@sema-agent/server 7.139.0 → 7.141.0

package/dist/trace/redact.js

@@ -888,6 +888,28 @@ const CREDENTIAL_NAME_ALT = (() => {
     return [...CREDENTIAL_PARAM_NAMES].sort((a, b) => b.length - a.length || (a < b ? -1 : 1)).join("|");
 })();
 const CREDENTIAL_NAME_MAX = Math.max(...CREDENTIAL_PARAM_NAMES.map((w) => w.length));
+const JSON_FIELD_QUOTE_FORMS = ['"', '\\"', '\\\\\\"'];
+for (let d = 0; d < JSON_FIELD_QUOTE_FORMS.length; d++) {
+    if (JSON_FIELD_QUOTE_FORMS[d] !== "\\".repeat(2 ** d - 1) + '"')
+        throw new Error(`redact: JSON field quote form ${d} must be ${2 ** d - 1} backslashes + a quote`);
+}
+function buildJsonSecretFieldSource() {
+    const lt = String.raw `\n\r\u2028\u2029`;
+    const l = `[${lt}]`;
+    let q = '"';
+    let b = String.raw `\\`;
+    let o = `[^"\\\\${lt}]`;
+    const alts = [];
+    for (let d = 0; d < JSON_FIELD_QUOTE_FORMS.length; d++) {
+        if (d > 0) {
+            o = `(?:${o}|${b}${o})`;
+            q = b + q;
+            b = b + b;
+        }
+        alts.push(String.raw `(${q}(?:${CREDENTIAL_NAME_ALT})${q}\s*:\s*)${q}(?:${o}|${l}|${b}(?:${o}|${b}|${q}))*${q}`);
+    }
+    return alts.join("|");
+}
 const asciiLower = (s) => s.replace(/[A-Z]/g, (c) => c.toLowerCase());
 function credentialNameAnchor(name) {
     return CREDENTIAL_ANCHOR_OF.get(asciiLower(name));
@@ -897,7 +919,7 @@ const STRUCTURAL_SECRET_PATTERNS = [
     [/-----BEGIN(?:[^-](?:[^-](?:[^-]|-(?!-))*)?)?PRIVATE KEY(?: BLOCK)?-----[\s\S]{0,8192}?-----END(?:[^-](?:[^-](?:[^-]|-(?!-))*)?)?PRIVATE KEY(?: BLOCK)?-----/g, "«redacted:private-key»"],
     [/---- BEGIN SSH2 ENCRYPTED PRIVATE KEY ----[\s\S]{0,8192}?---- END SSH2 ENCRYPTED PRIVATE KEY ----/g, "«redacted:private-key»"],
     [/:(?<=[A-Za-z][A-Za-z0-9+.-]*:)\/\//g, "$1«redacted»"],
-    [new RegExp(String.raw `("(?:${CREDENTIAL_NAME_ALT})"\s*:\s*)"[^"\\]*(?:\\.[^"\\]*)*"`, "gi"), '$1"«redacted»"'],
+    [new RegExp(buildJsonSecretFieldSource(), "gi"), '$1"«redacted»"'],
 ];
 const PPK_CONTAINER_TOKEN = "«redacted:private-key»";
 const PEM_FRAGMENT_TOKEN = "«redacted:private-key:partial»";
@@ -1094,6 +1116,7 @@ function parsePemBody(scan, s, i, limit) {
 function rightmostPemRunEnd(scan, s, from, to) {
     let best = -1;
     let runStart = -1;
+    let plainBackslashTill = -1;
     for (let p = from; p <= to; p++) {
         if (p < to) {
             const unit = opaqueUnitEnd(scan, p);
@@ -1106,6 +1129,20 @@ function rightmostPemRunEnd(scan, s, from, to) {
                 p = unit - 1;
                 continue;
             }
+            if (p >= plainBackslashTill && s.charCodeAt(p) === CH_BACKSLASH) {
+                const j = pemEscapeLetterAt(s, p, to);
+                if (j >= 0) {
+                    if (runStart >= 0 && p - runStart >= PEM_BODY_RUN_MIN)
+                        best = p;
+                    runStart = -1;
+                    p = j;
+                    continue;
+                }
+                let k = p + 1;
+                while (k < to && s.charCodeAt(k) === CH_BACKSLASH)
+                    k += 1;
+                plainBackslashTill = k;
+            }
         }
         if (p < to && isBase64Code(s.charCodeAt(p))) {
             if (runStart < 0)
@@ -1153,38 +1190,54 @@ function findPemFence(scan, text, from) {
         if (close < 0)
             return undefined;
         from = labelFrom;
-        if (inOpaqueUnit(scan, fence))
-            continue;
         if (!isPemFenceLabel(text, labelFrom, close))
             continue;
-        return { fence, after: close + PEM_FENCE_CLOSE.length };
+        const after = close + PEM_FENCE_CLOSE.length;
+        if (anchorHeld(scan, fence, after))
+            continue;
+        return { fence, after };
     }
 }
 const SSH2_FENCE_OPEN = "---- BEGIN SSH2 ENCRYPTED PRIVATE KEY ----";
 const SSH2_FENCE_CLOSE = "---- END SSH2 ENCRYPTED PRIVATE KEY ----";
 const SSH2_BODY_MAX = 8192;
-function unitCountWithin(scan, from, to, max) {
+function unitCountWithin(scan, from, to, max, t = scan.table) {
     if (to - from <= max)
         return true;
     noteEvidenceRead(scan, from);
     noteEvidenceRead(scan, to);
-    const st = scan.table.starts;
-    if (st.length === 0)
-        return false;
-    const k = firstCredentialSpanFrom(scan.table, from);
-    if (k >= st.length || st[k] >= to)
-        return false;
-    let n = 0;
-    for (let p = from; p < to;) {
-        if (n > max)
-            return false;
-        const unit = opaqueUnitEnd(scan, p);
