@sema-agent/server 7.132.0 → 7.133.0

package/dist/trace/redact.js

@@ -276,10 +276,14 @@ let coveredPositions = 0;
 let headScreenHits = 0;
 let fullYCalls = 0;
 let forensicLevels = 0;
+let forensicRuns = 0;
+let forensicSkips = 0;
+let urlSegmentRuns = 0;
+let urlSegmentReplays = 0;
 let ssh2ScanBytes = 0;
 let mappedUnits = 0;
 export function armPoolBudgetForTest() {
-    return { spanCount: poolSpanCount, coveredPositions, headScreenHits, fullYCalls, armCount: poolArmCount, boundaryArmCount: poolBoundaryArmCount, forensicLevels, ssh2ScanBytes, mappedUnits };
+    return { spanCount: poolSpanCount, coveredPositions, headScreenHits, fullYCalls, armCount: poolArmCount, boundaryArmCount: poolBoundaryArmCount, forensicLevels, forensicRuns, forensicSkips, urlSegmentRuns, urlSegmentReplays, ssh2ScanBytes, mappedUnits };
 }
 export function resetArmPoolBudgetForTest() {
     poolSpanCount = 0;
@@ -287,6 +291,10 @@ export function resetArmPoolBudgetForTest() {
     headScreenHits = 0;
     fullYCalls = 0;
     forensicLevels = 0;
+    forensicRuns = 0;
+    forensicSkips = 0;
+    urlSegmentRuns = 0;
+    urlSegmentReplays = 0;
     ssh2ScanBytes = 0;
     mappedUnits = 0;
 }
@@ -631,16 +639,17 @@ const keywordArm = (keywordSrc, valueClass, min, tailSrc = "") => {
     LEXICAL_KEYWORD_ARMS.add(re);
     return re;
 };
-const CREDENTIAL_NAME_WORDS = [
-    "api_key", "apikey", "api-key", "key",
-    "token", "access_token", "refresh_token", "id_token",
-    "auth", "authorization",
-    "password", "passwd", "pwd",
-    "secret", "client_secret", "private_key",
-    "signature", "sig",
-    "x-amz-signature", "x-amz-security-token", "x-amz-credential",
-    "sas",
-];
+const CREDENTIAL_NAME_ANCHORS = {
+    api_key: "structure-only", apikey: "structure-only", "api-key": "structure-only", key: "structure-only",
+    token: "structure-only", access_token: "structure-only", refresh_token: "structure-only", id_token: "structure-only",
+    auth: "structure-only", authorization: "auth-scheme", "proxy-authorization": "auth-scheme",
+    password: "declarative", passwd: "any-form", pwd: "any-form",
+    secret: "declarative", client_secret: "declarative", private_key: "structure-only",
+    signature: "structure-only", sig: "structure-only",
+    "x-amz-signature": "structure-only", "x-amz-security-token": "structure-only", "x-amz-credential": "structure-only",
+    sas: "structure-only",
+};
+const CREDENTIAL_NAME_WORDS = Object.keys(CREDENTIAL_NAME_ANCHORS);
 const CREDENTIAL_NAME_ALT = (() => {
     for (const w of CREDENTIAL_NAME_WORDS) {
         if (!/^[a-z][a-z0-9_-]*$/.test(w))
@@ -657,6 +666,7 @@ const STRUCTURAL_SECRET_PATTERNS = [
 const PPK_CONTAINER_TOKEN = "«redacted:private-key»";
 const PEM_FRAGMENT_TOKEN = "«redacted:private-key:partial»";
 const HEADLESS_PPK_TOKEN = "«redacted:private-key:partial»";
+const ANCHORED_VALUE_TOKEN = "«redacted»";
 const KEYWORD_SECRET_PATTERNS = [
     [keywordArm("[Bb]earer", "[A-Za-z0-9._~+/-]", 20, "=*"), "Bearer «redacted»"],
     [keywordArm("Basic", "[A-Za-z0-9+/]", 16, "={0,2}"), "Basic «redacted»"],
@@ -689,11 +699,11 @@ function pemEscapeLetterAt(s, i, limit) {
     const n = s.charCodeAt(j);
     return n === CH_r || n === CH_n || n === CH_t ? j : -1;
 }
-function skipPemSeps(s, i, limit) {
+function skipPemSeps(scan, s, i, limit) {
     for (;;) {
         if (i >= limit)
             return i;
-        if (opaqueUnitEnd(i) >= 0)
+        if (opaqueUnitEnd(scan, i) >= 0)
             return i;
         const c = s.charCodeAt(i);
         if (isSepCode(c)) {
@@ -736,17 +746,17 @@ function pemInlineSepLen(s, i, limit) {
     }
     return 0;
 }
-function probePemHeaderToken(s, p, limit) {
-    if (p >= limit || opaqueUnitEnd(p) >= 0 || !isIdentStartCode(s.charCodeAt(p)))
+function probePemHeaderToken(scan, s, p, limit) {
+    if (p >= limit || opaqueUnitEnd(scan, p) >= 0 || !isIdentStartCode(s.charCodeAt(p)))
         return -1;
     p += 1;
     let identLen = 1;
-    while (identLen < PEM_HEADER_IDENT_MAX && p < limit && opaqueUnitEnd(p) < 0 && isIdentCode(s.charCodeAt(p))) {
+    while (identLen < PEM_HEADER_IDENT_MAX && p < limit && opaqueUnitEnd(scan, p) < 0 && isIdentCode(s.charCodeAt(p))) {
         p += 1;
         identLen += 1;
     }
     for (;;) {
-        if (p >= limit || opaqueUnitEnd(p) >= 0)
+        if (p >= limit || opaqueUnitEnd(scan, p) >= 0)
             return -1;
         const c = s.charCodeAt(p);
         if (c === CH_SPACE || c === CH_TAB) {
@@ -756,29 +766,29 @@ function probePemHeaderToken(s, p, limit) {
         return c === CH_COLON ? p + 1 : -1;
     }
 }
-const PEM_HDR = { search: 0, contentEnd: 0, next: 0, hitLimit: false, jsonEnd: false };
-function setPemHdr(search, contentEnd, next, hitLimit, jsonEnd = false) {
-    PEM_HDR.search = search;
-    PEM_HDR.contentEnd = contentEnd;
-    PEM_HDR.next = next;
-    PEM_HDR.hitLimit = hitLimit;
-    PEM_HDR.jsonEnd = jsonEnd;
+function setPemHdr(scan, search, contentEnd, next, hitLimit, jsonEnd = false) {
+    const h = scan.hdr;
+    h.search = search;
+    h.contentEnd = contentEnd;
+    h.next = next;
+    h.hitLimit = hitLimit;
+    h.jsonEnd = jsonEnd;
     return true;
 }
-function parsePemHeaderLine(s, i, limit, allowBare, json) {
-    const start = skipPemSeps(s, i, limit);
+function parsePemHeaderLine(scan, s, i, limit, allowBare, json) {
+    const start = skipPemSeps(scan, s, i, limit);
     if (start >= limit)
         return false;
-    const afterToken = probePemHeaderToken(s, start, limit);
+    const afterToken = probePemHeaderToken(scan, s, start, limit);
     if (afterToken < 0 && !allowBare)
         return false;
     let p = afterToken < 0 ? start : afterToken;
-    if (afterToken >= 0 && probePemHeaderToken(s, p, limit) >= 0)
-        return setPemHdr(start, p, p, false);
+    if (afterToken >= 0 && probePemHeaderToken(scan, s, p, limit) >= 0)
+        return setPemHdr(scan, start, p, p, false);
     for (;;) {
         if (p >= limit)
-            return setPemHdr(start, p, p, true);
-        const unit = opaqueUnitEnd(p);
+            return setPemHdr(scan, start, p, p, true);
+        const unit = opaqueUnitEnd(scan, p);
         if (unit >= 0) {
             p = Math.min(unit, limit);
             continue;
@@ -790,12 +800,12 @@ function parsePemHeaderLine(s, i, limit, allowBare, json) {
         }
         if (c === CH_QUOTE) {
             if (json)
-                return setPemHdr(start, p, p, false, true);
+                return setPemHdr(scan, start, p, p, false, true);
             p += 1;
             continue;
         }
         if (c === CH_CR || c === CH_LF)
-            return setPemHdr(start, p, p + 1, false);
+            return setPemHdr(scan, start, p, p + 1, false);
         if (c === CH_BACKSLASH) {
             let j = p;
             while (j < limit && s.charCodeAt(j) === CH_BACKSLASH)
