir) {
  * virama (which is Joining_Type Transparent, so it is the anchor, never skipped),
  * then uses effectiveNeighbor to find the consonant base past any transparent
  * marks / invisibles between it and the virama.
- * @param {string[]} cps @param {number} i
+ * @param {Int32Array} cps @param {number} i
  * @returns {boolean}
  */
 function followsBrahmicConjunct(cps, i) {
   let j = i - 1;
-  while (j >= 0 && !isJoinControl(cps[j]) && classify(cps[j]) !== null) j--;
-  if (j < 0 || !isVirama(/** @type {number} */ (cps[j].codePointAt(0))))
-    return false;
-  return isBrahmicConsonantChar(effectiveNeighbor(cps, j, -1));
+  while (
+    j >= 0 &&
+    !isJoinControl(cps[j]) &&
+    classifyCp(cps[j]) !== CODE_VISIBLE
+  )
+    j--;
+  if (j < 0 || !isVirama(cps[j])) return false;
+  return isBrahmicConsonantCp(effectiveNeighbor(cps, j, -1));
 }
 
 /**
@@ -700,12 +793,12 @@ function followsBrahmicConjunct(cps, i) {
  *   - Arabic-family joiner: between two cursive letters (ZWNJ needs both, ZWJ at
  *     least one — it forces a connected form). A joiner whose effective neighbour
  *     is ANOTHER joiner is a run (a zero-width payload channel) and is rejected.
- * Leading/trailing joiners fall out because "" has Joining_Type U.
- * @param {string[]} cps @param {number} i
+ * Leading/trailing joiners fall out because the -1 boundary has Joining_Type U.
+ * @param {Int32Array} cps @param {number} i
  * @returns {boolean}
  */
 function isPreservedJoiner(cps, i) {
-  const cp = /** @type {number} */ (cps[i].codePointAt(0));
+  const cp = cps[i];
   if (cp !== ZWNJ && cp !== ZWJ) return false;
   // Emoji ZWJ sequences use ZWJ only; the real neighbours are the pictographs,
   // which may each sit behind a variation selector (🏳️‍🌈 = base VS16 ZWJ rainbow;
@@ -713,8 +806,8 @@ function isPreservedJoiner(cps, i) {
   // selectors on BOTH sides — leftNonSelector and its mirror rightNonSelector.
   if (
     cp === ZWJ &&
-    EMOJI_LEFT.test(leftNonSelector(cps, i)) &&
-    EMOJI_BASE.test(rightNonSelector(cps, i))
+    isEmojiLeft(leftNonSelector(cps, i)) &&
+    isEmojiBase(rightNonSelector(cps, i))
   )
     return true;
   // Indic: meaningful only after a virama sitting on a real consonant base.
@@ -737,62 +830,65 @@ function isPreservedJoiner(cps, i) {
  * A keycap base + selector with NO trailing U+20E3 is a bare hidden presentation
  * selector, so it fails closed and is stripped. A longer selector run still
  * surfaces: the next selector's left neighbour is itself a selector.
- * @param {string[]} cps @param {number} i
+ * @param {Int32Array} cps @param {number} i
  * @returns {boolean}
  */
 function isEmojiPresentationSelector(cps, i) {
-  if (
-    !PRESENTATION_SELECTORS.has(/** @type {number} */ (cps[i].codePointAt(0)))
-  )
-    return false;
-  const prev = cps[i - 1] ?? "";
-  if (EMOJI_LEFT.test(prev)) return true;
+  if (!PRESENTATION_SELECTORS.has(cps[i])) return false;
+  const prev = i > 0 ? cps[i - 1] : -1;
+  if (isEmojiLeft(prev)) return true;
   return (
-    KEYCAP_BASE.test(prev) &&
-    (cps[i + 1]?.codePointAt(0) ?? -1) === COMBINING_KEYCAP
+    isKeycapBase(prev) &&
+    (i + 1 < cps.length ? cps[i + 1] : -1) === COMBINING_KEYCAP
   );
 }
 