-        p = unit > 0 && unit <= to ? unit : p + 1;
-        n += 1;
+    const lo = firstCredentialSpanFrom(t, from);
+    let a = lo;
+    let b = t.ends.length;
+    while (a < b) {
+        const mid = (a + b) >>> 1;
+        if (t.ends[mid] <= to)
+            a = mid + 1;
+        else
+            b = mid;
     }
-    return n <= max;
-}
-function collectSsh2FenceSpans(scan, text, span, isHead) {
+    if (a === lo)
+        return false;
+    const saved = unitSavings(t);
+    return to - from - (saved[a] - saved[lo]) <= max;
+}
+const UNIT_SAVINGS = new WeakMap();
+function unitSavings(t) {
+    let saved = UNIT_SAVINGS.get(t);
+    if (saved === undefined) {
+        const n = t.starts.length;
+        saved = new Float64Array(n + 1);
+        for (let k = 0; k < n; k++)
+            saved[k + 1] = saved[k] + (t.ends[k] - t.starts[k] - 1);
+        UNIT_SAVINGS.set(t, saved);
+    }
+    return saved;
+}
+export function unitCountWithinForTest(table, from, to, max) {
+    const t = { starts: Int32Array.from(table, (x) => x[0]), ends: Int32Array.from(table, (x) => x[1]) };
+    return unitCountWithin(buildForensicScan(t, 1), from, to, max);
+}
+function collectSsh2FenceSpans(scan, text, json, span, isHead) {
     let cachedFrom = 0;
     let cachedAt;
     const nextClose = (from) => {
@@ -1201,29 +1254,78 @@ function collectSsh2FenceSpans(scan, text, span, isHead) {
         cachedAt = p;
         return p;
     };
+    let freeFrom = 0;
+    let freeAt;
+    const freeClose = (from) => {
+        if (freeAt !== undefined && freeFrom <= from && (freeAt < 0 || freeAt >= from))
+            return freeAt;
+        let p = text.indexOf(SSH2_FENCE_CLOSE, from);
+        ssh2ScanBytes += (p < 0 ? text.length : p) - from;
+        while (p >= 0 && anchorHeld(scan, p, p + 1)) {
+            const q = text.indexOf(SSH2_FENCE_CLOSE, p + 1);
+            ssh2ScanBytes += (q < 0 ? text.length : q) - (p + 1);
+            p = q;
+        }
+        freeFrom = from;
+        freeAt = p;
+        return p;
+    };
+    const truncatedEnd = createTruncatedBlockEnd(scan, text, json, freeClose);
+    let openFrom = 0;
+    let openAt;
+    const nextFreeOpen = (from) => {
+        if (openAt !== undefined && openFrom <= from && (openAt < 0 || openAt >= from))
+            return openAt;
+        let p = text.indexOf(SSH2_FENCE_OPEN, from);
+        ssh2ScanBytes += (p < 0 ? text.length : p) - from;
+        while (p >= 0 && anchorHeld(scan, p, p + SSH2_FENCE_OPEN.length)) {
+            const q = text.indexOf(SSH2_FENCE_OPEN, p + 1);
+            ssh2ScanBytes += (q < 0 ? text.length : q) - (p + 1);
+            p = q;
+        }
+        openFrom = from;
+        openAt = p;
+        return p;
+    };
     for (let from = 0;;) {
         const fence = text.indexOf(SSH2_FENCE_OPEN, from);
         if (fence < 0)
             return;
-        if (inOpaqueUnit(scan, fence)) {
+        const bodyFrom = fence + SSH2_FENCE_OPEN.length;
+        if (anchorHeld(scan, fence, bodyFrom)) {
             from = fence + 1;
             continue;
         }
-        const bodyFrom = fence + SSH2_FENCE_OPEN.length;
         if (isHead && unitCountWithin(scan, bodyFrom, text.length, SSH2_BODY_MAX)) {
             span(fence, text.length, true);
             return;
         }
+        let resume = fence + 1;
+        if (!isHead) {
+            const open = nextFreeOpen(bodyFrom);
+            const limit = open < 0 ? text.length : open;
+            const t = truncatedEnd(bodyFrom, limit);
+            const bodyEnd = t < 0 ? -1 : armorBodyEnd(scan, text, json, bodyFrom, limit, false);
+            const end = bodyEnd < 0 ? -1 : Math.max(bodyEnd, t);
+            if (end >= 0 && unitCountWithin(scan, bodyFrom, end, SSH2_BODY_MAX, othersOf(scan))) {
+                span(fence, end);
+                resume = end;
+            }
+        }
         const close = nextClose(bodyFrom);
-        if (close < 0)
-            return;
+        if (close < 0) {
+            if (isHead)
+                return;
+            from = resume;
+            continue;
+        }
         if (!unitCountWithin(scan, bodyFrom, close, SSH2_BODY_MAX)) {
-            from = fence + 1;
+            from = resume;
             continue;
         }
         const end = close + SSH2_FENCE_CLOSE.length;
         span(fence, end);
-        from = scanResumeAfterHit(fence, end, SSH2_FENCE_OPEN.length);
+        from = Math.max(resume, scanResumeAfterHit(fence, end, SSH2_FENCE_OPEN.length));
     }
 }