@@ -808,11 +818,11 @@ function parsePemHeaderLine(s, i, limit, allowBare, json) {
         }
         let q = p;
         for (;;) {
-            if (opaqueUnitEnd(q) >= 0)
+            if (opaqueUnitEnd(scan, q) >= 0)
                 break;
             const b = pemLineBreakLen(s, q, limit);
             if (b === 1)
-                return setPemHdr(start, p, q + 1, false);
+                return setPemHdr(scan, start, p, q + 1, false);
             if (b >= 2) {
                 q += b;
                 continue;
@@ -823,19 +833,19 @@ function parsePemHeaderLine(s, i, limit, allowBare, json) {
             q += u;
         }
         if (q >= limit)
-            return setPemHdr(start, p, q, true);
-        if (probePemHeaderToken(s, q, limit) >= 0)
-            return setPemHdr(start, p, q, false);
+            return setPemHdr(scan, start, p, q, true);
+        if (probePemHeaderToken(scan, s, q, limit) >= 0)
+            return setPemHdr(scan, start, p, q, false);
         p = q;
     }
 }
-function parsePemBody(s, i, limit) {
+function parsePemBody(scan, s, i, limit) {
     let end = -1;
     let p = i;
     for (;;) {
-        const q = skipPemSeps(s, p, limit);
+        const q = skipPemSeps(scan, s, p, limit);
         let r = q;
-        while (r < limit && opaqueUnitEnd(r) < 0 && isBase64Code(s.charCodeAt(r)))
+        while (r < limit && opaqueUnitEnd(scan, r) < 0 && isBase64Code(s.charCodeAt(r)))
             r += 1;
         if (r - q < PEM_BODY_RUN_MIN)
             break;
@@ -844,12 +854,12 @@ function parsePemBody(s, i, limit) {
     }
     return end;
 }
-function rightmostPemRunEnd(s, from, to) {
+function rightmostPemRunEnd(scan, s, from, to) {
     let best = -1;
     let runStart = -1;
     for (let p = from; p <= to; p++) {
         if (p < to) {
-            const unit = opaqueUnitEnd(p);
+            const unit = opaqueUnitEnd(scan, p);
             if (unit > 0) {
                 if (runStart >= 0 && p - runStart >= PEM_BODY_RUN_MIN)
                     best = p;
@@ -893,7 +903,7 @@ function isPemFenceLabel(s, from, to) {
 }
 const PEM_FENCE_OPEN = "-----BEGIN";
 const PEM_FENCE_CLOSE = "-----";
-function findPemFence(text, from) {
+function findPemFence(scan, text, from) {
     for (;;) {
         const fence = text.indexOf(PEM_FENCE_OPEN, from);
         if (fence < 0)
@@ -903,7 +913,7 @@ function findPemFence(text, from) {
         if (close < 0)
             return undefined;
         from = labelFrom;
-        if (inOpaqueUnit(fence))
+        if (inOpaqueUnit(scan, fence))
             continue;
         if (!isPemFenceLabel(text, labelFrom, close))
             continue;
@@ -913,26 +923,28 @@ function findPemFence(text, from) {
 const SSH2_FENCE_OPEN = "---- BEGIN SSH2 ENCRYPTED PRIVATE KEY ----";
 const SSH2_FENCE_CLOSE = "---- END SSH2 ENCRYPTED PRIVATE KEY ----";
 const SSH2_BODY_MAX = 8192;
-function unitCountWithin(from, to, max) {
+function unitCountWithin(scan, from, to, max) {
     if (to - from <= max)
         return true;
-    const st = scanEvidence.starts;
+    noteEvidenceRead(scan, from);
+    noteEvidenceRead(scan, to);
+    const st = scan.table.starts;
     if (st.length === 0)
         return false;
-    const k = firstCredentialSpanFrom(scanEvidence, from);
+    const k = firstCredentialSpanFrom(scan.table, from);
     if (k >= st.length || st[k] >= to)
         return false;
     let n = 0;
     for (let p = from; p < to;) {
         if (n > max)
             return false;
-        const unit = opaqueUnitEnd(p);
+        const unit = opaqueUnitEnd(scan, p);
         p = unit > 0 && unit <= to ? unit : p + 1;
         n += 1;
     }
     return n <= max;
 }
-function collectSsh2FenceSpans(text, span) {
+function collectSsh2FenceSpans(scan, text, span) {
     let cachedFrom = 0;
     let cachedAt;
     const nextClose = (from) => {
@@ -940,7 +952,7 @@ function collectSsh2FenceSpans(text, span) {
             return cachedAt;
         let p = text.indexOf(SSH2_FENCE_CLOSE, from);
         ssh2ScanBytes += (p < 0 ? text.length : p) - from;
-        while (p >= 0 && inOpaqueUnit(p)) {
+        while (p >= 0 && inOpaqueUnit(scan, p)) {
             const q = text.indexOf(SSH2_FENCE_CLOSE, p + 1);
             ssh2ScanBytes += (q < 0 ? text.length : q) - (p + 1);
             p = q;
@@ -953,7 +965,7 @@ function collectSsh2FenceSpans(text, span) {
         const fence = text.indexOf(SSH2_FENCE_OPEN, from);
         if (fence < 0)
             return;
-        if (inOpaqueUnit(fence)) {
+        if (inOpaqueUnit(scan, fence)) {
             from = fence + 1;
             continue;
         }
@@ -961,7 +973,7 @@ function collectSsh2FenceSpans(text, span) {
         const close = nextClose(bodyFrom);
         if (close < 0)
             return;
-        if (!unitCountWithin(bodyFrom, close, SSH2_BODY_MAX)) {
+        if (!unitCountWithin(scan, bodyFrom, close, SSH2_BODY_MAX)) {
             from = fence + 1;
             continue;
         }
@@ -1011,31 +1023,31 @@ function collectPemFenceSpans(text, span) {
         from = scanResumeAfterHit(fence, endAfter, PEM_FENCE_OPEN.length);
     }
 }
-function collectPemFragmentSpans(text, json, span) {
-    let cur = findPemFence(text, 0);
+function collectPemFragmentSpans(scan, text, json, span) {
+    let cur = findPemFence(scan, text, 0);
     let inherited = false;
     while (cur !== undefined) {
-        const next = findPemFence(text, cur.after);
+        const next = findPemFence(scan, text, cur.after);
         const limit = next === undefined ? text.length : next.fence;
         let pos = cur.after;
         let allowBare = inherited;
         let hitLimit = false;
         let rightmost = -1;
-        while (parsePemHeaderLine(text, pos, limit, allowBare, json)) {
-            const e = rightmostPemRunEnd(text, PEM_HDR.search, PEM_HDR.contentEnd);
+        while (parsePemHeaderLine(scan, text, pos, limit, allowBare, json)) {
+            const e = rightmostPemRunEnd(scan, text, scan.hdr.search, scan.hdr.contentEnd);
             if (e > rightmost)
                 rightmost = e;
-            pos = PEM_HDR.next;
+            pos = scan.hdr.next;
             allowBare = false;
-            if (PEM_HDR.hitLimit) {
+            if (scan.hdr.hitLimit) {
                 hitLimit = true;
                 break;
             }
-            if (PEM_HDR.jsonEnd)
+            if (scan.hdr.jsonEnd)
                 break;
         }
         inherited = hitLimit;
-        let bodyEnd = parsePemBody(text, pos, limit);
+        let bodyEnd = parsePemBody(scan, text, pos, limit);
         if (bodyEnd < 0)
             bodyEnd = rightmost;
         if (bodyEnd >= 0)
@@ -1043,18 +1055,18 @@ function collectPemFragmentSpans(text, json, span) {
         cur = next;
     }
 }
-function collectHeadlessPpkSpans(text, span) {
+function collectHeadlessPpkSpans(scan, text, span) {