 /**
  * Per-invisible carve-out analysis, shared by carveStrip and
- * countPayloadInvisible: for each code point, its CHECKS category (null when
- * visible) and its preserve `kind` ("joiner" | "emojivs" | "tag" | "stdvs" |
- * "ivs" | "blank" | null). Everything invisible that is NOT preserve-eligible is
- * payload; the scatter floor counts only that, so meaningful joiners/selectors
- * never push honest prose over the threshold.
- * @param {string[]} cps
- * @returns {{ codes: (string|null)[], kind: (string|null)[], payloadInvis: number, visibleLen: number }}
+ * countPayloadInvisible: for each code point, its CODE_* class (CODE_VISIBLE
+ * when visible) and its preserve KIND_* (KIND_NONE when the char is payload).
+ * Everything invisible that is NOT preserve-eligible is payload; the scatter
+ * floor counts only that, so meaningful joiners/selectors never push honest
+ * prose over the threshold.
+ * @param {Int32Array} cps
+ * @returns {{ codes: Uint8Array, kind: Uint8Array, payloadInvis: number, visibleLen: number }}
  */
 function analyzeCarve(cps) {
-  const codes = new Array(cps.length);
+  const codes = new Uint8Array(cps.length);
   // Indices of the invisibles, so every pass below is O(invisibles) rather than
   // O(length): in ordinary text they are a vanishing fraction of a paste, and a
   // full-length pass per preserve rule is what made the analysis linear in the
   // WHOLE prompt several times over.
-  const invisible = [];
+  let invisCount = 0;
   let visibleLen = 0;
   let hasTagBase = false;
   for (let i = 0; i < cps.length; i++) {
-    const code = classify(cps[i]);
+    const code = classifyCp(cps[i]);
     codes[i] = code;
-    if (code !== null) {
-      invisible.push(i);
+    if (code !== CODE_VISIBLE) {
+      invisCount++;
       continue;
     }
     visibleLen++;
-    hasTagBase ||= cps[i].codePointAt(0) === TAG_BASE;
+    hasTagBase ||= cps[i] === TAG_BASE;
   }
+  // Sized exactly, from the count the pass above already produced: a growable
+  // array reallocates its way up through a document that is mostly invisible,
+  // and that churn is the collector's whole share of this function.
+  const invisible = new Int32Array(invisCount);
+  for (let i = 0, at = 0; at < invisCount; i++)
+    if (codes[i] !== CODE_VISIBLE) invisible[at++] = i;
   // A tag sequence is preservable only when it opens on a TAG_BASE pictograph,
   // so with no base in the text markTagSequences returns all-false.
   const tagKeep = hasTagBase ? markTagSequences(cps) : null;
-  const kind = new Array(cps.length).fill(null);
+  const kind = new Uint8Array(cps.length);
   for (const i of invisible) {
-    if (tagKeep !== null && tagKeep[i]) kind[i] = "tag";
-    else if (isPreservedJoiner(cps, i)) kind[i] = "joiner";
-    else if (isEmojiPresentationSelector(cps, i)) kind[i] = "emojivs";
-    else if (isStandardizedVariationSelector(cps, i)) kind[i] = "stdvs";
-    else if (isIdeographicVariationSelector(cps, i)) kind[i] = "ivs";
-    else if (isPreservedBlankFiller(cps, i)) kind[i] = "blank";
+    if (tagKeep !== null && tagKeep[i]) kind[i] = KIND_TAG;
+    else if (isPreservedJoiner(cps, i)) kind[i] = KIND_JOINER;
+    else if (isEmojiPresentationSelector(cps, i)) kind[i] = KIND_EMOJIVS;
+    else if (isStandardizedVariationSelector(cps, i)) kind[i] = KIND_STDVS;
+    else if (isIdeographicVariationSelector(cps, i)) kind[i] = KIND_IVS;
+    else if (isPreservedBlankFiller(cps, i)) kind[i] = KIND_BLANK;
   }
   // Blank fillers are budgeted here, document-wide and all-or-nothing, against
   // the visible anchor-script text rather than against the joiner/selector
@@ -811,28 +907,25 @@ function analyzeCarve(cps) {
   /** @type {Record<string, number[]>} */
   const blankIndices = { braille: [], hangul: [] };
   for (const i of invisible)
-    if (kind[i] === "blank")
-      blankIndices[
-        cps[i].codePointAt(0) === BRAILLE_BLANK ? "braille" : "hangul"
-      ].push(i);
+    if (kind[i] === KIND_BLANK)
+      blankIndices[cps[i] === BRAILLE_BLANK ? "braille" : "hangul"].push(i);
   for (const [
     script,
     isAnchor,
-  ] of /** @type {[string, (ch: string) => boolean][]} */ ([
+  ] of /** @type {[string, (cp: number) => boolean][]} */ ([
     ["braille", isBrailleCell],
     ["hangul", isHangul],
   ])) {
     const indices = blankIndices[script];
     if (indices.length <= TOTAL_PRESERVED_BLANK_BUDGET) continue;
-    const anchors = cps.reduce(
-      (n, ch, i) => n + (codes[i] === null && isAnchor(ch) ? 1 : 0),
-      0,
-    );
+    let anchors = 0;
+    for (let i = 0; i < cps.length; i++)
+      if (codes[i] === CODE_VISIBLE && isAnchor(cps[i])) anchors++;
     if (indices.length > Math.floor(anchors / PRESERVED_BLANK_PER_ANCHOR))
-      for (const i of indices) kind[i] = null;
+      for (const i of indices) kind[i] = KIND_NONE;
   }
   let payloadInvis = 0;
-  for (const i of invisible) if (kind[i] === null) payloadInvis++;
+  for (const i of invisible) if (kind[i] === KIND_NONE) payloadInvis++;
   return { codes, kind, payloadInvis, visibleLen };
 }
 
