@sema-agent/server 7.145.0 → 7.147.0

package/dist/trace/redact.js

@@ -1,5 +1,5 @@
 import { REDACTION_MARK, displayUrlOf, stripFormatCharacters } from "@sema-agent/core";
-import { CONTROL_AND_BIDI_CHARS, CREDENTIAL_PARAM_NAMES, isHierarchicalUrl } from "@sema-agent/settings-schema";
+import { CONTROL_AND_BIDI_CHARS, CREDENTIAL_PARAM_NAMES, credentialParamWordOf, isHierarchicalUrl } from "@sema-agent/settings-schema";
 import { recordFailOpen } from "../observability/fail-open.js";
 const normalizeForRedaction = stripFormatCharacters;
 export function mapNormalizedToOriginal(text, normalized) {
@@ -1062,7 +1062,7 @@ function undecidedKeywordStart(text, t) {
 }
 const CREDENTIAL_NAME_ANCHORS = {
     api_key: "declarative", apikey: "declarative", "api-key": "declarative", key: "structure-only",
-    token: "structure-only", access_token: "declarative", refresh_token: "declarative", id_token: "declarative",
+    token: "assignment", access_token: "declarative", refresh_token: "declarative", id_token: "declarative",
     auth: "structure-only", authorization: "auth-scheme", "proxy-authorization": "auth-scheme",
     password: "declarative", passwd: "any-form", pwd: "any-form",
     secret: "declarative", client_secret: "declarative", private_key: "declarative",
@@ -1070,14 +1070,9 @@ const CREDENTIAL_NAME_ANCHORS = {
     "x-amz-signature": "declarative", "x-amz-security-token": "declarative", "x-amz-credential": "declarative",
     sas: "structure-only",
 };
-const CREDENTIAL_NAME_ALT = (() => {
-    for (const w of CREDENTIAL_PARAM_NAMES) {
-        if (!/^[a-z][a-z0-9_-]*$/.test(w))
-            throw new Error(`redact: credential name ${JSON.stringify(w)} must be lowercase [a-z0-9_-] (the alternation is built without escaping)`);
-    }
-    return [...CREDENTIAL_PARAM_NAMES].sort((a, b) => b.length - a.length || (a < b ? -1 : 1)).join("|");
-})();
 const CREDENTIAL_NAME_MAX = Math.max(...CREDENTIAL_PARAM_NAMES.map((w) => w.length));
+const JSON_FIELD_NAME_CLASS = "[A-Za-z0-9_.-]";
+const isJsonFieldNameCode = (c) => isAsciiAlnumCode(c) || c === CH_UNDERSCORE || c === CH_MINUS || c === CH_DOT;
 const JSON_FIELD_QUOTE_FORMS = ['"', '\\"', '\\\\\\"'];
 for (let d = 0; d < JSON_FIELD_QUOTE_FORMS.length; d++) {
     if (JSON_FIELD_QUOTE_FORMS[d] !== "\\".repeat(2 ** d - 1) + '"')
@@ -1096,15 +1091,53 @@ function buildJsonSecretFieldSource() {
             q = b + q;
             b = b + b;
         }
-        alts.push(String.raw `(${q}(?:${CREDENTIAL_NAME_ALT})${q}\s*:\s*)${q}(?:${o}|${l}|${b}(?:${o}|${b}|${q}))*${q}`);
+        alts.push(String.raw `(${q}(${JSON_FIELD_NAME_CLASS}+)${q}\s*:\s*)${q}(?:${o}|${l}|${b}(?:${o}|${b}|${q}))*${q}`);
     }
     return alts.join("|");
 }
 const asciiLower = (s) => s.replace(/[A-Z]/g, (c) => c.toLowerCase());
 function credentialNameAnchor(name) {
-    return CREDENTIAL_ANCHOR_OF.get(asciiLower(name));
+    let word = CREDENTIAL_WORD_MEMO.get(name);
+    if (word === undefined) {
+        word = credentialParamWordOf(name) ?? null;
+        if (name.length <= CREDENTIAL_WORD_MEMO_NAME_MAX) {
+            if (CREDENTIAL_WORD_MEMO.size >= CREDENTIAL_WORD_MEMO_SIZE)
+                CREDENTIAL_WORD_MEMO.clear();
+            CREDENTIAL_WORD_MEMO.set(name, word);
+        }
+    }
+    return word === null ? undefined : CREDENTIAL_NAME_ANCHORS[word];
+}
+const CREDENTIAL_WORD_MEMO = new Map();
+const CREDENTIAL_WORD_MEMO_SIZE = 1024;
+const CREDENTIAL_WORD_MEMO_NAME_MAX = 64;
+const BARE_WORD_READINGS = {
+    null: "absent-or-boolean", nil: "absent-or-boolean", none: "absent-or-boolean", undefined: "absent-or-boolean",
+    true: "absent-or-boolean", false: "absent-or-boolean", yes: "absent-or-boolean", no: "absent-or-boolean",
+    str: "type-name", string: "type-name", bytes: "type-name", int: "type-name", integer: "type-name", float: "type-name", number: "type-name",
+    bool: "type-name", boolean: "type-name", any: "type-name", object: "type-name", array: "type-name", secretstr: "type-name",
+};
+for (const w of Object.keys(BARE_WORD_READINGS)) {
+    if (!/^[a-z]+$/.test(w))
+        throw new Error(`redact: bare value word ${JSON.stringify(w)} must be lowercase ASCII letters (values are ASCII-lowercased before the lookup)`);
+}