 const PEM_END_OPEN = "-----END";
@@ -1241,16 +1343,20 @@ function pemFenceLineEnd(text, labelFrom) {
     }
     return isPemFenceLabel(text, labelFrom, close) ? close + PEM_FENCE_CLOSE.length : PEM_LINE_INVALID;
 }
-function collectPemFenceSpans(text, span, isHead) {
+function collectPemFenceSpans(scan, text, span, isHead) {
     let endFrom = -1;
     let endAt = -1;
     let endAfter = -1;
+    const visibleEndLine = (b) => {
+        const after = pemFenceLineEnd(text, b + PEM_END_OPEN.length);
+        return after >= 0 && !inOpaqueUnit(scan, b) ? after : -1;
+    };
     const earliestEndFence = (from) => {
         if (endFrom >= 0 && from >= endFrom && (endAt < 0 || endAt >= from))
             return;
         let b = text.indexOf(PEM_END_OPEN, from);
         let after = -1;
-        while (b >= 0 && (after = pemFenceLineEnd(text, b + PEM_END_OPEN.length)) < 0)
+        while (b >= 0 && (after = visibleEndLine(b)) < 0)
             b = text.indexOf(PEM_END_OPEN, b + 1);
         endFrom = from;
         endAt = b;
@@ -1265,6 +1371,10 @@ function collectPemFenceSpans(text, span, isHead) {
             from = fence + 1;
             continue;
         }
+        if (anchorHeld(scan, fence, bodyFrom === PEM_LINE_OPEN ? text.length : bodyFrom)) {
+            from = fence + 1;
+            continue;
+        }
         if (bodyFrom !== PEM_LINE_OPEN)
             earliestEndFence(bodyFrom);
         if (bodyFrom === PEM_LINE_OPEN || endAt < 0) {
@@ -1272,7 +1382,7 @@ function collectPemFenceSpans(text, span, isHead) {
                 span(fence, text.length, true);
             return;
         }
-        if (endAt - bodyFrom > PEM_FENCE_BODY_MAX) {
+        if (!unitCountWithin(scan, bodyFrom, endAt, PEM_FENCE_BODY_MAX)) {
             from = fence + 1;
             continue;
         }
@@ -1280,35 +1390,80 @@ function collectPemFenceSpans(text, span, isHead) {
         from = scanResumeAfterHit(fence, endAfter, PEM_FENCE_OPEN.length);
     }
 }
-function collectPemFragmentSpans(scan, text, json, span) {
+function truncationWindowEnd(text, from, json) {
+    if (!json)
+        return text.length;
+    for (let i = from; i < text.length; i++) {
+        const c = text.charCodeAt(i);
+        if (c === CH_BACKSLASH) {
+            i += 1;
+            continue;
+        }
+        if (c === CH_QUOTE)
+            return i;
+    }
+    return text.length;
+}
+function armorBodyEnd(scan, text, json, from, limit, allowBare) {
+    let pos = from;
+    let bare = allowBare;
+    let hitLimit = false;
+    let rightmost = -1;
+    while (parsePemHeaderLine(scan, text, pos, limit, bare, json)) {
+        const e = rightmostPemRunEnd(scan, text, scan.hdr.search, scan.hdr.contentEnd);
+        if (e > rightmost)
+            rightmost = e;
+        pos = scan.hdr.next;
+        bare = false;
+        if (scan.hdr.hitLimit) {
+            hitLimit = true;
+            break;
+        }
+        if (scan.hdr.jsonEnd)
+            break;
+    }
+    const bodyEnd = parsePemBody(scan, text, pos, limit);
+    scan.hdr.hitLimit = hitLimit;
+    return bodyEnd >= 0 ? bodyEnd : rightmost;
+}
+function createTruncatedBlockEnd(scan, text, json, closeAt) {
+    let winFrom = -1;
+    let winAt = -1;
+    return (from, limit) => {
+        if (!(winFrom >= 0 && from >= winFrom && from <= winAt)) {
+            winFrom = from;
+            winAt = truncationWindowEnd(text, from, json);
+        }
+        const close = closeAt(from);
+        if (close >= 0 && close < winAt)
+            return -1;
+        return rightmostPemRunEnd(scan, text, from, Math.min(limit, winAt));
+    };
+}
+function collectPemFragmentSpans(scan, text, json, span, isHead) {
     let cur = findPemFence(scan, text, 0);
     let inherited = false;
+    let closeFrom = -1;
+    let closeAt = -1;
+    const freeClose = (from) => {
+        if (closeFrom >= 0 && from >= closeFrom && (closeAt < 0 || closeAt >= from))
+            return closeAt;
+        let b = text.indexOf(PEM_END_OPEN, from);
+        while (b >= 0 && (pemFenceLineEnd(text, b + PEM_END_OPEN.length) < 0 || anchorHeld(scan, b, b + 1)))
+            b = text.indexOf(PEM_END_OPEN, b + 1);
+        closeFrom = from;
+        closeAt = b;
+        return b;
+    };
+    const truncatedEnd = createTruncatedBlockEnd(scan, text, json, freeClose);
     while (cur !== undefined) {
         const next = findPemFence(scan, text, cur.after);
         const limit = next === undefined ? text.length : next.fence;
-        let pos = cur.after;