@@ -847,12 +940,12 @@ function analyzeCarve(cps) {
  */
 export function countPayloadInvisible(text) {
   // Payload is a SUBSET of the invisibles (analyzeCarve counts only positions
-  // classify marks invisible), so a text with none has a payload count of zero
+  // classifyCp marks invisible), so a text with none has a payload count of zero
   // and needs neither the code-point array nor the carve analysis. This reads
   // every code point — it is a necessary condition checked in full, not a scan
   // bound an attacker could paste past.
   if (!hasInvisibleCodePoint(text)) return 0;
-  return analyzeCarve(Array.from(text)).payloadInvis;
+  return analyzeCarve(codePointArray(text)).payloadInvis;
 }
 
 /**
@@ -872,33 +965,33 @@ function bulkStrip(body) {
 
 /**
  * The nearest code point left of index `i` that is not a variation selector, or
- * "" at the string start. An emoji ZWJ sequence can place a VS16 between the base
+ * -1 at the string start. An emoji ZWJ sequence can place a VS16 between the base
  * pictograph and the ZWJ, so the joiner's real left neighbor is found by stepping
  * over any variation selector(s).
- * @param {string[]} cps
+ * @param {Int32Array} cps
  * @param {number} i
- * @returns {string}
+ * @returns {number}
  */
 function leftNonSelector(cps, i) {
   let p = i - 1;
-  while (p >= 0 && VARIATION_SELECTOR.test(cps[p])) p--;
-  return cps[p] ?? "";
+  while (p >= 0 && isVariationSelectorCp(cps[p])) p--;
+  return p >= 0 ? cps[p] : -1;
 }
 
 /**
  * The nearest code point right of index `i` that is not a variation selector, or
- * "" at the string end. Mirror of {@link leftNonSelector}: an emoji ZWJ can be
+ * -1 at the string end. Mirror of {@link leftNonSelector}: an emoji ZWJ can be
  * followed by a selector before the next component's base pictograph, so the
  * joiner's real right neighbor is found by stepping over any variation
  * selector(s).
- * @param {string[]} cps
+ * @param {Int32Array} cps
  * @param {number} i
- * @returns {string}
+ * @returns {number}
  */
 function rightNonSelector(cps, i) {
   let p = i + 1;
-  while (p < cps.length && VARIATION_SELECTOR.test(cps[p])) p++;
-  return cps[p] ?? "";
+  while (p < cps.length && isVariationSelectorCp(cps[p])) p++;
+  return p < cps.length ? cps[p] : -1;
 }
 
 /**
@@ -910,23 +1003,17 @@ function rightNonSelector(cps, i) {
  * payload is not a registered subdivision is left unmarked so it is stripped —
  * grammatical validity alone is NOT enough, since a valid run spells arbitrary
  * ASCII (fail closed on the top ASCII-smuggling vector).
- * @param {string[]} cps
- * @returns {boolean[]} keep[i] true iff `cps[i]` is inside a preservable tag sequence
+ * @param {Int32Array} cps
+ * @returns {Uint8Array} keep[i] non-zero iff `cps[i]` is inside a preservable tag sequence
  */
 function markTagSequences(cps) {
-  const keep = new Array(cps.length).fill(false);
-  /** @param {number} k @returns {number} */
-  const cpAt = (k) => /** @type {number} */ (cps[k].codePointAt(0));
+  const keep = new Uint8Array(cps.length);
   for (let i = 0; i < cps.length; i++) {
-    if (cpAt(i) !== TAG_BASE) continue;
+    if (cps[i] !== TAG_BASE) continue;
     let j = i + 1;
     let payload = "";
-    while (
-      j < cps.length &&
-      cpAt(j) >= TAG_SPEC_MIN &&
-      cpAt(j) <= TAG_SPEC_MAX
-    ) {
-      payload += String.fromCharCode(cpAt(j) - 0xe0000);
+    while (j < cps.length && cps[j] >= TAG_SPEC_MIN && cps[j] <= TAG_SPEC_MAX) {
+      payload += String.fromCharCode(cps[j] - 0xe0000);
       j++;
     }
     const tagLen = j - (i + 1);
@@ -936,10 +1023,10 @@ function markTagSequences(cps) {
       tagLen >= 1 &&
       tagLen <= MAX_TAG_SPEC_CHARS &&
       j < cps.length &&
-      cpAt(j) === TAG_CANCEL &&
+      cps[j] === TAG_CANCEL &&
       REGISTERED_TAG_PAYLOADS.has(payload)
     ) {
-      for (let k = i + 1; k <= j; k++) keep[k] = true;
+      for (let k = i + 1; k <= j; k++) keep[k] = 1;
       i = j; // resume after the consumed sequence
     }
   }
@@ -951,29 +1038,26 @@ function markTagSequences(cps) {
  * immediately preceding code point forms a REGISTERED standardized variation
  * sequence (per the generated UCD table). Every unregistered FE00–FE0D selector
  * stays payload.
- * @param {string[]} cps @param {number} i
+ * @param {Int32Array} cps @param {number} i
  * @returns {boolean}
  */
 function isStandardizedVariationSelector(cps, i) {
-  const cp = /** @type {number} */ (cps[i].codePointAt(0));
+  const cp = cps[i];
   if (cp < 0xfe00 || cp > 0xfe0d) return false;
-  const prev = cps[i - 1];
-  return prev
-    ? isStandardizedVariant(/** @type {number} */ (prev.codePointAt(0)), cp)
-    : false;
+  return i > 0 ? isStandardizedVariant(cps[i - 1], cp) : false;
 }
 