+const BARE_WORD_OF = new Map(Object.entries(BARE_WORD_READINGS));
+const BARE_WORD_MAX = Math.max(...Object.keys(BARE_WORD_READINGS).map((w) => w.length));
+function bareWordIsValue(reading, bare) {
+    switch (reading) {
+        case "absent-or-boolean":
+            return false;
+        case "type-name":
+            return bare === "declared";
+        default: {
+            const unhandled = reading;
+            throw new Error(`redact: unhandled bare value word reading ${String(unhandled)}`);
+        }
+    }
+}
+export function lineKeyTypeNamesForTest() {
+    return Object.entries(BARE_WORD_READINGS).filter(([, r]) => r === "type-name").map(([w]) => w);
 }
-const CREDENTIAL_ANCHOR_OF = new Map(Object.entries(CREDENTIAL_NAME_ANCHORS));
 const STRUCTURAL_SECRET_PATTERNS = [
     [/-----BEGIN(?:[^-](?:[^-](?:[^-]|-(?!-))*)?)?PRIVATE KEY(?: BLOCK)?-----[\s\S]{0,8192}?-----END(?:[^-](?:[^-](?:[^-]|-(?!-))*)?)?PRIVATE KEY(?: BLOCK)?-----/g, "«redacted:private-key»"],
     [/---- BEGIN SSH2 ENCRYPTED PRIVATE KEY ----[\s\S]{0,8192}?---- END SSH2 ENCRYPTED PRIVATE KEY ----/g, "«redacted:private-key»"],
@@ -1855,46 +1888,26 @@ const isRegexSpace = (c) => c === 32 || (c >= 9 && c <= 13) || c === 0xa0 || c =
 const isLineTerminator = (c) => c === 10 || c === 13 || c === 0x2028 || c === 0x2029;
 const isControlCode = (c) => c < 0x20 || c === 0x7f;
 const TOKEN_UNIT_Y = new RegExp(REDACTION_TOKEN_RE_SRC, "y");
-const CREDENTIAL_NAME_SCAN_MAX = CREDENTIAL_NAME_MAX * 3 + 1;
-function decodeAsciiName(name) {
-    let out = "";
-    for (let i = 0; i < name.length; i++) {
-        const c = name.charCodeAt(i);
-        if (c !== 37) {
-            out += name[i];
-            continue;
-        }
-        const hex = name.slice(i + 1, i + 3);
-        if (hex.length !== 2 || !/^[0-9A-Fa-f]{2}$/.test(hex))
-            return undefined;
-        const b = Number.parseInt(hex, 16);
-        if (b >= 0x80)
-            return undefined;
-        out += String.fromCharCode(b);
-        i += 2;
-    }
-    return out;
-}
-function credentialParamValueStart(text, p) {
-    const limit = Math.min(text.length, p + CREDENTIAL_NAME_SCAN_MAX);
-    let hasPct = false;
-    for (let i = p; i < limit; i++) {
+function credentialParamValueStart(text, p, json) {
+    let encoded = false;
+    for (let i = p; i < text.length; i++) {
         const c = text.charCodeAt(i);
-        if (c === 37) {
-            hasPct = true;
-            continue;
-        }
         if (c === CH_EQ) {
             if (i === p)
                 return -1;
-            const name = hasPct ? decodeAsciiName(text.slice(p, i)) : text.slice(p, i);
-            return name !== undefined && credentialNameAnchor(name) !== undefined ? i + 1 : -1;
+            const raw = text.slice(p, i);
+            return credentialNameAnchor(encoded ? receiverParamName(raw) : raw) !== undefined ? i + 1 : -1;
         }
-        if (!(isAsciiAlnumCode(c) || c === CH_UNDERSCORE || c === CH_MINUS))
+        if (c === 63 || c === 38 || c === 35 || isRegexSpace(c) || isControlCode(c) || (json && c === 34))
             return -1;
+        if (c === 37 || c === 43)
+            encoded = true;
     }
     return -1;
 }
+function receiverParamName(raw) {
+    return new URLSearchParams(`${raw}=`).keys().next().value ?? raw;
+}
 function tokenUnitEnd(text, p) {
     TOKEN_UNIT_Y.lastIndex = p;
     return TOKEN_UNIT_Y.test(text) ? TOKEN_UNIT_Y.lastIndex : -1;
@@ -2948,7 +2961,7 @@ function collectUrlCredentialSpans(scan, text, json, span, isHead) {
         const c = text.charCodeAt(i);
         if (c !== 63 && c !== 38 && c !== 35)
             continue;
-        const valueStart = credentialParamValueStart(text, i + 1);
+        const valueStart = credentialParamValueStart(text, i + 1, json);
         if (valueStart < 0)
             continue;
         while (qc < ppn && pp[qc] < i)
@@ -2997,7 +3010,7 @@ function collectUrlCredentialSpans(scan, text, json, span, isHead) {
     scan.footHi = armHi;
 }
 const JSON_FIELD_ANCHOR = '"';
-const JSON_FIELD_BACK = Math.max(...JSON_FIELD_QUOTE_FORMS.map((f) => f.length));
+const JSON_FIELD_HEAD_MAX = Math.max(...JSON_FIELD_QUOTE_FORMS.map((f) => f.length));
 function jsonSecretFieldValueQuoteAt(text, p, depth) {
     const form = JSON_FIELD_QUOTE_FORMS[depth];