-        let allowBare = inherited;
-        let hitLimit = false;
-        let rightmost = -1;
-        while (parsePemHeaderLine(scan, text, pos, limit, allowBare, json)) {
-            const e = rightmostPemRunEnd(scan, text, scan.hdr.search, scan.hdr.contentEnd);
-            if (e > rightmost)
-                rightmost = e;
-            pos = scan.hdr.next;
-            allowBare = false;
-            if (scan.hdr.hitLimit) {
-                hitLimit = true;
-                break;
-            }
-            if (scan.hdr.jsonEnd)
-                break;
-        }
-        inherited = hitLimit;
-        let bodyEnd = parsePemBody(scan, text, pos, limit);
-        if (bodyEnd < 0)
-            bodyEnd = rightmost;
-        if (bodyEnd >= 0)
-            span(cur.fence, bodyEnd);
+        const bodyEnd = armorBodyEnd(scan, text, json, cur.after, limit, inherited);
+        inherited = scan.hdr.hitLimit;
+        const end = isHead || bodyEnd < 0 ? bodyEnd : Math.max(bodyEnd, truncatedEnd(cur.after, limit));
+        if (end >= 0)
+            span(cur.fence, end);
         cur = next;
     }
 }
@@ -1414,10 +1569,6 @@ function collectHeadlessPpkSpans(scan, text, span, isHead) {
         const at = text.indexOf(KEY, search);
         if (at === -1)
             break;
-        if (inOpaqueUnit(scan, at)) {
-            search = at + KEY.length;
-            continue;
-        }
         let p = at + KEY.length;
         const d0 = p;
         while (p < n && opaqueUnitEnd(scan, p) < 0 && text.charCodeAt(p) >= 48 && text.charCodeAt(p) <= 57)
@@ -1426,6 +1577,10 @@ function collectHeadlessPpkSpans(scan, text, span, isHead) {
             search = at + KEY.length;
             continue;
         }
+        if (anchorHeld(scan, at, p)) {
+            search = at + KEY.length;
+            continue;
+        }
         let end = -1;
         let open = false;
         for (let from = p;;) {
@@ -1524,6 +1679,14 @@ const JSON_SECRET_FIELD_PATTERN = (() => {
         throw new Error(`redact: expected exactly one JSON secret-field rule (replacement '$1"«redacted»"') in FULL_ARM_PATTERNS, found ${rows.length}`);
     return rows[0];
 })();
+const JSON_FIELD_VALUE_REPLS = (() => {
+    const [plain] = JSON_FIELD_QUOTE_FORMS;
+    const repl = JSON_SECRET_FIELD_PATTERN[1];
+    if (!repl.startsWith("$1" + plain) || !repl.endsWith(plain) || repl.length < 2 + 2 * plain.length)
+        throw new Error(`redact: the JSON secret-field replacement must be $1 + a quoted mark, got ${JSON.stringify(repl)}`);
+    const mark = repl.slice(2 + plain.length, repl.length - plain.length);
+    return JSON_FIELD_QUOTE_FORMS.map((f) => f + mark + f);
+})();
 const isRegexSpace = (c) => c === 32 || (c >= 9 && c <= 13) || c === 0xa0 || c === 0x1680 || (c >= 0x2000 && c <= 0x200a) || c === 0x2028 || c === 0x2029 || c === 0x202f || c === 0x205f || c === 0x3000 || c === 0xfeff;
 const isLineTerminator = (c) => c === 10 || c === 13 || c === 0x2028 || c === 0x2029;
 const isControlCode = (c) => c < 0x20 || c === 0x7f;
@@ -1610,7 +1773,7 @@ let forensicRescanMode = "incremental";
 export function setForensicRescanModeForTest(mode) {
     forensicRescanMode = mode;
 }
-function foldCredentialSpans(prev, spans, from) {
+function foldCredentialSpans(prev, spans, from, admit) {
     const cap = spans.length - from;
     if (cap === 0)
         return { next: prev, dirty: NO_CREDENTIAL_SPANS };
@@ -1619,6 +1782,8 @@ function foldCredentialSpans(prev, spans, from) {
     let m = 0;
     for (let i = from; i < spans.length; i++) {
         const sp = spans[i];
+        if (admit !== undefined && !admit(sp))
+            continue;
         const k = firstCredentialSpanFrom(prev, sp.start + 1) - 1;
         if (k >= 0 && prev.ends[k] >= sp.end)
             continue;
@@ -1729,6 +1894,7 @@ const FOOT_NONE = 0x7fffffff;
 function buildForensicScan(table, armCount) {
     return {
         table,
+        others: undefined,
         cursor: 0,
         dirty: undefined,
         footLo: FOOT_NONE,
@@ -1742,8 +1908,9 @@ function buildForensicScan(table, armCount) {
         hdr: { search: 0, contentEnd: 0, next: 0, hitLimit: false, jsonEnd: false },
     };
 }
-function advanceEvidence(scan, table, dirty) {
+function useEvidenceView(scan, table, dirty, others) {
     scan.table = table;
+    scan.others = others;
     scan.cursor = 0;
     scan.dirty = dirty;
 }
@@ -1777,6 +1944,22 @@ function inOpaqueUnit(scan, p) {
     const k = firstCredentialSpanFrom(t, p) - 1;