 /**
  * True when `cps[i]` is an ideographic variation selector (VS17–VS256,
  * U+E0100–U+E01EF) immediately after a CJK ideograph — the registry-faithful
  * structural gate for an ideographic variation sequence.
- * @param {string[]} cps @param {number} i
+ * @param {Int32Array} cps @param {number} i
  * @returns {boolean}
  */
 function isIdeographicVariationSelector(cps, i) {
-  const cp = /** @type {number} */ (cps[i].codePointAt(0));
+  const cp = cps[i];
   if (cp < IVS_MIN || cp > IVS_MAX) return false;
-  return isCjkIdeograph(cps[i - 1] ?? "");
+  return isCjkIdeograph(i > 0 ? cps[i - 1] : -1);
 }
 
 /**
@@ -981,13 +1065,13 @@ function isIdeographicVariationSelector(cps, i) {
  * next to a real, script-appropriate visible neighbour — a genuine empty Braille
  * cell or archaic-Korean filler, not a hidden run. The zero-width Mn marks in
  * BLANK_NON_CF have no such anchored use and are never preserved here.
- * @param {string[]} cps @param {number} i
+ * @param {Int32Array} cps @param {number} i
  * @returns {boolean}
  */
 function isPreservedBlankFiller(cps, i) {
-  const cp = /** @type {number} */ (cps[i].codePointAt(0));
-  const prev = cps[i - 1] ?? "";
-  const next = cps[i + 1] ?? "";
+  const cp = cps[i];
+  const prev = i > 0 ? cps[i - 1] : -1;
+  const next = i + 1 < cps.length ? cps[i + 1] : -1;
   if (cp === BRAILLE_BLANK) return isBrailleCell(prev) || isBrailleCell(next);
   if (HANGUL_FILLERS.has(cp)) return isHangul(prev) || isHangul(next);
   return false;
@@ -1003,22 +1087,99 @@ const GRAPHEME_SEGMENTER = new Intl.Segmenter("en", {
 });
 