     const n = text.length;
@@ -3005,10 +3018,8 @@ function jsonSecretFieldValueQuoteAt(text, p, depth) {
     let i = nameFrom;
     for (; i < n; i++) {
         const c = text.charCodeAt(i);
-        if (!(isAsciiAlnumCode(c) || c === CH_UNDERSCORE || c === CH_MINUS))
+        if (!isJsonFieldNameCode(c))
             break;
-        if (i - nameFrom >= CREDENTIAL_NAME_MAX)
-            return -1;
     }
     if (i === nameFrom || !text.startsWith(form, i) || credentialNameAnchor(text.slice(nameFrom, i)) === undefined)
         return -1;
@@ -3092,7 +3103,7 @@ function collectJsonSecretFieldSpans(text, span, isHead) {
     let from = 0;
     for (let p = text.indexOf(JSON_FIELD_ANCHOR); p >= 0;) {
         let run = 0;
-        while (run < JSON_FIELD_BACK - 1 && p - run - 1 >= from && text.charCodeAt(p - run - 1) === CH_BACKSLASH)
+        while (run < JSON_FIELD_HEAD_MAX - 1 && p - run - 1 >= from && text.charCodeAt(p - run - 1) === CH_BACKSLASH)
             run += 1;
         let next = -1;
         for (let d = JSON_FIELD_QUOTE_FORMS.length - 1; d >= 0 && next < 0; d--) {
@@ -3107,7 +3118,7 @@ function collectJsonSecretFieldSpans(text, span, isHead) {
             const open = found === STRING_OPEN;
             const end = open ? text.length : found;
             span(q, end, q, open ? NOT_CLOSED : end - form.length, open, JSON_FIELD_VALUE_REPLS[d]);
-            from = scanResumeAfterHit(start, end, JSON_FIELD_BACK);
+            from = scanResumeAfterHit(start, end, end - q);
             next = text.indexOf(JSON_FIELD_ANCHOR, from);
             if (next < 0)
                 return;
@@ -3126,8 +3137,6 @@ function isEngineMarkedCandidate(text, start, end, repl) {
     return end - start === lead.length + REDACTION_MARK.length + trail.length && text.startsWith(lead, start) && text.startsWith(REDACTION_MARK, start + lead.length) && text.startsWith(trail, end - trail.length);
 }
 const STRONG_AUTH_SCHEME_MAX = Math.max(...[...STRONG_AUTH_SCHEMES].map((w) => w.length));
-const ABSENT_OR_BOOLEAN_WORDS = new Set(["null", "nil", "none", "undefined", "true", "false", "yes", "no"]);
-const ABSENT_OR_BOOLEAN_MAX = Math.max(...[...ABSENT_OR_BOOLEAN_WORDS].map((w) => w.length));
 const CH_GRAVE = 96, CH_APOS = 39, CH_DOT = 46, CH_COMMA = 44, CH_SEMI = 59, CH_DOLLAR = 36;
 const CH_LPAREN = 40, CH_RPAREN = 41, CH_RBRACKET = 93, CH_LBRACE = 123, CH_RBRACE = 125, CH_LT = 60, CH_GT = 62;
 const CH_QMARK = 63, CH_AMP = 38, CH_HASH = 35;
@@ -3154,6 +3163,9 @@ const unitChOf = (unit) => (unit >> 3) - 1;
 const unitLenOf = (unit) => unit & 7;
 function readAnchorUnit(text, i, json) {
     anchoredScanUnits += 1;
+    return readTextUnit(text, i, json);
+}
+function readTextUnit(text, i, json) {
     const c = text.charCodeAt(i);
     if (!json)
         return packUnit(c, 1);
@@ -3217,16 +3229,13 @@ function anchorHeadAt(scan, text, op, json) {
         i -= quoteLen;
     }
     const nameEnd = i + 1;
-    const floor = Math.max(-1, i - (CREDENTIAL_NAME_MAX + 2));
     let j = i;
-    while (j > floor && isIdentCode(text.charCodeAt(j)))
+    while (j >= 0 && isIdentCode(text.charCodeAt(j)))
         j -= 1;
     anchoredScanUnits += nameEnd - (j + 1);
     const bound = j + 1 < nameEnd ? nameBoundAt(scan, Math.max(j, 0), nameEnd) : -1;
     if (bound > j)
         j = bound - 1;
-    else if (j === floor && j >= 0 && isIdentCode(text.charCodeAt(j)))
-        return undefined;
     let nameStart = j + 1;
     let afterEscape = false;
     if (j >= 0 && text.charCodeAt(j) === CH_BACKSLASH && escapedAt(text, j + 1)) {
@@ -3269,7 +3278,7 @@ function anchorHeadAt(scan, text, op, json) {
         const left = k >= 0 ? text.charCodeAt(k) : 0;
         listSep = left === CH_QMARK || left === CH_AMP || left === CH_HASH ? CH_AMP : left === CH_SEMI ? CH_SEMI : left === CH_COMMA || left === CH_LPAREN || left === CH_LBRACKET || left === CH_LBRACE ? CH_COMMA : 0;
     }
-    return { strength, quotedName: quote !== 0, spacedLeft, listSep };
+    return { strength, quotedName: quote !== 0, spacedLeft, listSep, runStart };
 }
 function quotedValueEnd(text, cs, quote, json, isHead) {
     const n = text.length;
@@ -3382,7 +3391,7 @@ function bareValueEnd(text, s, json, listSep, memo) {
     }
     return e;
 }