     return k >= 0 && st[k] < p && t.ends[k] > p;
 }
+function othersOf(scan) {
+    const t = scan.others;
+    if (t === undefined)
+        throw new Error("redact: a structural-anchor question was asked by a forensic arm that declares no credential family — it has no other-families evidence to read");
+    return t;
+}
+function anchorHeld(scan, p, lineEnd) {
+    const t = othersOf(scan);
+    noteEvidenceRead(scan, p);
+    noteEvidenceRead(scan, lineEnd - 1);
+    const st = t.starts;
+    if (st.length === 0)
+        return false;
+    const k = firstCredentialSpanFrom(t, p) - 1;
+    return k >= 0 && st[k] < p && t.ends[k] >= lineEnd;
+}
 function opaqueUnitEnd(scan, p) {
     noteEvidenceRead(scan, p);
     return opaqueUnitEndAt(scan, p);
@@ -1975,21 +2158,22 @@ function collectUrlCredentialSpans(scan, text, json, span, isHead) {
     scan.footHi = armHi;
 }
 const JSON_FIELD_ANCHOR = '"';
-function jsonSecretFieldValueQuoteAt(text, p) {
+const JSON_FIELD_BACK = Math.max(...JSON_FIELD_QUOTE_FORMS.map((f) => f.length));
+function jsonSecretFieldValueQuoteAt(text, p, depth) {
+    const form = JSON_FIELD_QUOTE_FORMS[depth];
     const n = text.length;
-    let i = p + 1;
+    const nameFrom = p + form.length;
+    let i = nameFrom;
     for (; i < n; i++) {
         const c = text.charCodeAt(i);
-        if (c === CH_QUOTE)
-            break;
-        if (i - p > CREDENTIAL_NAME_MAX)
-            return -1;
         if (!(isAsciiAlnumCode(c) || c === CH_UNDERSCORE || c === CH_MINUS))
+            break;
+        if (i - nameFrom >= CREDENTIAL_NAME_MAX)
             return -1;
     }
-    if (i >= n || i === p + 1 || credentialNameAnchor(text.slice(p + 1, i)) === undefined)
+    if (i === nameFrom || !text.startsWith(form, i) || credentialNameAnchor(text.slice(nameFrom, i)) === undefined)
         return -1;
-    i += 1;
+    i += form.length;
     while (i < n && isRegexSpace(text.charCodeAt(i)))
         i += 1;
     if (text.charCodeAt(i) !== CH_COLON)
@@ -1997,38 +2181,99 @@ function jsonSecretFieldValueQuoteAt(text, p) {
     i += 1;
     while (i < n && isRegexSpace(text.charCodeAt(i)))
         i += 1;
-    return text.charCodeAt(i) === CH_QUOTE ? i : -1;
+    return text.startsWith(form, i) ? i : -1;
 }
 const STRING_OPEN = -2;
-function jsonStringEndAt(text, q, isHead) {
-    const n = text.length;
-    for (let i = q + 1; i < n;) {
+const U_END = 0;
+const U_QUOTE = 1;
+const U_BSL = 2;
+const U_ORD = 3;
+const U_LT = 4;
+const U_BREAK = 5;
+const packUnit8 = (kind, next) => next * 8 + kind;
+const unit8Kind = (u) => (u % 8);
+const unit8Next = (u) => (u - (u % 8)) / 8;
+function escapedUnitAt(text, i, depth) {
+    if (i >= text.length)
+        return packUnit8(U_END, i);
+    if (depth === 0) {
         const c = text.charCodeAt(i);
-        if (c === CH_QUOTE)
-            return i + 1;
-        if (c === CH_BACKSLASH) {
-            if (i + 1 < n && !isLineTerminator(text.charCodeAt(i + 1))) {
-                i += 2;
+        return packUnit8(c === CH_QUOTE ? U_QUOTE : c === CH_BACKSLASH ? U_BSL : isLineTerminator(c) ? U_LT : U_ORD, i + 1);
+    }
+    const u = escapedUnitAt(text, i, depth - 1);
+    switch (unit8Kind(u)) {
+        case U_QUOTE: return packUnit8(U_BREAK, unit8Next(u));
+        case U_BSL: return escapePairUnit(text, unit8Next(u), depth - 1);
+        case U_ORD:
+        case U_LT:
+        case U_BREAK:
+        case U_END: return u;
+    }
+}
+function escapePairUnit(text, i, depth) {
+    const v = escapedUnitAt(text, i, depth);
+    const next = unit8Next(v);
+    switch (unit8Kind(v)) {
+        case U_BSL: return packUnit8(U_BSL, next);
+        case U_QUOTE: return packUnit8(U_QUOTE, next);
+        case U_ORD: return packUnit8(U_ORD, next);
+        case U_LT:
+        case U_BREAK: return packUnit8(U_BREAK, next);
+        case U_END: return packUnit8(U_END, next);
+    }
+}
+function jsonStringEndAt(text, from, depth, isHead) {
+    for (let i = from;;) {
+        const u = escapedUnitAt(text, i, depth);
+        switch (unit8Kind(u)) {
+            case U_QUOTE:
+                return unit8Next(u);
+            case U_ORD:
+            case U_LT:
+                i = unit8Next(u);
+                continue;
+            case U_BSL: {
+                const v = escapedUnitAt(text, unit8Next(u), depth);
+                const vk = unit8Kind(v);
+                if (vk === U_END)
+                    return isHead ? STRING_OPEN : -1;
+                if (vk === U_LT || vk === U_BREAK)
+                    return -1;