 /**
- * The code-point index one past the end of each grapheme cluster of `body`, in
- * order — the segmenter's UTF-16 boundaries restated in code-point space, which
- * is the space `carveStrip`'s per-code-point arrays live in. ECMA-402 guarantees
- * the segments partition the input, so the last entry is always the code-point
- * length of `body`.
- * @param {string} body
- * @returns {number[]}
+ * The UTF-16 index at which each code point of `cps` starts, plus one final
+ * entry for the end of the string — the bridge between the code-point space the
+ * carve analysis works in and the UTF-16 space `body.slice` and the segmenter
+ * speak.
+ * @param {Int32Array} cps
+ * @returns {Int32Array}
  */
-function clusterEnds(body) {
-  const ends = [];
-  let end = 0;
-  for (const { segment } of GRAPHEME_SEGMENTER.segment(body)) {
-    end += codePointLength(segment);
-    ends.push(end);
+function u16Offsets(cps) {
+  const offsets = new Int32Array(cps.length + 1);
+  let at = 0;
+  for (let i = 0; i < cps.length; i++) {
+    offsets[i] = at;
+    at += cps[i] > 0xffff ? 2 : 1;
   }
-  return ends;
+  offsets[cps.length] = at;
+  return offsets;
+}
+
+/**
+ * The code-point index of the UTF-16 index `u16`, by binary search over
+ * {@link u16Offsets}. `u16` is always a code-point (indeed a cluster) boundary,
+ * so the search always lands exactly.
+ * @param {Int32Array} offsets @param {number} u16
+ * @returns {number}
+ */
+function cpIndexOf(offsets, u16) {
+  let lo = 0;
+  let hi = offsets.length - 1;
+  while (lo < hi) {
+    const mid = (lo + hi) >> 1;
+    if (offsets[mid] < u16) lo = mid + 1;
+    else hi = mid;
+  }
+  return lo;
+}
+
+// Above this share of the code points being carve-out CANDIDATES, resolving each
+// candidate's cluster with `Segments.containing` costs more than segmenting the
+// document once from the start (a `containing` call is a few times dearer than
+// one step of the sequential iterator). Both strategies read the SAME segmenter,
+// so they return the same boundaries; this only picks the cheaper way to ask.
+const CONTAINING_CANDIDATE_SHARE = 4;
+
+/**
+ * A source of the grapheme cluster containing a given code-point index, over
+ * indices asked for in increasing order.
+ *
+ * Cluster boundaries matter only where a preservable invisible sits: a cluster
+ * with none leaves every counter in {@link carveStrip} untouched, and the emit
+ * loop treats each of its code points the same however the boundaries fall. So
+ * the clusters are resolved on demand around the candidates rather than by
+ * segmenting the whole document — the difference between reading one emoji at
+ * the end of an 8 MB log and segmenting the 8 MB.
+ * @param {string} body @param {Int32Array} offsets @param {number} candidates
+ * @returns {(cp: number) => { start: number, end: number }}
+ */
+function clusterResolver(body, offsets, candidates) {
+  const cpCount = offsets.length - 1;
+  if (candidates * CONTAINING_CANDIDATE_SHARE < cpCount) {
+    const segments = GRAPHEME_SEGMENTER.segment(body);
+    return (cp) => {
+      // `offsets[cp]` is inside the string for every code-point index the walk
+      // asks about, so the segment always exists.
+      const found = /** @type {{ index: number, segment: string }} */ (
+        segments.containing(offsets[cp])
+      );
+      return {
+        start: cpIndexOf(offsets, found.index),
+        end: cpIndexOf(offsets, found.index + found.segment.length),
+      };
+    };
+  }
+  // Dense candidates: walk the segmenter forward instead, keeping a code-point
+  // cursor in step with it so no boundary needs searching for. The iterator is
+  // abandoned wherever the last candidate leaves it, so a document whose
+  // preserve budget is spent in its first line is never segmented past it.
+  const iterator = GRAPHEME_SEGMENTER.segment(body)[Symbol.iterator]();
+  let start = 0;
+  let end = 0;
+  return (cp) => {
+    while (end <= cp) {
+      // ECMA-402 guarantees the segments partition the input, so every code
+      // point inside it has a cluster and the iterator cannot run out first; if
+      // it ever did, reading `.segment` off `undefined` throws here rather than
+      // silently answering with a boundary nobody computed.
+      const step = /** @type {{ value: { segment: string } }} */ (
+        iterator.next()
+      );
+      start = end;
+      end = cpIndexOf(offsets, offsets[start] + step.value.segment.length);
+    }
+    return { start, end };
+  };
 }
 
 /**
@@ -1046,14 +1207,19 @@ function clusterEnds(body) {
  * makes the caller claim a strip that did not happen, and a stuffed channel
  * surfaces as its category once it overruns the budget.
  * @param {string} body
+ * @param {Int32Array} [cps]  `body`'s code points, when the caller already has them
+ * @param {ReturnType<typeof analyzeCarve>} [analysis]  likewise the analysis
  * @returns {{ cleaned: string, found: string[] }}
  */
-function carveStrip(body) {
-  const cps = Array.from(body);
-  // Pass 1: classify + evaluate the gate once (see analyzeCarve). Only PAYLOAD
-  // invisibles count toward the scatter floor, so a meaningful-joiner-dense text
-  // (formal Persian, a long Devanagari conjunct run) stays under it.
-  const { codes, kind, payloadInvis, visibleLen } = analyzeCarve(cps);
+function carveStrip(
+  body,
+  cps = codePointArray(body),
+  analysis = analyzeCarve(cps),
+) {
+  // Only PAYLOAD invisibles count toward the scatter floor, so a
+  // meaningful-joiner-dense text (formal Persian, a long Devanagari conjunct
+  // run) stays under it.
+  const { codes, kind, payloadInvis, visibleLen } = analysis;
   // SCATTERED_THRESHOLD is the floor on payload invisibles: past it the document
   // is drowning in hidden bytes, so the carve-out is off and even a meaningful
   // joiner is stripped (threshold-evasion catch — over-strip beats under).
@@ -1070,8 +1236,25 @@ function carveStrip(body) {
     ),
   );
 
