echelongraph-mcp 3.0.0 → 3.0.2

package/dist/textBudget.js

@@ -62,7 +62,11 @@ import * as z from "zod";
 //      the tool names leave first (the clean rows, counted in data.summary), then the last of the
 //      rest, or for a step of series named keepNewest (exposure_radar's daily and weekly counts,
 //      which the API sends oldest first) its last ones, the newest, the oldest leaving first; a
-//      step that cannot fit even empty is emptied, and the next one is cut;
+//      step that cannot fit even empty is emptied, and the next one is cut. A level can cut inside
+//      each entry on its own terms (an EntryLevel, #3132: check_sbom's rows keep at most the same
+//      number of matches, the most that fit, so only the rows with more lose any), and a step named
+//      keepAll (#3139: cve_remediation's vendor_remediations) keeps every entry at its leanest level
+//      while the later steps are cut, its entries leaving only once they all are;
 //   2. then every other list at the top level of data, the same way. A list inside an object of
 //      data (get_cve's remediation summary, with fix_status, #2841) is cut only where a DataCut
 //      names it, and none names get_cve's. Once a step fits, the room it leaves goes back to the
@@ -70,7 +74,9 @@ import * as z from "zod";
 //      emptied while its rows were whole, keeps its entries once the thinned rows fit);
 //   3. no string is shortened and no value changes: a thinned entry keeps some of its fields as
 //      they are (every field a thinning level drops is optional in the outputSchema, so data still
-//      validates against it), and no field outside the lists cut changes; the envelope says
+//      validates against it), and no field outside the lists cut changes (the one field a cut
+//      adds is an EntryLevel's mark, check_sbom's matches_truncated, which says what the row's own
+//      cut left out, and which its outputSchema names); the envelope says
 //      data_truncated true, truncated gives each list cut by its path in data with its total, the
 //      number returned and, where its entries are thinned, thinned true, and the note ends with
 //      sentences starting DATA CUT that say what was cut and to which fields, how to read the rest
@@ -118,11 +124,12 @@ function cutValue(v, clip, cap, s) {
     if (typeof v === "string") {
         if (v.length <= clip)
             return v;
-        s.clipped++;
+        if (s)
+            s.clipped++;
         return clipString(v, clip);
     }
     if (Array.isArray(v)) {
-        if (v.length > cap)
+        if (s && v.length > cap)
             s.capped++;
         return v.slice(0, cap).map((x) => cutValue(x, clip, cap, s));
     }
@@ -130,18 +137,31 @@ function cutValue(v, clip, cap, s) {
         return Object.fromEntries(Object.entries(v).map(([k, x]) => [k, cutValue(x, clip, cap, s)]));
     return v;
 }
+// A RowKeep as the fields it names, each with its subfields (null: kept whole), built once per
+// RowKeep (3.0.2: through 3.0.1, once per row cut; a 2,000-row answer's structured cut built it
+// some 12,000 times). A RowKeep is never changed once built.
+const wantedOf = (() => {
+    const built = new WeakMap();
+    return (keep) => {
+        let wanted = built.get(keep);
+        if (!wanted)
+            built.set(keep, (wanted = new Map(keep.map((k) => (typeof k === "string" ? [k, null] : [k[0], k[1]])))));
+        return wanted;
+    };
+})();
 function cutRow(row, keep, level, s, prefix = "") {
-    const wanted = new Map(keep.map((k) => (typeof k === "string" ? [k, null] : [k[0], k[1]])));
+    const wanted = wantedOf(keep);
     const cap = level.cap ?? Number.POSITIVE_INFINITY;
     const out = {};
-    for (const [k, v] of Object.entries(row)) {
+    for (const k of Object.keys(row)) {
+        const v = row[k];
         if (!wanted.has(k)) {
-            s.left.add(`${prefix}${k}`);
+            s?.left.add(`${prefix}${k}`);
             continue;
         }
         const sub = wanted.get(k);
         if (sub && Array.isArray(v)) {
-            if (v.length > cap)
+            if (s && v.length > cap)
                 s.capped++;
             out[k] = v.slice(0, cap).map((e) => (isPlainObject(e) ? cutRow(e, sub, level, s, `${prefix}${k}[].`) : cutValue(e, level.clip, cap, s)));
         }
@@ -336,18 +356,51 @@ export const answeringNow = () => calls.getStore();
 // tool and directs no model (test/description-policy.test.mjs reads inputSchema descriptions too).