-function literalValueAt(text, s, json, declaredIfBare, listSep, isHead, memo) {
+function literalValueAt(text, s, json, bare, listSep, isHead, memo) {
     const n = text.length;
     if (s >= n)
         return undefined;
@@ -3403,8 +3412,21 @@ function literalValueAt(text, s, json, declaredIfBare, listSep, isHead, memo) {
     }
     else if (!isAsciiAlnumCode(first))
         return undefined;
-    if (!declaredIfBare)
-        return undefined;
+    let lineKey;
+    switch (bare) {
+        case "never":
+            return undefined;
+        case "declared":
+            lineKey = false;
+            break;
+        case "line-key":
+            lineKey = true;
+            break;
+        default: {
+            const unhandled = bare;
+            throw new Error(`redact: unhandled bare literal form ${String(unhandled)}`);
+        }
+    }
     if (isProgramIdentStartCode(text.charCodeAt(vs))) {
         let k = vs;
         while (k < n && isProgramIdentCode(text.charCodeAt(k)))
@@ -3417,10 +3439,92 @@ function literalValueAt(text, s, json, declaredIfBare, listSep, isHead, memo) {
     const e = bareValueEnd(text, vs, json, listSep, memo);
     if (e <= vs)
         return undefined;
-    if (e - vs <= ABSENT_OR_BOOLEAN_MAX && ABSENT_OR_BOOLEAN_WORDS.has(text.slice(vs, e).toLowerCase()))
-        return undefined;
+    if (e - vs <= BARE_WORD_MAX) {
+        const reading = BARE_WORD_OF.get(asciiLower(text.slice(vs, e)));
+        if (reading !== undefined && !bareWordIsValue(reading, lineKey ? "line-key" : "declared"))
+            return undefined;
+    }
+    if (lineKey) {
+        const rest = lineKeyRestAt(text, e, json, isHead);
+        switch (rest) {
+            case "ends":
+                break;
+            case "goes-on":
+                return undefined;
+            case "undecided":
+                return { start: vs, end: text.length, quoted: false, open: true };
+            default: {
+                const unhandled = rest;
+                throw new Error(`redact: unhandled line-key rest ${String(unhandled)}`);
+            }
+        }
+    }
     return { start: vs, end: e, quoted: false };
 }
+function lineKeyRestAt(text, e, json, isHead) {
+    const n = text.length;
+    let i = e;
+    while (i < n) {
+        const unit = readAnchorUnit(text, i, json);
+        const ch = unitChOf(unit);
+        if (isInlineSpaceUnit(ch) || (ch >= 0 && INVISIBLE_UNIT_CLASS[ch] === 1)) {
+            i += unitLenOf(unit);
+            continue;
+        }
+        return ch === JSON_STRING_END || isLineTerminator(ch) || ch === CH_HASH ? "ends" : "goes-on";
+    }
+    return isHead ? "undecided" : "ends";
+}
+function unitEndingAt(text, end, json) {
+    const c = text.charCodeAt(end - 1);
+    anchoredScanUnits += 1;
+    if (!json)
+        return packUnit(c, 1);
+    if (end >= 6 && text.charCodeAt(end - 6) === CH_BACKSLASH && text.charCodeAt(end - 5) === CH_u && !escapedAt(text, end - 6)) {
+        const h0 = hexDigitValue(text.charCodeAt(end - 4));
+        const h1 = hexDigitValue(text.charCodeAt(end - 3));
+        const h2 = hexDigitValue(text.charCodeAt(end - 2));
+        const h3 = hexDigitValue(text.charCodeAt(end - 1));
+        if (h0 >= 0 && h1 >= 0 && h2 >= 0 && h3 >= 0)
+            return packUnit((h0 << 12) | (h1 << 8) | (h2 << 4) | h3, 6);
+    }
+    if (end >= 2 && text.charCodeAt(end - 2) === CH_BACKSLASH && escapedAt(text, end - 1)) {
+        const two = readTextUnit(text, end - 2, true);
+        if (unitLenOf(two) === 2)
+            return two;
+    }
+    return c === CH_QUOTE ? packUnit(JSON_STRING_END, 1) : packUnit(c, 1);
+}
+function lineHeadBefore(text, at, json) {
+    let i = at;
+    let blank = false;
+    for (;;) {
+        if (i <= 0)
+            return true;
+        const unit = unitEndingAt(text, i, json);
+        const ch = unitChOf(unit);
+        if (isInlineSpaceUnit(ch)) {
+            i -= unitLenOf(unit);
+            blank = true;
+            continue;
+        }
+        if (ch >= 0 && INVISIBLE_UNIT_CLASS[ch] === 1) {
+            i -= unitLenOf(unit);
+            continue;
+        }
+        if (ch === CH_MINUS && blank) {
+            i -= unitLenOf(unit);
+            blank = false;
+            continue;
+        }