+  const n = cps.length;
+  // Every code point that draws on the joiner/selector budget, in order. Blank
+  // fillers are exempt (their allowance is already spent in analyzeCarve), so a
+  // cluster holding only those needs no boundary of its own.
+  /** @type {number[]} */
+  const candidates = [];
+  if (allowCarveOut)
+    for (let k = 0; k < n; k++)
+      if (kind[k] !== KIND_NONE && kind[k] !== KIND_BLANK) candidates.push(k);
+
   const foundCodes = new Set();
-  let out = "";
+  /** @type {string[]} */
+  const kept = [];
+  const offsets = u16Offsets(cps);
+  // Start of the kept run currently being accumulated, in UTF-16 units. Output
+  // is assembled from slices of `body` — one per uninterrupted kept run — rather
+  // than a character at a time, so a document with nothing to strip costs one
+  // slice however long it is.
+  let runStart = 0;
   // Preserved JOINERS in the current uninterrupted cluster (tags/blank fillers
   // and presentation selectors don't chain, so they are exempt). A genuine gap
   // (two visible chars in a row — see prevVisible) resets it; past the cap the
@@ -1088,80 +1271,151 @@ function carveStrip(body) {
   // char is stripped and its category reported.
   let preservedTotal = 0;
   let prevVisible = false;
-  let start = 0;
-  for (const end of clusterEnds(body)) {
+
+  /** Emit `[from, to)` under a settled `fits`, updating every counter.
+   * @param {number} from @param {number} to @param {boolean} fits */
+  const emit = (from, to, fits) => {
+    for (let k = from; k < to; k++) {
+      const code = codes[k];
+      if (code === CODE_VISIBLE) {
+        // A visible char following another visible char is a real word/segment
+        // boundary, not a join — the joined cluster (if any) ended here.
+        if (prevVisible) {
+          joinerRun = 0;
+          selectorRun = 0;
+        }
+        prevVisible = true;
+        continue; // ordinary visible character: stays inside the kept run
+      }
+      // A blank filler rides on allowCarveOut alone (its own allowance is
+      // already spent in analyzeCarve); everything else rides on `fits`.
+      if (
+        kind[k] === KIND_BLANK ? allowCarveOut : fits && kind[k] !== KIND_NONE
+      ) {
+        if (kind[k] === KIND_JOINER) joinerRun++;
+        if (kind[k] === KIND_IVS || kind[k] === KIND_STDVS) selectorRun++;
+        if (kind[k] !== KIND_BLANK) preservedTotal++;
+        prevVisible = false; // a joiner/selector/tag/blank keeps the cluster open
+        continue;
+      }
+      foundCodes.add(CODE_CATEGORY[code]);
+      prevVisible = false; // a stripped invisible neither opens nor closes a gap
+      if (offsets[k] > runStart) kept.push(body.slice(runStart, offsets[k]));
+      runStart = offsets[k + 1];
+    }
+  };
+
+  const clusterOf =
+    candidates.length > 0
+      ? clusterResolver(body, offsets, candidates.length)
+      : null;
+  // The last index at which the emit loop resets the run counters — a visible
+  // code point directly after another visible one. The condition reads only
+  // `codes`, never a preserve decision, so the whole set of reset points is
+  // known before the walk starts. Past this index the run counters can only
+  // ever be incremented, which is what makes the exhaustion test below final.
+  let lastGap = -1;
+  // Remaining candidates by the limit each one draws on, decremented as the
+  // walk passes them.
+  let leftJoiner = 0;
+  let leftSelector = 0;
+  let leftOther = 0;
+  if (clusterOf !== null) {
+    for (let i = n - 1; i > 0; i--)
+      if (codes[i] === CODE_VISIBLE && codes[i - 1] === CODE_VISIBLE) {
+        lastGap = i;
+        break;
+      }
+    for (const c of candidates) {
+      if (kind[c] === KIND_JOINER) leftJoiner++;
+      else if (kind[c] === KIND_IVS || kind[c] === KIND_STDVS) leftSelector++;
+      else leftOther++;
+    }
+  }
+
+  /** True when no cluster from here on can be preserved, so the rest of the
+   * document is settled and needs no boundaries. Every term is monotone:
+   * `preservedTotal` only grows, and past `lastGap` the run counters only grow
+   * too, so a limit that is spent here is spent for good.
+   * @param {number} at */
+  const nothingLeftFits = (at) => {
+    if (preservedTotal >= maxPreserved) return true;
+    if (at <= lastGap) return false; // a reset ahead can reopen a spent run
+    if (leftOther > 0) return false; // a tag/presentation selector draws on neither run
+    if (leftJoiner > 0 && joinerRun < CONSECUTIVE_JOINER_CAP) return false;
+    if (leftSelector > 0 && selectorRun < CONSECUTIVE_SELECTOR_CAP)
+      return false;
+    return true;
+  };
+
+  let k = 0;
+  let next = 0;
+  while (k < n) {
+    while (next < candidates.length && candidates[next] < k) next++;
+    if (
+      clusterOf === null ||
+      next === candidates.length ||
+      nothingLeftFits(k)
+    ) {
+      emit(k, n, false);
+      break;
+    }
+    const { start, end } = clusterOf(candidates[next]);
+    if (start > k) emit(k, start, false);
     // Charge the WHOLE cluster's preservables against every limit at once: if
     // any one of them would fall due part-way through, none of the cluster is
-    // preserved. `need === 0` (the common case: a cluster with no preservable
-    // invisible) leaves every counter untouched.
+    // preserved.
     let need = 0;
     let joiners = 0;
     let selectors = 0;
-    for (let k = start; k < end; k++) {
-      // "blank" is exempt: analyzeCarve already decided it against the
-      // anchor-proportional allowance, so it neither draws on this budget nor
-      // is stripped by it (only by the scatter floor, via allowCarveOut).
-      if (kind[k] === null || kind[k] === "blank") continue;
+    for (let j = start; j < end; j++) {
+      if (kind[j] === KIND_NONE || kind[j] === KIND_BLANK) continue;
       need++;
-      if (kind[k] === "joiner") joiners++;
-      if (kind[k] === "ivs" || kind[k] === "stdvs") selectors++;
+      if (kind[j] === KIND_JOINER) joiners++;
+      if (kind[j] === KIND_IVS || kind[j] === KIND_STDVS) selectors++;
     }
     // The run counters as they stand at the cluster's FIRST preservable char.
     // A cluster can OPEN with a genuine gap — two visible code points in a row,
     // e.g. the second of two adjacent emoji ZWJ sequences, or a letter and its
-    // harakat — which the emit loop resets on a few lines below. Judging the
-    // caps on the stale pre-reset count would strip joiners the cap never meant
-    // to catch: a false positive on legitimate joined text. This mirrors the
-    // emit loop's gap rule exactly (only a visible char after another visible
-    // char closes a run; any invisible, payload included, does not) and stops at
-    // the first preservable, since resets past it are the emit loop's business.
+    // harakat — which the emit loop resets on. Judging the caps on the stale
+    // pre-reset count would strip joiners the cap never meant to catch: a false
+    // positive on legitimate joined text. This mirrors the emit loop's gap rule
+    // exactly (only a visible char after another visible char closes a run; any
+    // invisible, payload included, does not) and stops at the first preservable,
+    // since resets past it are the emit loop's business.
     let runJoiner = joinerRun;
     let runSelector = selectorRun;
     let seenVisible = prevVisible;
-    for (let k = start; k < end && kind[k] === null; k++) {
-      if (codes[k] === null && seenVisible) {
+    for (let j = start; j < end && kind[j] === KIND_NONE; j++) {
+      if (codes[j] === CODE_VISIBLE && seenVisible) {
         runJoiner = 0;
         runSelector = 0;
       }
-      seenVisible = codes[k] === null;
+      seenVisible = codes[j] === CODE_VISIBLE;
     }
-    const fits =
-      allowCarveOut &&
-      preservedTotal + need <= maxPreserved &&
-      runJoiner + joiners <= CONSECUTIVE_JOINER_CAP &&
-      runSelector + selectors <= CONSECUTIVE_SELECTOR_CAP;
-    for (let k = start; k < end; k++) {
-      const code = codes[k];
-      if (code === null) {
-        // A visible char following another visible char is a real word/segment
-        // boundary, not a join — the joined cluster (if any) ended here.
-        if (prevVisible) {
-          joinerRun = 0;
-          selectorRun = 0;
-        }
-        prevVisible = true;
-        out += cps[k]; // ordinary visible character
-        continue;
-      }
-      // A blank filler rides on allowCarveOut alone (its own allowance is
-      // already spent in analyzeCarve); everything else rides on `fits`.
-      if (kind[k] === "blank" ? allowCarveOut : fits && kind[k] !== null) {
-        if (kind[k] === "joiner") joinerRun++;
-        if (kind[k] === "ivs" || kind[k] === "stdvs") selectorRun++;
-        if (kind[k] !== "blank") preservedTotal++;
-        prevVisible = false; // a joiner/selector/tag/blank keeps the cluster open
-        out += cps[k];
-        continue;
-      }
-      foundCodes.add(code);
-      prevVisible = false; // a stripped invisible neither opens nor closes a gap
+    for (let j = next; j < candidates.length && candidates[j] < end; j++) {
+      if (kind[candidates[j]] === KIND_JOINER) leftJoiner--;
+      else if (
+        kind[candidates[j]] === KIND_IVS ||
+        kind[candidates[j]] === KIND_STDVS
+      )
+        leftSelector--;
+      else leftOther--;
     }
-    start = end;
+    emit(
+      start,
+      end,
+      preservedTotal + need <= maxPreserved &&
+        runJoiner + joiners <= CONSECUTIVE_JOINER_CAP &&
+        runSelector + selectors <= CONSECUTIVE_SELECTOR_CAP,
+    );
+    k = end;
   }
+  kept.push(body.slice(runStart));
   const found = CHECKS.filter(([code]) => foundCodes.has(code)).map(
     ([code]) => code,
   );
-  return { cleaned: out, found };
+  return { cleaned: kept.join(""), found };
 }
 