     const KEY = "Private-Lines: ";
     const n = text.length;
     const isB64 = (c) => (c >= 48 && c <= 57) || (c >= 65 && c <= 90) || (c >= 97 && c <= 122) || c === 43 || c === 47 || c === 61;
-    const b64At = (i) => opaqueUnitEnd(i) < 0 && isB64(text.charCodeAt(i));
-    const skipHs = (i) => { while (i < n && opaqueUnitEnd(i) < 0 && (text.charCodeAt(i) === 32 || text.charCodeAt(i) === 9))
+    const b64At = (i) => opaqueUnitEnd(scan, i) < 0 && isB64(text.charCodeAt(i));
+    const skipHs = (i) => { while (i < n && opaqueUnitEnd(scan, i) < 0 && (text.charCodeAt(i) === 32 || text.charCodeAt(i) === 9))
         i += 1; return i; };
     const skipNewlines = (i) => {
         let q = skipHs(i);
         let seen = false;
         for (;;) {
-            if (opaqueUnitEnd(q) >= 0)
+            if (opaqueUnitEnd(scan, q) >= 0)
                 break;
             let any = false;
             if (text.charCodeAt(q) === 13) {
@@ -1087,7 +1099,7 @@ function collectHeadlessPpkSpans(text, span) {
         return seen ? q : -1;
     };
     const escapedNewlineLen = (i) => {
-        if (opaqueUnitEnd(i) >= 0)
+        if (opaqueUnitEnd(scan, i) >= 0)
             return 0;
         let k = i;
         while (k < n && text.charCodeAt(k) === 92)
@@ -1101,7 +1113,7 @@ function collectHeadlessPpkSpans(text, span) {
         const b = skipHs(i);
         if (b >= n)
             return true;
-        if (opaqueUnitEnd(b) >= 0)
+        if (opaqueUnitEnd(scan, b) >= 0)
             return false;
         const c = text.charCodeAt(b);
         return c === 10 || c === 13 || c === 34 || escapedNewlineLen(b) > 0;
@@ -1111,13 +1123,13 @@ function collectHeadlessPpkSpans(text, span) {
         const at = text.indexOf(KEY, search);
         if (at === -1)
             break;
-        if (inOpaqueUnit(at)) {
+        if (inOpaqueUnit(scan, at)) {
             search = at + KEY.length;
             continue;
         }
         let p = at + KEY.length;
         const d0 = p;
-        while (p < n && opaqueUnitEnd(p) < 0 && text.charCodeAt(p) >= 48 && text.charCodeAt(p) <= 57)
+        while (p < n && opaqueUnitEnd(scan, p) < 0 && text.charCodeAt(p) >= 48 && text.charCodeAt(p) <= 57)
             p += 1;
         if (p === d0) {
             search = at + KEY.length;
@@ -1130,7 +1142,7 @@ function collectHeadlessPpkSpans(text, span) {
             if (q0 === -1)
                 break;
             let q = q0;
-            const mk = opaqueUnitEnd(q) < 0 ? text.charCodeAt(q) : -1;
+            const mk = opaqueUnitEnd(scan, q) < 0 ? text.charCodeAt(q) : -1;
             if (mk === 43 || mk === 45)
                 q = skipHs(q + 1);
             let r = q;
@@ -1169,7 +1181,7 @@ const FRAGMENT_SECRET_PATTERNS = [
 const DISPLAY_SAFE_URL_TOKEN = "«redacted:url»";
 export { DISPLAY_SAFE_URL_TOKEN };
 const WITHHELD_VALUE_TOKEN = "«redacted»";
-const REDACTION_TOKENS = new Set([...FULL_ARM_PATTERNS.map(([, r]) => r), PEM_FRAGMENT_TOKEN, DISPLAY_SAFE_URL_TOKEN, ...FRAGMENT_SECRET_PATTERNS.map(([, r]) => r)]
+const REDACTION_TOKENS = new Set([...FULL_ARM_PATTERNS.map(([, r]) => r), PEM_FRAGMENT_TOKEN, ANCHORED_VALUE_TOKEN, DISPLAY_SAFE_URL_TOKEN, ...FRAGMENT_SECRET_PATTERNS.map(([, r]) => r)]
     .flatMap((r) => r.match(/«[^»]*»/g) ?? []));
 {
     const closed = new RegExp(`^${REDACTION_TOKEN_RE_SRC}$`);
@@ -1285,8 +1297,8 @@ function tokenUnitEnd(text, p) {
     return TOKEN_UNIT_Y.test(text) ? TOKEN_UNIT_Y.lastIndex : -1;
 }
 const NO_CREDENTIAL_SPANS = { starts: new Int32Array(0), ends: new Int32Array(0) };
-function credentialSpans(text, spans, withSpans) {
-    const iv = withSpans ? spans.map((sp) => [sp.start, sp.end]) : [];
+function credentialSpans(text) {
+    const iv = [];
     for (let i = text.indexOf("«"); i >= 0; i = text.indexOf("«", i + 1)) {
         const e = tokenUnitEnd(text, i);
         if (e > 0) {
@@ -1318,13 +1330,103 @@ function credentialSpans(text, spans, withSpans) {
     k += 1;
     return { starts: starts.subarray(0, k), ends: ends.subarray(0, k) };
 }
-function sameCredentialSpans(a, b) {
-    if (a.starts.length !== b.starts.length)
-        return false;
-    for (let i = 0; i < a.starts.length; i++)
-        if (a.starts[i] !== b.starts[i] || a.ends[i] !== b.ends[i])
-            return false;
-    return true;
+let forensicRescanMode = "incremental";
+export function setForensicRescanModeForTest(mode) {
+    forensicRescanMode = mode;
+}
+function foldCredentialSpans(prev, spans, from) {
+    const cap = spans.length - from;
+    if (cap === 0)
+        return { next: prev, dirty: NO_CREDENTIAL_SPANS };
+    const Sa = new Int32Array(cap);
+    const Ea = new Int32Array(cap);
+    let m = 0;
+    for (let i = from; i < spans.length; i++) {
+        const sp = spans[i];
+        const k = firstCredentialSpanFrom(prev, sp.start + 1) - 1;
+        if (k >= 0 && prev.ends[k] >= sp.end)
+            continue;
+        Sa[m] = sp.start;
+        Ea[m] = sp.end;
+        m += 1;
+    }
+    if (m === 0)
+        return { next: prev, dirty: NO_CREDENTIAL_SPANS };
+    const S = Sa.subarray(0, m).sort();
+    const E = Ea.subarray(0, m).sort();
+    const cs = new Int32Array(m);
+    const ce = new Int32Array(m);
+    let C = 0;
+    for (let i = 0, j = 0, depth = 0, open = 0; i < m || j < m;) {
+        if (i < m && (j >= m || S[i] <= E[j])) {
+            if (depth === 0)
+                open = S[i];
+            depth += 1;
+            i += 1;
+        }
+        else {
+            depth -= 1;
+            if (depth === 0) {
+                cs[C] = open;
+                ce[C] = E[j];
+                C += 1;
+            }
+            j += 1;
+        }
+    }
+    const P = prev.starts.length;
+    const oS = new Int32Array(P + C);
+    const oE = new Int32Array(P + C);
+    const dS = new Int32Array(C + P);
+    const dE = new Int32Array(C + P);
+    let on = 0;
+    let dn = 0;
+    let curS = 0;
+    let curE = 0;
+    let sources = 0;
+    let onlyPrev = false;
+    const flush = () => {
+        if (sources === 0)
+            return;
+        oS[on] = curS;
+        oE[on] = curE;
+        on += 1;
+        if (!(sources === 1 && onlyPrev)) {
+            dS[dn] = curS;
+            dE[dn] = curE;
+            dn += 1;
+        }
+    };
+    for (let pi = 0, ci = 0; pi < P || ci < C;) {
+        const takePrev = ci >= C || (pi < P && prev.starts[pi] <= cs[ci]);
+        const s = takePrev ? prev.starts[pi] : cs[ci];
+        const e = takePrev ? prev.ends[pi] : ce[ci];
+        if (takePrev)
+            pi += 1;
+        else
+            ci += 1;
+        if (sources > 0 && s <= curE) {
+            if (e > curE)
+                curE = e;
+            sources += 1;
+        }
+        else {
+            flush();
+            curS = s;
+            curE = e;
+            sources = 1;
+            onlyPrev = takePrev;