+        return isLineTerminator(ch) || ch === JSON_STRING_END;
+    }
+}
+function declarativeBareAt(text, head, spacedRight, json) {
+    if (head.quotedName || (!head.spacedLeft && !spacedRight))
+        return "declared";
+    return spacedRight && lineHeadBefore(text, head.runStart, json) ? "line-key" : "never";
+}
 function schemeValueAt(text, s, json) {
     const n = text.length;
     let i = s;
@@ -3504,11 +3608,16 @@ function anchoredValueAt(scan, text, op, json, span, isHead, memo) {
         case "auth-scheme":
             v = schemeValueAt(text, s, json);
             break;
+        case "assignment":
+            if (text.charCodeAt(op) !== CH_EQ || head.quotedName || head.spacedLeft || spacedRight)
+                return;
+            v = literalValueAt(text, s, json, "declared", head.listSep, isHead, memo);
+            break;
         case "declarative":
-            v = literalValueAt(text, s, json, head.quotedName || (!head.spacedLeft && !spacedRight), head.listSep, isHead, memo);
+            v = literalValueAt(text, s, json, declarativeBareAt(text, head, spacedRight, json), head.listSep, isHead, memo);
             break;
         case "any-form":
-            v = literalValueAt(text, s, json, true, head.listSep, isHead, memo);
+            v = literalValueAt(text, s, json, "declared", head.listSep, isHead, memo);
             break;
         default: {
             const unhandled = head.strength;
@@ -3592,6 +3701,149 @@ function collectAnchoredValueSpans(scan, text, json, span, isHead) {
     scan.footLo = armLo;
     scan.footHi = armHi;
 }
+const isRegexWordCode = (c) => isAsciiAlnumCode(c) || c === CH_UNDERSCORE;
+const isDiagnosticNameCode = (c) => isRegexWordCode(c) || c === CH_MINUS;
+const isDiagnosticValueUnit = (ch) => ch !== JSON_STRING_END && !isRegexSpace(ch) && ch !== CH_QUOTE && ch !== CH_APOS && ch !== CH_COMMA && ch !== CH_RBRACE;
+const isAsciiLetterCode = (ch) => (ch >= 0x41 && ch <= 0x5a) || (ch >= 0x61 && ch <= 0x7a);
+const isDiagnosticSchemeValueUnit = (ch) => isAsciiAlnumCode(ch) || ch === CH_DOT || ch === CH_UNDERSCORE || ch === CH_TILDE || ch === CH_PLUS || ch === CH_SLASH || ch === CH_EQ || ch === CH_MINUS;
+function diagnosticNameSlot(tier) {
+    switch (tier) {
+        case "assignment":
+        case "declarative":
+        case "any-form":
+        case "auth-scheme":
+            return true;
+        case "structure-only":
+            return false;
+        default: {
+            const unhandled = tier;
+            throw new Error(`redact: unhandled free-text anchor strength ${String(unhandled)}`);
+        }
+    }
+}
+const DIAGNOSTIC_SCHEME_RE = new RegExp([...STRONG_AUTH_SCHEMES].sort((a, b) => b.length - a.length).join("|"), "gi");
+let diagnosticScanUnits = 0;
+export function diagnosticScanUnitsForTest() {
+    return diagnosticScanUnits;
+}
+export function resetDiagnosticScanUnitsForTest() {
+    diagnosticScanUnits = 0;
+}
+function collectDiagnosticValueSpans(text, json, span, isHead, deletedAt) {
+    const n = text.length;
+    const readRun = (from, isValue) => {
+        let i = from;
+        while (i < n) {
+            const unit = readTextUnit(text, i, json);
+            diagnosticScanUnits += 1;
+            if (!isValue(unitChOf(unit)))
+                break;
+            i += unitLenOf(unit);
+        }
+        return i;
+    };
+    const skipBlank = (from) => readRun(from, isRegexSpace);
+    let valueEnd = 0;
+    let plainEnd = 0;
+    let nextEq = text.indexOf("=");
+    let nextColon = text.indexOf(":");
+    while (nextEq >= 0 || nextColon >= 0) {
+        let op;
+        if (nextColon < 0 || (nextEq >= 0 && nextEq < nextColon)) {
+            op = nextEq;
+            nextEq = text.indexOf("=", op + 1);
+        }
+        else {
+            op = nextColon;
+            nextColon = text.indexOf(":", op + 1);
+        }
+        const inValue = op + 1 < plainEnd;
+        let e = op;
+        while (e > 0 && isRegexSpace(text.charCodeAt(e - 1)))
+            e -= 1;
+        diagnosticScanUnits += op - e;
+        if (e === 0 || !isRegexWordCode(text.charCodeAt(e - 1)))
+            continue;
+        let runStart = e;
+        while (runStart > 0 && isDiagnosticNameCode(text.charCodeAt(runStart - 1)))