 // Any tag char (the whole U+E0000–U+E007F block is category Cf).
@@ -1198,12 +1452,28 @@ function needsCarveOut(body) {
  * @returns {string}
  */
 export function payloadInvisibleView(text) {
-  const cps = Array.from(text);
+  const cps = codePointArray(text);
   const { codes, kind } = analyzeCarve(cps);
-  let out = "";
-  for (let i = 0; i < cps.length; i++)
-    out += codes[i] !== null && kind[i] === null ? cps[i] : " ";
-  return out;
+  const offsets = u16Offsets(cps);
+  /** @param {number} i */
+  const isPayload = (i) => codes[i] !== CODE_VISIBLE && kind[i] === KIND_NONE;
+  // Written a RUN at a time — one `" ".repeat(n)` per masked stretch, one slice
+  // of `text` per payload stretch — because the two stretches alternate a
+  // handful of times in a real document and once per character in none of them.
+  /** @type {string[]} */
+  const parts = [];
+  let i = 0;
+  while (i < cps.length) {
+    const maskFrom = i;
+    while (i < cps.length && !isPayload(i)) i++;
+    // One space per masked CODE POINT, so the view stays code-point-aligned with
+    // `text` even where an astral character is two UTF-16 units wide.
+    if (i > maskFrom) parts.push(" ".repeat(i - maskFrom));
+    const keepFrom = i;
+    while (i < cps.length && isPayload(i)) i++;
+    if (i > keepFrom) parts.push(text.slice(offsets[keepFrom], offsets[i]));
+  }
+  return parts.join("");
 }
 