+        }
+    }
+    flush();
+    return { next: { starts: oS.subarray(0, on), ends: oE.subarray(0, on) }, dirty: { starts: dS.subarray(0, dn), ends: dE.subarray(0, dn) } };
+}
+export function credentialSpansFoldForTest(prev, add) {
+    const table = (iv) => ({ starts: Int32Array.from(iv, (x) => x[0]), ends: Int32Array.from(iv, (x) => x[1]) });
+    const back = (t) => Array.from(t.starts, (s, i) => [s, t.ends[i]]);
+    const spans = add.map(([start, end]) => ({ start, end, repl: "", rank: 0, order: 0 }));
+    const { next, dirty } = foldCredentialSpans(table(prev), spans, 0);
+    return { next: back(next), dirty: back(dirty) };
 }
 function firstCredentialSpanFrom(cs, from) {
     let lo = 0;
@@ -1338,43 +1440,90 @@ function firstCredentialSpanFrom(cs, from) {
     }
     return lo;
 }
-function credentialSpansCover(cs, from, to) {
+function credentialSpansCover(scan, from, to) {
+    noteEvidenceRead(scan, from);
+    noteEvidenceRead(scan, to);
+    const cs = scan.table;
     let k = firstCredentialSpanFrom(cs, from + 1) - 1;
     if (k < 0)
         k = 0;
     return k < cs.starts.length && cs.starts[k] <= from && cs.ends[k] >= to;
 }
-let scanEvidence = NO_CREDENTIAL_SPANS;
-let scanEvidenceCursor = 0;
-function setScanEvidence(cs) {
-    scanEvidence = cs;
-    scanEvidenceCursor = 0;
+const FOOT_NONE = 0x7fffffff;
+function buildForensicScan(table, armCount) {
+    return {
+        table,
+        cursor: 0,
+        dirty: undefined,
+        footLo: FOOT_NONE,
+        footHi: -1,
+        armFoot: new Int32Array(2 * armCount),
+        lastAt: -1,
+        headsRead: { a: NO_URL_SEGMENTS, n: 0 },
+        headsWrite: { a: NO_URL_SEGMENTS, n: 0 },
+        paramsRead: { a: NO_URL_SEGMENTS, n: 0 },
+        paramsWrite: { a: NO_URL_SEGMENTS, n: 0 },
+        hdr: { search: 0, contentEnd: 0, next: 0, hitLimit: false, jsonEnd: false },
+    };
+}
+function advanceEvidence(scan, table, dirty) {
+    scan.table = table;
+    scan.cursor = 0;
+    scan.dirty = dirty;
+}
+function noteEvidenceRead(scan, p) {
+    if (p < scan.footLo)
+        scan.footLo = p;
+    if (p > scan.footHi)
+        scan.footHi = p;
+}
+function footprintClean(dirty, lo, hi) {
+    if (lo > hi)
+        return true;
+    const ends = dirty.ends;
+    let a = 0;
+    let b = ends.length;
+    while (a < b) {
+        const mid = (a + b) >>> 1;
+        if (ends[mid] < lo)
+            a = mid + 1;
+        else
+            b = mid;
+    }
+    return a >= ends.length || dirty.starts[a] > hi;
 }
-function inOpaqueUnit(p) {
-    const st = scanEvidence.starts;
+function inOpaqueUnit(scan, p) {
+    noteEvidenceRead(scan, p);
+    const t = scan.table;
+    const st = t.starts;
     if (st.length === 0)
         return false;
-    const k = firstCredentialSpanFrom(scanEvidence, p) - 1;
-    return k >= 0 && st[k] < p && scanEvidence.ends[k] > p;
+    const k = firstCredentialSpanFrom(t, p) - 1;
+    return k >= 0 && st[k] < p && t.ends[k] > p;
+}
+function opaqueUnitEnd(scan, p) {
+    noteEvidenceRead(scan, p);
+    return opaqueUnitEndAt(scan, p);
 }
-function opaqueUnitEnd(p) {
-    const st = scanEvidence.starts;
+function opaqueUnitEndAt(scan, p) {
+    const t = scan.table;
+    const st = t.starts;
     if (st.length === 0)
         return -1;
-    let k = scanEvidenceCursor;
+    let k = scan.cursor;
     while (k < st.length && st[k] < p)
         k += 1;
     while (k > 0 && st[k - 1] >= p)
         k -= 1;
-    scanEvidenceCursor = k;
-    return k < st.length && st[k] === p ? scanEvidence.ends[k] : -1;
+    scan.cursor = k;
+    return k < st.length && st[k] === p ? t.ends[k] : -1;
 }
-let lastAtInRun = -1;
-function scanUrlRun(text, i, kind, json) {
+function scanUrlRun(scan, text, i, kind, json) {
     const n = text.length;
-    lastAtInRun = -1;
-    while (i < n) {
-        const unit = opaqueUnitEnd(i);
+    noteEvidenceRead(scan, i);
+    scan.lastAt = -1;
+    run: while (i < n) {
+        const unit = opaqueUnitEndAt(scan, i);
         if (unit >= 0) {
             i = unit;
             continue;
@@ -1385,56 +1534,117 @@ function scanUrlRun(text, i, kind, json) {
                 i += 2;
                 continue;
             }
-            return i;
+            break;
         }
         if (isRegexSpace(c) || (json && c === 34))
-            return i;
+            break;
         switch (kind) {
             case "plain-user":
                 if (c === CH_AT || c === 47 || c === 58)
-                    return i;
+                    break run;
                 break;
             case "plain-pass":
                 if (c === 47)
-                    return i;
+                    break run;
                 break;
             case "token-pass":
                 if (c === 58 && text.charCodeAt(i + 1) === 47 && text.charCodeAt(i + 2) === 47)
-                    return i;
+                    break run;
                 break;
             case "param-value":
                 if (c === 38 || c === 35 || isControlCode(c))
-                    return i;
+                    break run;
                 break;
         }
         if (c === CH_AT)
-            lastAtInRun = i;
+            scan.lastAt = i;
         i += 1;
     }
+    noteEvidenceRead(scan, i);
     return i;
 }
-function matchUserinfoAt(text, p, json) {
-    const probeEnd = scanUrlRun(text, p, "plain-user", json);
-    const keyId = probeEnd > p && text.charCodeAt(probeEnd) === 58 && credentialSpansCover(scanEvidence, p, probeEnd);
-    scanUrlRun(text, p, keyId ? "token-pass" : "plain-pass", json);
-    if (lastAtInRun <= p)
+function matchUserinfoAt(scan, text, p, json) {
+    const probeEnd = scanUrlRun(scan, text, p, "plain-user", json);
+    const keyId = probeEnd > p && text.charCodeAt(probeEnd) === 58 && credentialSpansCover(scan, p, probeEnd);
+    scanUrlRun(scan, text, p, keyId ? "token-pass" : "plain-pass", json);
+    const at = scan.lastAt;
+    if (at <= p)
         return null;
-    return lastAtInRun;
+    return at;
+}
+const URL_SEG_STRIDE = 4;
+const URL_SEG_MAX_INTS = 3 * 1_048_576;
+const NO_URL_SEGMENTS = new Int32Array(0);
+function growUrlSegments(list) {
+    const len = list.a.length;
+    if (len >= URL_SEG_MAX_INTS)
+        return false;
+    const bigger = new Int32Array(Math.min(Math.max(len * 2, 4 * URL_SEG_STRIDE), URL_SEG_MAX_INTS));
+    bigger.set(list.a.subarray(0, list.n));
+    list.a = bigger;
+    return true;
 }
-function collectUrlCredentialSpans(text, json, span) {
+function collectUrlCredentialSpans(scan, text, json, span) {
+    const dirty = scan.dirty;
+    const hr = scan.headsRead;
+    const hw = scan.headsWrite;
+    const pr = scan.paramsRead;
+    const pw = scan.paramsWrite;
+    hw.n = 0;
+    pw.n = 0;
+    let armLo = FOOT_NONE;
+    let armHi = -1;
     const head = URL_CREDENTIAL_PATTERN[0];
-    head.lastIndex = 0;