+            runStart -= 1;
+        diagnosticScanUnits += e - runStart;
+        let nameStart = -1;
+        let nameTier;
+        for (let q = runStart; q < e && nameStart < 0; q = q === runStart ? Math.max(runStart + 1, e - CREDENTIAL_NAME_MAX) : q + 1) {
+            if (!isRegexWordCode(text.charCodeAt(q)))
+                continue;
+            const bounded = q === runStart || text.charCodeAt(q - 1) === CH_MINUS || deletedAt(q) !== "none";
+            const tier = bounded ? credentialNameAnchor(text.slice(q, e)) : undefined;
+            if (tier !== undefined && diagnosticNameSlot(tier)) {
+                nameStart = q;
+                nameTier = tier;
+            }
+        }
+        if (nameStart < 0)
+            continue;
+        let s;
+        let end;
+        if (inValue) {
+            s = op + 1;
+            end = plainEnd;
+        }
+        else {
+            s = skipBlank(op + 1);
+            if (s < n) {
+                const unit = readTextUnit(text, s, json);
+                if (unitChOf(unit) === CH_QUOTE)
+                    s += unitLenOf(unit);
+            }
+            if (s >= n) {
+                if (isHead)
+                    span(nameStart, n, op, NOT_CLOSED, true);
+                continue;
+            }
+            end = readRun(s, isDiagnosticValueUnit);
+            plainEnd = end;
+        }
+        if (end > s && nameTier === "auth-scheme" && readRun(s, isAsciiLetterCode) === end) {
+            const k = skipBlank(end);
+            if (k > end && k >= n && isHead) {
+                span(nameStart, n, op, NOT_CLOSED, true);
+                continue;
+            }
+            if (k > end && k < n) {
+                const credEnd = readRun(k, isDiagnosticSchemeValueUnit);
+                if (credEnd > k)
+                    end = credEnd;
+            }
+        }
+        if (end > s && end > valueEnd) {
+            span(s, end, op, NOT_CLOSED);
+            valueEnd = end;
+        }
+    }
+    let schemeEnd = 0;
+    DIAGNOSTIC_SCHEME_RE.lastIndex = 0;
+    for (let m = DIAGNOSTIC_SCHEME_RE.exec(text); m !== null; m = DIAGNOSTIC_SCHEME_RE.exec(text)) {
+        const at = m.index;
+        const q = at + m[0].length;
+        if (q < schemeEnd)
+            continue;
+        if (at > 0 && isRegexWordCode(text.charCodeAt(at - 1)) && deletedAt(at) === "none")
+            continue;
+        const k = skipBlank(q);
+        if (k === q && deletedAt(q) !== "blank")
+            continue;
+        if (k >= n) {
+            if (isHead)
+                span(at, n, at, NOT_CLOSED, true);
+            continue;
+        }
+        const end = readRun(k, isDiagnosticSchemeValueUnit);
+        if (end > k) {
+            span(k, end, at, NOT_CLOSED);
+            schemeEnd = end;
+        }
+    }
+}
 export function structuralScannerForTest(arm) {
     const collect = (scan) => (text) => {
         const out = [];
@@ -3750,6 +4002,7 @@ const armPool = (() => {
             order,
             phase: 1,
             lexical: LEXICAL_KEYWORD_ARMS.has(re),
+            diagnosticOnly: false,
             collect: (text, _json, _eat, out, isHead) => {
                 if (boundary === undefined)
                     collectRegexSpans(arm, text, out);
@@ -3769,16 +4022,16 @@ const armPool = (() => {
             prior: { kind: "bounded", gap: keywordTail === undefined ? NO_GAP : (c) => keywordTail.isSeparator(String.fromCharCode(c)) },
         };
     };
-    const scannerMember = (token, order, arm, reach, family, prior) => {
+    const scannerMember = (token, order, arm, reach, family, prior, rank = ARM_RANK.structural, lexical = false, diagnosticOnly = false) => {
         const repl = spanRepl(token);
-        const rank = ARM_RANK.structural;
         return {
             token,
             rank,
             order,
             phase: 1,
-            lexical: false,
-            collect: (text, json, eat, out, isHead) => arm(text, json, eat, (start, end, anchor, closeAt, undecided, r = repl) => out.push(undecided === true ? { start, end, repl: r, rank, order, undecided, anchor, closeAt } : { start, end, repl: r, rank, order, anchor, closeAt }), isHead),
+            lexical,
+            diagnosticOnly,