 export const FULL_ARG_DESCRIPTION = "true: data in the structured result is the answer whole, however long. Without it, a structured result past 30,000 characters of JSON has its data cut (DATA CUT): in an order the note states, the entries of its longest lists keep only some of their fields, and then the lists only some of their entries; data_truncated is true, and truncated gives each list cut with its total, the number returned and whether its entries are thinned. Whole data is for a program; a client that sizes structured results, as Claude Code does against MAX_MCP_OUTPUT_TOKENS, can refuse an answer past its cap.";
 export const FULL_ARG = z.boolean().optional().describe(FULL_ARG_DESCRIPTION);
-const thinned = (e, keep) => isPlainObject(e) ? cutRow(e, keep, { keep, clip: Number.POSITIVE_INFINITY }, { left: new Set(), clipped: 0, capped: 0 }) : e;
+// A level as its fields, and what it does inside each entry (#3132).
+const levelOf = (l) => (Array.isArray(l) ? { keep: l } : l);
+const thinned = (e, level, cap = Number.POSITIVE_INFINITY) => {
+    if (!isPlainObject(e))
+        return e;
+    const { keep, capped, mark } = levelOf(level);
+    const t = cutRow(e, keep, { keep, clip: Number.POSITIVE_INFINITY });
+    const inner = capped ? t[capped] : undefined;
+    if (capped && Array.isArray(inner) && inner.length > cap)
+        t[capped] = inner.slice(0, cap);
+    return mark ? { ...t, ...mark(e, cap) } : t;
+};
+// The longest list named `capped` inside any entry of a list (#3132): the cap a level starts below.
+const longestInside = (v, capped) => Array.isArray(v) ? v.reduce((m, e) => Math.max(m, Array.isArray(field(e, capped)) ? field(e, capped).length : 0), 0) : 0;
 // An entry JSON cannot write (undefined) is written null in a list.
 const entryChars = (e) => JSON.stringify(e)?.length ?? 4;
 const listOf = (data, at) => at.reduce((o, k) => field(o, k), data);
-function listAt(data, path, firstOut, thin, newest) {
+// 3.0.2: a list's entries are measured, thinned, only when the cut first asks how many characters
+// some of them take (chars), each thinned, measured and let go; and thinned to be kept only when
+// the cut asks for them (keep), only those it keeps, each once. Through 3.0.1 every list the cut
+// tried held every entry thinned for as long as the cut ran, and a level that caps a list inside
+// each entry thinned every entry at no cap before it tried any: on a 2,000-row check_sbom answer
+// (test/http-memory.test.mjs's) the structured cut allocated 108 MB, against 18 MB on 3.0.0 and 24
+// MB now (V8's sampling heap profiler, collected objects included). What is measured and kept is
+// the same: each entry thinned as before, its characters summed as before.
+function listAt(data, path, firstOut, level, newest, cap = Number.POSITIVE_INFINITY, levelAt) {
     const at = path.split(".");
     const v = listOf(data, at);
     if (!Array.isArray(v) || v.length === 0)
         return undefined;
     const n = v.length;
-    const entries = thin ? v.map((e) => thinned(e, thin)) : v;
-    const lens = entries.map(entryChars);
+    const made = [];
+    const entry = (i) => {
+        if (!level)
+            return v[i];
+        if (!(i in made))
+            made[i] = thinned(v[i], level, cap);
+        return made[i];
+    };
+    const thin = level ? levelOf(level).keep : undefined;
+    // A capped level's clause only where its cap cuts an entry's list (#3139's review: a package
+    // with one range is not "at most its first 1").
+    const lv = level ? levelOf(level) : undefined;
+    const bites = lv?.capped === undefined || v.some((e) => (Array.isArray(field(e, lv.capped)) ? field(e, lv.capped).length : 0) > cap);
+    const thinSaid = lv && bites ? lv.said?.(cap) : undefined;
     // The indices in the order they leave: from the end, or, for a series kept newest, from the start.
     const leavingOrder = (i) => (newest ? i : n - 1 - i);
     const order = [];
@@ -360,24 +413,43 @@ function listAt(data, path, firstOut, thin, newest) {
     for (let j = 0; j < n; j++)
         if (!queued.has(leavingOrder(j)))
             order.push(leavingOrder(j));
-    const leaving = [0];
-    for (const i of order)
-        leaving.push(leaving[leaving.length - 1] + lens[i]);
-    const all = leaving[n];
+    // The characters of the entries in the order they leave, summed: leaving[j] is the first j's.