-    for (let m = head.exec(text); m !== null; m = head.exec(text)) {
+    const ph = hr.a;
+    const phn = dirty === undefined ? 0 : hr.n;
+    let pc = 0;
+    for (let from = 0;;) {
+        head.lastIndex = from;
+        const m = head.exec(text);
+        if (m === null)
+            break;
         const colon = m.index;
         const start = colon + 3;
-        const at = matchUserinfoAt(text, start, json);
-        if (at === null) {
-            head.lastIndex = colon + 1;
-            continue;
+        while (pc < phn && ph[pc] < colon)
+            pc += URL_SEG_STRIDE;
+        const known = pc < phn && ph[pc] === colon;
+        let at;
+        let lo;
+        let hi;
+        if (known && footprintClean(dirty, ph[pc + 2], ph[pc + 3])) {
+            at = ph[pc + 1];
+            lo = ph[pc + 2];
+            hi = ph[pc + 3];
+            urlSegmentReplays += 1;
         }
-        span(start, at);
-        head.lastIndex = at + 1;
-    }
+        else {
+            scan.footLo = FOOT_NONE;
+            scan.footHi = -1;
+            at = matchUserinfoAt(scan, text, start, json) ?? -1;
+            lo = scan.footLo;
+            hi = scan.footHi;
+            urlSegmentRuns += 1;
+            if (at >= 0 && at !== (known ? ph[pc + 1] : -2))
+                span(start, at);
+        }
+        if (hw.n + URL_SEG_STRIDE <= hw.a.length || growUrlSegments(hw)) {
+            const w = hw.a;
+            const k = hw.n;
+            w[k] = colon;
+            w[k + 1] = at;
+            w[k + 2] = lo;
+            w[k + 3] = hi;
+            hw.n = k + URL_SEG_STRIDE;
+        }
+        if (lo < armLo)
+            armLo = lo;
+        if (hi > armHi)
+            armHi = hi;
+        from = at < 0 ? colon + 1 : at + 1;
+    }
+    const pp = pr.a;
+    const ppn = dirty === undefined ? 0 : pr.n;
+    let qc = 0;
     for (let i = 0; i < text.length; i++) {
         const c = text.charCodeAt(i);
         if (c !== 63 && c !== 38 && c !== 35)
@@ -1442,11 +1652,49 @@ function collectUrlCredentialSpans(text, json, span) {
         const valueStart = credentialParamValueStart(text, i + 1);
         if (valueStart < 0)
             continue;
-        const valueEnd = scanUrlRun(text, valueStart, "param-value", json);
-        if (valueEnd > valueStart)
-            span(valueStart, valueEnd);
+        while (qc < ppn && pp[qc] < i)
+            qc += URL_SEG_STRIDE;
+        const known = qc < ppn && pp[qc] === i;
+        let valueEnd;
+        let lo;
+        let hi;
+        if (known && footprintClean(dirty, pp[qc + 2], pp[qc + 3])) {
+            valueEnd = pp[qc + 1];
+            lo = pp[qc + 2];
+            hi = pp[qc + 3];
+            urlSegmentReplays += 1;
+        }
+        else {
+            scan.footLo = FOOT_NONE;
+            scan.footHi = -1;
+            valueEnd = scanUrlRun(scan, text, valueStart, "param-value", json);
+            lo = scan.footLo;
+            hi = scan.footHi;
+            urlSegmentRuns += 1;
+            if (valueEnd > valueStart && valueEnd !== (known ? pp[qc + 1] : -2))
+                span(valueStart, valueEnd);
+        }
+        if (pw.n + URL_SEG_STRIDE <= pw.a.length || growUrlSegments(pw)) {
+            const w = pw.a;
+            const k = pw.n;
+            w[k] = i;
+            w[k + 1] = valueEnd;
+            w[k + 2] = lo;
+            w[k + 3] = hi;
+            pw.n = k + URL_SEG_STRIDE;
+        }
+        if (lo < armLo)
+            armLo = lo;
+        if (hi > armHi)
+            armHi = hi;
         i = valueEnd - 1;
     }
+    scan.headsRead = hw;
+    scan.headsWrite = hr;
+    scan.paramsRead = pw;
+    scan.paramsWrite = pr;
+    scan.footLo = armLo;
+    scan.footHi = armHi;
 }
 const JSON_FIELD_ANCHOR = '"';
 const CREDENTIAL_NAME_MAX = Math.max(...CREDENTIAL_NAME_WORDS.map((w) => w.length));
@@ -1507,6 +1755,353 @@ function collectJsonSecretFieldSpans(text, span) {
         p = text.indexOf(JSON_FIELD_ANCHOR, scanResumeAfterHit(p, end, JSON_FIELD_ANCHOR.length));
     }
 }
+const STRONG_AUTH_SCHEMES = new Set(["basic", "bearer"]);
+const STRONG_AUTH_SCHEME_MAX = Math.max(...[...STRONG_AUTH_SCHEMES].map((w) => w.length));
+const ABSENT_OR_BOOLEAN_WORDS = new Set(["null", "nil", "none", "undefined", "true", "false", "yes", "no"]);
+const ABSENT_OR_BOOLEAN_MAX = Math.max(...[...ABSENT_OR_BOOLEAN_WORDS].map((w) => w.length));
+const CREDENTIAL_ANCHOR_OF = new Map(Object.entries(CREDENTIAL_NAME_ANCHORS));
+const CH_GRAVE = 96, CH_APOS = 39, CH_DOT = 46, CH_COMMA = 44, CH_SEMI = 59, CH_DOLLAR = 36;
+const CH_LPAREN = 40, CH_RPAREN = 41, CH_RBRACKET = 93, CH_LBRACE = 123, CH_RBRACE = 125, CH_LT = 60, CH_GT = 62;
+const CH_QMARK = 63, CH_AMP = 38, CH_HASH = 35;
+const JSON_STRING_END = -1;
+const isAsciiAlnumCode = (c) => (c >= CH_0 && c <= CH_9) || (c >= CH_A && c <= CH_Z) || (c >= CH_a && c <= CH_z);
+const isProgramIdentCode = (c) => isAsciiAlnumCode(c) || c === CH_UNDERSCORE || c === CH_DOLLAR;
+const isProgramIdentStartCode = (c) => isIdentStartCode(c) || c === CH_UNDERSCORE || c === CH_DOLLAR;
+const isQuoteUnit = (ch) => ch === CH_QUOTE || ch === CH_APOS || ch === CH_GRAVE;
+const isValueCloser = (ch) => ch === CH_DOT || ch === CH_COMMA || ch === CH_SEMI || ch === CH_COLON || ch === CH_RPAREN || ch === CH_RBRACKET || ch === CH_RBRACE || ch === CH_GT;
+const isInlineSpaceUnit = (ch) => ch === CH_SPACE || ch === CH_TAB;
+const isToken68Code = (c) => isAsciiAlnumCode(c) || c === CH_DOT || c === CH_MINUS || c === CH_UNDERSCORE || c === CH_TILDE || c === CH_PLUS || c === CH_SLASH;
+const endsValueUnit = (ch) => ch === JSON_STRING_END || isRegexSpace(ch) || isQuoteUnit(ch) || isValueCloser(ch);
+const endsHeaderValueUnit = (ch) => ch === JSON_STRING_END || isLineTerminator(ch) || isQuoteUnit(ch) || ch === CH_COMMA || ch === CH_SEMI || ch === CH_RPAREN || ch === CH_RBRACKET || ch === CH_RBRACE || ch === CH_GT;
+const bracketOf = (c) => c === CH_LPAREN ? 1 : c === CH_RPAREN ? -1 : c === CH_LBRACKET ? 2 : c === CH_RBRACKET ? -2 : c === CH_LBRACE ? 3 : c === CH_RBRACE ? -3 : c === CH_LT ? 4 : c === CH_GT ? -4 : 0;
+let anchoredScanUnits = 0;
+export function anchoredScanUnitsForTest() {
+    return anchoredScanUnits;
+}
+export function resetAnchoredScanUnitsForTest() {
+    anchoredScanUnits = 0;
+}
+const packUnit = (ch, len) => ((ch + 1) << 3) | len;
+const unitChOf = (unit) => (unit >> 3) - 1;
+const unitLenOf = (unit) => unit & 7;
+function readAnchorUnit(text, i, json) {
+    anchoredScanUnits += 1;
+    const c = text.charCodeAt(i);
+    if (!json)
+        return packUnit(c, 1);
+    if (c === CH_QUOTE)
+        return packUnit(JSON_STRING_END, 1);
+    if (c !== CH_BACKSLASH || i + 1 >= text.length)
+        return packUnit(c, 1);
+    switch (text.charCodeAt(i + 1)) {
+        case CH_n: return packUnit(CH_LF, 2);
+        case CH_r: return packUnit(CH_CR, 2);