+                i = unit8Next(v);
                 continue;
             }
-            return isHead && i + 1 >= n ? STRING_OPEN : -1;
+            case U_BREAK:
+                return -1;
+            case U_END:
+                return isHead ? STRING_OPEN : -1;
         }
-        i += 1;
     }
-    return isHead ? STRING_OPEN : -1;
 }
 function collectJsonSecretFieldSpans(text, span, isHead) {
+    let from = 0;
     for (let p = text.indexOf(JSON_FIELD_ANCHOR); p >= 0;) {
-        const q = jsonSecretFieldValueQuoteAt(text, p);
-        const found = q < 0 ? -1 : jsonStringEndAt(text, q, isHead);
-        if (found === -1) {
-            p = text.indexOf(JSON_FIELD_ANCHOR, p + 1);
-            continue;
+        let run = 0;
+        while (run < JSON_FIELD_BACK - 1 && p - run - 1 >= from && text.charCodeAt(p - run - 1) === CH_BACKSLASH)
+            run += 1;
+        let next = -1;
+        for (let d = JSON_FIELD_QUOTE_FORMS.length - 1; d >= 0 && next < 0; d--) {
+            const form = JSON_FIELD_QUOTE_FORMS[d];
+            const start = p - (form.length - 1);
+            if (start < p - run)
+                continue;
+            const q = jsonSecretFieldValueQuoteAt(text, start, d);
+            const found = q < 0 ? -1 : jsonStringEndAt(text, q + form.length, d, isHead);
+            if (found === -1)
+                continue;
+            const open = found === STRING_OPEN;
+            const end = open ? text.length : found;
+            span(q, end, open, JSON_FIELD_VALUE_REPLS[d]);
+            from = scanResumeAfterHit(start, end, JSON_FIELD_BACK);
+            next = text.indexOf(JSON_FIELD_ANCHOR, from);
+            if (next < 0)
+                return;
         }
-        const open = found === STRING_OPEN;
-        const end = open ? text.length : found;
-        span(q, end, open);
-        p = text.indexOf(JSON_FIELD_ANCHOR, scanResumeAfterHit(p, end, JSON_FIELD_ANCHOR.length));
+        p = next >= 0 ? next : text.indexOf(JSON_FIELD_ANCHOR, p + 1);
     }
 }
 const STRONG_AUTH_SCHEMES = new Set(["basic", "bearer"]);
@@ -2417,7 +2662,7 @@ export function structuralScannerForTest(arm) {
         case "json-secret-field":
             return { declared: new RegExp(JSON_SECRET_FIELD_PATTERN[0].source, JSON_SECRET_FIELD_PATTERN[0].flags), spans: collect(collectJsonSecretFieldSpans) };
         case "pem-fence":
-            return { declared: new RegExp(PEM_FENCE_PATTERN[0].source, PEM_FENCE_PATTERN[0].flags), spans: collect(collectPemFenceSpans) };
+            return { declared: new RegExp(PEM_FENCE_PATTERN[0].source, PEM_FENCE_PATTERN[0].flags), spans: collect((text, span, isHead) => collectPemFenceSpans({ ...buildForensicScan(NO_CREDENTIAL_SPANS, 1), others: NO_CREDENTIAL_SPANS }, text, span, isHead)) };
     }
 }
 let ppkScanBytes = 0;
@@ -2450,9 +2695,9 @@ function collectPpkContainerSpans(scan, text, eat, span, isHead) {
         }
         return p;
     };
-    const isVersionedHead = (at) => {
+    const versionedHeadEnd = (at) => {
         const p = versionEnd(at);
-        return p > at + HEAD.length && text.startsWith(": ", p);
+        return p > at + HEAD.length && text.startsWith(": ", p) ? p + 2 : -1;
     };
     const isOpenHead = (at) => {
         const p = versionEnd(at);
@@ -2460,8 +2705,11 @@ function collectPpkContainerSpans(scan, text, eat, span, isHead) {
     };
     const nextVersionedHead = (from) => {
         let p = find(HEAD, from);
-        while (p !== Number.POSITIVE_INFINITY && (inOpaqueUnit(scan, p) || !isVersionedHead(p)))
-            p = find(HEAD, p + HEAD.length);
+        for (; p !== Number.POSITIVE_INFINITY; p = find(HEAD, p + HEAD.length)) {
+            const lineEnd = versionedHeadEnd(p);
+            if (lineEnd >= 0 && !anchorHeld(scan, p, lineEnd))
+                break;
+        }
         return p;
     };
     const hexRunEnd = (from) => {
@@ -2529,7 +2777,7 @@ function collectPpkContainerSpans(scan, text, eat, span, isHead) {
         at = end >= text.length ? Number.POSITIVE_INFINITY : nextVersionedHead(end);
     }
     const last = isHead ? text.lastIndexOf(HEAD) : -1;
-    if (last >= 0 && !inOpaqueUnit(scan, last) && isOpenHead(last))
+    if (last >= 0 && isOpenHead(last) && !anchorHeld(scan, last, text.length))
         span(last, text.length, true);
 }
 const armPool = (() => {
@@ -2574,6 +2822,7 @@ const armPool = (() => {
             retry: boundary === undefined ? undefined : (text, at, out) => collectStickySpans(boundary, text, at, out),