+    let leaving;
+    const sums = () => {
+        if (leaving)
+            return leaving;
+        const lens = [];
+        for (let i = 0; i < n; i++)
+            lens.push(entryChars(!level || i in made ? entry(i) : thinned(v[i], level, cap)));
+        leaving = [0];
+        for (const i of order)
+            leaving.push(leaving[leaving.length - 1] + lens[i]);
+        return leaving;
+    };
     const kept = (k) => Math.max(0, Math.min(n, k));
+    const over = new Map();
+    const keptAt = (k) => {
+        const out = new Set(order.slice(0, n - kept(k)));
+        return Array.from({ length: n }, (_, i) => i).filter((i) => !out.has(i));
+    };
     return {
         path,
         at,
         n,
         firstOut,
         thin,
+        ...(thinSaid ? { thinSaid } : {}),
         ...(newest ? { newest } : {}),
         named,
-        chars: (k) => all - leaving[n - kept(k)] + Math.max(0, kept(k) - 1),
-        keep: (k) => {
-            const out = new Set(order.slice(0, n - kept(k)));
-            return entries.filter((_, i) => !out.has(i));
+        ...(levelAt !== undefined ? { level: levelAt } : {}),
+        cap,
+        over,
+        chars: (k) => {
+            const l = sums();
+            return l[n] - l[n - kept(k)] + Math.max(0, kept(k) - 1);
         },
+        kept: keptAt,
+        keep: (k) => keptAt(k).map((i) => (over.has(i) ? over.get(i)?.entry : entry(i))),
     };
 }
 // `o` with the list at `at` replaced by `v`, each object on the way copied, its keys in their order.
@@ -388,6 +460,30 @@ function withList(o, at, v) {
 const orListed = (xs) => (xs.length < 2 ? xs.join("") : `${xs.slice(0, -1).join(", ")} or ${xs[xs.length - 1]}`);
 // The fields a thinning level keeps, as a sentence says them.
 const keepSaid = (keep) => listed(keep.map((x) => (typeof x === "string" ? x : `${x[0]} (each with ${listed([...x[1]])})`)));
+// The clause on the entries that took back detail (#3132's review): their positions among those
+// kept, in their order in data, grouped where one level and cap holds a run of them (#3132's second
+// review: not always the first kept, since give-back passes an entry that cannot take any back).
+function givenBackSaid(list, k) {
+    if (list.over.size === 0)
+        return "";
+    const kept = list.kept(k);
+    const runs = [];
+    kept.forEach((i, pos) => {
+        const g = list.over.get(i);
+        if (!g)
+            return;
+        const last = runs[runs.length - 1];
+        if (last && last.to === pos && last.g.level === g.level && last.g.cap === g.cap)
+            last.to = pos + 1;
+        else
+            runs.push({ from: pos + 1, to: pos + 1, g });
+    });
+    if (runs.length === 0)
+        return "";
+    const n = runs.reduce((t, r) => t + r.to - r.from + 1, 0);
+    const one = (r) => `${r.from === r.to ? `entry ${r.from}` : `entries ${r.from} to ${r.to}`} cut to ${keepSaid(r.g.keep)}${r.g.said ? `, ${r.g.said}` : ""}`;
+    return `; with the room left, ${n} of the entries kept take back detail (by position among those kept, in their order in data): ${runs.map(one).join("; ")}`;
+}
 // What a cut keeps of each list it has cut so far, as truncated and as the DATA CUT sentences.