+        case CH_t: return packUnit(CH_TAB, 2);
+        case CH_f: return packUnit(12, 2);
+        case CH_b: return packUnit(8, 2);
+        case CH_QUOTE: return packUnit(CH_QUOTE, 2);
+        case CH_BACKSLASH: return packUnit(CH_BACKSLASH, 2);
+        case CH_SLASH: return packUnit(CH_SLASH, 2);
+        case CH_u: {
+            const h0 = hexDigitValue(text.charCodeAt(i + 2));
+            const h1 = hexDigitValue(text.charCodeAt(i + 3));
+            const h2 = hexDigitValue(text.charCodeAt(i + 4));
+            const h3 = hexDigitValue(text.charCodeAt(i + 5));
+            return h0 >= 0 && h1 >= 0 && h2 >= 0 && h3 >= 0 ? packUnit((h0 << 12) | (h1 << 8) | (h2 << 4) | h3, 6) : packUnit(c, 1);
+        }
+        default:
+            return packUnit(c, 1);
+    }
+}
+function escapedAt(text, i) {
+    let k = i - 1;
+    while (k >= 0 && text.charCodeAt(k) === CH_BACKSLASH)
+        k -= 1;
+    anchoredScanUnits += i - 1 - k;
+    return ((i - 1 - k) & 1) === 1;
+}
+function anchorHeadAt(text, op, json) {
+    let i = op - 1;
+    let spacedLeft = false;
+    for (;;) {
+        if (i < 0)
+            return undefined;
+        const c = text.charCodeAt(i);
+        if (c === CH_SPACE || c === CH_TAB) {
+            i -= 1;
+            spacedLeft = true;
+            anchoredScanUnits += 1;
+            continue;
+        }
+        if (json && c === CH_t && i >= 1 && text.charCodeAt(i - 1) === CH_BACKSLASH && escapedAt(text, i)) {
+            i -= 2;
+            spacedLeft = true;
+            continue;
+        }
+        break;
+    }
+    let quote = 0;
+    let quoteLen = 0;
+    const q = text.charCodeAt(i);
+    if (q === CH_QUOTE || q === CH_APOS || q === CH_GRAVE) {
+        quote = q;
+        quoteLen = json && q === CH_QUOTE && escapedAt(text, i) ? 2 : 1;
+        i -= quoteLen;
+    }
+    const nameEnd = i + 1;
+    const floor = Math.max(-1, i - (CREDENTIAL_NAME_MAX + 2));
+    let j = i;
+    while (j > floor && isIdentCode(text.charCodeAt(j)))
+        j -= 1;
+    anchoredScanUnits += nameEnd - (j + 1);
+    if (j === floor && j >= 0 && isIdentCode(text.charCodeAt(j)))
+        return undefined;
+    let nameStart = j + 1;
+    let afterEscape = false;
+    if (j >= 0 && text.charCodeAt(j) === CH_BACKSLASH && escapedAt(text, j + 1)) {
+        const e = text.charCodeAt(nameStart);
+        if (e === CH_b || e === CH_f || e === CH_n || e === CH_r || e === CH_t) {
+            nameStart += 1;
+            afterEscape = true;
+        }
+        else if (e === CH_u && nameStart + 5 <= nameEnd && hexDigitValue(text.charCodeAt(nameStart + 1)) >= 0 && hexDigitValue(text.charCodeAt(nameStart + 2)) >= 0
+            && hexDigitValue(text.charCodeAt(nameStart + 3)) >= 0 && hexDigitValue(text.charCodeAt(nameStart + 4)) >= 0) {
+            nameStart += 5;
+            afterEscape = true;
+        }
+    }
+    const runStart = nameStart;
+    while (nameStart < nameEnd && text.charCodeAt(nameStart) === CH_MINUS)
+        nameStart += 1;
+    if (nameStart >= nameEnd)
+        return undefined;
+    let before = j;
+    if (quote !== 0) {
+        if (afterEscape || nameStart !== j + 1 || j < 0 || text.charCodeAt(j) !== quote)
+            return undefined;
+        const openLen = json && quote === CH_QUOTE && escapedAt(text, j) ? 2 : 1;
+        if (openLen !== quoteLen)
+            return undefined;
+        before = j - openLen;
+    }
+    const strength = CREDENTIAL_ANCHOR_OF.get(text.slice(nameStart, nameEnd).toLowerCase());
+    if (strength === undefined)
+        return undefined;
+    if (!afterEscape && runStart === j + 1 && quote === 0 && j >= 0 && text.charCodeAt(j) === CH_SLASH)
+        return undefined;
+    let listSep = 0;
+    if (!afterEscape) {
+        let k = before;
+        while (k >= 0 && (text.charCodeAt(k) === CH_SPACE || text.charCodeAt(k) === CH_TAB))
+            k -= 1;
+        anchoredScanUnits += before - k;
+        const left = k >= 0 ? text.charCodeAt(k) : 0;
+        listSep = left === CH_QMARK || left === CH_AMP || left === CH_HASH ? CH_AMP : left === CH_SEMI ? CH_SEMI : left === CH_COMMA || left === CH_LPAREN || left === CH_LBRACKET || left === CH_LBRACE ? CH_COMMA : 0;
+    }
+    return { strength, quotedName: quote !== 0, spacedLeft, listSep };
+}
+function quotedValueEnd(text, cs, quote, json) {
+    const n = text.length;
+    let i = cs;
+    while (i < n) {
+        const unit = readAnchorUnit(text, i, json);
+        const ch = unitChOf(unit);
+        if (ch === quote)
+            return i;
+        if (ch === JSON_STRING_END)
+            break;
+        i += unitLenOf(unit);
+        if (ch === CH_BACKSLASH && quote !== JSON_STRING_END) {
+            if (i >= n)
+                break;
+            const escaped = readAnchorUnit(text, i, json);
+            if (unitChOf(escaped) === JSON_STRING_END)
+                break;
+            i += unitLenOf(escaped);
+        }
+    }
+    return -1;
+}
+function bareValueEnd(text, s, json, listSep) {
+    const n = text.length;
+    let i = s;
+    while (i < n) {
+        const unit = readAnchorUnit(text, i, json);
+        const ch = unitChOf(unit);
+        if (ch === JSON_STRING_END || isRegexSpace(ch))
+            break;
+        if (listSep !== 0 && (ch === listSep || (listSep === CH_AMP && ch === CH_HASH)))
+            break;
+        const next = i + unitLenOf(unit);
+        if (isQuoteUnit(ch)) {
+            if (next >= n)
+                break;
+            if (endsValueUnit(unitChOf(readAnchorUnit(text, next, json))))
+                break;
+        }
+        i = next;
+    }
+    anchoredScanUnits += i - s;
+    const excess = [0, 0, 0, 0];
+    for (let k = s; k < i; k += 1) {
+        const b = bracketOf(text.charCodeAt(k));
+        if (b !== 0)
+            excess[Math.abs(b) - 1] = excess[Math.abs(b) - 1] + (b < 0 ? 1 : -1);
+    }
+    let e = i;
+    while (e > s) {
+        const c = text.charCodeAt(e - 1);
+        if (c === CH_DOT || c === CH_COMMA || c === CH_SEMI || c === CH_COLON) {
+            e -= 1;
+            continue;
+        }
+        const b = bracketOf(c);
+        if (b < 0 && excess[-b - 1] > 0) {
+            excess[-b - 1] = excess[-b - 1] - 1;
+            e -= 1;
+            continue;
+        }
+        break;
+    }
+    return e;
+}
+function literalValueAt(text, s, json, declaredIfBare, listSep) {
+    const n = text.length;
+    if (s >= n)
+        return undefined;
+    const firstUnit = readAnchorUnit(text, s, json);
+    const first = unitChOf(firstUnit);
+    let vs = s;
+    if (isQuoteUnit(first) || first === JSON_STRING_END) {
+        vs = s + unitLenOf(firstUnit);
+        if (vs >= n)
+            return undefined;
+        if (!isAsciiAlnumCode(unitChOf(readAnchorUnit(text, vs, json))))
+            return undefined;
+        const close = quotedValueEnd(text, vs, first, json);