             headSrc: boundary === undefined ? undefined : headSrc,
             headFirst: boundary === undefined ? undefined : headFirst,
+            family: undefined,
         };
     };
     const scannerMember = (token, order, arm, rank = ARM_RANK.structural, lexical = false) => {
@@ -2584,13 +2833,16 @@ const armPool = (() => {
             order,
             phase: 1,
             lexical,
-            collect: (text, json, eat, out, isHead) => arm(text, json, eat, (start, end, undecided) => out.push(undecided === true ? { start, end, repl, rank, order, undecided } : { start, end, repl, rank, order }), isHead),
+            collect: (text, json, eat, out, isHead) => arm(text, json, eat, (start, end, undecided, r = repl) => out.push(undecided === true ? { start, end, repl: r, rank, order, undecided } : { start, end, repl: r, rank, order }), isHead),
             retry: undefined,
             headSrc: undefined,
             headFirst: undefined,
+            family: undefined,
         };
     };
-    const forensicMember = (token, order, arm) => {
+    const forensicMember = (token, order, arm, family = undefined, view = "all") => {
+        if (view === "other-families" && family === undefined)
+            throw new Error(`redact: forensic arm ${token} reads the other-families evidence view but declares no credential family`);
         const repl = spanRepl(token);
         const rank = ARM_RANK.structural;
         return {
@@ -2599,17 +2851,19 @@ const armPool = (() => {
             order,
             phase: 2,
             lexical: false,
-            collect: (scan, text, json, eat, out, isHead) => arm(scan, text, json, eat, (start, end, undecided) => out.push(undecided === true ? { start, end, repl, rank, order, undecided } : { start, end, repl, rank, order }), isHead),
+            collect: (scan, text, json, eat, out, isHead) => arm(scan, text, json, eat, (start, end, undecided, r = repl) => out.push(undecided === true ? { start, end, repl: r, rank, order, undecided } : { start, end, repl: r, rank, order }), isHead),
             retry: undefined,
             headSrc: undefined,
             headFirst: undefined,
+            family,
+            view,
         };
     };
     const structuralScannerMember = (row, order) => {
         if (row === PEM_FENCE_PATTERN)
-            return scannerMember(row[1], order, (text, _json, _eat, span, isHead) => collectPemFenceSpans(text, span, isHead));
+            return forensicMember(row[1], order, (scan, text, _json, _eat, span, isHead) => collectPemFenceSpans(scan, text, span, isHead), "pem-armor", "other-families");
         if (row === SSH2_FENCE_PATTERN)
-            return forensicMember(row[1], order, (scan, text, _json, _eat, span, isHead) => collectSsh2FenceSpans(scan, text, span, isHead));
+            return forensicMember(row[1], order, (scan, text, json, _eat, span, isHead) => collectSsh2FenceSpans(scan, text, json, span, isHead), "ssh2-armor");
         if (row === URL_CREDENTIAL_PATTERN)
             return forensicMember(row[1], order, (scan, text, json, _eat, span, isHead) => collectUrlCredentialSpans(scan, text, json, span, isHead));
         if (row === JSON_SECRET_FIELD_PATTERN)
@@ -2619,9 +2873,9 @@ const armPool = (() => {
     const members = [];
     for (const row of STRUCTURAL_SECRET_PATTERNS)
         members.push(structuralScannerMember(row, members.length));
-    members.push(forensicMember(PPK_CONTAINER_TOKEN, members.length, (scan, text, _json, eat, span, isHead) => collectPpkContainerSpans(scan, text, eat, span, isHead)));
-    members.push(forensicMember(PEM_FRAGMENT_TOKEN, members.length, (scan, text, json, _eat, span) => collectPemFragmentSpans(scan, text, json, span)));
-    members.push(forensicMember(HEADLESS_PPK_TOKEN, members.length, (scan, text, _json, _eat, span, isHead) => collectHeadlessPpkSpans(scan, text, span, isHead)));
+    members.push(forensicMember(PPK_CONTAINER_TOKEN, members.length, (scan, text, _json, eat, span, isHead) => collectPpkContainerSpans(scan, text, eat, span, isHead), "putty-ppk"));
+    members.push(forensicMember(PEM_FRAGMENT_TOKEN, members.length, (scan, text, json, _eat, span, isHead) => collectPemFragmentSpans(scan, text, json, span, isHead), "pem-armor"));
+    members.push(forensicMember(HEADLESS_PPK_TOKEN, members.length, (scan, text, _json, _eat, span, isHead) => collectHeadlessPpkSpans(scan, text, span, isHead), "putty-ppk"));