 function cutSaid(cut, kept, wholeChars, data, over, wholeFit) {
     const isThinned = ({ list, k }) => list.thin !== undefined && k > 0;
@@ -405,7 +501,7 @@ function cutSaid(cut, kept, wholeChars, data, over, wholeFit) {
         const which = list.firstOut ? `whose ${list.firstOut.field} is ${orListed(list.firstOut.values)} (${list.firstOut.why})` : "";
         const leftOut = out === 0 ? "" : first === 0 ? `, the ${end} ${out} left out` : first === out ? `, the ${out} left out being entries ${which}` : `, the ${out} left out being the ${first} ${which} and the ${end} ${out - first} of the rest`;
         if (isThinned(x)) {
-            parts.push(`${list.path} keeps ${k === list.n ? `all ${k}` : `${k} of its ${list.n}`} entries, each cut to ${keepSaid(list.thin)}${leftOut}`);
+            parts.push(`${list.path} keeps ${k === list.n ? `all ${k}` : `${k} of its ${list.n}`} entries, each cut to ${keepSaid(list.thin)}${list.thinSaid ? `, ${list.thinSaid}` : ""}${leftOut}${givenBackSaid(list, k)}`);
             continue;
         }
         if (!list.firstOut || first === 0 || k === 0) {
@@ -491,16 +587,44 @@ export function cutData(data, cut, wholeChars, structured) {
     let fits = false;
     for (const [s, step] of steps.entries()) {
         // Every entry whole, then each thinning level in turn, every entry kept; at the leanest level
-        // the entries leave until the result fits.
+        // the entries leave until the result fits (with keepAll, #3139, not in this step: see below).
         const levels = [undefined, ...(step.thin ?? [])];
         let lists = [];
         let k = 0;
+        const at = (level, cap, levelAt) => step.lists.map((p) => listAt(data, p, step.leaveOutFirst, level, step.keepNewest, cap, levelAt)).filter((l) => l !== undefined && !kept.has(l.path));
         for (const [i, thin] of levels.entries()) {
-            lists = step.lists.map((p) => listAt(data, p, step.leaveOutFirst, thin, step.keepNewest)).filter((l) => l !== undefined && !kept.has(l.path));
+            lists = at(thin, undefined, i - 1);
             if (lists.length === 0)
                 break;
             const base = JSON.stringify(apply(lists.map((list) => ({ list, k: 0 })))).length;
             const top = Math.max(...lists.map((l) => l.n));
+            // #3132: a level that caps a list inside each entry, every entry kept: the most entries of
+            // that inner list, the same number in each, that fit; a level where even none fits is passed.
+            // #3132's review: a level with `least` is taken at that cap or more, or passed.
+            const capped = thin === undefined ? undefined : levelOf(thin).capped;
+            if (capped !== undefined) {
+                const longest = Math.max(0, ...step.lists.map((p) => longestInside(listOf(data, p.split(".")), capped)));
+                const least = (thin === undefined ? undefined : levelOf(thin).least) ?? 0;
+                if (longest > least && size(at(thin, least, i - 1), top, base) <= STRUCTURED_BUDGET) {
+                    let m = least;
+                    let hi = longest - 1;
+                    while (m < hi) {
+                        const mid = Math.ceil((m + hi) / 2);
+                        if (size(at(thin, mid, i - 1), top, base) <= STRUCTURED_BUDGET)
+                            m = mid;
+                        else
+                            hi = mid - 1;
+                    }
+                    lists = at(thin, m, i - 1);
+                    k = top;
+                    fits = true;
+                    break;
+                }
+                if (i < levels.length - 1)
+                    continue;
+                // The last level, and even its least cap does not fit: the entries go on at that cap.
+                lists = at(thin, least, i - 1);
+            }
             if (i < levels.length - 1) {
                 if (size(lists, top, base) <= STRUCTURED_BUDGET) {
                     k = top;
@@ -509,6 +633,25 @@ export function cutData(data, cut, wholeChars, structured) {
                 }
                 continue;
             }
+            if (step.keepAll) {
+                // #3139: every entry stays, at this level; the later steps are cut first.
+                k = top;
+                fits = size(lists, top, base) <= STRUCTURED_BUDGET;
+                break;
+            }
+            // #3132's review: entries leave at the step's leaveAt level, where it names one.
+            if (step.leaveAt && step.thin) {
+                const { level, cap } = step.leaveAt;
+                lists = at(step.thin[level], cap, level);
+            }
+            if (step.whole) {
+                // Every entry or none (#3132's review: data.not_sent_purls).