+            collect: (text, json, eat, out, isHead, deletedAt) => arm(text, json, eat, (start, end, anchor, closeAt, undecided, r = repl) => out.push(undecided === true ? { start, end, repl: r, rank, order, undecided, anchor, closeAt } : { start, end, repl: r, rank, order, anchor, closeAt }), isHead, deletedAt),
             retry: undefined,
             headSrc: undefined,
             headFirst: undefined,
@@ -3795,6 +4048,7 @@ const armPool = (() => {
             order,
             phase: 2,
             lexical,
+            diagnosticOnly: false,
             collect: (scan, text, json, eat, out, isHead) => arm(scan, text, json, eat, (start, end, anchor, closeAt, undecided, r = repl) => out.push(undecided === true ? { start, end, repl: r, rank, order, undecided, anchor, closeAt } : { start, end, repl: r, rank, order, anchor, closeAt }), isHead),
             retry: undefined,
             headSrc: undefined,
@@ -3813,7 +4067,7 @@ const armPool = (() => {
         if (row === URL_CREDENTIAL_PATTERN)
             return forensicMember(row[1], order, (scan, text, json, _eat, span, isHead) => collectUrlCredentialSpans(scan, text, json, span, isHead), "://".length, "url", { kind: "bounded", gap: NO_GAP });
         if (row === JSON_SECRET_FIELD_PATTERN)
-            return scannerMember(row[1], order, (text, _json, _eat, span, isHead) => collectJsonSecretFieldSpans(text, span, isHead), JSON_FIELD_BACK, "json-field", { kind: "bounded", gap: isRegexSpace });
+            return scannerMember(row[1], order, (text, _json, _eat, span, isHead) => collectJsonSecretFieldSpans(text, span, isHead), JSON_FIELD_HEAD_MAX, "json-field", { kind: "bounded", gap: isRegexSpace });
         throw new Error(`redact: structural row /${row[0].source}/ has no hand-written scanner — structural grammars are declared as regexes but never executed as one (S-102 / S-265)`);
     };
     const members = [];
@@ -3822,13 +4076,14 @@ const armPool = (() => {
     members.push(forensicMember(PPK_CONTAINER_TOKEN, members.length, (scan, text, _json, eat, span, isHead) => collectPpkContainerSpans(scan, text, eat, span, isHead), PPK_FILE_HEAD.length, "putty-ppk", { kind: "anchored", anchors: [PPK_FILE_HEAD] }));
     members.push(forensicMember(PEM_FRAGMENT_TOKEN, members.length, (scan, text, json, _eat, span, isHead) => collectPemFragmentSpans(scan, text, json, span, isHead), PEM_FENCE_OPEN.length, "pem-armor", { kind: "anchored", anchors: [PEM_FENCE_OPEN, PEM_END_OPEN] }));
     members.push(forensicMember(HEADLESS_PPK_TOKEN, members.length, (scan, text, _json, _eat, span, isHead) => collectHeadlessPpkSpans(scan, text, span, isHead), PPK_LINES_FIELD.length, "putty-ppk", { kind: "anchored", anchors: [PPK_LINES_FIELD] }));
-    members.push(forensicMember(ANCHORED_VALUE_TOKEN, members.length, (scan, text, json, _eat, span, isHead) => collectAnchoredValueSpans(scan, text, json, span, isHead), Math.max(BEARER_VALUE_MIN, ABSENT_OR_BOOLEAN_MAX + 1, STRONG_AUTH_SCHEME_MAX + 1), "anchor", { kind: "bounded", gap: (c) => isInlineSpaceUnit(c) || isSchemeDelimiterCode(c) }, ARM_RANK.keyword, true));
+    members.push(forensicMember(ANCHORED_VALUE_TOKEN, members.length, (scan, text, json, _eat, span, isHead) => collectAnchoredValueSpans(scan, text, json, span, isHead), Math.max(BEARER_VALUE_MIN, BARE_WORD_MAX + 1, STRONG_AUTH_SCHEME_MAX + 1), "anchor", { kind: "bounded", gap: (c) => isInlineSpaceUnit(c) || isSchemeDelimiterCode(c) }, ARM_RANK.keyword, true));
     for (const row of KEYWORD_SECRET_PATTERNS)
         members.push(regexMember(row, ARM_RANK.keyword, members.length));
     for (const row of SHAPE_SECRET_PATTERNS)
         members.push(regexMember(row, ARM_RANK.shape, members.length));
     for (const row of FRAGMENT_SECRET_PATTERNS)
         members.push(regexMember(row, ARM_RANK.fragment, members.length));
+    members.push(scannerMember(ANCHORED_VALUE_TOKEN, members.length, (text, json, _eat, span, isHead, deletedAt) => collectDiagnosticValueSpans(text, json, span, isHead, deletedAt), Math.max(CREDENTIAL_NAME_MAX, STRONG_AUTH_SCHEME_MAX) + 2, "prose", { kind: "bounded", gap: isRegexSpace }, ARM_RANK.keyword, true, true));
     for (const [re] of KEYWORD_SECRET_PATTERNS) {
         if (!LEXICAL_KEYWORD_ARMS.has(re))