+        if (close >= 0)
+            return { start: vs, end: close, quoted: true };
+    }
+    else if (!isAsciiAlnumCode(first))
+        return undefined;
+    if (!declaredIfBare)
+        return undefined;
+    if (isProgramIdentStartCode(text.charCodeAt(vs))) {
+        let k = vs;
+        while (k < n && isProgramIdentCode(text.charCodeAt(k)))
+            k += 1;
+        anchoredScanUnits += k - vs;
+        const after = text.charCodeAt(k);
+        if (after === CH_LPAREN || after === CH_LBRACKET || (after === CH_DOT && k + 1 < n && isProgramIdentStartCode(text.charCodeAt(k + 1))))
+            return undefined;
+    }
+    const e = bareValueEnd(text, vs, json, listSep);
+    if (e <= vs)
+        return undefined;
+    if (e - vs <= ABSENT_OR_BOOLEAN_MAX && ABSENT_OR_BOOLEAN_WORDS.has(text.slice(vs, e).toLowerCase()))
+        return undefined;
+    return { start: vs, end: e, quoted: false };
+}
+function schemeValueAt(text, s, json) {
+    const n = text.length;
+    let i = s;
+    if (i >= n)
+        return undefined;
+    const opening = readAnchorUnit(text, i, json);
+    if (isQuoteUnit(unitChOf(opening)) || unitChOf(opening) === JSON_STRING_END)
+        i += unitLenOf(opening);
+    const w = i;
+    while (i < n && i - w <= STRONG_AUTH_SCHEME_MAX && (isIdentStartCode(text.charCodeAt(i))))
+        i += 1;
+    anchoredScanUnits += i - w;
+    if (i - w > STRONG_AUTH_SCHEME_MAX || !STRONG_AUTH_SCHEMES.has(text.slice(w, i).toLowerCase()))
+        return undefined;
+    let spaced = false;
+    while (i < n) {
+        const unit = readAnchorUnit(text, i, json);
+        if (!isInlineSpaceUnit(unitChOf(unit)))
+            break;
+        i += unitLenOf(unit);
+        spaced = true;
+    }
+    if (!spaced)
+        return undefined;
+    const vs = i;
+    if (i >= n || !isAsciiAlnumCode(text.charCodeAt(i)))
+        return undefined;
+    while (i < n && isToken68Code(text.charCodeAt(i)))
+        i += 1;
+    while (i < n && text.charCodeAt(i) === CH_EQ)
+        i += 1;
+    anchoredScanUnits += i - vs;
+    const e = i;
+    while (i < n) {
+        const unit = readAnchorUnit(text, i, json);
+        if (!isInlineSpaceUnit(unitChOf(unit)))
+            break;
+        i += unitLenOf(unit);
+    }
+    if (i < n && !endsHeaderValueUnit(unitChOf(readAnchorUnit(text, i, json))))
+        return undefined;
+    return { start: vs, end: e, quoted: false };
+}
+function collectAnchoredValueSpans(text, json, span) {
+    const n = text.length;
+    let resume = 0;
+    let nextEq = text.indexOf("=");
+    let nextColon = text.indexOf(":");
+    for (;;) {
+        if (nextEq >= 0 && nextEq < resume)
+            nextEq = text.indexOf("=", resume);
+        if (nextColon >= 0 && nextColon < resume)
+            nextColon = text.indexOf(":", resume);
+        if (nextEq < 0 && nextColon < 0)
+            return;
+        let op;
+        if (nextColon < 0 || (nextEq >= 0 && nextEq < nextColon)) {
+            op = nextEq;
+            nextEq = text.indexOf("=", op + 1);
+        }
+        else {
+            op = nextColon;
+            nextColon = text.indexOf(":", op + 1);
+        }
+        const head = anchorHeadAt(text, op, json);
+        if (head === undefined)
+            continue;
+        let s = op + 1;
+        let spacedRight = false;
+        while (s < n) {
+            const unit = readAnchorUnit(text, s, json);
+            if (!isInlineSpaceUnit(unitChOf(unit)))
+                break;
+            s += unitLenOf(unit);
+            spacedRight = true;
+        }
+        let v;
+        switch (head.strength) {
+            case "structure-only":
+                continue;
+            case "auth-scheme":
+                v = schemeValueAt(text, s, json);
+                break;
+            case "declarative":
+                v = literalValueAt(text, s, json, head.quotedName || (!head.spacedLeft && !spacedRight), head.listSep);
+                break;
+            case "any-form":
+                v = literalValueAt(text, s, json, true, head.listSep);
+                break;
+            default: {
+                const unhandled = head.strength;
+                throw new Error(`redact: unhandled free-text anchor strength ${String(unhandled)}`);
+            }
+        }
+        if (v === undefined)
+            continue;
+        span(v.start, v.end);
+        resume = v.quoted ? v.start : v.end;
+    }
+}
 export function structuralScannerForTest(arm) {
     const collect = (scan) => (text) => {
         const out = [];
@@ -1523,7 +2118,7 @@ export function structuralScannerForTest(arm) {
 let ppkScanBytes = 0;
 export function ppkScanBytesForTest() { return ppkScanBytes; }
 export function resetPpkScanBytesForTest() { ppkScanBytes = 0; }
-function collectPpkContainerSpans(text, record, span) {
+function collectPpkContainerSpans(scan, text, record, span) {
     const HEAD = "PuTTY-User-Key-File-";
     const MAC = "Private-MAC: ";
     const HASH = "Private-Hash: ";
@@ -1542,7 +2137,7 @@ function collectPpkContainerSpans(text, record, span) {
     const isVersionedHead = (at) => {
         let p = at + HEAD.length;
         const start = p;
-        while (p < text.length && opaqueUnitEnd(p) < 0) {
+        while (p < text.length && opaqueUnitEnd(scan, p) < 0) {
             const c = text.charCodeAt(p);
             if (c >= 48 && c <= 57)
                 p += 1;
@@ -1553,13 +2148,13 @@ function collectPpkContainerSpans(text, record, span) {
     };
     const nextVersionedHead = (from) => {
         let p = find(HEAD, from);
-        while (p !== Number.POSITIVE_INFINITY && (inOpaqueUnit(p) || !isVersionedHead(p)))
+        while (p !== Number.POSITIVE_INFINITY && (inOpaqueUnit(scan, p) || !isVersionedHead(p)))
             p = find(HEAD, p + HEAD.length);
         return p;
     };
     const hexRunEnd = (from) => {
         let e = from;
-        while (e < text.length && opaqueUnitEnd(e) < 0) {
+        while (e < text.length && opaqueUnitEnd(scan, e) < 0) {
             const c = text.charCodeAt(e);
             if ((c >= 48 && c <= 57) || (c >= 97 && c <= 102) || (c >= 65 && c <= 70))
                 e += 1;
@@ -1594,7 +2189,7 @@ function collectPpkContainerSpans(text, record, span) {
             let gapBlank = true;
             if (limit !== Number.POSITIVE_INFINITY) {
                 for (let i = hexEnd; i < limit; i++) {
-                    if (opaqueUnitEnd(i) >= 0) {
+                    if (opaqueUnitEnd(scan, i) >= 0) {
                         gapBlank = false;
                         break;
                     }
@@ -1650,15 +2245,30 @@ const armPool = (() => {
             headFirst: boundary === undefined ? undefined : headFirst,
         };
     };
-    const scannerMember = (token, order, phase, scan) => {
+    const scannerMember = (token, order, arm, rank = ARM_RANK.structural, lexical = false) => {