+                if (size(lists, 0, base) <= STRUCTURED_BUDGET) {
+                    k = size(lists, top, base) <= STRUCTURED_BUDGET ? top : 0;
+                    fits = true;
+                }
+                break;
+            }
             if (size(lists, 0, base) <= STRUCTURED_BUDGET) {
                 // The most entries each list of the step keeps with the result inside the budget.
                 let hi = top;
@@ -527,15 +670,50 @@ export function cutData(data, cut, wholeChars, structured) {
         if (fits)
             break;
     }
+    const exact = () => {
+        const { truncated, said } = cutSaid(cut, [...kept.values()], wholeChars, data, false, wholeFit);
+        return JSON.stringify(structured(apply(), truncated, said)).length;
+    };
+    // #3139: every step cut and the result still past the budget: a keepAll step's entries leave now,
+    // the step's first, as many as must, the rest of data as the steps after it left it. The steps
+    // after it then take back what room is left (below), as though it were the step that fits.
+    // #3139's review: with more than one keepAll step, the last one's entries leave first
+    // (cve_remediation's fixed_branches before any vendor advisory).
+    if (!fits) {
+        for (const [s, step] of [...steps.entries()].reverse()) {
+            if (!step.keepAll || fits)
+                continue;
+            const entries = [...kept.values()].filter((e) => e.step === s);
+            if (entries.length === 0)
+                continue;
+            const set = (k) => {
+                for (const e of entries)
+                    e.k = Math.min(k, e.list.n);
+            };
+            set(0);
+            if (exact() > STRUCTURED_BUDGET)
+                continue;
+            let k = 0;
+            let hi = Math.max(...entries.map((e) => e.list.n));
+            while (k < hi) {
+                const mid = Math.ceil((k + hi) / 2);
+                set(mid);
+                if (exact() <= STRUCTURED_BUDGET)
+                    k = mid;
+                else
+                    hi = mid - 1;
+            }
+            set(k);
+            for (const e of entries)
+                e.step = steps.length;
+            fits = true;
+        }
+    }
     // The room the step that fits leaves goes back to the steps emptied before it, the last first,
     // each step's lists keeping at most the same number of their entries, as many as fit, at the
     // level they were thinned to (scan_manifest's not_checked, emptied while its rows were whole,
     // keeps its entries once the thinned rows fit).
     if (fits) {
-        const exact = () => {
-            const { truncated, said } = cutSaid(cut, [...kept.values()], wholeChars, data, false, wholeFit);
-            return JSON.stringify(structured(apply(), truncated, said)).length;
-        };
         const last = Math.max(...[...kept.values()].map((e) => e.step));
         for (let s = last - 1; s >= 0; s--) {
             const entries = [...kept.values()].filter((e) => e.step === s);
@@ -547,6 +725,13 @@ export function cutData(data, cut, wholeChars, structured) {
             };
             let k = Math.min(...entries.map((e) => e.k));
             let hi = Math.max(...entries.map((e) => e.list.n));
+            if (steps[s].whole) {
+                // Every entry or none (#3132's review).
+                at(hi);
+                if (exact() > STRUCTURED_BUDGET)
+                    at(k);
+                continue;
+            }
             while (k < hi) {
                 const mid = Math.ceil((k + hi) / 2);
                 at(mid);
@@ -558,6 +743,75 @@ export function cutData(data, cut, wholeChars, structured) {
             at(k);
         }
     }
+    // #3132's review: then a giveBack step's entries, in their order in data, take back detail (see
+    // DataCutStep): each the richest level above its own that fits. A RowKeep level is tried whole;
+    // of the capped levels, only the leanest at or above the entry's own (check_sbom's compact one,
+    // or the entry's own), uncapped and then at the most inner entries that fit, so a row takes back
+    // more of its matches compact before fewer of them thinned. #3132's second review: an entry that
+    // takes back nothing is passed, not an end (through round 2 it ended give-back, so a row at the
+    // compact level holding every match, too large to move up, kept every later capped row at its
+    // cap while room was left); the entries that took some are named by position (givenBackSaid).
+    if (fits) {
+        for (const [s, step] of steps.entries()) {
+            if (!step.giveBack || !step.thin)
+                continue;
+            const thin = step.thin;
+            for (const e of [...kept.values()].filter((x) => x.step === s)) {
+                const { list } = e;
+                const own = list.level;
+                if (own === undefined || list.thin === undefined)
+                    continue;
+                const whole = listOf(data, list.at);
+                if (!Array.isArray(whole))
+                    continue;
+                let leanestCapped = -1;
+                for (let j = 0; j <= own; j++)
+                    if (levelOf(thin[j]).capped !== undefined)
+                        leanestCapped = j;
+                const tryAt = (i, j, c) => {
+                    const l = levelOf(thin[j]);
+                    list.over.set(i, { entry: thinned(whole[i], thin[j], c), level: j, cap: c, keep: l.keep, ...(l.said && l.capped && c < Number.POSITIVE_INFINITY ? { said: l.said(c) } : {}) });
+                    if (exact() <= STRUCTURED_BUDGET)
+                        return true;
+                    list.over.delete(i);
+                    return false;
+                };
+                for (const i of list.kept(e.k)) {
+                    // An entry its own level already keeps as the richest would is passed, not an end.