             throw new Error(`redact: keyword arm /${re.source}/ is not registered as lexical — build it with keywordArm() so the bounded-unit scope can exclude it`);
@@ -3840,8 +4095,9 @@ const armPool = (() => {
     const laneOf = (scope) => {
         const inScope = (m) => {
             switch (scope) {
-                case "free-text": return true;
-                case "bounded-unit": return !m.lexical;
+                case "free-text": return !m.diagnosticOnly;
+                case "bounded-unit": return !m.lexical && !m.diagnosticOnly;
+                case "diagnostic": return true;
             }
         };
         return {
@@ -3853,13 +4109,14 @@ const armPool = (() => {
     const LANES = {
         "free-text": laneOf("free-text"),
         "bounded-unit": laneOf("bounded-unit"),
+        diagnostic: laneOf("diagnostic"),
     };
     const headScreen = new RegExp(`(?:${retryMembers.map((m) => m.headSrc).join("|")})`, "y");
     const headFirstUnit = unionMembers(retryMembers.map((m) => m.headFirst)) ?? new Uint32Array(0x10000 >>> 5).fill(0xffffffff);
     poolArmCount = members.length;
     poolBoundaryArmCount = retryMembers.length;
     const reaches = members.map((m) => ({ token: m.token, order: m.order, reach: m.reach }));
-    const run = (text, wantCount, json, eat, scope, reach, engineMarked) => {
+    const run = (text, wantCount, json, eat, scope, reach, engineMarked, deletedAt) => {
         readings += 1;
         const isHead = reach !== undefined;
         const lane = LANES[scope];
@@ -3914,7 +4171,7 @@ const armPool = (() => {
             }
         };
         for (const m of lane.phase1)
-            m.collect(text, json, eat, spans, isHead);
+            m.collect(text, json, eat, spans, isHead, deletedAt);
         closeCoveragePositions(0);
         if (lane.phase2.length > 0) {
             const scan = buildForensicScan(tokenUnits(text), buildEvidenceRows(text), lane.phase2.length);
@@ -3999,8 +4256,8 @@ let onRedaction;
 export function setRedactionObserver(fn) {
     onRedaction = fn;
 }
-function applyRules(text, wantCount, json, eat, scope, reach, engineMarked) {
-    return armPool(text, wantCount, json, eat, scope, reach, engineMarked);
+function applyRules(text, wantCount, json, eat, scope, reach, engineMarked, deletedAt) {
+    return armPool(text, wantCount, json, eat, scope, reach, engineMarked, deletedAt);
 }
 function reportHits(hits) {
     if (onRedaction === undefined)
@@ -4072,7 +4329,19 @@ function runRedaction(text, observe, json, wantHits, scope, layout, extent, obse
         const toOriginal = createViewToOriginal(layers);
         const reach = extent.kind === "head" ? (viewStart) => toOriginal.start(viewStart) < extent.emitEnd : undefined;
         const engineMarked = (viewStart, viewEnd, repl) => isEngineMarkedCandidate(text, toOriginal.start(viewStart), toOriginal.start(viewEnd - 1) + 1, repl);
-        const r = applyRules(view, wantCount, json, eat, scope, reach, engineMarked);
+        const deletedAt = (viewIndex) => {
+            if (viewIndex <= 0 || viewIndex > view.length)
+                return "none";
+            const lo = toOriginal.start(viewIndex - 1) + 1;
+            const hi = viewIndex === view.length ? text.length : toOriginal.start(viewIndex);
+            if (hi <= lo)
+                return "none";
+            for (let k = lo; k < hi; k++)
+                if (isRegexSpace(text.charCodeAt(k)))
+                    return "blank";
+            return "invisible";
+        };
+        const r = applyRules(view, wantCount, json, eat, scope, reach, engineMarked, deletedAt);
         forgetEscapedSeparatorTails();
         readsSoFar += 1;
         if (readsSoFar === 1) {
@@ -4154,7 +4423,7 @@ export function redactSecretsWithArms(text, opts) {
     return { text: r.text, arms: new Set(r.hits.map((h) => h.arm)) };
 }
 export function redactionSpansForTest(text, opts) {
-    const r = runRedaction(text, false, opts?.json === true, false, "free-text", "multi-line", WHOLE_EXTENT);
+    const r = runRedaction(text, false, opts?.json === true, false, opts?.scope ?? "free-text", "multi-line", WHOLE_EXTENT);
     return { text: r.text, spans: r.spans.map((sp) => ({ start: sp.start, end: sp.end })) };
 }
 export function proposeRedactionSpans(text, scope, layout, extent) {