     members.push(scannerMember(ANCHORED_VALUE_TOKEN, members.length, (text, json, _eat, span, isHead) => collectAnchoredValueSpans(text, json, span, isHead), ARM_RANK.keyword, true));
     for (const row of KEYWORD_SECRET_PATTERNS)
         members.push(regexMember(row, ARM_RANK.keyword, members.length));
@@ -2636,6 +2890,13 @@ const armPool = (() => {
     const retryMembers = members.filter((m) => m.retry !== undefined);
     const phase1 = members.filter((m) => m.phase === 1);
     const phase2 = members.filter((m) => m.phase === 2);
+    const familyOfOrder = members.map((m) => m.family);
+    const viewKeyOf = (m) => {
+        switch (m.view) {
+            case "all": return undefined;
+            case "other-families": return m.family;
+        }
+    };
     const laneOf = (scope) => {
         const inScope = (m) => {
             switch (scope) {
@@ -2643,7 +2904,16 @@ const armPool = (() => {
                 case "bounded-unit": return !m.lexical;
             }
         };
-        return { phase1: phase1.filter(inScope), phase2: phase2.filter(inScope), retry: retryMembers.filter(inScope) };
+        const lanePhase2 = phase2.filter(inScope);
+        const viewKeys = [...new Set([...lanePhase2.map(viewKeyOf), ...lanePhase2.flatMap((m) => (m.family === undefined ? [] : [m.family]))])];
+        return {
+            phase1: phase1.filter(inScope),
+            phase2: lanePhase2,
+            retry: retryMembers.filter(inScope),
+            viewKeys,
+            viewOf: lanePhase2.map((m) => viewKeys.indexOf(viewKeyOf(m))),
+            othersOf: lanePhase2.map((m) => (m.family === undefined ? -1 : viewKeys.indexOf(m.family))),
+        };
     };
     const LANES = {
         "free-text": laneOf("free-text"),
@@ -2694,18 +2964,26 @@ const armPool = (() => {
             m.collect(text, json, eat, spans, isHead);
         closeCoveragePositions(0);
         if (lane.phase2.length > 0) {
-            const scan = buildForensicScan(credentialSpans(text), lane.phase2.length);
+            const tokens = credentialSpans(text);
+            const scan = buildForensicScan(tokens, lane.phase2.length);
             const reuse = forensicRescanMode === "incremental";
             const foot = scan.armFoot;
+            const views = lane.viewKeys.map((key) => ({ key, table: tokens, dirty: undefined }));
             let folded = 0;
             for (let level = 0;; level += 1) {
                 const before = spans.length;
                 for (let j = 0; j < lane.phase2.length; j++) {
-                    const dirty = scan.dirty;
-                    if (dirty !== undefined && footprintClean(dirty, foot[2 * j], foot[2 * j + 1])) {
+                    const view = views[lane.viewOf[j]];
+                    const oi = lane.othersOf[j];
+                    const others = oi < 0 ? undefined : views[oi];
+                    const dirty = view.dirty;
+                    const lo = foot[2 * j];
+                    const hi = foot[2 * j + 1];
+                    if (dirty !== undefined && footprintClean(dirty, lo, hi) && (others === undefined || (others.dirty !== undefined && footprintClean(others.dirty, lo, hi)))) {
                         forensicSkips += 1;
                         continue;
                     }
+                    useEvidenceView(scan, view.table, dirty, others?.table);
                     scan.footLo = FOOT_NONE;
                     scan.footHi = -1;
                     lane.phase2[j].collect(scan, text, json, level === 0 ? eat : undefined, spans, isHead);
@@ -2715,11 +2993,18 @@ const armPool = (() => {
                 }
                 closeCoveragePositions(before);
                 forensicLevels += 1;
-                const grown = foldCredentialSpans(scan.table, spans, folded);
+                let grew = false;
+                for (const view of views) {
+                    const key = view.key;
+                    const grown = foldCredentialSpans(view.table, spans, folded, key === undefined ? undefined : (sp) => familyOfOrder[sp.order] !== key);
+                    if (grown.dirty.starts.length > 0)
+                        grew = true;
+                    view.table = grown.next;
+                    view.dirty = reuse ? grown.dirty : undefined;
+                }
                 folded = spans.length;
-                if (grown.dirty.starts.length === 0)
+                if (!grew)
                     break;
-                advanceEvidence(scan, grown.next, reuse ? grown.dirty : undefined);
             }
         }
         poolSpanCount += spans.length;