+                    if (JSON.stringify(thinned(whole[i], thin[0])) === JSON.stringify(thinned(whole[i], thin[own], list.cap)))
+                        continue;
+                    let took = false;
+                    for (let j = 0; j <= own && !took; j++) {
+                        const l = levelOf(thin[j]);
+                        const inner = l.capped !== undefined && Array.isArray(field(whole[i], l.capped)) ? field(whole[i], l.capped).length : 0;
+                        if (l.capped === undefined) {
+                            if (j < own)
+                                took = tryAt(i, j, Number.POSITIVE_INFINITY);
+                            continue;
+                        }
+                        if (j !== leanestCapped)
+                            continue;
+                        if (j < own || list.cap < inner)
+                            took = tryAt(i, j, Number.POSITIVE_INFINITY);
+                        if (took)
+                            break;
+                        let c = j === own ? list.cap + 1 : (l.least ?? 0);
+                        let hi = inner - 1;
+                        if (c > hi || !tryAt(i, j, c))
+                            continue;
+                        while (c < hi) {
+                            const mid = Math.ceil((c + hi) / 2);
+                            if (tryAt(i, j, mid))
+                                c = mid;
+                            else
+                                hi = mid - 1;
+                        }
+                        took = tryAt(i, j, c);
+                    }
+                }
+            }
+        }
+    }
     const { truncated, said } = cutSaid(cut, [...kept.values()], wholeChars, data, !fits, wholeFit);
     if (truncated === undefined)
         return undefined;

package/dist/tools/check_affected.js

@@ -373,8 +373,11 @@ async function checkAffected(kit, a) {
         return kit.crashed(TOOL, e);
     }
 }
+// One output schema per process, not per request (3.0.2; index.ts envelopeSchema says why).
+const OUTPUTS = new WeakMap();
 export function registerCheckAffected(server, kit) {
-    const output = kit.envelopeSchema({ data: DATA, coverage: COVERAGE, freshness: null });
+    const output = OUTPUTS.get(kit.envelopeSchema) ?? kit.envelopeSchema({ data: DATA, coverage: COVERAGE, freshness: null });
+    OUTPUTS.set(kit.envelopeSchema, output);
     server.registerTool(TOOL, {
         title: CHECK_AFFECTED_TITLE,
         description: CHECK_AFFECTED_DESCRIPTION,

package/dist/tools/check_sbom.js

@@ -100,15 +100,121 @@ export const SBOM_ROW_THIN = [
     "cve_ids",
     "matched_package",
     "matched_via",
+    "matched_version_from",
+    "purl_name",
     ["matches", ["cve_id", "kev_listed", "ransomware", "epss_score", "effective_score", "score_assessed", "fixed_in", "fixed_in_reason"]],
 ];
+// #3132: past SBOM_ROW_THIN, each row is cut on its own terms before any row leaves. Through 3.0.0
+// SBOM_ROW_THIN was the only level, and it keeps every match object, so one row still large once
+// thinned left data, and every row after it with it (rows leave from the end): measured on hosted
+// 3.0.0 (2026-10-11), five Debian 12 purls, all affected, kept 1 row (libssl3; linux-libc-dev
+// 6.1.55-1's 200 matches are 42,417 characters thinned); Juice Shop 11.1.2 with
+// magento/community-edition 2.3.0 inserted at index 2 kept 2 of 51 rows (19 affected); that purl
+// alone kept none, and the note said "check 0 or fewer purls per call". Now, in order:
+//   1. SBOM_ROW_THIN, every row, every match (as before);
+//   2. the same, with every row's matches capped at one number m, the most that fit: a row with
+//      more than m keeps its first m (the API's order: highest effective_score first) and carries
+//      matches_truncated, its own total and returned, and the CVE IDs among all its matches that
+//      are KEV-listed (kev_listed_cve_ids) or used in ransomware (ransomware_cve_ids), and the
+//      distinct fixed_in versions they name (fixed_in_versions), so what a triage ranks by first
+//      is still said of the matches cut; rows with m or fewer matches are untouched;
+//   3. SBOM_ROW_COMPACT, each match cut to cve_id, kev_listed, ransomware, fixed_in and
+//      effective_score, the row keeping matched_package, matched_via and an upstream row's
+//      matched_version_from and purl_name, matches capped at one number m as in 2 (any m, 0
+//      included), with the same matches_truncated;
+//   4. SBOM_ROW_MIN, the text's leanest level (index, purl, verdict, not_assessed_reason and
+//      cve_ids), with that matches_truncated on each row that had matches;
+//   5. SBOM_ROW_MIN with matches_truncated cut to total and returned;
+// and only then do rows leave (clean, then not assessed, then the last of the rest).