         const repl = spanRepl(token);
         return {
             token,
-            rank: ARM_RANK.structural,
+            rank,
             order,
-            phase,
+            phase: 1,
+            lexical,
+            collect: (text, json, observe, out) => arm(text, json, observe, (start, end) => out.push({ start, end, repl, rank, order })),
+            retry: undefined,
+            headSrc: undefined,
+            headFirst: undefined,
+        };
+    };
+    const forensicMember = (token, order, arm) => {
+        const repl = spanRepl(token);
+        const rank = ARM_RANK.structural;
+        return {
+            token,
+            rank,
+            order,
+            phase: 2,
             lexical: false,
-            collect: (text, json, observe, out) => scan(text, json, observe, (start, end) => out.push({ start, end, repl, rank: ARM_RANK.structural, order })),
+            collect: (scan, text, json, observe, out) => arm(scan, text, json, observe, (start, end) => out.push({ start, end, repl, rank, order })),
             retry: undefined,
             headSrc: undefined,
             headFirst: undefined,
@@ -1666,21 +2276,22 @@ const armPool = (() => {
     };
     const structuralScannerMember = (row, order) => {
         if (row === PEM_FENCE_PATTERN)
-            return scannerMember(row[1], order, 1, (text, _json, _observe, span) => collectPemFenceSpans(text, span));
+            return scannerMember(row[1], order, (text, _json, _observe, span) => collectPemFenceSpans(text, span));
         if (row === SSH2_FENCE_PATTERN)
-            return scannerMember(row[1], order, 2, (text, _json, _observe, span) => collectSsh2FenceSpans(text, span));
+            return forensicMember(row[1], order, (scan, text, _json, _observe, span) => collectSsh2FenceSpans(scan, text, span));
         if (row === URL_CREDENTIAL_PATTERN)
-            return scannerMember(row[1], order, 2, (text, json, _observe, span) => collectUrlCredentialSpans(text, json, span));
+            return forensicMember(row[1], order, (scan, text, json, _observe, span) => collectUrlCredentialSpans(scan, text, json, span));
         if (row === JSON_SECRET_FIELD_PATTERN)
-            return scannerMember(row[1], order, 1, (text, _json, _observe, span) => collectJsonSecretFieldSpans(text, span));
+            return scannerMember(row[1], order, (text, _json, _observe, span) => collectJsonSecretFieldSpans(text, span));
         throw new Error(`redact: structural row /${row[0].source}/ has no hand-written scanner — structural grammars are declared as regexes but never executed as one (S-102 / S-265)`);
     };
     const members = [];
     for (const row of STRUCTURAL_SECRET_PATTERNS)
         members.push(structuralScannerMember(row, members.length));
-    members.push(scannerMember(PPK_CONTAINER_TOKEN, members.length, 2, (text, _json, observe, span) => collectPpkContainerSpans(text, observe, span)));
-    members.push(scannerMember(PEM_FRAGMENT_TOKEN, members.length, 2, (text, json, _observe, span) => collectPemFragmentSpans(text, json, span)));
-    members.push(scannerMember(HEADLESS_PPK_TOKEN, members.length, 2, (text, _json, _observe, span) => collectHeadlessPpkSpans(text, span)));
+    members.push(forensicMember(PPK_CONTAINER_TOKEN, members.length, (scan, text, _json, observe, span) => collectPpkContainerSpans(scan, text, observe, span)));
+    members.push(forensicMember(PEM_FRAGMENT_TOKEN, members.length, (scan, text, json, _observe, span) => collectPemFragmentSpans(scan, text, json, span)));
+    members.push(forensicMember(HEADLESS_PPK_TOKEN, members.length, (scan, text, _json, _observe, span) => collectHeadlessPpkSpans(scan, text, span)));
+    members.push(scannerMember(ANCHORED_VALUE_TOKEN, members.length, (text, json, _observe, span) => collectAnchoredValueSpans(text, json, span), ARM_RANK.keyword, true));
     for (const row of KEYWORD_SECRET_PATTERNS)
         members.push(regexMember(row, ARM_RANK.keyword, members.length));
     for (const row of SHAPE_SECRET_PATTERNS)
@@ -1746,25 +2357,37 @@ const armPool = (() => {
                 at = freshCovered(before);
             }
         };
-        setScanEvidence(NO_CREDENTIAL_SPANS);
         for (const m of lane.phase1)
             m.collect(text, json, observe, spans);
         closeCoveragePositions(0);
         if (lane.phase2.length > 0) {
-            let evidence = credentialSpans(text, spans, false);
+            const scan = buildForensicScan(credentialSpans(text), lane.phase2.length);
+            const reuse = forensicRescanMode === "incremental";
+            const foot = scan.armFoot;
+            let folded = 0;
             for (let level = 0;; level += 1) {
                 const before = spans.length;
-                setScanEvidence(evidence);
-                for (const m of lane.phase2)
-                    m.collect(text, json, observe && level === 0, spans);
+                for (let j = 0; j < lane.phase2.length; j++) {
+                    const dirty = scan.dirty;
+                    if (dirty !== undefined && footprintClean(dirty, foot[2 * j], foot[2 * j + 1])) {
+                        forensicSkips += 1;
+                        continue;
+                    }
+                    scan.footLo = FOOT_NONE;
+                    scan.footHi = -1;
+                    lane.phase2[j].collect(scan, text, json, observe && level === 0, spans);
+                    foot[2 * j] = scan.footLo;
+                    foot[2 * j + 1] = scan.footHi;
+                    forensicRuns += 1;
+                }
                 closeCoveragePositions(before);
                 forensicLevels += 1;
-                const next = credentialSpans(text, spans, true);
-                if (sameCredentialSpans(next, evidence))
+                const grown = foldCredentialSpans(scan.table, spans, folded);
+                folded = spans.length;
+                if (grown.dirty.starts.length === 0)
                     break;
-                evidence = next;
+                advanceEvidence(scan, grown.next, reuse ? grown.dirty : undefined);
             }
-            setScanEvidence(NO_CREDENTIAL_SPANS);
         }
         poolSpanCount += spans.length;
         const kept = resolveSpanOverlaps(spans);
@@ -1837,6 +2460,9 @@ export function redactionSpansForTest(text, opts) {
     const r = runRedaction(text, false, opts?.json === true, false, "free-text");
     return { text: r.text, spans: r.spans.map((sp) => ({ start: sp.start, end: sp.end })) };
 }
+export function proposeRedactionSpans(text, scope) {
+    return runRedaction(text, true, false, false, scope).spans.map((sp) => ({ start: sp.start, end: sp.end, repl: sp.repl }));
+}
 const REDACT_MAX_DEPTH = 64;
 export function redactDeep(value) {
     return redactDeepWith(value, redactSecrets);