Shared first-party token scanner. Assemble logical text before scanning; arbitrary provider secrets and encodings are outside this shape contract.