+// #3132's review: round 1 had no level 3, and level 2 was taken at m = 0. The production
+// synthetic's 201-purl probe (synthetic/probes.mjs SBOM_PROBE_PURLS, recorded on hosted 3.0.0 with
+// full: true, 2026-10-11: 201 affected rows, 415 matches, 710,724 characters) then came back at
+// level 5 with 132 rows, every match, KEV flag and fixed_in gone, and the probe's EXPECT (log4j-core
+// 2.14.1's CVE-2021-44228 match, fixed_in 2.15.0; the upstream row's matched_via) failed, where
+// 3.0.0 kept 43 rows thinned and passed. So now:
+//   - level 2 is taken only at m >= 1 (least): at m = 0 it holds less than level 3;
+//   - when not even level 5 keeps every row, rows leave at level 3 with matches capped at
+//     SBOM_LEAVING_CAP (leaveAt), not at level 5: a page of the size the note names then comes back
+//     with each row's KEV flags and fixed_in, which at level 5 no page size did;
+//   - once the cut is settled, the rows kept take back detail in input order while the result fits
+//     (giveBack): each the richest level above its own that fits, its matches at the compact level
+//     at the most that fit, stopping at the first row that takes back none.
+// Measured on that recording (test/check_sbom-large-rows.test.mjs): 54 of 201 rows, each compact
+// with every match (none has more than 7), the log4j-core row with its CVE-2021-44228 match and the
+// upstream row with matched_via, at 29,959 characters.
+// cve_ids is what the API caps at 200 a row, about 3,400 characters, so every row survives level 5
+// unless the rows are many (the probe's 201, Juice Shop's full 840 purls).
+export const SBOM_ROW_COMPACT = [
+    "index",
+    "purl",
+    "verdict",
+    "not_assessed_reason",
+    "cve_ids",
+    "matched_package",
+    "matched_via",
+    "matched_version_from",
+    "purl_name",
+    ["matches", ["cve_id", "kev_listed", "ransomware", "fixed_in", "effective_score"]],
+];
+export const SBOM_ROW_MIN = ["index", "purl", "verdict", "not_assessed_reason", "cve_ids"];
+// The most matches a row keeps, compact, when rows leave (the API's order, highest effective_score
+// first); the rest are in its cve_ids and matches_truncated.
+export const SBOM_LEAVING_CAP = 10;
+// matches_truncated for a row whose matches data keeps `kept` of (none at levels 3 and 4); with
+// `summary`, the three lists drawn from all of the row's matches. Absent on a row with no match
+// cut, and on one with no matches.