 /**
@@ -1259,13 +1529,40 @@ export function payloadLongRunSample(text) {
  * @returns {number}
  */
 export function countEffectiveInvisible(text) {
-  const payload = countPayloadInvisible(text);
-  const stripped = stripInvisible(text);
+  // A text with no invisible code point has no payload and nothing to strip, so
+  // it needs neither the code-point array nor the carve analysis. This reads
+  // every code point — a necessary condition checked in full, not a scan bound
+  // an attacker could paste past.
+  if (!hasInvisibleCodePoint(text)) return 0;
+  // A leading BOM is sliced off before the strip but counted by the analysis, so
+  // the two would read different strings; that case pays for both separately.
+  if (text.charCodeAt(0) === 0xfeff)
+    return surplusOver(countPayloadInvisible(text), text, stripInvisible(text));
+  // Otherwise both terms are readings of ONE carve analysis of ONE string, so
+  // the analysis is done once and handed to the strip.
+  const cps = codePointArray(text);
+  const analysis = analyzeCarve(cps);
+  const { cleaned } = stripBody(text, cps, analysis);
+  return surplusOver(analysis.payloadInvis, text, cleaned, cps.length);
+}
+
+/**
+ * The payload count plus the code points the strip removed BEYOND it — the
+ * carve-out's over-budget surplus (see {@link countEffectiveInvisible}). A
+ * leading BOM is preserved by the strip but counted as payload, so the
+ * difference can go slightly negative; hence the clamp.
+ * @param {number} payload @param {string} text @param {string} stripped
+ * @param {number} [cpLen]  `text`'s code-point length, when already known
+ * @returns {number}
+ */
+function surplusOver(payload, text, stripped, cpLen) {
   // Two identical strings differ by zero code points, so the common clean paste
   // skips both counting passes; codePointLength is the String iterator's count,
   // the same unit `[...text].length` measures, without the array.
   const removed =
-    stripped === text ? 0 : codePointLength(text) - codePointLength(stripped);
+    stripped === text
+      ? 0
+      : (cpLen ?? codePointLength(text)) - codePointLength(stripped);
   return payload + Math.max(0, removed - payload);
 }
 
@@ -1320,12 +1617,25 @@ export function stripInvisibleWithReport(text, originalText = text) {
   const hasLeadingBom =
     originalText.charCodeAt(0) === 0xfeff && text.charCodeAt(0) === 0xfeff;
   const body = hasLeadingBom ? text.slice(1) : text;
-  const { cleaned, found } = needsCarveOut(body)
-    ? carveStrip(body)
-    : bulkStrip(body);
+  const { cleaned, found } = stripBody(body);
   return { cleaned: hasLeadingBom ? BOM + cleaned : cleaned, found };
 }
 
+/**
+ * The strip of a BOM-resolved body: the carve-out walk when anything in it could
+ * be preserved, the single bulk regex pass otherwise. `cps` and `analysis` let a
+ * caller that has already analyzed `body` hand the work over instead of paying
+ * for it twice.
+ * @param {string} body
+ * @param {Int32Array} [cps]
+ * @param {ReturnType<typeof analyzeCarve>} [analysis]
+ * @returns {{ cleaned: string, found: string[] }}
+ */
+function stripBody(body, cps, analysis) {
+  if (!needsCarveOut(body)) return bulkStrip(body);
+  return carveStrip(body, cps, analysis);
+}
+
 /**
  * Strip payload-capable invisible chars (cleaned text only). See
  * stripInvisibleWithReport for the BOM and ZWNJ/ZWJ carve-out semantics.