+function matchesTruncated(row, kept, summary) {
+    const ms = Array.isArray(row.matches) ? row.matches.filter(isObj) : [];
+    if (ms.length <= kept)
+        return {};
+    const ids = (f) => [...new Set(ms.filter((m) => m[f] === true && typeof m.cve_id === "string").map((m) => m.cve_id))];
+    const fixed = [...new Set(ms.map((m) => m.fixed_in).filter((v) => typeof v === "string"))];
+    return {
+        matches_truncated: {
+            total: ms.length,
+            returned: Math.min(kept, ms.length),
+            ...(summary ? { kev_listed_cve_ids: ids("kev_listed"), ransomware_cve_ids: ids("ransomware"), fixed_in_versions: fixed } : {}),
+        },
+    };
+}
+const MATCHES_TRUNCATED_SAID = "carrying matches_truncated, which gives its own total and returned, and, of all its matches, the CVE IDs KEV-listed (kev_listed_cve_ids) or used in ransomware (ransomware_cve_ids) and the distinct fixed_in versions (fixed_in_versions)";
+const cappedSaid = (cap) => `each row's matches keeping at most its first ${cap} (the API's order, highest effective_score first), a row with more than that ${MATCHES_TRUNCATED_SAID}`;
+export const SBOM_ROW_LEVELS = [
+    SBOM_ROW_THIN,
+    { keep: SBOM_ROW_THIN, capped: "matches", least: 1, mark: (row, cap) => matchesTruncated(row, cap, true), said: cappedSaid },
+    { keep: SBOM_ROW_COMPACT, capped: "matches", mark: (row, cap) => matchesTruncated(row, cap, true), said: cappedSaid },
+    { keep: SBOM_ROW_MIN, mark: (row) => matchesTruncated(row, 0, true), said: () => `a row that had matches ${MATCHES_TRUNCATED_SAID}` },
+    { keep: SBOM_ROW_MIN, mark: (row) => matchesTruncated(row, 0, false), said: () => "a row that had matches carrying matches_truncated with its total and returned 0" },
+];
+const SBOM_LEAVE_AT = { level: 2, cap: SBOM_LEAVING_CAP };
+// The page sentence (#3132): never "0 or fewer". Rows leave only once no level keeps them all, so a
+// call of as many purls as data kept rows keeps each of its rows; when not one row fits, no page
+// size does, and the note says where a row is read instead.
+// #3132's review: the lists beside the rows go first, scan_manifest's not_checked before
+// not_sent_purls, which keeps every purl or none (whole): those purls are the list a client
+// retries, and round 1 kept 3 of the rate-limited case's 800. With none kept, the note gives them
+// exactly as positions in the input (sendingSentences: coverage.sent + 1 to
+// coverage.distinct_purls), and the room the rows leave goes back to not_sent_purls before
+// not_checked.
 export function sbomData(sides, page) {
+    const others = sides.filter((x) => x !== "not_sent_purls");
     return {
         steps: [
-            { lists: sides },
-            { lists: ["results"], thin: [SBOM_ROW_THIN], leaveOutFirst: { field: "verdict", values: ["not_affected", "not_assessed"], why: "data.summary counts every verdict" } },
+            ...(others.length ? [{ lists: others }] : []),
+            ...(sides.includes("not_sent_purls") ? [{ lists: ["not_sent_purls"], whole: true }] : []),
+            {
+                lists: ["results"],
+                thin: SBOM_ROW_LEVELS,
+                leaveOutFirst: { field: "verdict", values: ["not_affected", "not_assessed"], why: "data.summary counts every verdict" },
+                leaveAt: SBOM_LEAVE_AT,
+                giveBack: true,
+            },
         ],
-        page: (t) => (t.results && t.results.returned < t.results.total ? page(t.results.returned) : ""),
+        page: (t) => t.results && t.results.returned < t.results.total
+            ? t.results.returned > 0
+                ? page(t.results.returned)
+                : `Not one row fits data even cut to ${SBOM_ROW_COMPACT.map((x) => (typeof x === "string" ? x : x[0])).join(", ")}, so no number of purls per call does: the same call with full: true returns every row whole.`
+            : "",
     };
 }
 const SBOM_DATA = sbomData(["not_sent_purls"], (k) => `To read every row in data, check ${k} or fewer purls per call.`);
@@ -288,11 +394,15 @@ export function checkSbomOutput(envelopeSchema) {
         freshness: null,
     });
 }
+// One output schema per process, not per request (3.0.2; index.ts envelopeSchema says why).
+const OUTPUTS = new WeakMap();
 // A literal server.registerTool(name, { title, description, … }) call with constant strings:
 // marketing-site lib/mcpToolClaims.test.ts reads it here (it follows index.ts's call to this
 // function) and holds the /pulse/mcp row to this title and description.
 export function registerCheckSbom(server, deps) {
-    const output = checkSbomOutput(deps.envelopeSchema);
+    const envelope = deps.envelopeSchema;
+    const output = OUTPUTS.get(envelope) ?? checkSbomOutput(envelope);
+    OUTPUTS.set(envelope, output);
     server.registerTool(CHECK_SBOM, {
         title: CHECK_SBOM_TITLE,
         description: CHECK_SBOM_DESCRIPTION,